Loan Approval Delegation Matrix: Enforce Sanction Authority
Last reviewed: November 2026
A loan approval delegation matrix is the board-approved table that states which role or committee may sanction a loan, up to what amount, for which product and risk grade, and under what conditions. Enforcing it inside the loan system means software, not a reviewer's memory, decides whether an approver is allowed to sign.
This guide is for CEOs, CROs and heads of credit at NBFCs, banks, housing finance companies and fintech lenders. It covers why delegated authority breaks down, how to turn it into system rules, and how to tell whether it holds under volume pressure.
Key Takeaways
- A delegation matrix only works when the loan system blocks out-of-authority approvals, instead of logging them for audit to find months later.
- Most breaches come from exposure aggregation gaps, split proposals and open-ended deputation, not from rogue approvers.
- From 1 April 2026, RBI caps NBFC related-party materiality thresholds at ₹10 crore, ₹5 crore and ₹1 crore for Upper (and Top), Middle and Base Layer NBFCs respectively.
- Directors, key managerial personnel (KMP) and specified employees must recuse themselves from related-party loan decisions, so recusal needs to be a system check too.
Why Is Sanctioning Authority a Leadership Problem?
Sanctioning authority is a leadership problem because every approval outside delegated limits is a credit decision the board never authorised. When such a loan goes bad, the question shifts from why it defaulted to who allowed it.
Regulators expect the discipline in writing. RBI's NBFC Credit Risk Management Directions require a board-approved credit policy, and since April 2026 they also state who must sanction related-party loans above a materiality threshold.
There is a speed cost as well. When approvers are unsure of their limits, files climb the hierarchy to be safe, and senior credit time goes to loans a branch could have cleared.
How Do Sanctioning Authority Breaches Happen?
Sanctioning authority breaches usually happen in six ways: limits that ignore group exposure, split proposals, deputation without expiry, stale matrices, grade mismatches and conflicted approvers. Each looks harmless on a single file, which is why manual checks rarely catch them.
| Breach Pattern | What Goes Wrong | Where It Usually Shows |
|---|---|---|
| Exposure not aggregated | Limit checked on the new loan only | Group or co-borrower exposure above the approver's limit |
| Split proposals | One need broken into two smaller loans | Same borrower, same week, two sanctions just under a limit |
| Open-ended deputation | Leave-cover powers never withdrawn | Approvals by a deputy after the holder returned |
| Stale matrix | Policy revised, system not updated | Approvals valid under old limits, invalid under new ones |
| Grade mismatch | Amount limit applied without risk grade | High-risk grade approved at a low-risk limit |
| Conflicted approver | Approver related to the borrower | Related-party loan with no recusal on record |
The first two are invisible on a single file. They need checks that look across the borrower's whole relationship with you.
How Do Lenders Enforce a Loan Approval Delegation Matrix in the System?
Lenders enforce a loan approval delegation matrix in five layers, each turning a line of policy into a system rule. Together they make an out-of-authority sanction impossible to record, not just easy to spot.
- Store the matrix as versioned data: limits become tables with effective dates.
- Compute true exposure: limits apply to the whole relationship, not one proposal.
- Route by rule: the system picks the right approver.
- Control deputation and recusal: temporary powers expire and conflicts lock users out.
- Make every exception visible: escalations and ratifications are recorded with reasons.
Layer 1: Is the Matrix Stored as Data, Not a PDF?
Store each row of the matrix as structured data: role, product, amount band, risk grade, collateral type and conditions. Give every version an effective date, so the system knows which limits applied on the day of each sanction.
Keep the board note that approved each version alongside it. Auditors can then trace any sanction to the exact limit that allowed it.
Layer 2: Is the Limit Checked Against Total Exposure?
Approval limits should apply to total exposure, not only the new proposal. That means adding existing loans, co-borrower and guarantor exposure and connected entities before routing.
Outside debt affects the risk grade, so a sound credit bureau integration architecture matters here. Internal exposure, however, has to come from your own books, which needs a single customer view across products.
Layer 3: Does the System Route the File to the Right Approver?
Once exposure and grade are known, the system should route the file to the lowest authority allowed to sanction it. Anyone below that level sees a recommend action, not a sanction button.
Digiqt's credit underwriting automation AI agent shows how assessment output can be prepared before the file reaches an approver. Running authority rules in the same credit decision engine as policy rules keeps both on one set of data.
Layer 4: Are Deputation and Recusal Controlled?
Deputation should be a dated record: who covers whom, from when, to when and with which limits. Powers should lapse automatically at the end date.
Recusal needs the same rigour. RBI's NBFC directions require directors, KMP and specified employees, meaning staff up to two levels below the board plus anyone designated by policy, to recuse themselves from loan decisions involving themselves or their related parties.
That recusal also covers later material changes, such as one-time settlements, write-offs and waivers. Build it as a hard lock on the user, not a declaration checkbox.
Layer 5: Is Every Exception Visible?
Some files legitimately need a higher authority or a post-facto ratification. Record each one with the reason, approver and timestamp, so nothing depends on email trails.
This guide covers who approves; tracking which policy exceptions were approved is a separate discipline, credit policy deviation tracking.
How many loans in your book were sanctioned by someone who did not have the authority to sanction them?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how our lending platform can carry your approval rules from onboarding to disbursement.
How Does a Loan Approval Delegation Matrix Work on a Real File?
On a real file, the matrix only works if the system sees everything the approver cannot. In this illustrative scenario, a Middle Layer NBFC's matrix lets a regional credit head sanction up to ₹1 crore of total exposure and the national credit head up to ₹3 crore.
A relationship manager submits a ₹90 lakh loan against property (LAP) for a proprietor. On the file alone, it sits comfortably inside the regional head's limit.
| Check | Finding |
|---|---|
| Exposure aggregation | The proprietor's firm already has a ₹1.6 crore term loan with the same NBFC |
| Total exposure | ₹90 lakh + ₹1.6 crore = ₹2.5 crore, above the regional limit |
| Routing | File moves to the national credit head, whose limit is ₹3 crore |
| Related-party screen | The proprietor is the brother of the NBFC's chief financial officer, a KMP |
| Materiality check | ₹90 lakh is below the ₹5 crore Middle Layer ceiling, so delegated authority may sanction |
| Recusal | The CFO is locked out of the file and any later changes to it |
The loan is sanctioned by the right person, the related-party register is updated, and the CFO's recusal is on record. Under manual routing, the regional head would have approved it in good faith.
The lesson for leadership: the approver was honest, but the information was incomplete. Authority has to be checked against data the approver cannot see on one screen.
Which Delegation Approach Fits Your Lending Model?
The right delegation approach depends on ticket size, sourcing channel and how much of the book is decided by rules. High-volume digital books need the authority built into automated decisions, while large-ticket books need committee controls.
| Situation | Recommended Approach |
|---|---|
| Small-ticket digital loans at high volume | Board-delegated authority for the rules engine, human review only for referrals |
| Branch-led secured lending (LAP, MSME) | Amount-plus-grade matrix with exposure aggregation and regional routing |
| Large corporate or project loans | Committee sanction with quorum, minutes and recusal captured in the system |
| Group with several lending entities | One matrix per entity, with a shared exposure view across the group |
Can an Algorithm Hold Sanctioning Authority?
Yes, if the board delegates it explicitly. Treat the scorecard or rules engine as a named authority with its own amount band, product scope and review cycle.
That keeps automated approvals inside the same governance as human ones. It also gives auditors one place to check what the model was allowed to sanction, which ties into your obligations under scale-based regulation for NBFCs.
Where Does the Digiqt Lending Platform Fit?
The Digiqt Lending Platform is built for lenders that want a custom lending product or platform live in weeks, with user-friendly APIs covering onboarding, disbursement and repayments. Digiqt's stated approach starts with understanding the business problem and validating ROI and solution fit, then delivers through agile sprints.
For delegated authority, the practical step is to scope approval rules as a requirement of your sanction journey from the first sprint. That includes matrix tables, exposure aggregation, routing, deputation, recusal and a rule that disbursement opens only when a valid sanction sits on the file.
Servicing data feeds the exposure check, so connect origination to your loan management system for NBFCs. A credit memo AI copilot can then prepare the note the right approver signs.
Which Metrics Show the Matrix Is Holding?
Five metrics show whether the matrix is holding: blocked attempts, escalation rate, turnaround by level, deputation approvals and ratifications. Review them monthly with the CRO and business heads together.
| Metric | Formula | What a Weak Number Signals |
|---|---|---|
| Blocked out-of-authority attempts | Blocked sanction attempts ÷ sanctions | Users testing limits, or a matrix that is too tight |
| Escalation rate by level | Files escalated ÷ files received, by level | Limits too low, or grading too conservative |
| Turnaround by level | Time from recommendation to sanction | Senior approvers have become a bottleneck |
| Deputation approvals | Sanctions under deputation ÷ total sanctions | Powers sitting with deputies too long |
| Post-facto ratifications | Ratified sanctions ÷ total sanctions | Approvals happening outside the system |
Which Mistakes Weaken Delegated Authority?
Four mistakes weaken delegated authority most often, and all of them are design choices.
- Checking the loan, not the exposure. A limit that ignores existing and connected exposure can be beaten by splitting files.
- Letting deputation run without an end date. Temporary powers quietly become permanent.
- Updating the policy PDF but not the system. The board approves new limits, while the software keeps enforcing the old ones.
- Treating recusal as a declaration form. A conflicted user who can still open and edit the file has not really recused.
What Is Changing Next?
RBI's January 2026 amendment directions on lending to related parties, effective 1 April 2026, created a harmonised framework across banks, NBFCs and other regulated entities. NBFCs must also run quarterly or more frequent internal audit reviews of related-party lending, so supervisors will expect system evidence, not just policy text.
Rules engines will take on more sanctions in small-ticket lending, which makes their authority limits a board matter. See AI agents in loan underwriting and compliance by design architecture for how to build these controls in.
Can your board see, today, that every sanction last quarter came from someone allowed to give it?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how our lending platform helps you build sanction authority into the loan journey itself.
