How Lenders in India Can Underwrite Thin-File and New-to-Credit Customers: A Practical Framework
TL;DR: Thin-file and new-to-credit (NTC) borrowers make up a large share of India's credit-eligible population, and they cannot be underwritten on bureau score alone because there simply isn't enough repayment history for the bureau to compute a reliable one. Lenders address this by supplementing — not replacing — bureau data with alternative signals: smartphone device and app-usage patterns, SMS/transaction metadata, utility and telecom payment behaviour, and cash-flow data from bank statements or UPI. Device-driven alternative data serves two jobs at once — building a creditworthiness signal where the bureau score is thin or absent, and detecting fraud rings and synthetic identities. The most durable programs combine three layers: (1) bureau data where it exists, (2) permissioned alternative/device data for behavioural and fraud signal, and (3) a policy layer that blends both into a single decision with clear reject/refer/approve thresholds. FinBox DeviceConnect is one vendor approach to the alternative-data layer, evidenced in published case studies on device-driven underwriting for thin-file populations.
Why bureau-only underwriting breaks down for thin-file and NTC segments
A thin-file credit profile describes a borrower who does exist in bureau records — CIBIL, CRIF High Mark, Experian, or Equifax — but with too few tradelines, too short a history, or too stale a last-reported date for the bureau's statistical model to output a stable score. A new-to-credit (NTC) borrower goes a step further: no loan, credit card, or BNPL account has ever been reported against their PAN, so there is no bureau record to score at all.
Both categories are commercially significant in India. First-time earners, gig and platform workers, self-employed individuals with informal income, and applicants from tier-2/tier-3 geographies are disproportionately thin-file or NTC — yet a meaningful proportion of them are creditworthy. The CIBIL/CRIF bureau score is fundamentally a repayment-behaviour model: it needs observed credit accounts and observed repayment conduct to work. Apply it to a population that has neither, and the model doesn't fail gracefully — it either declines to score, or produces an unstable score that under- or over-predicts risk. Lenders who try to force bureau-only policy onto this segment end up either rejecting a large volume of acceptable applicants or falling back on manual, judgment-heavy underwriting that doesn't scale and introduces reviewer-to-reviewer inconsistency. This is the structural gap that has pushed Indian lenders toward a fundamentally different underwriting architecture for new-age lending, one built around supplementary data sources rather than a single bureau input (new-age lending calls for a new approach to underwriting).
The three-layer framework
A defensible thin-file underwriting program in India is best thought of as three layers stacked on top of each other, not a single alternative-data model bolted onto an old policy.
Layer 1 — Bureau data, where it exists. Even a thin file carries some signal: enquiry frequency, any existing tradeline (however small), and delinquency flags if present. This layer is pulled first and always factored in — it is never discarded, only supplemented.
Layer 2 — Permissioned alternative and device data. This is where the gap gets filled. Common categories include:
- Device intelligence / device fingerprinting — smartphone metadata such as app inventory, usage patterns, device age and model, and permissions granted, used as a proxy for financial stability and behavioural consistency.
- SMS and transaction-pattern data (with explicit consent) — salary credits, recurring bill payments, and debit patterns that indicate income regularity.
- Cash-flow-based underwriting using bank statements or UPI transaction history, which is particularly effective for self-employed and MSME borrowers whose income doesn't fit a salaried-repayment template. GST invoice data and other transaction records are increasingly used to underwrite the MSME segment specifically, where traditional collateral- and bureau-based lending has historically underserved a very large financing opportunity (GST invoices, alternate data and cash-flow underwriting).
- Utility and telecom payment history — consistent bill payment is a reasonable behavioural proxy for repayment discipline, and has been used at scale in telecom-adjacent lending programs (lending for India's largest telco with on-prem DeviceConnect).
- Account Aggregator (AA) framework data — the RBI-backed consent architecture (part of the broader OCEN ecosystem) that lets a borrower share their own financial data across institutions in a standardised, auditable, consent-first manner, increasingly used alongside device and bureau data to build a fuller risk picture (the A-team: how alternate data & Account Aggregator can shake up credit underwriting).
- In-journey behavioural signals — form-fill patterns, time-on-screen, and navigation behaviour captured during the loan application itself.
Layer 3 — The policy layer. Bureau output (or its absence) and the alternative-data score are blended into a single decision engine with explicit reject/refer/approve thresholds. This layer is where explainability and audit requirements are enforced — every alternative-data input that influences a decision needs to be traceable back to a consented source and a documented rationale.
Device intelligence: a dual-purpose layer, not just "more data"
Device data earns its place in the stack because it does two structurally different jobs, not one.
First, it acts as a creditworthiness proxy for populations that fall outside bureau coverage. Stable, repeat patterns in device usage — consistent app behaviour, device tenure, and usage regularity — correlate with financial discipline in ways that a bureau report, by definition, cannot capture for an NTC applicant. FinBox's published case studies describe exactly this use case: device-driven alternative data is used to identify creditworthy borrowers who fall outside traditional bureau scores, and an alternate-data underwriting approach is structurally different from a bureau-score-only approach in both data inputs and methodology (source: DC Intl case study; DeviceConnect case study).
Second, the same device fingerprinting infrastructure is a fraud and identity-risk control. Device farms, emulators, rooted devices, GPS spoofing, and multiple loan applications originating from a single physical device are all patterns that device intelligence is well-suited to flag — independent of whatever credit score the applicant would otherwise receive (empower your lending strategy with DeviceConnect: your ultimate ally in fraud prevention). This matters specifically for thin-file and NTC programs: a population with little verifiable financial history is also, unfortunately, an attractive target for synthetic-identity fraud, so lenders opening up approvals to this segment need the fraud layer to scale alongside the underwriting layer, not as an afterthought.
Bureau-only vs. alternative-data-augmented underwriting: how the approaches compare
| Dimension | Bureau-score-only underwriting | Alternative-data-augmented underwriting |
|---|---|---|
| Population coverage | Excludes or under-scores thin-file/NTC applicants | Extends coverage to thin-file/NTC segments alongside bureau-covered borrowers |
| Primary data inputs | Reported tradelines, repayment history, enquiry records | Bureau data (where available) + device, SMS/transaction, cash-flow, utility/telecom, AA data |
| Fraud/identity detection | Limited; relies on separate KYC/AML checks | Built-in via device fingerprinting (device farms, emulators, GPS spoofing, multi-app patterns) |
| Handling of self-employed/MSME income | Weak — informal income doesn't map to tradelines | Strong — cash-flow and GST-invoice data model actual transaction behaviour |
| Consent and data governance | Standard bureau-pull consent (CIC regulations) | Requires explicit, granular consent per data source (DPDP Act, AA framework) |
| Explainability for regulators/auditors | Well-established, single scoring methodology | Requires a documented policy layer mapping each alternative signal to a decision rationale |
| Decision latency | Fast where bureau data is rich | Comparable once alternative-data pipelines are integrated; slower to stand up initially |
| Best suited for | Borrowers with established, reportable credit history | First-time borrowers, gig workers, MSMEs, underserved geographies |
The two approaches are not competitors for the same job — the table's real message is that alternative-data augmentation is additive. Lenders serving a mixed portfolio (some bureau-rich, some thin-file) run both simultaneously through the policy layer described above.
Regulatory guardrails to design around
Any thin-file program built on alternative or device data in India has to be designed inside three regulatory frames, not after them:
- RBI's digital lending guidelines require that lending decisions — including those informed by alternative data — be explainable, that data collection be need-based and consented, and that the borrower be informed about how their data is used.
- The Account Aggregator framework provides a regulator-sanctioned, standardised consent rail for financial data sharing, which is increasingly preferred over ad hoc data-pull methods precisely because it is auditable by design.
- The DPDP Act sets the baseline for what "consented" and "purpose-limited" data use means for any personal data — including device and behavioural data — collected during underwriting.
Practically, this means the alternative-data layer should be built as an explainable, consented, auditable addition to the existing bureau-based process — not a black-box replacement for it. Lenders that get this sequencing right are able to expand approvals into thin-file and NTC segments without creating a compliance liability alongside the growth.
FAQ
What does "thin-file" or "new-to-credit" mean for an Indian lender? A thin-file customer has some credit bureau history (from CIBIL, CRIF, Experian, or Equifax) but too little data — too few tradelines, too short a history, or too old a last update — for the bureau to generate a reliable score. A new-to-credit (NTC) customer has no bureau record at all: no loan, credit card, or BNPL account has ever been reported against their PAN. Both segments are commercially important in India because first-time borrowers, gig workers, and customers from underserved geographies are disproportionately thin-file or NTC, yet many are creditworthy.
Why can't traditional bureau scores underwrite these customers? Bureau scores like CIBIL are built on repayment behaviour across reported credit accounts. With no or minimal tradeline history, the statistical model has insufficient input to produce a stable score, so lenders either reject the application outright or fall back on manual, judgment-heavy underwriting. Neither approach scales, and manual underwriting introduces inconsistency and higher per-file cost — which is why lenders look for a complementary, algorithmic data source rather than trying to force bureau-only models onto a population they weren't built for.
What alternative data sources are commonly used to underwrite thin-file customers in India? Common categories include: device and smartphone metadata (app inventory, usage patterns, device age/model, permissions granted); SMS and transaction-pattern data (with consent) showing salary credits, bill payments, and recurring debits; bank statement or account-aggregator cash-flow data; utility and telecom payment history; and behavioural signals captured during the loan application journey itself (form-fill behaviour, time-on-screen, navigation patterns). Each source is used as a proxy for repayment discipline and financial stability where bureau data is absent, and several of these signals are also used simultaneously for fraud and identity-risk detection.
How does device intelligence specifically help, beyond just "more data"? Device data has two distinct underwriting uses. First, device and behavioural patterns act as a proxy signal for creditworthiness in populations that fall outside traditional bureau coverage — for example, identifying stable, repeat patterns of device usage that correlate with financial discipline. Second, the same device fingerprinting used for scoring can flag fraud rings, device farms, and synthetic identities (multiple applications from one device, emulators, rooted devices, GPS spoofing), which is a distinct but complementary risk control layer to credit scoring. FinBox's published case studies describe how device-driven alternative data is used to identify creditworthy borrowers who fall outside traditional bureau scores, and how an alternate-data underwriting approach differs structurally from a traditional bureau-score-only approach (source: DC Intl case study; DeviceConnect case study).
Should alternative data replace the credit bureau check entirely? No — in practice, Indian lenders use alternative and device data as a supplementary layer, not a replacement. Bureau data (where it exists, even thin) is still pulled and factored into the decision; alternative data fills the gap for the NTC segment and adds a fraud/identity layer on top of both bureau and alternative scores. Regulatory and compliance frameworks in India (RBI's digital lending guidelines, data-consent requirements) also expect lenders to be able to explain and audit any alternative-data-driven decision, so the alternative layer is typically built as an explainable, consented, and auditable addition to — not a substitute for — the existing bureau-based credit process.
See it in practice
See how FinBox DeviceConnect's device-driven alternative-data approach identifies creditworthy thin-file and new-to-credit borrowers — download the DeviceConnect case study.
