Finance & insuranceFlagship industry
Every screen is a disclosure, and every message is on the record.
Banks, lenders, insurers, wealth and payments businesses, where the customer meets the regulator on every screen. We design journeys with the disclosures built in, CRMs that know what happened last, and secure platforms that leave an audit trail.
Where the rules biteMap of all forty-one industries
What is shifting
Onboarding, lending and service now happen on a phone screen, under directions that say what the screen must show. Each shift names what it demands, and a fact that shows it.
It demandsA digital identity that still reads as secure and regulated.
SignalRBI treats video KYC (V-CIP) as equal to in-person KYC when its controls are followed.
It demandsJourneys where required disclosures are designed in, not bolted on.
SignalA Key Fact Statement with the all-in APR must reach the borrower before the contract is signed.
It demandsA CRM that knows what happened last, so every message is relevant and consented.
SignalCustomers can share their financial data with any regulated lender through a revocable Account Aggregator consent.
It demandsAI with an owner, an evaluation set and a path for incidents.
SignalRBI’s FREE-AI committee (August 2025) recommends a board-approved AI policy for every regulated entity.
The rulebook
RBI, SEBI and IRDAI directions, the payment and security standards and the data law, read for a typical programme. Your compliance team keeps sign-off; every disclosure screen we design is logged for their review.
Frameworks we build to
Frameworks we design and build to — not a claim of certification.
Often shapes the work
Securities and Exchange Board of India
Regulated entities may not associate with unregistered advisers or with anyone claiming returns without permission; advertising may not promise assured returns.
We designCreator and content programmes are screened for registration and for return claims before they run.
SEBI · Intermediaries and other amendment regulations, 29 August 2024
Insurance Regulatory and Development Authority of India
Insurance advertising must be fair and not misleading; the 2021 advertisement regulations were folded into the 2024 framework and its master circulars.
We designInsurance messaging is checked against the policy wording it describes.
IRDAI (Protection of Policyholders’ Interests …) Regulations, 2024
Shapes most of the work
Reserve Bank of India
Key Fact Statement with the all-in APR before the contract, a cooling-off period to exit without penalty, and disclosure of every lending service provider and app.
We designThe KFS is a designed, logged screen shown before consent — never a PDF behind a link.
RBI · Digital Lending Directions, 8 May 2025, as consolidated in the November 2025 Master Directions Official text: RBI Digital Lending Directions
Reserve Bank of India
Video-based customer identification (V-CIP) counts as in-person KYC when its controls hold: a live official, liveness checks, geo-tagging, recordings stored in India and an audit trail.
We designV-CIP journeys are designed with slot booking, retry paths and an assisted fallback.
RBI · KYC Directions, 2025 (successor to the 2016 Master Direction)
Shapes most of the work
Reserve Bank of India
From 1 April 2026, domestic digital payments need at least two factors of authentication, one of them dynamic, with risk-based checks encouraged.
We designStep-up authentication is designed for the risky moment, not for every tap.
RBI · Authentication Mechanisms for Digital Payment Transactions Directions, 25 September 2025
PCI Security Standards Council
Card-data security standard; since 31 March 2025 every script on a payment page must be inventoried and authorised (6.4.3) and changes to the page detected (11.6.1).
We designPayment pages ship with a script inventory and change detection from day one.
PCI SSC · PCI DSS v4.0.1, June 2024 Official text: PCI DSS v4.0.1
Shapes most of the work
MeitY · Reserve Bank of India
Consent for each purpose with easy withdrawal; financial data moves between institutions only under a granular, revocable consent artefact.
We designConsent and data-sharing screens are designed to the consent artefact, and every grant is logged.
DPDP Rules, 2025 (core obligations from 13 May 2027) · RBI NBFC – Account Aggregator Directions
Shapes most of the work
Indian Computer Emergency Response Team
Report cyber incidents within six hours of noticing them, and keep logs of every ICT system for a rolling 180 days, within India.
We designLogging and incident runbooks are built into the platform, not added after launch.
CERT-In · Directions under section 70B(6), 28 April 2022 Official text: CERT-In Directions, 2022
Often shapes the work
Reserve Bank of India
A committee report, not yet binding: seven principles and 26 recommendations, including a board-approved AI policy, consumer protection and AI incident reporting.
We designEvery AI feature ships with an owner, an evaluation set and an incident path.
RBI · FREE-AI Committee Report, 13 August 2025
Compiled 2 October 2026. Our reading of typical programmes, not legal advice. Rules change; your counsel confirms how each one applies to you.
Challenges
What borrowers and policyholders need before they sign, and what your teams must be able to prove afterwards.
Borrowers need the cost, the term and the way out before they sign.
Customers judge security by the first screen and by every message after it.
The app, the branch and the call centre should all know what happened last.
What we build
Journeys, the customer record and the secure platform beneath them carry most of a financial-services programme. Every line links to the capability that does the work.
Secure web and app builds, payment integration and audit-ready infrastructure.
Onboarding, KYC and lending journeys designed around required disclosures.
CRM rebuilt around the customer journey, with consent and suppression built in.
A brand that signals safety and clarity at the size of an app icon.
Compliance-reviewed campaigns, and creator programmes that never promise returns.
Service assistants that cite the policy they answer from and hand off to people.
Programmes
The way in walks every onboarding and lending journey against the directions that apply and ranks the fixes by drop-off and by risk. Lengths are typical, never promised.
The way in
We walk every onboarding and lending journey against the RBI directions that apply, then rank the fixes by drop-off and by risk.
What it hands over
02Milestone · 4–8 months
Application, PAN, video KYC and funding redesigned as one journey, tested with customers and integrated with your approved providers.
MovesOnboarding completion rate
Services: End-to-end UX & UI design · Web or mobile app · User research & usability testing
Enquire about Digital onboarding and video-KYC journey03Project · 8–12 weeks
The Key Fact Statement, the all-in APR and the cooling-off period designed as screens customers read, with every view logged.
MovesDrop-off at each disclosure step
Services: End-to-end UX & UI design · UX writing & content design
Enquire about Lending journey with KFS and APR designed in04Milestone · 4–9 months
One customer record behind every message, with consent, suppression and the last event known before anything is sent.
MovesOpt-out and complaint rates
Services: Customer data & identity foundation · Lifecycle journey build · Customer journey mapping
Enquire about Journey-led CRM and lifecycle messaging05Retainer · Ongoing
Templates and approved modules that move compliance review from every asset to the system that makes them.
MovesCompliance review cycle time
Services: Campaign design system · Content production retainer
Enquire about Compliance-reviewed content and campaign systemHow success is measured
The number we moveOnboarding completion
AI, under the rules
Each use case has an owner, an evaluation set and an incident path, in line with RBI’s FREE-AI recommendations; a person approves what matters, and every answer is kept for the audit trail.
Use case 01
Measured byContained conversations, with the complaint rate held flat
Tested forOWASP LLM01 · Prompt injection
Ships only with its evaluation set, its guardrail and an owner
Use case 02
Measured byCompliance review cycle time
Tested forOWASP LLM06 · Excessive agency (it can block, never publish)
Ships only with its evaluation set, its guardrail and an owner
Use case 03
Measured byComplaints per thousand contacts
Tested forOWASP LLM09 · Misinformation
Ships only with its evaluation set, its guardrail and an owner
A deliverable, in working code
One hundred applicants through onboarding. Move how many clear each step and see where the largest drop goes and how many fund the account. Illustrative figures.
Of every hundred applicants who start
KFS v3 shown · consent logged · cooling-off date sent
Account funded52 of 100as illustrated
Largest dropVideo KYC (V-CIP)−21
What it shows
An illustrative onboarding funnel of one hundred applicants: 84 verify PAN, 63 finish video KYC, 58 accept the Key Fact Statement and 52 fund the account, with each disclosure logged. Change how many clear a step and the rest of the funnel recalculates.
Figures
Every number here is an illustration of how the deliverable reads, never a client result.
Work and insights
Financial-services projects, anonymised until each client approves the write-up, and what we have written on disclosures and consent.
All work in financial services
A CRM that knows what happened last
Make every customer message aware of the last thing that happened. Read the project
Onboarding with disclosures designed in
Get more applicants through KYC without hiding a single disclosure. Read the project
A typical programme · composite
A lender rebuilt its CRM around the customer journey, so every message knows what happened last and every disclosure is logged.
Anonymised and illustrative: the shape a programme takes, never a named client.
Questions
Something else on your mind? Ask us directly
We design and build the customer-facing journeys, the CRM and the integration layer. Core banking and loan management stay on your licensed platforms.
We design the journey and its screens and integrate the KYC and V-CIP providers you have approved. Recordings and data stay where the RBI directions require.
Yes, inside guardrails: it cites its sources, it hands complaints and hardship to people, and every use has an owner, an evaluation set and an incident path — in line with RBI’s FREE-AI recommendations.
Your compliance team keeps sign-off. We design to the directions, keep a record of every disclosure screen and make their review faster.
Keep exploring
Tell us what you’re building. We’ll answer straight.
01About 2 minutes
You get A reply from a lead, not a sales queue
02About 8 minutesMost useful
You get Options and a first scope after one call
03About 15 minutes
You get Receipt confirmed and a named bid lead
Every engagement starts with a written scope and a quote agreed before work begins. How each package is priced
