Finance & insuranceFlagship industry
Every screen is a disclosure, and every message is on the record.
For banks, lenders, insurers, wealth and payments businesses, we design journeys with the disclosures built in. We also build CRMs that know each customer’s last interaction, and secure platforms that keep an audit trail.
Where the rules biteMap of all forty-one industries
What is shifting
Onboarding, lending and service now happen on a phone, under directions that specify what each screen must show. Each shift lists what it demands and a fact that shows it.
What it requiresA digital brand that still looks secure and regulated.
EvidenceRBI treats video KYC (V-CIP) as equal to in-person KYC when its controls are followed.
What it requiresJourneys with the required disclosures designed in from the start.
EvidenceA Key Fact Statement with the all-in APR must reach the borrower before the contract is signed.
What it requiresA CRM that knows each customer’s last interaction, so every message is relevant and consented.
EvidenceCustomers can share their financial data with any regulated lender through a revocable Account Aggregator consent.
What it requiresAI with an owner, an evaluation set and a path for incidents.
EvidenceRBI’s FREE-AI committee (August 2025) recommends a board-approved AI policy for every regulated entity.
The rulebook
RBI, SEBI and IRDAI directions, payment and security standards and data law, as they apply to a typical programme. Each rule shows what it requires and how our work responds.
Frameworks we build to
We design and build to these frameworks; this is not a claim of certification.
Often shapes the work
Securities and Exchange Board of India
Regulated entities may not associate with unregistered advisers or with anyone claiming returns without permission; advertising may not promise assured returns.
We designCreator and content programmes are screened for registration and for return claims before they run.
SEBI · Intermediaries and other amendment regulations, 29 August 2024
Insurance Regulatory and Development Authority of India
Insurance advertising must be fair and not misleading; the 2021 advertisement regulations were folded into the 2024 framework and its master circulars.
We designInsurance messaging is checked against the policy wording it describes.
IRDAI (Protection of Policyholders’ Interests …) Regulations, 2024
Shapes most of the work
Reserve Bank of India
Key Fact Statement with the all-in APR before the contract, a cooling-off period to exit without penalty, and disclosure of every lending service provider and app.
We designThe KFS is a designed, logged screen shown before consent, never a PDF behind a link.
RBI · Digital Lending Directions, 8 May 2025, as consolidated in the November 2025 Master Directions Official text: RBI Digital Lending Directions
Reserve Bank of India
Video-based customer identification (V-CIP) counts as in-person KYC when its controls hold: a live official, liveness checks, geo-tagging, recordings stored in India and an audit trail.
We designV-CIP journeys are designed with slot booking, retry paths and an assisted fallback.
RBI · KYC Directions, 2025 (successor to the 2016 Master Direction)
Shapes most of the work
Reserve Bank of India
From 1 April 2026, domestic digital payments need at least two factors of authentication, one of them dynamic, with risk-based checks encouraged.
We designStep-up authentication is designed for risky moments, so routine payments stay quick.
RBI · Authentication Mechanisms for Digital Payment Transactions Directions, 25 September 2025
PCI Security Standards Council
Card-data security standard; since 31 March 2025 every script on a payment page must be inventoried and authorised (6.4.3) and changes to the page detected (11.6.1).
We designPayment pages launch with a script inventory and change detection in place.
PCI SSC · PCI DSS v4.0.1, June 2024 Official text: PCI DSS v4.0.1
Shapes most of the work
MeitY · Reserve Bank of India
Consent for each purpose with easy withdrawal; financial data moves between institutions only under a granular, revocable consent artefact.
We designConsent and data-sharing screens are designed to the consent artefact, and every grant is logged.
DPDP Rules, 2025 (core obligations from 13 May 2027) · RBI NBFC – Account Aggregator Directions
Shapes most of the work
Indian Computer Emergency Response Team
Report cyber incidents within six hours of noticing them, and keep logs of every ICT system for a rolling 180 days, within India.
We designLogging and incident procedures are built into the platform before launch.
CERT-In · Directions under section 70B(6), 28 April 2022 Official text: CERT-In Directions, 2022
Often shapes the work
Reserve Bank of India
A committee report, not yet binding: seven principles and 26 recommendations, including a board-approved AI policy, consumer protection and AI incident reporting.
We designEvery AI feature launches with a named owner, an evaluation set and an incident process.
RBI · FREE-AI Committee Report, 13 August 2025
Compiled 2 October 2026. Our reading of typical programmes, not legal advice. Rules change; your counsel confirms how each one applies to you.
Challenges
What borrowers and policyholders need to understand, and what your teams must prove afterwards.
Borrowers need the cost, the term and the way out before they sign.
Customers judge security by the first screen and by every message after it.
The app, the branch and the call centre should all know what happened last.
What we build
Journeys, the customer record and the secure platform beneath them carry most of the work. Each line links to the capability that does it.
Secure web and app builds, payment integration and audit-ready infrastructure.
Onboarding, KYC and lending journeys designed around required disclosures.
CRM rebuilt around the customer journey, with consent and suppression built in.
A brand that looks safe and clear, even at the size of an app icon.
Compliance-reviewed campaigns and creator programmes that never promise returns.
Service assistants that cite the policy they answer from and hand off to people.
Programmes
You can start with the journey audit; what follows depends on what it finds. Lengths are typical.
The way in
We check every onboarding and lending journey against the RBI directions that apply, then rank the fixes by drop-off and risk.
What you get
02Milestone · 4–8 months
Application, PAN, video KYC and funding redesigned as one journey, tested with customers and integrated with your approved providers.
MeasureOnboarding completion rate
Services: Complete UX & UI design · Web or mobile app · User research & usability testing
Enquire about Digital onboarding and video-KYC journey03Project · 8–12 weeks
The Key Fact Statement, the all-in APR and the cooling-off period designed as screens customers read, with every view logged.
MeasureDrop-off at each disclosure step
Services: Complete UX & UI design · UX writing & content design
Enquire about Lending journey and KFS design04Milestone · 4–9 months
One customer record behind every message, with consent, suppression and the last event known before anything is sent.
MeasureOpt-out and complaint rates
Services: Customer data & identity foundation · Lifecycle journey build · Customer journey mapping
Enquire about Journey-led CRM and lifecycle messaging05Retainer · Ongoing
Compliance reviews the templates and approved modules, so each new asset starts from approved parts.
MeasureCompliance review cycle time
Services: Campaign design system · Content production retainer
Enquire about Compliance-reviewed campaign templatesHow success is measured
Main measureOnboarding completion
AI, under the rules
Each use case is tested on your own examples before release. A named person approves what goes live, and every answer is logged for audit.
Use case 01
Measured byConversations resolved without hand-off, with complaints held flat
Tested forOWASP LLM01 · Prompt injection
Goes live only with its evaluation set, automatic checks and a named owner
Use case 02
Measured byCompliance review cycle time
Tested forOWASP LLM06 · Excessive agency (it can block, never publish)
Goes live only with its evaluation set, automatic checks and a named owner
Use case 03
Measured byComplaints per thousand contacts
Tested forOWASP LLM09 · Misinformation
Goes live only with its evaluation set, automatic checks and a named owner
A deliverable, in working code
One hundred applicants through onboarding. Change how many clear each step to see where the biggest drop is and how many fund the account. Illustrative figures.
Of every hundred applicants who start
KFS v3 shown · consent logged · cooling-off date sent
Account funded52 of 100as illustrated
Largest dropVideo KYC (V-CIP)−21
What it shows
An illustrative onboarding funnel of one hundred applicants: 84 verify PAN, 63 finish video KYC, 58 accept the Key Fact Statement and 52 fund the account, with each disclosure logged. Change how many clear a step and the rest of the funnel recalculates.
Figures
Every number here is illustrative and shows how the deliverable reads; none is a client result.
Work and insights
Projects stay anonymous until each client approves the write-up; our articles on disclosures and consent sit alongside them.
All work in financial services
A typical programme · composite
A lender rebuilt its CRM around the customer journey, so each message reflects the customer’s last interaction and every disclosure is logged.
Anonymised and illustrative: the shape a programme takes, never a named client.
Questions
Something else on your mind? Ask us directly
No. We design and build the customer-facing journeys, the CRM and the integrations. Core banking and loan management stay on your licensed platforms.
We design the journey and its screens and integrate the KYC and V-CIP providers you have approved. Recordings and data stay where the RBI directions require.
Yes, with controls. It cites its sources, hands complaints and hardship to a person, and each use is designed in line with RBI’s FREE-AI recommendations.
Your compliance team keeps sign-off. We design to the directions, keep a record of every disclosure screen and make their review faster.
Keep exploring
You will speak to a lead who would run the work, and get a straight answer on fit.
01About 2 minutes
You get A reply from a named lead
02About 8 minutesRecommended
You get Options and a first scope after one call
03About 15 minutes
You get Receipt confirmed and a named bid lead
Every engagement starts with a written scope and a quote agreed before work begins. How each package is priced
