Managed IT support · Fintech, NBFCs and loan DSAs
Managed IT Support for NBFCs, Fintech Companies and Loan DSAs
Web Your Vyavsay runs IT for NBFCs, digital lending startups and loan DSAs in India: a helpdesk for staff, on-site support in Ahmedabad and Gujarat, and day-to-day operation of servers, cloud accounts, backups and security. For lenders the work centres on what regulators and attackers now focus on: multi-factor login on every admin and API account, payment API credentials kept out of code, 180 days of logs, and staff laptops that still receive security updates.
By Web Your Vyavsay team · Published
Drafted with AI assistance. Claims are checked against the sources listed below and reviewed by our team.
What is changing for fintech, nbfcs and loan dsas IT right now
- 1
CERT-In flagged payment API abuse at lenders (9 October 2026)
Advisory CIAD-2026-0046, rated critical, describes attackers using stolen payment-gateway and partner-bank API credentials to push disbursals that bypass application checks. Its recommendations include multi-factor authentication on payment and admin portals, an inventory of every API, short-lived tokens instead of static keys, a second approver for fund movements and centrally kept logs for at least 180 days.
- 2
Six hours to report an incident, 180 days of logs
Under CERT-In’s directions of 28 April 2022, listed cyber incidents must be reported within six hours of noticing them, and logs of ICT systems must be kept for a rolling 180 days within India. A lender that cannot pull its logs cannot meet either rule.
- 3
RBI rewrote NBFC outsourcing rules (28 November 2025)
The RBI’s Managing Risks in Outsourcing Directions, 2025 replaced the earlier outsourcing instructions for NBFCs. The IT outsourcing chapter applies to NBFCs in the Middle Layer and above; Base Layer NBFCs are outside that chapter. DSAs are not NBFCs, but the lender they work for stays responsible for the data they handle.
- 4
Borrower data must stay in India
The RBI’s Digital Lending Directions, 2025 require borrower data to be stored on servers in India. Spreadsheets of borrower details on personal drives and chat apps are the usual gap.
- 5
Personal data duties are phasing in
The DPDP Rules were notified in November 2025 with an 18-month phase-in, so most duties, including reasonable security safeguards and breach notice, apply from May 2027. The Act allows penalties of up to ₹250 crore for failing to keep personal data secure. This is a summary, not legal advice.
What this looks like in practice
Client story, anonymised
A loan DSA matching loan account numbers by hand
A loan distribution agency had a monthly sheet of disbursed cases with the loan account number (LAN) column partly empty. Staff filled the gaps by searching the bank’s master dump one row at a time.
We wrote a matching tool that fills each missing LAN by comparing the agency’s rows against the bank dump on customer or company name, loan amount, bank, product, location and month, and flags the rows it cannot match with confidence for a person to check.
The same work showed where the agency’s IT risk sat: borrower data moving between personal laptops as spreadsheet attachments. That is the part a managed IT engagement fixes, with shared storage, access by role and laptops that are patched and backed up.
Based on a real project. The client’s name is withheld.
Illustrative scenario
A 25-person digital lender in the week CIAD-2026-0046 lands
The founders read the CERT-In advisory and realise nobody knows how many API keys exist for their payment gateway and partner banks, or who can see them. Three of the keys sit in a configuration file in the code repository.
In the first week we list every API and admin account, switch on multi-factor login, move keys into a secrets vault and rotate them, add a second approver for disbursals above a set limit, and start shipping logs to central storage kept for 180 days. Laptops still on Windows 10, which stopped receiving free security updates on 14 October 2025, go on an upgrade plan.
After that the helpdesk handles new joiners, leavers and lost devices, and a monthly review checks that keys, access and backups still match the plan.
A composite example of how we would work. Not a specific client or result.
What we take over, and in what order
- 1
Inventory
Every laptop, account, API key, server, cloud project and spreadsheet that holds borrower data.
- 2
Lock down access
Multi-factor login on email, admin panels, payment and bank portals; remove shared and former-staff accounts.
- 3
Secrets and logs
Move API keys into a vault, rotate them, and keep logs centrally for at least 180 days.
- 4
Devices and backups
Patch or replace unsupported systems, encrypt laptops, and test that backups actually restore.
- 5
Run it
Helpdesk for staff, joiner and leaver checklists, and a monthly report on access, patches and backups.
The full scope, response model and what is not included are on the managed IT support page.
Software we have built in this industry
Loan Marketplace & Lead Platform
Advision Loans
Before: Generic pages that do not separate secured and unsecured loan intent
Loan discovery to qualified enquiry in a few steps
Read the Advision Loans case studyPayment Gateway Admin Platform
Fydus Pay
Before: Transaction lists reviewed manually with no filters by merchant, order, transaction ID or bank
One secure portal for payment operations
Read the Fydus Pay case study
Frequently asked questions
What IT security rules apply to NBFCs in India?
CERT-In’s 2022 directions apply to all companies: report listed cyber incidents within six hours and keep ICT logs for 180 days in India. The RBI’s Managing Risks in Outsourcing Directions, 2025 add IT outsourcing duties for NBFCs in the Middle Layer and above, and the Digital Lending Directions, 2025 require borrower data to be stored in India.
Can a Base Layer NBFC or a loan DSA outsource its IT?
Yes. The IT outsourcing chapter of the RBI’s 2025 outsourcing directions applies to Middle Layer NBFCs and above, so Base Layer NBFCs are outside it, and DSAs are not NBFCs at all. Both still fall under CERT-In’s directions and, from May 2027, most DPDP duties.
What should a lender do about CERT-In advisory CIAD-2026-0046?
List every payment and banking API and who holds its credentials, turn on multi-factor login for admin and payment portals, replace static keys with short-lived ones kept in a vault, require a second approver for fund movements, and keep logs centrally for at least 180 days.
Do you certify that we are RBI compliant?
No. We run and secure your IT so the technical controls regulators ask for are in place and evidenced. Compliance sign-off belongs to your compliance officer and auditors.
Can you build lending software as well as run IT?
Yes. We have built a loan marketplace with a telecalling CRM and a payment gateway admin portal. Software work is a separate engagement from managed IT support. See the outsourced tech department
Sources
- CERT-In advisory CIAD-2026-0046: payment and disbursement API abuse in BFSI entities (9 October 2026)
- CERT-In: Directions under section 70B(6) of the IT Act, 28 April 2022 (6-hour reporting, 180-day logs)
- RBI: Non-Banking Financial Companies – Managing Risks in Outsourcing Directions, 2025 (28 November 2025)
- S.S. Rana & Co.: RBI Digital Lending Directions, 2025 explained
- Press Information Bureau: DPDP Rules, 2025 notified (17 November 2025)
- Microsoft Lifecycle: Windows 10 Home and Pro (end of support 14 October 2025)