By Srijan Nagar, Co-Founder of FinBox
India’s next wave of borrowers is already here. They’re in Surat, Kanpur, Coimbatore, applying for loans through their phones, many of them for the first time. Personal loan applications from smaller cities grew sharply through 2025, and lenders have largely built the tools to assess them. Better models, alternative data, UPI-linked underwriting. The capability to understand these borrowers exists.
The problem is something else entirely.
Even when a lender’s model correctly identifies a creditworthy borrower, the rules that actually drive the approval decision may not reflect that. Those rules, the policy layer sitting between the model and the decision, are updated weeks after the insight that should have changed them. The model learns. The policy doesn’t, not quickly enough.
That gap, between what the data knows and what the system does, is where approvals get missed, where compliant borrowers get turned away, and where the lenders who’ve solved this problem are simply moving ahead.
What actually happens when you apply for a loan
Most people assume a loan decision involves a person reviewing their application. It doesn’t. It’s a set of rules running automatically in the background, sometimes called a policy or a credit decisioning platform. In simple words, it’s the brain of the lending operation. Every application that comes in gets processed through this brain, which checks it against a series of conditions and spits out a decision in seconds.
Those rules might say something like: if the applicant’s credit score is above 720, their monthly income is above ₹30,000, and they have no defaults in the last two years, approve up to ₹5 lakh. Thousands of variations of this logic fire every time someone applies.
The people who design those rules are risk managers. They watch which borrowers repay reliably and which don’t, and they tune the rules accordingly. When they notice the rules aren’t working well for a particular type of borrower, they want to update them. And this is exactly where the problem begins.
Why a simple rule change takes weeks
The rules that drive credit decisions aren’t a spreadsheet a risk manager can edit. They live inside code, built and maintained by engineering teams.
So when a risk manager wants to make a change, they raise a request with the technology team. That request goes into a queue, gets built, gets tested, gets deployed. In most organisations, this takes four to six weeks.
Think about what that means in reality. The data flags an issue in week one. The fix doesn’t go live until week six. For five weeks, the wrong borrowers are being rejected, the right ones are being turned away, and nobody in the organisation can do anything about it.
Why this is a much bigger problem in smaller cities
In metro markets with established borrowers, a slow policy cycle is frustrating but survivable. Borrower profiles are relatively predictable. A quarterly review keeps things roughly on track.
But India’s growth story right now is playing out in Rajkot, Nashik, Warangal, not just Mumbai and Bengaluru. In these markets, borrower behaviour varies much more by geography, income type, and even season. A rule designed for a salaried professional in Pune can reject creditworthy borrowers in Coimbatore, simply because they look different on paper. The lender never finds out. The borrower walks away. And a competitor who’s moving faster wins the account.
Regulatory pressure is tightening this window further. The Reserve Bank of India’s updated digital lending guidelines, including DLG frameworks that limit how much risk can be offloaded, require lenders to be more transparent on pricing and more accountable on decisions. When requirements change, the decisioning logic needs to keep pace. When it takes weeks to update a rule, compliance gaps open and widen fast.
What slow decisioning actually costs
The costs don’t always show up immediately on a balance sheet, but they compound in ways that matter such as Missed approvals come first. When rules are calibrated on old data and the market has moved, creditworthy borrowers get rejected. That’s lost revenue, and it’s invisible because you never see the loans that didn’t happen.
Then there’s pricing that doesn’t fit. Blunt rules applied to varied borrowers mean you’re either leaving approvals on the table or absorbing losses that sharper rules would have caught. Both problems show up long after the policy decision that caused them.
The third cost is the hardest to see: teams stop trying. When every rule change requires an engineering sprint, risk managers stop proposing changes. They default to what’s already in place. Over time, conservative policies calcify, and the organisation drifts further from the market it’s trying to serve.
What the faster lenders have figured out
A growing number of lenders, mostly fintechs and digitally native NBFCs, but increasingly some bank divisions too, have started solving this by separating policy from engineering entirely.
For these lenders, updating a credit rule is an operational decision, not a development project. Risk teams write and test rules themselves, in plain language or spreadsheet-style interfaces, without touching code. They can run a rule on a small segment of borrowers first, watch how it performs, and roll it out fully only once it’s working. This approach, known as champion-challenger testing, means changes are validated before they scale.
This is the problem modern credit decisioning platforms were built to solve. Rather than routing every rule change through an engineering queue, they put that control directly in the hands of the people who understand the borrowers. Risk teams can write, test, and deploy policy changes themselves, on the same day, without touching code. The Monday to Wednesday turnaround that most risk managers can only imagine becomes the default, not the exception.
The question every lender should be asking
The conversation in lending has focused almost entirely on models. How sophisticated is your scorecard?
What alternative data are you using? How good is your bureau triangulation? These are the wrong questions to lead with. Good models are table stakes now. Most serious lenders have them.
The more revealing question is this: from the moment your data tells you something needs to change, how long does it actually take to change it?
If the answer is days, you’re in reasonable shape. If it’s weeks, you’re leaving more on the table than you realise, in approvals, in pricing, and in the compounding cost of a team that’s stopped experimenting.
India’s next wave of borrowers won’t wait for a quarterly policy review. The lenders who reach them first will be the ones whose systems can move as fast as their data does.