Ninety days to an answer the RBI inspector will accept.
A mid-size NBFC holds thousands of loan files, hundreds of vendor and DSA agreements, and a policy manual that changes every quarter. When an inspector or an auditor asks "show me", the answer today takes days of searching. This blueprint shows how it takes under a minute, without a single customer record leaving your infrastructure.
Who this is for
Modelled on representative organisation profiles. Test these parameters against your internal numbers.
Size band
Teams
Systems
Regulator
Also in scope
The three documents and two processes
The 3 documents and 2 processes you already have. No new content has to be created to begin.
The 3 Core Document Sets
Loan files (KYC, sanction letter, agreement, security documents)
Searched by file number; a missing document is found at inspection, not before
Inspector and auditor questions start here
Vendor, DSA and collection-agency agreements
Scanned PDFs on a drive; renewal and penalty clauses known to one person
Outsourcing directions expect you to know your material vendors and their terms
Policy and circular library (credit policy, fair practices code, RBI circulars)
Versions in email; which version applied on a given date is a reconstruction
"Which policy was in force when this loan was sanctioned?"
The 2 Mission-Critical Processes
Pre-inspection file check
Three people, two weeks before every RBI or statutory audit
Nobody was hired for this
Vendor compliance evidence
Compliance officer chases 60–80 vendors for certificates and audit reports each year
Late or missing evidence is a finding
Days 1–90 in four stages
A phased, non-disruptive roadmap. Governed rules signed first, production live by week three, full autonomy by day 90.
- PHASE 01Days 1–15
Map and write the rules
Together we list where loan files, agreements and policies actually sit, which teams are already pasting them into public AI tools, and who may see what. The access, retention and approval rules (next section) are written as policy documents and signed by the compliance head. No software is installed yet.
Milestone: Signed rules & zero software footprint - PHASE 02Days 16–36
Open the door
Vectalk is deployed inside your infrastructure or your cloud account on the three document sets above. Three weeks from kickoff to production. From day 36, a compliance officer can ask "Which loan files sanctioned in FY 2025–26 above ₹50 lakh are missing a valuation report?" and get the list, each file with the page it was checked against.
Milestone: Vectalk deployed in private boundary - PHASE 03Days 37–60
Put the first worker on the pre-inspection check
A Neo Agent runs the file check every night: each loan file against the document checklist for its product, exceptions listed with the missing item and the responsible branch. The operations head approves the exception list each morning. Nothing is sent to a branch without that approval.
Milestone: First autonomous worker live with approvals - PHASE 04Days 61–90
Vendor evidence, and the audit trail as evidence
A second agent tracks vendor certificates and audit reports against each agreement's requirements and drafts the reminder emails; the compliance officer sends them. Every question asked and every agent action is logged. At day 90, that log is the compliance evidence for the board pack.
Milestone: Complete audit evidence & board report
The rules written first
The governance engine runs before the models. Rules are codified in software and signed off by responsible executives.
Access
ENFORCED RULEA branch user sees only their branch's files; credit sees sanction and security documents; collections sees repayment history but not KYC images; board members see summaries, never raw files
Masking
ENFORCED RULEPAN, Aadhaar numbers and bank account numbers are masked before retrieval for every role except the two named KYC officers
Retention
ENFORCED RULEDocuments keep the retention period in your record-retention policy; the AI stores no copy outside the deployment boundary
Residency
ENFORCED RULEDocuments, embeddings and answers stay on the servers you choose, in India
Approvals
ENFORCED RULENo agent sends anything to a branch, a vendor or a customer without a named approver; a material exception is a named approver, not a queue
What the board sees at day 90
Modelled, with the inputs beside each number. Replace with your own.
- BOARD DELIVERABLE 01
Inspection prep from two weeks to two days.
Inputthree people, ten working days each, before each of two inspections or audits a year. The nightly file check removes the search; the two days that remain are review and remediation.
- BOARD DELIVERABLE 02
Zero loan files with an unknown gap on inspection day.
Inputthe agent checks every file nightly against the product checklist; exceptions are visible from day 37, not from the inspector's visit.
- BOARD DELIVERABLE 03
Vendor evidence collected on a schedule, not in a panic.
Input70 material vendors; certificate and audit report dates tracked per agreement; reminders drafted 30 days before each falls due.
- BOARD DELIVERABLE 04
A compliance question answered in under a minute, with the source.
Inputthe three document sets; the answer carries the file name, page and clause.
- BOARD DELIVERABLE 05
An audit log the inspector can read.
EMPIRICAL BENCHMARKEvery question, who asked it, what they were allowed to see, what the agent did and who approved it.
Price band and what recurs
Transparent pricing with zero hidden seat taxes or foreign inference surcharges. Board-ready clarity.
Vectalk on the three document sets
Licence and usage, yearly
First Neo Agent (pre-inspection check)
Per quarter; second agent costs less because connectors and rules are already in place
One-time setup, data preparation, rule-writing workshop
Does not recur
Executive Transparency: Every quote is three lines — licence, usage credits, one-time setup — so the board sees what recurs and what does not.
FAQ
Straightforward answers to the compliance, security, and IT architecture questions boardrooms ask.
The directions set obligations on you as the regulated entity: due diligence, a contract with the right clauses, data location, audit rights. A deployment inside your own infrastructure or cloud account, with the vendor under your contract, is the shape those obligations expect. Your compliance team confirms the mapping; we provide the documentation.
No. Loan files, embeddings, prompts and answers stay on the servers you choose. There is no API call to a foreign AI provider in the deployment.
Open-source models we fine-tune and deploy for you, inside your boundary. You own the deployment.
The pilot includes OCR and language handling; files that cannot be read reliably are listed as exceptions for a human, not guessed at.
Yes. Many organisations start with one agent. The door and the workers share one platform, so adding the other is a configuration, not a project.
Similar shape, different documents: see the pharma manufacturing blueprint
Compare how this governed 90-day pilot architecture applies across adjacent operational models.
AI your board can say yes to.
Bring one question your compliance team cannot answer in a day.