Credit Policy Deviation Tracking: See Every Exception
Last reviewed: November 2026
Credit policy deviation tracking is the practice of recording every loan approved outside the lender's credit policy, with the deviation type, justification, mitigants and approver, and then monitoring how those loans perform against in-policy loans. It shows leadership what the real credit policy is, not just the written one.
This guide is for CROs, heads of credit policy and board risk committee members at NBFCs, banks, housing finance companies and fintech lenders. It covers how deviations arise, how to log them in a structured way, how to build deviation MIS and how to connect exceptions to later defaults.
Key Takeaways
- RBI's NBFC Credit Facilities Directions require a board-approved credit policy, and untracked deviations quietly rewrite it.
- RBI's 2026 NBFC fraud directions require examination of staff accountability in all fraud cases, which needs a clear record of who approved what.
- Deviations should be detected by the system, coded and linked to loan performance, not self-declared in free text.
- The key output is delinquency by deviation type, which tells you which exceptions to tighten and which to write into policy.
Why Is Credit Policy Deviation Tracking a Leadership Problem?
Credit policy deviation tracking is a leadership problem because deviations are where the written policy and the actual book part ways. If a fifth of loans are approved by exception, the board is overseeing a policy that does not describe a fifth of the book.
RBI's NBFC Credit Facilities Directions, 2025 require NBFCs to put in place a board-approved credit policy. Deviations are not prohibited, but a board cannot judge its policy without knowing how often, where and why it is set aside.
Fraud governance raises the stakes. RBI's NBFC Fraud Risk Management Directions, 2026 require lenders to examine staff accountability in all fraud cases in a time-bound manner, and a clean deviation record is the evidence that examination needs.
Middle and Upper Layer NBFCs must also run an early warning signals (EWS) framework overseen by a board-level committee. Deviation data is one of the most useful inputs to it, and our guide to scale-based regulation for NBFCs explains how those layers are defined.
How Do Credit Policy Deviations Arise?
Credit policy deviations usually fall into six types: eligibility, collateral, documentation, process, pricing and structure. Each shows up in different data and carries a different kind of risk.
| Deviation Type | Typical Example | Where It Usually Shows Up |
|---|---|---|
| Eligibility | Fixed obligations to income ratio (FOIR) above the cap, bureau score below the cut-off | Higher early delinquency |
| Collateral | Loan-to-value (LTV) ratio above the limit, weaker property type | Higher loss when loans default |
| Documentation | Post-disbursement documents (PDD) deferred, documents waived | Ageing PDD lists, weak recovery files |
| Process | Field visit or verification waived | Fraud and misrepresentation cases |
| Pricing | Rate or fees below the pricing grid | Margin erosion, channel pressure |
| Structure | Tenor beyond policy, moratorium granted | Repayment stress later in the loan |
Some deviations change the probability of default, while others change the loss when default happens. A good tracking system records both kinds separately.
How Do Lenders Track Credit Policy Deviations?
Lenders track credit policy deviations in five steps, from a common language to a feedback loop into policy. Each step makes exceptions more visible and more useful.
- Deviation taxonomy: one list of coded deviation types for every product.
- System detection: rules flag deviations automatically at decision time.
- Justification and mitigants: structured reasons and conditions with deadlines.
- Deviation MIS: regular reports by type, product, channel and approver.
- Performance link: delinquency by deviation code, fed back into policy.
Step 1: What Should the Deviation Codes Look Like?
Create a short, stable list of deviation codes, each tied to one policy parameter, such as "FOIR above cap" or "PDD deferred". Record the size of the breach too, for example FOIR 58% against a 55% cap.
Keep free text for context only. Analysis depends on codes, not on paragraphs in a credit memo.
Step 2: Who Decides That a Loan Is a Deviation?
The system should decide, not the underwriter. Encode policy parameters in your credit decision engine, so any breach is flagged and coded automatically at decision time.
Self-declared deviations are always under-reported. Who may approve each deviation belongs to the delegation matrix, a separate control, so here the focus is on capturing what was approved.
Digiqt's credit underwriting automation agent shows how policy checks can run on every application. The output should be a deviation code, not just a pass or fail.
Step 3: What Must Accompany Each Deviation?
Every deviation needs a structured justification and, where relevant, a mitigant such as a guarantor, higher margin or shorter tenor. Conditions attached to the approval need an owner and a deadline.
An AI drafting tool such as a credit memo AI copilot can help underwriters record consistent justifications. Track open conditions until they are closed, because a deferred document that never arrives turns a temporary deviation into a permanent one.
Step 4: What Should the Deviation MIS Show?
The deviation MIS should show deviation rates by code, product, branch, channel and approver, with trends over time. It should also show open conditions and their ageing.
Build it into your regular NBFC MIS reporting rather than as a separate spreadsheet. The credit policy committee should see it monthly and the board risk committee quarterly.
Step 5: Which Deviations Turn Into Defaults?
Track delinquency by deviation code using cohorts, as in vintage analysis of the loan portfolio, and compare each code with in-policy loans of the same vintage. Use a consistent measure, such as loans 30 or more days past due (30+ DPD) at 12 months on book.
Then act on the result. Codes that perform like in-policy loans may belong in policy, while codes that default far more need tighter approval or removal.
Do you know which of last year's approved exceptions are now driving your delinquency?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how our lending platform supports custom lending stacks where every exception can be captured.
How Does Credit Policy Deviation Tracking Work on a Real Book?
On a real book, deviation tracking turns a general worry into specific policy changes. In this illustrative scenario, an NBFC disburses 4,000 loans worth ₹400 crore in a quarter, and 880 of them, or 22%, are approved with a deviation.
After 12 months on book, 97 of the 3,120 in-policy loans, about 3.1%, are 30+ DPD. Among deviation loans, 60 of 880, or 6.8%, are 30+ DPD.
| Deviation Code | Loans | 30+ DPD at 12 Months | Rate |
|---|---|---|---|
| FOIR above cap | 352 | 35 | 9.9% |
| Bureau score below cut-off | 220 | 14 | 6.4% |
| PDD deferred | 176 | 6 | 3.4% |
| LTV above limit | 132 | 5 | 3.8% |
| All deviations | 880 | 60 | 6.8% |
FOIR deviations default at about three times the in-policy rate, and they are the most common code. PDD deferrals perform close to in-policy loans, as long as documents are actually collected.
The committee tightens FOIR deviation rules and caps the size of the breach. It also formalises the PDD process as policy, with tracked deadlines, instead of treating it as an exception.
The lesson for leadership: an average deviation rate hid one code doing most of the damage. Tracking by code told the committee exactly what to change.
Which Approach Fits Your Lending Model?
The right approach depends on volume, product range and how much judgement your underwriting allows. High-volume lenders need system detection and automated MIS, while judgement-heavy lenders need strong justification and condition tracking.
| Situation | Recommended Approach |
|---|---|
| High-volume retail lending | Rules-based detection, coded deviations, monthly cohort tracking |
| Secured lending with property | Separate LTV and documentation codes, PDD ageing, loss-given-default view |
| MSME and judgement-heavy credit | Structured justifications, mitigant tracking, approver-level MIS |
| New product or new geography | Lower deviation tolerance, faster cohort reviews, early policy refresh |
How Often Should Policy Change Because of Deviations?
Review deviation performance at every credit policy committee meeting, and propose policy changes when a code has enough seasoned loans to judge. Six to twelve months on book is a common window, depending on tenor.
A high and stable deviation rate on one code is itself a signal. Either the policy is wrong for the market, or the exception has become a habit.
Where Does a Lending Platform Fit in Deviation Tracking?
A lending platform fits as the place where policy rules run, deviations are coded and loan performance is recorded. When all three live in one system, the link from exception to default needs no manual reconciliation.
The workflow is: apply policy rules at decision time, code any breach, capture justification and mitigants, track conditions, then join deviation codes to repayment data for cohort MIS.
Digiqt's lending platform is built to launch custom lending products in weeks, covering onboarding, disbursement and repayments through APIs. For NBFCs, it offers APIs for onboarding, payments and other financial products, so deviation data and repayment data can sit in one stack.
Which Metrics Show Deviation Tracking Is Working?
Six metrics show whether deviation tracking is working: deviation rate, deviation mix, deviation delinquency ratio, condition closure rate, approver concentration and system detection share. Review them by product and channel.
| Metric | Formula | What a Weak Number Signals |
|---|---|---|
| Deviation rate | Loans with a deviation ÷ loans sanctioned | Policy out of step with the market |
| Deviation mix | Loans per deviation code ÷ all deviation loans | One exception has become routine |
| Deviation delinquency ratio | 30+ DPD rate of a code ÷ in-policy 30+ DPD rate | That exception adds real risk |
| Condition closure rate | Conditions closed by deadline ÷ conditions due | Temporary deviations becoming permanent |
| Approver concentration | Deviations by one approver ÷ all deviations | Approval habits needing review |
| System detection share | System-flagged deviations ÷ all deviations | Underwriters still self-declaring |
Which Mistakes Make Deviation Tracking Useless?
Four mistakes make deviation tracking useless, and all of them are common.
- Free-text deviations. Paragraphs in credit memos cannot be counted or compared.
- Self-declaration. Deviations that depend on the underwriter's honesty are always under-reported.
- Counting without performance. A deviation rate without delinquency data tells you nothing about risk.
- No feedback to policy. If tracking never changes the policy, it is only paperwork.
What Is Changing Next?
Supervisory expectations on early warning are rising. RBI's July 2026 NBFC fraud directions require Middle and Upper Layer NBFCs to run EWS frameworks overseen by a board-level committee, with indicators reviewed periodically for effectiveness.
Analytics are also improving. Digiqt's loan default prediction agent shows how deviation codes can become model features, and our guide to credit scorecard development explains how scorecards and policy rules work together.
Could your board see the default rate of every exception type approved last year?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how our lending platform brings onboarding, disbursement and repayments together through APIs.
