Growth Debt for Indian FinTech: Lending against Revenue without Lending against Regulatory Hope

1. Define the repayment asset

Growth debt sits between a conventional cash-flow loan and equity-funded expansion. The borrower may have established products, recurring contracts and visible scale while retaining customer concentration, product-development expenditure, operating losses or regulatory dependencies that make a standard leverage multiple unreliable. The lender's first task is to define the asset that will repay the facility.

The scale of India's digital infrastructure creates a large operating canvas. NPCI recorded 23.20 billion UPI transactions in May 2026.[1] That system-level volume is context for digital adoption and does not establish the revenue quality or repayment capacity of a particular FinTech. RBI's June 2026 Financial Stability Report provides current system context; transaction underwriting still requires borrower, partner and portfolio evidence.[16]

For an Indian FinTech, that asset is rarely a single consolidated revenue line. A platform can provide lead generation to banks and non-banking financial companies, operate a digital lending app, supply underwriting or servicing software, administer repayments, perform collections, distribute insurance or investment products, and provide a default loss guarantee. Some fees arise when a loan is disbursed. Others accrue while the loan remains serviced. Some are fixed subscriptions. Others depend on portfolio performance, customer behaviour or partner discretion.

The credit perimeter should therefore begin with a revenue-to-cash register. Each material stream should identify the contracting entity, customer, regulated partner, product, service obligation, pricing basis, invoice event, collection account, cancellation right, data dependency and continuing regulatory condition. Revenue earned outside the borrowing or guarantor group requires an enforceable route to debt service. Cash held for customers, regulated entities or credit support should remain outside freely available liquidity.

The legal and operating perimeter should be reconciled. The entity holding technology, employees and intellectual property may differ from the entity contracting with a lender. A group company may own the digital lending app while another supplies services. A default loss guarantee may sit in a separate vehicle. An offshore parent can own shares while Indian entities generate the cash. Debt documents should follow the real cash chain and preserve required regulatory separation.

The lender should then classify each source as existing, conditional or prospective. Existing revenue has an executed contract, operational product, completed service and observable collection history. Conditional revenue depends on a documented event that can be tested, such as a partner rollout, achieved service level or regulatory permission. Prospective revenue depends on a future licence, unsigned partner, new product or management plan. Prospective revenue can support the equity case. It should not support initial debt sizing.

This definition avoids a common category error. Enterprise value can reflect growth options, data assets, technology and a large addressable market. Debt service requires cash available at the right entity and time after operating costs, taxes, credit support, capital expenditure and regulatory obligations. Growth debt can participate in the transition from option value to cash value through staged availability.

2. Read regulation as an operating dependency

The digital-lending framework is built around regulated entities and their responsibilities. RBI's 2025 directions apply to digital lending activities of commercial banks, co-operative banks, non-banking financial companies, housing finance companies and all-India financial institutions.[2] The current scale-based framework supplies the wider prudential reference for non-banking financial companies.[14] A lending service provider acts as an agent for a regulated entity in activities such as acquisition, underwriting support, pricing, servicing, monitoring or recovery. The underlying contract must define roles, rights and obligations.

The regulated entity must conduct enhanced due diligence on the service provider, review its conduct and maintain monitoring arrangements for portfolios originated with its support.[2] Outsourcing does not remove the regulated entity's responsibility for the service provider's acts and omissions. This allocation creates a direct commercial consequence for the FinTech. Revenue continues only while the regulated partner remains satisfied with technical capability, data controls, fair conduct, regulatory compliance and portfolio outcomes.

Customer-protection requirements also affect the operating model. Loan offers presented by a multi-lender service provider must include prescribed information and use a consistent, unbiased approach. Regulated entities must assess creditworthiness, provide a Key Facts Statement, deliver signed documents, disclose products and service providers, provide complaint channels and keep the borrower informed about recovery agents.[2] The separate KFS circular requires all-in annual percentage rate information for relevant retail and MSME term loans and restricts later charges that were not disclosed.[4]

Fund-flow rules narrow the ways a platform can touch cash. Subject to stated exceptions, loan disbursement goes from the regulated entity to the borrower or end beneficiary, and repayment goes directly to the regulated entity. Third-party pass-through accounts are restricted. Fees payable to a lending service provider are paid by the regulated entity rather than collected separately from the borrower.[2] Revenue recognition and cash-control analysis must reflect this structure.

Data requirements are equally operational. Collection should be need-based, supported by prior explicit consent and an audit trail. Borrowers receive choices over specified data uses and disclosure. The directions restrict access to phone resources, require data-storage controls and place continuing responsibility for privacy and security on the regulated entity.[2] The Digital Personal Data Protection Rules, 2025 establish a phased commencement schedule and prescribe clear notices, specified purposes, consent mechanisms, security safeguards and breach-related procedures for provisions as they become effective.[5][6]

Regulation therefore enters the credit model through contracts, product design, data architecture, staffing, audit, remediation cost and the probability of partner continuation. The lender should avoid assigning a single binary label such as regulated or unregulated. It should identify each dependency and the cash flow it can interrupt.

RBI's 2024-25 Annual Report recorded the expansion of the Unified Lending Interface to 44 lenders, more than 60 data services and 12 loan journeys at 31 March 2025.[15] This infrastructure can reduce friction. Each borrower and product retains its own contract, permission, data and credit dependencies.

3. Distinguish five revenue families

The first family is software and platform revenue. It can include fixed subscriptions, per-user charges, API calls, decision-engine access, implementation fees and support. The strongest form has executed contracts, recurring minimums, acceptable termination rights, high gross margin, documented service levels and direct collection. Implementation revenue can be less durable if it depends on one-time deployments or significant customised work.

The second family is origination revenue. A lender or regulated partner can pay for customer acquisition, verification, underwriting support or completed disbursement. Volume can grow rapidly and fall when a partner changes appetite, pricing, product, funding capacity or risk limits. The credit model should separate approved applications, sanctioned loans and funded loans. Only the contractual invoice event should enter recognised revenue.

The third family is servicing revenue. It can accrue on outstanding balances, active customers, collections or other service measures. Servicing can persist beyond origination and may therefore appear more recurring. Its durability depends on portfolio amortisation, prepayment, delinquency, partner termination, service quality and rights to continue servicing after contract termination. A static outstanding balance can conceal deteriorating collections.

The fourth family is distribution and transaction revenue. Payment, insurance, investment or commerce products may create interchange, referral, convenience or commission income. The lender should determine whether the FinTech acts as principal or agent, identify chargebacks and refunds, and reconcile gross transaction value to net revenue. Ind AS 115 requires revenue to depict the transfer of promised goods or services in the consideration to which the entity expects to be entitled.[7]

The fifth family is credit-linked income and support. It can include interest or spread participation, collection incentives, first-loss economics and default loss guarantee fees. This family can create high reported yield and cash volatility. It should be evaluated together with expected losses, cash collateral, guarantee calls, regulatory capital at the partner, portfolio seasoning and recovery timing. A fee cannot be separated from the risk or cash support required to earn it.

These families should remain distinct in management reporting. Blending them into one growth rate hides different renewal, margin and loss characteristics. The lender can aggregate them after applying evidence-based eligibility and concentration rules.

Table 1. Revenue-quality scorecard for an Indian FinTech

Eligibility requires executed evidence and collected cash; prospective licences, products and partners receive no initial debt value.

4. Build the revenue-quality bridge

Reported revenue should be converted into an eligible revenue base before the lender calculates capacity. The bridge begins with the audited or independently verified consolidated number. It removes pass-through amounts, non-cash items, related-party revenue, disputed invoices and revenue outside the security group. It then applies stream-specific durability factors.

The illustrative bridge in Figure 1 begins with INR 240 crore of annual reported revenue. INR 24 crore of reimbursed or pass-through amounts is removed. The remaining categories are assessed against contract term, collection history, partner concentration, portfolio performance and continuing permissions. Origination income receives a larger haircut than contracted software because it is more exposed to lender appetite and product availability. Recovery and other income receive larger haircuts because timing and recurrence are less reliable.

The resulting INR 156 crore of eligible revenue is a credit input used alongside the financial statements and auditor's opinion. It provides a transparent basis for sizing debt and testing covenants. The factors should be approved at closing and refreshed using observed performance.

The bridge should also test cash conversion. Revenue collected in 90 or 120 days provides less near-term debt service than monthly cash collection. Unbilled revenue, contract assets and disputed partner reconciliations should receive a separate limit. Taxes, refunds, customer money and restricted balances should be removed from available cash.

Concentration should be applied after revenue eligibility. A partner representing 45 per cent of reported revenue may represent more than half of eligible revenue if other streams are heavily discounted. The lender can cap eligible revenue from any partner, product or revenue family. This makes capacity responsive to diversification that has actually entered production.

INR crore; figures and eligibility factors are illustrative management assumptions and are not a forecast or assessment of an identified company.

5. Underwrite contracts at partner and product level

Partner contracts are the primary evidence for revenue eligibility. Each contract should be abstracted for legal entity, product, territory, scope, exclusivity, minimum volume, price, invoice event, service level, audit right, data access, intellectual property, subcontracting, liability, termination, change of control and transition assistance. Commercial presentations and unsigned term sheets should remain outside the base case.

A volume commitment needs precise interpretation. A partner can provide a marketing target without an obligation to fund. A committed funding line can contain credit-policy conditions that allow approvals to decline. A minimum service payment can be reduced by service credits. The credit file should distinguish legally enforceable payments from operating expectations.

Termination rights often determine the useful life of revenue. A three-year stated term can permit termination for convenience on 30 or 90 days' notice. A partner can terminate one product while retaining another. Regulatory change, data breach, service failure, change of control and financial distress can create immediate rights. Debt tenor should follow the shortest material cash-life after renewal and termination analysis.

Change control also affects margin. A partner may ask for new data fields, model validation, user-interface changes, disclosure updates, consent flows or reporting. These changes can be mandatory for continued operation while commercial pricing remains fixed. The lender should test product-development capacity and the time between requirement and delivery.

Collection evidence should reconcile contract terms to bank receipts. For each partner, invoiced amount, taxes, credit notes, disputes, days sales outstanding and cash receipt should be tracked. A platform that grows funded volume while receivables expand can consume the liquidity expected to service debt. The borrower should produce a monthly partner-level revenue and cash schedule from system records to the general ledger and bank account.

The credit model should include a partner-renewal and appetite case. It can reduce funded volume, fee rates or products for the largest partner and apply a realistic replacement period. Replacement should require an executed contract and live production. Management's pipeline can inform the upside case and should not cure a base-case concentration breach.

6. Map every regulatory dependency to cash

A regulatory dependency map converts legal analysis into a credit-control tool. The first layer identifies the activity: payment, lending, account aggregation, investment distribution, insurance distribution, data processing or technology outsourcing. The second identifies the regulated entity and the FinTech's role. The third identifies the permission, contract, reporting, conduct, data and technology controls required for that revenue stream.

An origination fee paid by a bank depends on a valid regulated-entity relationship, an approved product, a functioning customer journey, required disclosures, creditworthiness assessment and compliant fund flow. A servicing fee depends on continuing access to portfolio data, reporting and customer service. A software subscription can be less exposed to lending volume while retaining cybersecurity, outsourcing and service-continuity dependencies.

RBI's IT outsourcing directions require regulated entities to manage third-party risk, contracts, audit access, business continuity, data, incident reporting and exit arrangements.[8] Its IT governance directions require robust service management, information-asset classification, technology refresh, third-party controls and assurance.[9] These obligations can lead a partner to require investment, remediation, audit or migration from the FinTech. The debt case should reserve cash for known control work.

The map should record evidence and expiry. Evidence can include regulator or partner correspondence, board policies, DLA reporting, audit reports, penetration tests, service-level reports, privacy notices, consent logs, data-flow diagrams, business continuity tests and complaint data. The public DLA directory became operational in 2025 and relies on regulated-entity reporting.[17] A green status should mean current evidence exists. Management assurance alone should remain amber until corroborated.

The Digital Personal Data Protection Act and 2025 Rules have staged effective dates.[5][6] The implementation plan should therefore identify which controls are already in force, which start after one year and which start after eighteen months from publication. Facility availability can require funded implementation, accountable ownership and completion before the relevant effective date. The model should avoid assuming that delayed commencement removes preparation cost.

Co-lending creates a separate dependency when regulated entities jointly fund a portfolio. The 2025 directions require each entity to retain at least ten per cent of each loan, prescribe upfront role disclosure, blended pricing, timely booking, escrow arrangements, audit, continuity, KYC, CIC reporting and borrower-level asset classification.[3] The applicable KYC framework remains the RBI Master Direction updated from time to time.[13] If a FinTech supplies technology or services to such an arrangement, its revenue relies on the partners' ability to operate the structure in compliance.

The map is an analytical checklist; the applicable legal perimeter depends on the product, entity, contract and current advice.

Table 2. Licensing, data and regulatory dependency matrix

Status should be supported by dated evidence and current legal advice for the actual product perimeter.

7. Reconcile unit economics before applying leverage

Growth can hide weak unit economics when acquisition spending, incentives, losses or support costs sit outside reported gross margin. The lender should reconstruct economics at partner, product and cohort level. The starting unit should match the commercial engine: funded loan, active borrower, transaction, serviced balance, merchant, software seat or API call.

For origination, contribution begins with the fee earned on a funded loan. It deducts marketing, lead acquisition, verification, bureau, KYC, fraud checks, underwriting operations, payment cost, partner-specific technology and expected cancellations. Shared engineering and compliance cost should then be allocated using a documented basis. The result should be reconciled to the general ledger.

Servicing economics should include customer support, collections, messaging, payment, data and platform infrastructure. Delinquent accounts can require greater servicing effort while generating lower collections. A servicing fee based on outstanding principal can decline through amortisation and prepayment. A fee based on collections can decline through credit deterioration. The model should show both volume and yield.

Credit-linked income requires a full loss and liquidity view. Ind AS 109 describes expected credit losses as probability-weighted estimates of cash shortfalls over the expected life of the instrument.[10] A FinTech that provides a guarantee or other support should model expected and stressed cash calls, timing, recoveries and collateral. The lender should use the contractual and accounting analysis applicable to the actual arrangement.

The illustrative reconciliation in Table 3 begins with INR 240 crore of reported revenue and INR 156 crore of eligible revenue from the quality bridge. It applies direct delivery cost, recurring product and compliance expenditure, cash taxes and working-capital demand. The resulting cash contribution is compared with maintenance technology, regulatory implementation and required credit-support reserves before debt service.

The model should use monthly cash rather than an annual average. Origination can be seasonal. Partner settlement can occur after reconciliation. Guarantee calls and remediation costs can be concentrated. A borrower with positive annual contribution can still face a quarter in which liquidity falls below the operating minimum.

Table 3. Illustrative unit-economics and cash reconciliation

INR crore; all values are illustrative management assumptions and require audited and system-level evidence in an actual financing.

The negative illustrative credit contribution has a deliberate purpose. It shows how an apparently profitable reported view can require further equity, pricing changes, cost action or revenue seasoning before conventional amortising debt becomes suitable. A staged facility can fund defined investment while initial drawings remain limited and liquidity remains protected.

8. Read cohort losses even when loans sit elsewhere

A lending service provider may have no loan receivable on its own balance sheet. Portfolio losses can still affect its cash. A regulated partner can reduce approvals, renegotiate fees, invoke contractual remedies, require additional monitoring, decline renewal or call a default loss guarantee. The credit file should therefore contain the same cohort discipline expected in a lender-funded portfolio.

The tape should identify origination month, partner, product, geography, ticket, tenor, pricing, customer attributes, decision version, disbursement, scheduled payment, actual payment, days past due, restructuring, write-off, recovery and guarantee status. Definitions should be consistent across periods. A change in delinquency tagging, write-off timing or cohort perimeter should be documented.

Vintage analysis tracks cumulative outcomes by months on book. It distinguishes seasoning from calendar effects. A recently originated portfolio can report low losses because few instalments have fallen due. A seasoned cohort provides more information and can reflect an older underwriting model. The lender should review both vintage and calendar-period views.

The illustrative curve in Figure 3 compares a reference cohort with a more recent cohort. The recent cohort reaches 5.2 per cent cumulative net loss by month twelve, above the illustrative 4.5 per cent covenant threshold. The result would block a later draw, increase the cash reserve and require a documented cause analysis. It would not automatically establish lifetime loss because the example stops at twelve months.

Cause analysis should separate mix, macro conditions, fraud, data, model, policy, operations, collections and partner behaviour. Approval rates can fall while loss improves, reducing revenue. Approval rates can rise while loss worsens, raising short-term origination revenue. Debt capacity should respond to the combined effect on revenue, margin, guarantee cash and partner continuity.

Percentage of original disbursed principal; the curves and threshold are illustrative management assumptions, end at month twelve and do not represent an identified portfolio.

Table 4. Cohort performance matrix

Thresholds and responses are illustrative; an actual matrix should reflect product tenor, loss definition and verified historical dispersion.

9. Treat default loss guarantees as cash obligations

RBI's digital-lending directions permit qualifying default loss guarantees only in specified circumstances. The provider must be an eligible lending service provider or regulated entity acting as one. The arrangement requires an explicit enforceable contract, prescribed forms of cover and a fixed identified portfolio. The cap is five per cent of the amount disbursed in that portfolio at a given time.[2]

The five per cent cap is a regulatory ceiling for qualifying arrangements. It is not a credit-loss forecast or a substitute for underwriting. The regulated entity remains responsible for asset classification and provisioning, and the directions require robust appraisal irrespective of guarantee cover.[2] A lender to the FinTech should evaluate the guarantee as a contingent cash use and an indicator of partner economics.

The guarantee register should identify partner, fixed portfolio, disbursed amount, cover, form, collateral location, invocation terms, longest underlying tenor, past default rates, amount invoked and remaining availability. The FinTech's website disclosures and statutory-auditor certifications required by the framework should reconcile to the register.[2]

Cash, fixed deposits or bank guarantees supporting the obligation should be restricted in the liquidity calculation. Invocation can occur before recoveries are realised. Cover once invoked cannot be reinstated through later loan recovery under the directions. The model should therefore distinguish accounting expense, cash collateral, cash call and recovery sharing.

The FinTech may earn a fee for providing the guarantee or obtain higher origination economics. The credit model should compare incremental after-tax cash income with expected and stressed cash use. Fees paid upfront can overstate durability if the underlying portfolio has not seasoned. Recognition for debt capacity can be spread over the risk period and capped by observed cohort performance.

A guarantee breach should trigger a wider partner review. Loss acceleration can affect origination volume, pricing, reporting, data requests and renewal. The facility should allow cash trapping, additional reserves, partner-specific draw suspension and a cure plan before a monetary default is considered.

10. Protect liquidity from growth and compliance demands

FinTech growth can consume cash through customer acquisition, payroll, cloud usage, product work, receivables, taxes, guarantee support and partner implementation. Debt can accelerate that consumption if availability precedes a durable revenue milestone. A minimum-liquidity covenant should therefore sit at the centre of the structure.

The liquidity model should begin with unrestricted cash in accounts subject to the lender's agreed control package. It should exclude customer money, escrow balances, tax money, guarantee collateral, restricted deposits and cash outside the security group. It should then show twelve to eighteen months of monthly operating cash, debt service, mandatory investment and committed credit support.

An operating reserve can be expressed as the greater of a fixed amount and a number of months of base cash expenditure. The illustrative facility uses the greater of INR 45 crore and nine months of recurring cash operating expenditure. The formula should use defined expenditure and prevent management from lowering the reserve through deferred payments or reclassification.

Receivables need a partner-level limit. Eligible receivables can require an executed contract, completed service, undisputed invoice and maximum age. Receivables from related parties, prospective products, terminated contracts or unresolved reconciliations should be excluded. Concentration caps can limit the amount from the largest partners.

Mandatory investment should be funded before discretionary expansion or distributions. It can include data-control remediation, cybersecurity, business continuity, audit findings, KFS or consent-flow changes, model monitoring, technology refresh and legal implementation for new rules. RBI's outsourcing and IT-governance directions make continuity, exit, assurance and vendor controls material to regulated partners.[8][9]

Liquidity reporting should show a base case and named stresses. These can include a partner payment delay, a thirty per cent decline in origination volume, increased guarantee calls, a cloud or technology remediation project, and slower equity funding. The structure can reduce availability before the borrower reaches the operating minimum.

11. Match facility architecture to evidence maturity

The illustrative growth-debt facility has INR 90 crore of committed capacity. INR 35 crore is available at closing, INR 25 crore after a revenue and partner milestone, INR 20 crore after cohort and control milestones, and INR 10 crore as a final performance accordion. The commitment creates funding visibility while the draw conditions preserve evidence discipline.

The closing draw can refinance agreed short-term liabilities, fund mandatory product and control work, and provide measured growth capital. It should remain small enough for the borrower to service under the existing eligible revenue base and minimum liquidity. Equity should fund losses and prospective products until those products produce contracted and collected revenue.

The facility can use a senior secured term loan with delayed-draw tranches. A revolving component can address timing differences in eligible partner receivables when borrowing-base controls are practical. Capitalised interest can postpone the cash test and should be limited, transparent and included in leverage. Warrants or other equity-linked consideration require legal, valuation, tax and governance analysis outside this paper.

Amortisation should follow the cash-life of eligible revenue. A short initial holiday can support implementation while retaining scheduled reduction during the contracted revenue period. A large bullet assumes refinancing or an exit. The lender should test repayment from internally generated cash before giving value to a future capital-markets transaction.

Pricing can step with evidence and risk. A margin can reduce after sustained covenant compliance, diversified eligible revenue and verified cohort performance. It can increase after a concentration, loss or liquidity trigger. Economic terms should remain consistent with applicable law and the actual lender's mandate.

The facility should include a committed use-of-proceeds schedule. Product expansion tied to an unreceived licence or unsigned regulated partner should remain outside initial permitted use. The borrower can draw for that product after the named dependency is satisfied. This structure converts a future option into a later borrowing base without treating the option as current cash flow.

The capital provider's own perimeter also matters. A bank, non-banking financial company, offshore lender and Indian alternative investment fund can have different investment powers, concentration rules, tax considerations and security requirements. For an Indian AIF provider, the current SEBI AIF Regulations and June 2026 Master Circular form part of the governing reference set.[19][20] Transaction counsel should confirm the provider-specific authority and conditions.

12. Release drawings through objective milestones

Milestones should be specific, measurable, time-bounded and supported by named evidence. A general statement that regulation is on track cannot support availability. Evidence can include an executed contract, current app reporting, satisfactory partner certification, a completed audit, a seasoned cohort report, collected revenue or an independently verified control closure.

The first later draw in the illustrative schedule requires annualised eligible revenue of at least INR 150 crore for three consecutive months, cash collection of at least ninety per cent of eligible billings, and a largest-partner share no higher than thirty-five per cent of eligible revenue. These thresholds reflect the example rather than a market standard.

The second later draw requires satisfactory control evidence and cohort performance. Relevant digital lending apps should have current reporting through the regulated partners. Material data or technology audit findings should be closed or fully funded. The most recent seasonable cohorts should remain inside approved delinquency and loss thresholds. Guarantee utilisation should remain below the stated level.

The final accordion requires four consecutive quarters of positive cash contribution after maintenance investment and credit-support reserves. It also requires a minimum debt-service coverage ratio and no unresolved regulatory, partner or data event. The accordion can fund a product or partner already in live production.

Milestones need expiry and waiver rules. A delayed milestone can reduce the commitment after a long-stop date. A waiver should be documented with revised economics, liquidity or collateral where appropriate. Repeated informal extensions weaken the relationship between evidence and debt capacity.

INR crore; draw sizes, timing and tests are illustrative management assumptions and require transaction-specific credit approval.

Table 5. Illustrative milestone draw conditions

Conditions are examples for a hypothetical facility; actual conditions require legal drafting, diligence and credit approval.

13. Use a covenant dashboard that follows the cash mechanism

Financial covenants should use definitions that match the revenue-quality bridge. A revenue coverage ratio can compare eligible recurring net revenue with cash interest, scheduled amortisation and mandatory credit-support contributions. A leverage ratio can use eligible cash contribution after recurring product, compliance and maintenance expenditure. Add-backs should be capped, dated and supported by completed actions.

Liquidity should be measured monthly or more frequently during a trigger period. Revenue and partner concentration can be tested monthly on a trailing basis. Cohort and guarantee measures can follow the portfolio reporting cycle. Regulatory, data and technology events should be reported promptly because a quarterly test can arrive too late.

The dashboard in Figure 5 uses four statuses. Green remains inside the approved range. Amber requires enhanced reporting and a cure plan. Red blocks drawings and distributions, traps cash or requires a reserve. Event status covers qualitative matters such as a regulatory notice, data breach, material service outage, partner termination or audit qualification.

Headroom matters more than point compliance. A borrower with INR 46 crore of unrestricted liquidity against a INR 45 crore minimum has limited capacity to absorb a guarantee call or receivable delay. Reporting should show actual, threshold and stressed value. The board and lender should receive the same definitions.

Cure mechanisms should correspond to cause. An equity cure can restore liquidity and cannot demonstrate revenue quality or cohort performance. A partner-concentration breach can be cured through verified diversified revenue, a lower draw or amortisation. A data-control breach requires remediation evidence. A loss trigger requires underwriting, collection and guarantee analysis.

The documentation should preserve a hierarchy of responses. Early warning produces information and a plan. Deterioration produces reserve, pricing, draw or distribution action. Severe or unresolved events can become defaults after agreed grace periods. This graduated approach keeps the facility aligned with operating evidence.

Values and thresholds are illustrative management assumptions; colour indicates the stated example response and does not represent an identified borrower.

Table 6. Covenant, trigger and cure ladder

The ladder separates information, availability and default responses; actual documentation requires transaction-specific legal drafting.

14. Align security and control with the revenue chain

Security should follow the entities, contracts, accounts and assets that generate eligible cash. It can include share security, security over movable assets and receivables, account control, intellectual-property security and guarantees, subject to applicable law, existing arrangements, regulatory restrictions and corporate approvals. The analysis should identify assets that cannot be transferred or enforced without consent.

Partner contracts can restrict assignment, security, subcontracting or change of control. The lender should determine whether acknowledgement, consent or direct arrangements are required. The value of receivables depends on enforceability, set-off, dispute, termination and continued service. A blanket description of all receivables provides limited protection if the major contracts prohibit transfer.

Technology and data require careful treatment. Code, models, configurations, cloud environments, vendor contracts and employee knowledge can support continuity. Personal data, customer information and regulated records remain subject to law and contract. Security documents should avoid implying unrestricted use of protected data. Enforcement planning should include a lawful continuity and migration route.

Account control should preserve regulated separation. Borrower repayments generally flow directly to regulated entities in digital-lending arrangements.[2] Co-lending transactions use prescribed escrow arrangements between regulated participants.[3] The growth-debt lender can control the FinTech's fee and operating accounts without intercepting loan principal or customer money.

Insurance, business continuity and key-person arrangements should reflect material risks. Cyber, professional indemnity, crime and directors' cover may be relevant. Policy terms, limits, exclusions and claims history should be verified. Insurance proceeds cannot replace operational resilience, data controls or partner continuity.

The enforcement case should assume that regulated partners can suspend or terminate. A transition agreement, escrow of critical materials, documented architecture, current licences, vendor portability and a tested business-continuity plan can preserve service and receivable value. RBI's IT outsourcing directions specifically require regulated entities to maintain exit strategies and continuity arrangements with service providers.[8]

15. Establish an evidence-led diligence and governance cycle

Initial diligence should reconcile the statutory accounts, management ledger, product systems, partner statements and bank receipts. Revenue samples should trace from contract and service event to invoice, tax, collection and general ledger. Cohort samples should trace from application and decision through disbursement, scheduled payment, delinquency, write-off, recovery and any guarantee call.

Legal diligence should map the entity and regulatory perimeter for each activity. It should review material partner, customer, vendor, employment, intellectual-property, data, cloud, guarantee and funding arrangements. Regulator and partner correspondence should be included. The review should identify current permissions and implementation obligations based on applicable advice.

Technology diligence should examine architecture, access, change management, model governance, data lineage, availability, incident response, vendor concentration, disaster recovery and audit findings. A successful penetration test covers a defined scope and date. It should be combined with operational and governance evidence.

Model diligence should document input data, objective, development, approval, validation, monitoring, overrides, bias testing, drift and change control. RBI's 2024 draft principles identified governance, development, deployment and validation as core model-risk themes; the Reserve Bank's June 2026 materials show model-risk guidance remained an active policy area.[11][12] The transaction should use the current final or applicable requirements confirmed by counsel and the regulated partners.

The borrower should maintain a monthly credit pack. It can include eligible revenue, partner concentration, billing and collection, unrestricted liquidity, use of proceeds, cohort performance, guarantee utilisation, complaints, uptime, incidents, audits, regulatory changes and milestone status. Numbers should reconcile to source systems and the general ledger.

Governance should assign accountable owners. Finance owns revenue and liquidity reconciliation. Risk owns cohort and guarantee reporting. Compliance owns regulatory dependencies and notices. Technology owns resilience and control remediation. The board receives exceptions and approves material changes. The lender receives the agreed pack and timely event notices.

Industry governance can also draw on the RBI's 2024 framework for FinTech self-regulatory organisations, whose finalisation is recorded in the 2024-25 Annual Report.[15] RBI recognised the Fintech Association for Consumer Empowerment as an SRO-FT in August 2024.[18] Membership or industry standards can support evidence within transaction diligence and the continuing responsibilities of regulated partners.

Independent verification can increase with risk. A standard quarter can use management certification and agreed data extracts. An amber trigger can require a lender adviser or auditor to test the relevant measure. A red or regulatory event can require an independent investigation, remediation plan and closure evidence. Scope and cost should be proportionate and defined in the documents.

16. Apply the framework within its limits

The proposed framework is an underwriting method. It does not establish a universal debt capacity for Indian FinTech companies. Products, counterparties, entities, contracts, customer groups, data, technology, licences and portfolio risks differ materially. Current legal and regulatory advice is required for the actual perimeter.

The illustrative numbers demonstrate mechanics. They were selected to show how reported revenue can contract after eligibility tests and how later drawings can depend on improvement. They do not estimate sector averages, expected returns, default rates or market pricing. The cohort curves end after twelve months and cannot describe lifetime loss for longer products.

Revenue eligibility uses judgement. A long contract can have weak minimums. A short contract can renew reliably. Historical collections can change after a partner alters appetite. Software revenue can depend on one regulated customer. The lender should retain transparent definitions, evidence, concentration limits and periodic recalibration.

Regulation can change and different interpretations can apply. The Digital Personal Data Protection Rules have staged commencement, and product-specific obligations can come from several regulators and contracts.[5][6] A regulatory dependency should remain linked to dated evidence and responsible advice. Forecast permissions and unsigned partner arrangements should remain outside initial repayment capacity.

The central credit conclusion is practical. Growth debt can fund an Indian FinTech when repayment rests on executed contracts, delivered services, collected cash, controlled liquidity and monitored portfolio outcomes. Prospective licences, products and partners can enter availability after their milestones are evidenced. This sequence allows capital to follow operating proof.

The framework brings five decisions into one system. The revenue-quality bridge defines what cash is eligible. The dependency map identifies what can interrupt it. The cohort curve captures credit transmission. The draw schedule releases capital after evidence matures. The covenant dashboard gives management and lenders a common response protocol.

Appendix A. Illustrative Model Assumptions

Purpose and perimeter

The worked example describes a hypothetical Indian FinTech group that provides software, origination, servicing, distribution and limited credit-support services to regulated partners. It does not identify a company, portfolio, offer or financing. All assumptions require replacement with verified transaction evidence.

Illustrative financial assumptions

1. Annual reported revenue is INR 240 crore. 2. Pass-through, disputed and otherwise ineligible revenue is INR 24 crore. 3. Stream-specific durability and concentration haircuts total INR 60 crore. 4. Eligible recurring revenue is INR 156 crore. 5. The operating-liquidity minimum is the greater of INR 45 crore and nine months of defined base cash expenditure. 6. The committed facility is INR 90 crore across four availability stages. 7. The most recent illustrative cohort reaches 5.2 per cent cumulative net loss at month twelve. 8. The illustrative draw-stop threshold is 4.5 per cent at month twelve. 9. The illustrative largest-partner threshold is thirty-five per cent of eligible revenue. 10. The illustrative DLG draw-stop threshold is sixty per cent utilisation of available cover.

Scenario limitations

The model omits transaction-specific interest, amortisation, tax, foreign exchange, legal, security, accounting and regulatory determinations. It also omits product-level lifetime loss beyond the displayed period, macroeconomic forecasts and management's detailed equity plan. An actual model should include monthly cash, partner contracts, verified portfolio tapes, current rules, sensitivity ranges and formal credit terms.

Appendix B. Credit Committee Checklist

Revenue and cash

1. Can every material revenue stream be traced from executed contract to delivered service, invoice, tax and bank receipt? 2. Which revenue is recurring, usage-based, origination-linked, servicing-linked, distribution-linked or credit-linked? 3. Which amounts are pass-through, disputed, related-party, non-cash or outside the security group? 4. What happens to revenue and liquidity if the largest partner reduces volume or terminates a product? 5. Does eligible revenue convert to unrestricted cash before debt service?

Regulation, data and technology

6. Which regulated entity is accountable for each lending product and digital lending app? 7. Are role, disclosure, fund-flow, complaint, data and reporting obligations evidenced? 8. Which DPDP requirements are in force, pending and funded for implementation? 9. Are material technology, outsourcing, resilience and audit findings closed or fully reserved? 10. Can services continue or transition lawfully after a major vendor, partner or borrower event?

Portfolio and credit support

11. Are cohort definitions, delinquency, write-off, recovery and guarantee data consistent and reconciled? 12. Have recent cohorts seasoned sufficiently for the proposed draw? 13. What cash, collateral and partner effects arise under the default loss guarantee agreements? 14. Are guarantee fees tested against expected and stressed cash calls?

Facility and governance

15. Does each draw depend on objective evidence within management's control? 16. Are liquidity, revenue, concentration, cohort and event covenants defined from source systems? 17. Do cure rights address the actual cause of a breach? 18. Are use of proceeds, mandatory investment and distributions ordered correctly? 19. Can the facility repay from existing contracted cash without relying on refinancing or an equity exit? 20. Are board, management, lender and independent-review responsibilities documented?

References

1. National Payments Corporation of India, Unified Payments Interface Product Statistics, May 2026. https://www.npci.org.in/product/upi/product-statistics
2. Reserve Bank of India, Reserve Bank of India (Digital Lending) Directions, 2025, RBI/2025-26/36, 8 May 2025. https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12848&Mode=0
3. Reserve Bank of India, Reserve Bank of India (Co-Lending Arrangements) Directions, 2025, RBI/DOR/2025-26/139, 6 August 2025. https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12888&Mode=0
4. Reserve Bank of India, Key Facts Statement for Loans and Advances, RBI/2024-25/18, 15 April 2024. https://rbi.org.in/Scripts/NotificationUser.aspx?Id=12663&Mode=0
5. Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025, Gazette Notification G.S.R. 846(E), 13 November 2025. https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf
6. Ministry of Electronics and Information Technology, Commencement Notification under the Digital Personal Data Protection Act, 2023, G.S.R. 843(E), 13 November 2025. https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf
7. Ministry of Corporate Affairs, Indian Accounting Standard 115, Revenue from Contracts with Customers. https://www.mca.gov.in/Ministry/pdf/INDAS115.pdf
8. Reserve Bank of India, Reserve Bank of India (Outsourcing of Information Technology Services) Directions, 2023, 10 April 2023. https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12486
9. Reserve Bank of India, Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023, 7 November 2023. https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12562
10. Ministry of Corporate Affairs, Indian Accounting Standard 109, Financial Instruments. https://www.mca.gov.in/Ministry/pdf/IndAS109_2020_10112020.pdf
11. Reserve Bank of India, Draft Circular on Regulatory Principles for Management of Model Risks in Credit, 5 August 2024. https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=58432
12. Reserve Bank of India, Reserve Bank of India Bulletin, June 2026. https://bulletin.rbi.org.in/
13. Reserve Bank of India, Master Direction: Know Your Customer Direction, 2016, updated 14 August 2025. https://old.rbi.org.in/commonman/English/Scripts/MasterDirection.aspx
14. Reserve Bank of India, Master Direction: Non-Banking Financial Company Scale Based Regulation Directions, 2023, updated 17 July 2025. https://rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12550
15. Reserve Bank of India, Annual Report 2024-25, Regulation, Supervision and Financial Inclusion. https://www.rbi.org.in/scripts/AnnualReportPublications.aspx?Id=1436
16. Reserve Bank of India, Financial Stability Report, June 2026. https://rbidocs.rbi.org.in/rdocs/PublicationReport/Pdfs/0FSRJUNE2026_300626A120EF6C37694C8C933181147F1379D7.PDF
17. Press Information Bureau, Digital Lending Ecosystem and RBI Digital Lending App Directory, 8 December 2025. https://www.pib.gov.in/PressReleasePage.aspx?PRID=2200567&lang=1&reg=3
18. Reserve Bank of India, Recognition of Fintech Association for Consumer Empowerment as a Self-Regulatory Organisation in the FinTech Sector, 28 August 2024. https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=58586
19. Securities and Exchange Board of India, Alternative Investment Funds Regulations, 2012, amended 14 July 2026. https://www.sebi.gov.in/legal/regulations/jul-2026/securities-and-exchange-board-of-india-alternative-investment-funds-regulations-2012-last-amended-on-july-14-2026-_102975.html
20. Securities and Exchange Board of India, Master Circular for Alternative Investment Funds, 3 June 2026. https://www.sebi.gov.in/legal/master-circulars/jun-2026/master-circular-for-alternative-investment-funds-aifs-_101817.html