Compliance Hooks

Compliance hooks are not reports added after launch. They are events, immutable versions and control tables that must be written at the moment the regulated action happens. If sanction, kfs_version, loan_transaction, asset_classification, consent_artifact, partner_share or audit_event is incomplete, downstream reports will be unreliable.

RBI’s KFS circular applies to all new retail and MSME term loans sanctioned on or after October 1, 2024 and requires a standardised Key Facts Statement, APR computation sheet, amortisation schedule and explicit borrower acknowledgement (RBI KFS circular, April 15, 2024). RBI’s Digital Lending Directions require explicit consent audit trail, DLA reporting on CIMS, direct fund flows, CIC reporting for digital lending and grievance controls (RBI Digital Lending Directions, 2025).

audit_event

Every material business action writes one immutable audit_event. Business tables may store the current status, but audit events preserve who did what, when, from where, using which evidence and approval.

Field	Type	Constraints	Nullable	References
audit_event_id	uuid	Primary key	No	None
event_type	enum	See event catalogue below	No	None
subject_type	enum	party, application, kyc_profile, beneficial_owner, document_instance, external_verification, credit_assessment, deviation, sanction, kfs_version, sanction_condition, disbursement, loan_account, loan_transaction, asset_classification, security_charge, mandate, collection_case, settlement_proposal, partner_profile, co_lending_arrangement, partner_share, dlg_set, consent_artifact, user_access	No	None
subject_id	uuid	Id of subject record	No	None
application_id	uuid	Required when event relates to origination	Yes	application.application_id
loan_account_id	uuid	Required after booking	Yes	loan_account.loan_account_id
party_id	uuid	Affected borrower/partner/user party where applicable	Yes	party.party_id
actor_type	enum	human_user, borrower_user, partner_api_client, system_service, vendor_user, batch_job	No	None
actor_id	uuid	User id, API client id or service id	No	None
actor_role	text	Actor code such as credit_analyst, ops_checker, partner_api_client	No	role.role_code
event_timestamp	timestamptz	Server time	No	None
business_effective_date	date	Required for DPD, NPA, transaction, charge, disbursement and closure events	Yes	None
source_channel	enum	branch, dsa_app, customer_portal, dla, partner_api, batch, admin_console, vendor_portal	No	None
request_id	text	API/request correlation id	Yes	None
idempotency_key	text	Required for external/API/batch events	Yes	None
before_hash	char(64)	Hash of previous material JSON state	Yes	None
after_hash	char(64)	Hash of new material JSON state	Yes	None
evidence_uri	text	Encrypted evidence packet path	Yes	None
reason_code	text	Required for rejection, override, waiver, hold, withdrawal, cancellation and correction	Yes	reason_code.code
approval_request_id	uuid	Required where action needs DoA or maker-checker	Yes	approval_request.approval_request_id
ip_address	inet	Required for user/API actions	Yes	None
device_fingerprint_hash	char(64)	Required for DLA/customer actions where available	Yes	None
signature_hash	char(64)	HMAC/signature over event body	No	None

Audit Event Catalogue

Event type	Required subject	Required evidence	Compliance reason
consent_granted, consent_revoked, consent_expired	consent_artifact	Consent text version, scope, purpose, channel, OTP/clickwrap/recording/AA artefact	Digital lending consent, privacy and purpose limitation.
kyc_verified, kyc_rejected, bo_added, sanctions_hit_cleared	kyc_profile, beneficial_owner, screening_hit	KYC docs, BO declaration, registry result, screening report	RBI KYC Master Direction CDD, BO and AML/CFT evidence.
document_uploaded, document_verified, document_pack_locked, documents_executed	document_instance	File hash, verification note, checker id, document pack version	Immutable document evidence.
bre_executed, deviation_raised, deviation_approved, credit_approved, credit_rejected	bre_result, deviation, credit_assessment	Rule version, CAM, approver level, decision note	DoA and credit-policy auditability.
kfs_generated, kfs_accepted, sanction_letter_generated, borrower_acceptance_recorded	kfs_version, sanction	KFS PDF/hash, APR computation JSON, amortisation schedule, borrower acknowledgement	KFS and digital disclosure duties.
cp_cleared, esign_completed, stamp_paid, mandate_activated	sanction_condition, signature_event, stamp_certificate, mandate	CP evidence, signature certificate, stamp certificate, UMRN/status	Documentation and disbursement control.
payment_initiated, disbursement_posted, disbursement_failed	disbursement, payment_instruction	Beneficiary verification, payment reference, checker approval	Direct fund-flow and wrong-beneficiary control.
loan_booked, demand_generated, receipt_posted, reversal_posted, waiver_posted	loan_account, loan_transaction	Schedule, due ledger, bank reference, approval	LMS/GL/CIC evidence.
dpd_changed, asset_classification_event, npa_classified, npa_upgraded	loan_account, asset_classification	Due ledger, DPD recomputation, effective date	IRAC, provisioning and CIC reporting.
case_opened, ptp_recorded, field_visit_completed, settlement_approved, writeoff_posted	collection_case, ptp, settlement_proposal, loan_transaction	Allocation, call/visit evidence, OTS approval, write-off note	Collections conduct and recovery governance.
partner_share_booked, escrow_reconciled, partner_dpd_sent, dlg_invoked	partner_share, escrow_movement, partner_status_event, dlg_set	Partner ack, escrow statement, DPD payload, DLG invocation file	CLA and DLG compliance.
role_granted, role_revoked, break_glass_started, access_review_completed	user_access	Ticket, approver, expiry, review result	Privileged access and audit control.

KFS Generation Hook

kfs_version

Field	Type	Constraints	Nullable	References
kfs_version_id	uuid	Primary key	No	None
application_id	uuid	Parent application	No	application.application_id
sanction_id	uuid	Populated when sanction exists	Yes	sanction.sanction_id
proposal_number	text	Unique KFS proposal number	No	None
kfs_version_number	int	Starts at 1; increments on economics change	No	None
product_code	text	Product master	No	product.product_code
loan_amount	numeric(18,2)	Amount offered	No	None
tenor_months	int	Required for term loan	No	None
annual_interest_rate	numeric(9,6)	Contract rate	No	None
apr_percent	numeric(9,6)	Computed annual percentage rate	No	None
repayment_frequency	enum	Same as sanction.repayment_frequency	No	None
emi_amount	numeric(18,2)	Required for EMI products	Yes	None
fee_json	jsonb	Processing, insurance, legal, valuation, documentation, stamp, platform, bounce, penal charge fields	No	None
third_party_charges_json	jsonb	Actual-basis charges recovered through RE	Yes	None
cooling_off_period_days	int	Minimum 1 for digital loans	Yes	None
grievance_json	jsonb	RE and LSP nodal grievance contact, RBI CMS link where applicable	No	None
amortisation_schedule_uri	text	Required for amortising term loans	Yes	None
apr_computation_uri	text	APR input/output evidence	No	None
document_uri	text	Rendered KFS path	No	None
sha256_hash	char(64)	Hash of rendered KFS	No	None
valid_from	timestamptz	Required	No	None
valid_until	timestamptz	At least 3 working days for tenor >= 7 days; 1 working day for tenor < 7 days	No	None
status	enum	draft, issued, accepted, expired, superseded, cancelled	No	None

KFS Trigger Rules

Trigger	Required action
credit_approved_without_deviation or all_deviations_approved	Generate KFS before sanction_letter_generated.
Any change to amount, tenor, rate, fee, repayment frequency, EMI, cooling-off, co-lending split, third-party charges or penalty terms	Supersede prior KFS; create new kfs_version; require fresh borrower acceptance.
Borrower clicks accept in customer_portal, dla or assisted branch flow	Write kfs_accepted audit event with evidence; set sanction.borrower_acceptance_at.
KFS validity expires before borrower acceptance	Emit sanction_expired or regenerate with current terms if credit policy permits.
Co-lending loan	KFS must show blended rate, partner RE disclosure, customer interface, fees/charges and APR.

CIC Reporting Hooks

Credit Information Company (CIC) reporting must be reproducible from LMS and party records. It must not be built from spreadsheet exports.

cic_submission

Field	Type	Constraints	Nullable	References
cic_submission_id	uuid	Primary key	No	None
cic_name	enum	transunion_cibil, experian, equifax, crif_highmark	No	None
segment	enum	consumer, commercial, mfi	No	None
reference_date	date	Reporting as-of date	No	None
cycle_type	enum	scheduled, correction, dispute_resolution, closure_update, ad_hoc_regulatory	No	None
file_format	enum	ucrf_consumer, ucrf_commercial, ucrf_mfi, cic_legacy	No	None
record_count	int	Non-negative	No	None
file_uri	text	Encrypted output file path	No	None
sha256_hash	char(64)	File hash	No	None
generated_at	timestamptz	Required	No	None
submitted_at	timestamptz	Required once sent	Yes	None
ack_received_at	timestamptz	Required once ack received	Yes	None
accepted_count	int	Required after ack	Yes	None
rejected_count	int	Required after ack	Yes	None
status	enum	draft, generated, submitted, accepted, accepted_with_rejects, rejected, corrected, cancelled	No	None

CIC Cycle Rules

Rule	Build requirement
Current cycle	Support at least fortnightly reference dates, 15th and last day of the month, and submission within 7 calendar days where applicable under RBI CIC reporting instructions.
July 2026 readiness	Make the cycle calendar configurable by RE type because RBI’s 2025/2026 credit-information reporting directions introduced more granular schedules for certain credit institutions from July 1, 2026. The scheduler must support 9th, 16th, 23rd and last-day reference dates, monthly full-file by the 5th day of next month, and incremental/correction files if the applicable RE direction requires them.
Co-lending	Each RE reports its own partner_share; borrower-facing account numbers and partner references must not create duplicate borrower identities.
Commercial borrower	Use business_entity.pan, gstin_primary, cin, llpin, udyam_registration_number, relationship data and beneficial-owner links where applicable.
Individual proprietor/promoter/guarantor	Use natural_person.pan, DOB, address, mobile and relationship segment.
DPD and asset class	Source from LMS loan_account.current_dpd and asset_classification, not collections notes.
Rejected records	Create correction task with reject reason; unresolved reject older than one cycle escalates to compliance and data owner.
Disputes	A borrower dispute creates correction workflow; if data is wrong, submit correction in next permissible cycle and store dispute resolution evidence.

The RBI CIC Directions list TransUnion CIBIL, Experian, Equifax and CRIF High Mark as registered CICs and prescribe standardised UCRF segments for consumer, commercial and MFI reporting in the CIC framework (RBI CIC Directions, 2025 public mirror).

Regulatory Returns Registry

regulatory_report_run

Field	Type	Constraints	Nullable	References
regulatory_report_run_id	uuid	Primary key	No	None
report_code	text	Controlled return code	No	regulatory_return_master.report_code
report_name	text	Human-readable name	No	None
regulator	enum	rbi, cic, ckyc, fiu_ind, cersai, ibbi_nesl, gst, income_tax, mca	No	None
period_start	date	Required	No	None
period_end	date	Required	No	None
due_date	date	Required	No	None
source_snapshot_uri	text	Immutable source extract	No	None
output_file_uri	text	Return file path	Yes	None
validation_status	enum	not_started, generated, validation_failed, validated, submitted, accepted, rejected, corrected	No	None
maker_user_id	uuid	Required after generation	Yes	user.user_id
checker_user_id	uuid	Required before submission	Yes	user.user_id
submitted_at	timestamptz	Required once submitted	Yes	None
ack_reference	text	Portal or regulator ack	Yes	None

Key Return Families

Return family	Trigger/source	Minimum data inputs	Owner	Control
DLA reporting on RBI CIMS	DLA deployed, joined, changed or ceased	DLA name, owner, website/app-store link, grievance officer, RE website, compliance certification	compliance_officer	Digital Lending Directions require RE reporting and certification; RBI publishes submitted data without validation.
NBFC supervisory returns on RBI CIMS/XBRL	Periodic NBFC return calendar	Balance sheet, P&L, exposure, NPA, provisioning, ALM, concentration, public funds, capital, related-party data	Finance/compliance	Return calendar configurable; maker-checker mandatory.
PSL returns where applicable	Priority sector eligible share	MSME classification, Udyam, product, sector, loan amount, outstanding, co-lending share	Compliance/finance	CLA PSL claim only for each RE’s share.
CIC submissions	Scheduled reporting cycle	Party, loan, DPD, asset class, co-borrowers, guarantors, closure, write-off, suit-filed/wilful default	Compliance/data ops	Reconcile accepted/rejected counts.
CKYC upload/update	New or updated CDD	KYC template fields, document metadata, CKYC id, legal entity data	KYC ops	Required under KYC/CKYCR framework.
FIU-IND STR/CTR support	AML alert or cash threshold	Transaction, party, KYC, alert narrative, branch, source of funds	AML/compliance	Separate confidential workflow; limited access.
CERSAI charge filing/satisfaction	Security creation, modification, closure	security_charge, collateral, borrower, charge amount, filing references	Legal/ops	Filing must block or condition secured disbursement according to product policy.
NeSL IU record/default evidence	Debt record authentication and default	Sanction, agreement, schedule, borrower auth, default record	Legal/ops	Used for debt evidence and insolvency/legal readiness.
RBI Ombudsman/internal complaints	Complaint rejected, unresolved, escalated or closed	Complaint category, borrower, loan, date received, response date, compensation/refund	Grievance/compliance	30-day unresolved/rejected complaint path must be visible to borrower for RBI CMS.

RBI’s Master Direction on Filing of Supervisory Returns gives standard periodicity timelines such as weekly, fortnightly, monthly, quarterly, half-yearly and yearly submission windows, with return-specific exceptions in annexes (RBI Filing of Supervisory Returns Directions, 2024).

Consent Registry

consent_artifact is already defined in domain model core. The compliance hook adds lifecycle controls.

Consent type	Purpose examples	Required scope fields	Revocation effect
contact	Call/SMS/email/WhatsApp for application and servicing	Channel, language, validity, source	Stops future non-essential contact except legal/regulatory notices.
bureau_pull	Consumer/commercial bureau enquiry for underwriting or monitoring where allowed	CIC, enquiry purpose, borrower role, validity	Blocks future pulls; existing report retained for audit and credit decision evidence.
gst_fetch	GST return analytics	GSTIN, return types, period, vendor, purpose	Blocks future GST fetch; parsed evidence retained if used in CAM.
account_aggregator	Bank data through AA	FI type, FIP/account refs, date range, fetch frequency, data life, purpose code	AA revocation blocks future fetch and updates consent_revoked.
bank_statement_upload	Borrower uploaded PDF/CSV statements	Account, period, parser permission	Blocks reuse for new purpose; existing underwriting evidence retained.
digilocker	Pull issued documents	Issuer, document type, scope, OAuth token validity	Token revoked; manual upload allowed.
ckyc_fetch	CKYC search/download	CKYC id/PAN, KYC type, purpose	Blocks future CKYC fetch.
udyam_verify	MSME verification	Udyam number, PAN/GSTIN, purpose	Blocks future verification call.
itr_fetch	ITR/ERI/vendor-assisted tax data	Assessment years, PAN, data fields, vendor/ERI scope	Blocks future tax data access.
data_sharing_partner	Share permitted variables with LSP/co-lender/anchor	Recipient, fields, purpose, expiry	Stops future sharing; partner must delete data per contract unless retention law requires otherwise.

Consent Enforcement Rules

Rule	Implementation
No active consent	Integration gateway returns consent_required; workflow cannot call external provider.
Purpose mismatch	Reject call even if consent exists; create audit event.
Expired consent	Set consent_artifact.status=expired; ask borrower for fresh consent.
Revoked consent	Stop future collection/sharing; do not delete regulated records needed for audit, KYC, loan servicing, legal or regulatory reporting.
Partner sharing	partner_api_client response builder checks data_sharing_partner scope before including personal, bureau, GST, ITR, AA or KYC data.
Data minimisation	API response includes only fields needed by state and partner contract.

Compliance Holds

Hold reason	Source	Blocks	Release authority
sanctions_true_positive	screening_hit	kyc_verified, sanction_letter_generated, loan_booked	aml_compliance
beneficial_owner_incomplete	beneficial_owner	kyc_verified	kyc_checker or aml_compliance waiver
kfs_not_accepted	kfs_version	documentation_started, loan_booked	Borrower or authorised signatory acceptance
fund_flow_breach	Payment reconciliation	loan_booked, partner payout	compliance_officer plus treasury_finance
cic_reject_unresolved	cic_submission	Closure of reporting cycle	Compliance/data owner
dpd_override_pending	LMS correction	CIC reporting and partner status finalisation	Risk head plus finance/compliance checker
partner_share_mismatch	Co-lending reconciliation	CLA settlement and partner payout	Partner ops plus finance
complaint_ombudsman_escalated	Complaint system	Closure of related complaint and root cause item	compliance_officer

Sources

• RBI, Key Facts Statement (KFS) for Loans & Advances, April 15, 2024
• RBI, Reserve Bank of India (Digital Lending) Directions, 2025
• RBI, Reserve Bank of India (Co-Lending Arrangements) Directions, 2025
• RBI, Credit Information Companies Directions, 2025 public mirror
• RBI, Master Direction - Filing of Supervisory Returns, 2024
• RBI, Master Direction - Know Your Customer (KYC) Direction, 2016