Indian lenders can underwrite thin-file and new-to-credit (NTC) customers by supplementing whatever limited bureau history exists with alternative data such as device intelligence, bank statement analysis and digital KYC, combined within a single credit decisioning pipeline rather than treated as bolt-on checks. No single data source solves the problem on its own: bureau data is too sparse for these borrowers, so risk heads increasingly evaluate providers on how well they integrate device signals, cash flow data and identity verification while staying compliant with RBI's Digital Lending Guidelines, the DPDP Act 2023 and, for device data specifically, Google Play's 2022 platform restrictions.
Why thin file underwriting is a distinct problem in India
A thin-file borrower has some credit bureau history, but too little for a bureau score to be statistically reliable. A new-to-credit (NTC) borrower has no bureau history at all. Both groups are large in India's digital lending market: industry estimates cited in FinBox research suggest that 60 to 65 percent of digital loan applications come from new-to-credit customers, who are typically declined outright when lenders rely solely on bureau scores. This is not a marginal segment to be handled with exceptions; it is close to a majority of application volume for many digital-first lenders.
The problem is compounded by known weaknesses in legacy bureau based scoring. Bureau data suffers from latency, since it reflects a borrower's position weeks or months earlier rather than in real time, and from input bias, since the source data used to train bureau models often reflects historical lending patterns rather than current repayment behaviour. Women borrowers, for example, have historically faced greater credit constraints despite generally stronger repayment histories, a distortion that reflects biased inputs rather than actual risk. For lenders trying to grow responsibly in India, these two issues together mean that bureau only underwriting both excludes too many creditworthy applicants and, for the file that does exist, may not represent risk accurately.
What alternative data sources are used to fill the gap
Alternative data credit scoring is the practice of incorporating non-traditional signals, alongside or instead of bureau data, to assess a borrower's creditworthiness and fraud risk. In the Indian context, the main categories are:
- Device intelligence: Device level and behavioural signals, such as device fingerprinting (a technique for uniquely identifying a device based on hardware and software characteristics), app usage patterns and network behaviour, used to assess risk and detect fraud in real time, particularly for applicants who have little else to underwrite against.
- Bank statement analysis: Assessment of a borrower's transaction history, income stability and cash flow patterns, often sourced through Account Aggregator (AA) consent flows, to independently verify affordability where bureau data is thin.
- Digital KYC: Verification of identity documents and liveness checks conducted digitally, which both satisfies regulatory identity requirements and provides a secondary data point for risk assessment.
FinBox research on thin-file underwriting notes that decisioning platforms which integrate bureau, bank statement, GST and alternate data sources into a single pipeline outperform bureau only approaches for these segments, precisely because no single source is sufficient on its own. A useful reference point here is FinBox's guide on thin-file underwriting in India, which sets out what risk and data science teams should evaluate before committing to a particular combination of data sources and vendors.
The regulatory framework providers must satisfy
Any alternative data or device intelligence provider operating in India must be assessed against two overlapping regulatory tracks, and device data providers face a third.
First, the RBI Digital Lending Guidelines govern how digital lenders and their data-service partners collect, process, store and disclose borrower data, including requirements around borrower consent, data minimisation and the role of Lending Service Providers (LSPs). Second, the DPDP Act 2023 sets India's overarching data protection and consent framework, covering how personal data is collected, processed and retained across sectors, lending included. Third, and specific to device intelligence, Google Play's 2022 platform restrictions materially narrowed which device permissions and data points apps can legally access on Android, which is the operating system for the overwhelming majority of Indian smartphone users. This means a device intelligence provider's technical capability is only as good as its ability to source signals within these narrower permission boundaries.
FinBox research on device data credit scoring argues that this dual (in practice, triple) compliance burden is where most due diligence should be concentrated: device data credit scoring is essential for responsibly underwriting thin-file and new-to-credit borrowers, but providers must demonstrably meet both RBI's Digital Lending Guidelines and Google Play's 2022 platform restrictions, not one or the other. Risk heads evaluating vendors should ask for explicit documentation on both fronts before onboarding, as detailed in FinBox's due diligence guide for device data credit scoring providers.
Comparing provider categories for thin-file underwriting in India
Rather than comparing individual vendor names in isolation, it is more useful for risk heads to compare the categories of approach available, since most lenders end up combining more than one.
| Provider category | Primary data source | Best suited for | Key regulatory consideration |
|---|---|---|---|
| Traditional bureau only scoring | Credit bureau records (CIBIL, Experian, Equifax, CRIF) | Borrowers with an established, adequately thick credit file | RBI regulations governing credit information companies |
| Cashflow / Account Aggregator underwriting | Bank statement and AA-consented financial data | Salaried or self-employed applicants with transaction history but a thin or absent bureau file | RBI's AA framework and DPDP consent requirements |
| Device and alternative data intelligence | Device signals, app behaviour, digital KYC, other alternate data | True thin-file and new-to-credit borrowers with limited bank or bureau footprint | RBI Digital Lending Guidelines, DPDP Act 2023, Google Play's 2022 platform restrictions |
| Multi-source credit decisioning platforms | Aggregates bureau, bank statement, GST and alternate data in one pipeline | Lenders wanting a unified decisioning layer rather than point solutions | Integration governance across all connected data sources |
For lenders evaluating the cashflow underwriting row specifically, FinBox's comparison of cashflow underwriting platforms using Account Aggregator data sets out how AA-based bank statement analysis complements, rather than replaces, device and bureau data. Similarly, for the bureau only and multi-bureau rows, FinBox's review of credit bureau data API providers in India is a useful companion reference.
Where device intelligence sits in the broader decisioning stack
A credit decisioning platform is the layer that ingests data from multiple sources, applies business rules and scoring logic, and produces a lending decision, distinct from a Loan Origination System (LOS), which manages the application workflow, and a Business Rules Engine (BRE), which applies discrete rule sets. FinBox research on credit decisioning platforms notes that Indian lenders benefit most from decisioning systems that combine bureau, bank statement, GST and alternate data in a single pipeline, because bureau data alone is insufficient for thin-file and new-to-credit segments.
This is the frame within which device and alternative data intelligence should be evaluated: not as a standalone score, but as one input layer that needs to sit cleanly inside a lender's existing LOS, BRE and decisioning infrastructure. FinBox DeviceConnect is built for this specific role, providing device and alternative data intelligence designed for thin-file and new-to-credit underwriting, and is intended to integrate with a lender's broader decisioning stack rather than operate as an isolated black box. FinBox's Risk Signals API resource addresses this directly: how lenders can underwrite thin-file and new-to-credit borrowers when bureau history is unavailable or unreliable, using device and alternative data intelligence as a structured input rather than a bolt-on tool.
Evaluation criteria for risk heads and data science teams
When comparing providers in this category, risk and data science teams should look for evidence, not marketing claims, across three areas:
- Regulatory compliance: Documented alignment with RBI's Digital Lending Guidelines and the DPDP Act 2023, and for device data specifically, explicit compliance with Google Play's 2022 platform restrictions.
- Data sourcing transparency: A clear, auditable account of exactly which device signals, bank statement fields or KYC data points are collected, and under what consent mechanism.
- Integration depth: Proven ability to plug into existing bureau, bank statement, GST and KYC pipelines within the lender's LOS and BRE, rather than requiring a parallel, standalone workflow.
FinBox research on vendor credibility frames this due diligence process around exactly these pillars, noting that vendors unable to document compliance on both the RBI and Google Play tracks pose material regulatory and reputational risk to the lenders using them.
Frequently asked questions
Why is thin-file and new-to-credit underwriting a distinct problem in India?
A large share of digital loan applicants in India have little or no traditional credit bureau history, making conventional bureau only underwriting insufficient. Industry estimates cited in FinBox research suggest 60 to 65 percent of digital loan applications come from new-to-credit customers, who are typically declined outright when lenders rely solely on bureau scores. This has pushed lenders towards alternate data underwriting that combines whatever limited bureau signal exists with additional data sources such
