Enriching eNACH -Impact on NBFCs, Banks, And Even Millennial Financing

India’s lending industry stands at a staggering 156.9 lakh crores, a steep increase of 100% from 2017. But what many miss out on is that of these, only 2% involve microfinance contributions. Instead, commercial and Retail lending dominates 98% of this, with each at 49%.

Although almost every citizen will try to avail of a loan at a point in their life is true. It is an integral part of the economy and even a commoner’s aspirations. But the above data identifies two significant factors. One, customers prefer commercial and retail lending. Two, These areas are potentially untapped and improvable.

Once considered stormy waters, even personal loans are now being navigated at a growth rate 3.8 times higher. This is primarily due to easier access and availing procedures of loans in the country. As a result, even banks and NBFCs are modifying their gameplan to incorporate the novel surge in commercial and retail loans through digital banking.

But then, why is the government stressing on eNACH Mandates? Why are banks and NBFCs preferring the involvement of eNACH?

 

What’s The Real Concern?

As the tide rises, so does the seaweed. Financial Institutions reported an abnormal increase in loan repayment defaulters. Although COVID-19 played a significant role in this, the impact is also attributed to a sense of gullibility. Even genuine customers who accidentally default face the risk of lowered credit ratings.

Entities have increased their safety and security measures to stop defaulting, but that alone won’t cut it. We need an impeccable system of retrieval and processing. Electronic clearing service was a primitive form of this. Even though insufficiently effective, it paved the way to a better solution- eNACH Mandates.

 

The What, Why, And How Of eNACH Mandates.

eNACH mandate is an improved version of the existing NACH mandate. The NACH mandate helps the customer give the collecting agency the right to debit the respective amount from the account for a fixed period at a specific frequency. The agency is required to collect the mandate form from their customers to facilitate the process of auto-debit for personal loan EMIs.

eNACH mandates are the digital versions of paper-based NACH mandates. They allow customers to approve recurring payment charges in a go, digitally. This will enable merchants to collect recurring insurance premiums, loan repayments, investment SIPs, utility bills, etc.

This makes things far easier for customers, NBFCs, and banks. This is why financial institutions now focus more on creating eNACH mandates for loan EMI collection from the borrowers. In addition, innovative companies and pioneer entities in the industry aim to craft solutions engineered to help NBFCs streamline their loan repayment collections while ensuring the benefit for the customer.

 

What Are Its Advantages?

  • Decreased Time- The digitized nature coupled with the automated deduction and reduced human involvement fastens the process. Signing up for loans is also swift with eNACH.
  • Increased Success Rate- loan disbursement and retrieval are more successful as most of the process is automated and the entire process is digitized.
  • Higher Successful Processing Rate- Almost all technical and human errors are negated with a proper digital system in place. This implies that the processing is better and more efficient.
  • Reduced Number of Defaulters- Defaulters find it hard to abscond and not pay. As everything is automated, the agreed-upon amount will be deducted accordingly from their accounts.

 

How Does It Impact And What’s The Bottom Line for eNACH?

It’s pretty much evident that eNACH is the new phase of recurring collections. Banks, NBFCs, and other financial institutions are incorporating it. Even genuine customers prefer eNACH as it is swifter and easier for processing. Millennials form the lion’s share of this as they mostly prefer digitized payments. This is evident because they overwhelmingly choose digital bank accounts over traditional options. The next generations will only soar higher from this point onwards to the digital canopy. Millennial financing is definitely digital.

But all this will be possible only with the proper implementation of eNACH and its methods. For this, you require the best resource provider you can get. We at Signzy can help you with this. With premium resources and products for your digitization and automation, you can better your processes.

 

About Signzy

Signzy is a market-leading platform that is redefining the speed, accuracy, and experience of how financial institutions are onboarding customers and businesses – using the digital medium. The company’s award-winning no-code GO platform delivers seamless, end-to-end, and multi-channel onboarding journeys while offering totally customizable workflows. It gives these players access to an aggregated marketplace of 240+ bespoke APIs that can be easily added to any workflow with simple widgets.

Signzy is enabling ten million+ end customer and business onboarding every month at a success rate of 99% while reducing the speed to market from 6 months to 3-4 weeks. It works with over 240+ FIs globally, including the 4 largest banks in India, a Top 3 acquiring Bank in the US, and has a robust global partnership with Mastercard and Microsoft. The company’s product team is based out of Bengaluru, and it has a strong presence in Mumbai, New York, and Dubai.

Visit www.signzy.com for more information about us.

You can reach out to our team at reachout@signzy.com

Written By:

Signzy

Written by an insightful Signzian intent on learning and sharing knowledge.

Banking And Fintech In The Metaverse Of Finance

Dolce and Gabbana had a peculiar sale last year. Their customers paid $5.7 million to the fashion conglomerate for basically… Nothing. Or that’s what people who do not understand virtual reality would say. In fact, the company sold primarily virtual products for customers to use in the Metaverse. This is why the Metaverse economy experienced retail sales of more than $20 billion with an annual growth rate of around 40%.

This is the mere beginning of using digital assets as a repository of value. It is the beginning of a digital renaissance, encompassing AR, VR, and other digital immersive technologies, which will lead to wide-scale adoption and regulations. Cryptocurrencies will also play a crucial role in this.

Financial institutions must secure their position in this enormous and novel part of the economy by incorporating Metaverse and crypto into their services and business models. This will lead them to a cryptocurrency-fueled metaverse economy.

As the metaverse users increase, financial transactions in the new realm will increase. The government will issue new regulatory guidelines in the coming future. But it is unwise not to adopt early. Banks and institutions should not wait for this. Instead, they should embrace the metaverse economy. Here are some of the ways in which this is possible.

Build And Leverage Trust

Customers usually trust banks more than even the government. This should be utilized in a positive fashion. Tap into the customers’ interests in crypto and digital assets. Despite the standard expectations, 45% of Boomers used cryptocurrencies to make a purchase, compared to the 30% of Zoomers, in 2021.

Mastercard is processing crypto payments and paving the way for other institutions to follow suit. Offering custody services and processing crypto payments help banks prepare for the digital future. Even mortgages, loans, etc., will have digital asset involvement. Banks and banking technology may also leverage their brand identity in user verification and risk management as more peer-to-peer crypto transactors want to trust authentic payment sources.

Metaverse Payment Platforms: Adopt The Boon

Metaverse virtual reality is all set to take over the shopping experience for customers. The fundamental fintech future will be altered to adopt the new paradigm. Financial institutions must process transactions on metaverse payment platforms to accommodate the customers and their needs. A trial pilot by Facebook, the Whatsapp digital wallet is the beginning of this transformation. It offers benefits like zero fees for international transfers, etc. 

These methods have so much potential and versatile applications. For example, such platforms will help fasten transactions and secure the customer’s safety and privacy. Moreover, the institutions can either provide such platforms or integrate the accounts into existing payment apps by utilizing their APIs. But it is noteworthy that most of these apps adapt to phones and screens and ARVR technology.

The metaverse economy is in the infant stage. But once it starts flying, the entire system will soar. This is the ripe time for banks and financial institutions to secure the fintech future. This is where banking technology ups its game a notch with payment platforms.

Integrate With AR And VR Platforms

Providing payment platforms in the new paradigm is essential. But banks need to do more than that. They need to integrate with the metaverse virtual reality. Banking technology must evolve to increase its presence in the Metaverse while ensuring that customers spend more time in it. 

This may be done in multiple ways:

  • Communications with customers- Include AR and VR where it is appropriate.
  • Increase Visual Presence- Transactional experiences should be encapsulating and immersive.
  • Explore the New Age Ads- Advertising is evolving along with technology. Digital billboards, avatars of celebrities, etc.

Banks In The Metaverse

The future of fintech is mainly altering. But it is not unpredictable. We may not be able to say how the Metaverse will affect us or how it will look, but we sure can understand how it can be leveraged. Financial institutions should not wait for regulatory guidelines to adapt to evolving technology. They must learn how to leverage their unique attributes.

Utilizing their attributes to meet the wants and needs of the customers helps and navigate the digital transition successfully. This includes the desire to be a participant in the metaverse and crypto economies. But all these financial institutions and banks need a reliable and trustworthy service source. A resource marketplace where you get all that you require. Signzy can help you with the best customizable APIs and resources with our efficient AI-based rule engine and technology.

About Signzy

Signzy is a market-leading platform that is redefining the speed, accuracy, and experience of how financial institutions are onboarding customers and businesses – using the digital medium. The company’s award-winning no-code GO platform delivers seamless, end-to-end, and multi-channel onboarding journeys while offering totally customizable workflows. It gives these players access to an aggregated marketplace of 240+ bespoke APIs that can be easily added to any workflow with simple widgets.

Signzy is enabling ten million+ end customer and business onboarding every month at a success rate of 99% while reducing the speed to market from 6 months to 3-4 weeks. It works with over 240+ FIs globally, including the 4 largest banks in India, a Top 3 acquiring Bank in the US, and has a robust global partnership with Mastercard and Microsoft. The company’s product team is based out of Bengaluru, and it has a strong presence in Mumbai, New York, and Dubai.

Visit www.signzy.com for more information about us.

You can reach out to our team at reachout@signzy.com

Written By:

Signzy

Written by an insightful Signzian intent on learning and sharing knowledge.

Exploiting SSTI To Execute Arbitrary Code On Server

Server-side templates create an accessible method for the dynamic generation of HTML code management. But they could also be susceptible to SSTI(server-side template injection). To fully comprehend these mechanics, we must understand what template engines and SSTI attacks are. This can also help execute arbitrary code on the server.

What are Template Engines and SSTI Attacks?

Template engines are created by including multiple specific templates with variable data to create web pages. Server-side template injection attacks can occur when user input is concatenated directly into a template without being sanitized against evil characters. As a result, attackers can inject arbitrary template directives into the template engine, allowing them to manipulate the template engine and, in some cases, gain complete control of the server.

Some of the Template engines are listed below : 

PHP – Smarty, Twigs                                                   

Java – Velocity, Freemaker                                                   

Python – JINJA, Mako, Tornado                                                   

JavaScript – Jade, Rage                                                   

Ruby – Liquid                                                    

 

Jinja: A Python Based Template Engine

Jinja is a Python template engine written as a self-contained open source project to create HTML, XML, or other markup formats returned to the user via an HTTP response. It is also referred to as “Jinja2”.

So why Jinja? 

Today Jinja is the most widely used Python-based template engine and is opted by configuration management tools Ansible and SaltStack and the static site generator Pelican to generate output files. Given its vast adaptation, we will have Jinja as a reference to understand how the SSTI attack works. 

The Vulnerable Code Snippet

 

 

Here, a part of the Template is dynamically generated using the form. Because template syntax is directly processed at the server-side without any filtration, an attacker possibly can inject a malicious payload inside the ‘name’ argument where user input is being placed within the template expression. 

Identifying The Vulnerability

As shown in the code snippet, the input we’ll provide will be rendered precisely by the template engine. 

So, if we put a mathematical expression to identify the vulnerability, if it is being rendered by template engine or not. 

 

 

 

Input value- {{7*7}} returned ‘Hello 49!’. So it is confirmed that the backend is using jinja2.

Python depends on specific modules like ‘sys,’ which includes other dependencies such as the ‘OS’ module; we will target the ‘OS’ module here for exploitation. However, the exploitation and getting shell would not be that easy here as Jinja does not support the import statement. 

Our very first goal here is to identify the template engine used by the target application, for which the TPLMAP tool can be leveraged. With numerous sandbox escape strategies, the TPLMAP tool aids the exploitation of Code Injection and Server-Side Template Injection vulnerabilities to get access to the underlying operating system.

Exploiting The Vulnerability

So as explained above, the import statement does not work in the case of Jinja; hence we will use some parts of code that are accessible to us, often called Gadgets, to achieve remote code execution.

 

The below payload will execute the malicious code which is inside the ‘popen’ function:

 

The above payload is explained in the below fig:

 

The RCE is achieved as shown below:

 

Workaround and Remediation

  • Templates should not be created using user-controlled input. To pass user input to the Template, use template parameters. Sanitize the data before processing it by removing any unwanted or potentially hazardous characters before putting it into the templates. This decreases the likelihood of your templates being maliciously explored.
  • Malicious code execution is inescapable if permitting certain dangerous characters to render specific elements of a template is a business requirement. Then encapsulating the template environment in a docker container is almost certainly the safer option. With this option, you may leverage Docker security to establish a safe environment that prevents dangerous actions.

 

About Signzy

Signzy is a market-leading platform that is redefining the speed, accuracy, and experience of how financial institutions are onboarding customers and businesses – using the digital medium. The company’s award-winning no-code GO platform delivers seamless, end-to-end, and multi-channel onboarding journeys while offering totally customizable workflows. It gives these players access to an aggregated marketplace of 240+ bespoke APIs that can be easily added to any workflow with simple widgets.

Signzy is enabling ten million+ end customer and business onboarding every month at a success rate of 99% while reducing the speed to market from 6 months to 3-4 weeks. It works with over 240+ FIs globally, including the 4 largest banks in India, a Top 3 acquiring Bank in the US, and has a robust global partnership with Mastercard and Microsoft. The company’s product team is based out of Bengaluru, and it has a strong presence in Mumbai, New York, and Dubai.

Visit www.signzy.com for more information about us.

You can reach out to our team at reachout@signzy.com

Written By:

Ankit Pandey

Ankit is a cyber geek currently working in the information security team at Signzy. Ankit holds eWPTX, eCPPTv2 & CEH certifications. Ankit is also an active member of Synack Red Team actively hacking and securing companies globally.

 

 

3 Major Reasons Why Your Business Can not Skip Out On KYB

Do you know how many shell companies are there in India?

Apparently, no one does. But, authorities identified 230,000 shell companies in the last 3 years. Scrutinized data mining revealed nearly 300,000 shell companies involved in hawala and other illegal transactions. Just government regulations won’t cut it to cut down on these launderers. Individual enterprises need to take action. Each business needs to know with whom they are getting involved.

When it comes to low, mid, or even high-level corporate collaborations, KYB (Know Your Business) is the ultimate evaluation mode to secure business interests and stay compliant with AML(anti-money laundering) obligations. Before an enterprise associates with another company, it should ensure authenticity. KYB provides this while verifying the organization on multiple dimensions.

Ponemon Institute concluded that companies unnecessarily spend more than $4 million due to not taking action and investing in regulatory and compliance practices. KYB, unlike KYC, verifies enterprises and businesses instead of customers. They use certified identification parameters that include the owner’s OVDs(Officially Verified Documents), CRN(Company Registration Number), etc.

Here are the 3 major reasons why you should always have KYB processes set up for your enterprise’s collaborations.

Reason 1- Safe and Secure Business Relationships

Any B2B service and interaction depends on mutual interests and understanding. The changing world of digital technology impacts significantly on your business. On top of this, business partners do not have directive authority over their partner’s vendors. Hence there is a constant and inevitable need to verify trust between the businesses for a stable relationship. This is where KYB forms a reliable standard for building trust and acts as a secure communication channel.

KYB essentially solidifies the reliance of companies and businesses on each other. Additionally, it also provides security and safety from external threats. Many regulatory bodies demand this as well. Hence a regulations compliant tag requires processes involving KYB.

Reason 2- Increased B2B Conversions

Any company that has accessed KYB processes generates more credibility and trust. Partner organizations receive a positive impression. The process is solid and safe with multiple identity checks and verification procedures. Since everything can be automated, any face-to-face fiddle can also be avoided. Trust between involved parties is directly proportional to a greater B2B conversion rate.

This way, the relationships help establish a well-formed reputation for the enterprises. Trust directly impacts the conversion rate; it is relevant for up-and-coming start-ups to ensure they have a built-in KYB process. KYB helps organizations identify themselves without any physical presence at sites or offices. It also helps provide interest-oriented services that increase the conversion rate for B2B services.

Reason 3- AML CFT Compliance

The increase in financial crimes worldwide makes it necessary for governments and law enforcement agencies to ensure regulatory measles. For example, the 1970’s Bank Secrecy Act in the US was established to combat tax evasion and unlawful drug dealings. This was the first step in AML’s history. In addition, organizations like FATF((Financial Action TaskForce) and FinCEN (Financial Crimes Enforcement Network) are aimed at this same goal of AML and following government regulations.

AML practices safeguard the safety interests of businesses. Non-compliance with AML is an expensive deal. Companies pay more than $5 million to regulatory authorities for non-compliance with AML.

The 4AMLD, the anti-money laundering directive from the European Union, dictates and encourages financial institutions to follow KYB practices. This keeps a tab on potential money laundering and terrorism funding initiatives. Therefore, KYB is mandatory for AML implementation. As a matter of fact, it is the cornerstone in identifying potential dangers in B2B interactions.

A Bonus 4th Reason For You:

KYB Reduces Operational Costs

It is no novel fact that automation and digitization help reduce operational costs and TAT. It also helps reduce human interventions and, in essence, human resources. But KYB, primarily digital KYB, takes this up a notch. Digital KYB, just like Digital KYC, maintains the status quo of technological independence. The processes involved are designed to create minimal human intervention while providing the safe and secure fortification it demands. This reduces errors, resulting in costs saved from human errors while maintaining security for the businesses. As it reduces the TAT, this increases the scalability of operations. This renders the future of processing faster for the involved enterprises.

To summarize, KYB is an effective method for creating secure business relations. This is done by reducing the total operational expenses, enhancing the conversion rate in B2B services while complying with AML policies and procedures.

If you wish to create a fortified and user-friendly Digital KYC/KYB process, we can help you with the best resources in the industry. From scratch, Signzy helps build entire onboarding and KYB processes for our clients. These are incredibly customizable too. Of course, you can understand how secure they are as we use state-of-the-art AI rule engines and APIs on our website.

About Signzy

Signzy is a market-leading platform that is redefining the speed, accuracy, and experience of how financial institutions are onboarding customers and businesses – using the digital medium. The company’s award-winning no-code GO platform delivers seamless, end-to-end, and multi-channel onboarding journeys while offering totally customizable workflows. It gives these players access to an aggregated marketplace of 240+ bespoke APIs that can be easily added to any workflow with simple widgets.

Signzy is enabling ten million+ end customer and business onboarding every month at a success rate of 99% while reducing the speed to market from 6 months to 3-4 weeks. It works with over 240+ FIs globally, including the 4 largest banks in India, a Top 3 acquiring Bank in the US, and has a robust global partnership with Mastercard and Microsoft. The company’s product team is based out of Bengaluru, and it has a strong presence in Mumbai, New York, and Dubai.

Visit www.signzy.com for more information about us.

You can reach out to our team at reachout@signzy.com

Written By:

Signzy

Written by an insightful Signzian intent on learning and sharing knowledge.

Blooming Blockchain- How It Can Help You KYC Faster, Safer, And Better

Does $10 billion seem like a boatload of money to you? According to Compliance Week, financial institutions across the globe were charged $10.4 billion as KYC and AML fines in 2020. Adjusted to inflation, that’s nearly half the revenue of the entire Hollywood in 2020. That’s wasted money that could have been saved.

Know Your Customer(KYC) processes form the spine of financial institutions’ safety. It primarily encompasses their Anti-Money Laundering (AML) efforts. Traditionally they have always been tiresome and time-consuming. Even after, they were not issues-free, and they were not unhackable. The processes are inefficient and labor-intensive. The risk of error is also pretty high. 80% of efforts go for information collation and processing, whereas the rest 20% is only spent on assessing and monitoring. 

Let’s have a look at how we can change this.

How Traditional KYC IS Falling Short

Customers dread KYC. For them, it serves no purpose other than to increase the activation energy required for CTA. Traditional KYC is out of the question as it:

  • Is manual and prone to human errors
  • Tiresome and time-consuming
  • Heavily dependent on physical attributes like space, storage, etc.

Digital KYC was the solution some years ago. They had:

  • AI-based processing that reduced errors
  • Quick TAT
  • Server storage
  • Better user experience

Many institutions shifted to Digital KYC with advanced Video KYC as an option. But before that metamorphosis could complete, we got newer and better modes. The digitized is getting digitized. This was primarily due to the shortcomings in safety, security, and universal ease of accessibility for the data and the users. An incompetent digital KYC process also Misidentifies fraudulent data and cannot track the customers for verification.

The era for change is here, and it begins with understanding blockchain technology. Blockchain is versatile and resilient. But above these, it records information as electronic databases in the form of blocks.

 

Blockchain KYC- The Next generation of KYC Processing

 

A blockchain is a specifically distributed database shared among the nodes of a digital network. It stores information electronically as a database. Blockchain KYC occurs in multiple stages in a specific Distributed Ledger Technology (DLT).

Stage 1- KYC DLT System

IFI or Initial Financial Institutions ensure users set up their digital identity using valid documents on a Blockchain KYC platform. The data becomes available with consent to institutions for verification. Some of the available options for storage are:

  • DLT platform
  • FI’s server
  • Centralized server

Stage 2- User can transact with FI

The user provides consent. The FI can verify and save the data on the DLT platform using the ‘Hash Function.’ FI delivers digital copies of KYC to the users marked with a Hash Function which matches the DLT platform’s one. This ensures that if the KYC data is changed, it will not correspond with the one on the DLT platform. In addition, it will alert the FIs about the change.

Stage 3- User transacts with Final Financial Institution(FFI)

Users consent to share data with FFI, and the KYC is performed. Then, FFI reviews the data and the respective hash function with the ones IFI uploaded. If both match, FFI finalizes the data as valid.

The Benefits of Blockchain KYC

  • Quality data with real-time monitoring and tracking.
  • Lower TAT- FIs have direct access to data without collation.
  • It eliminates paperwork
  • Decentralized, distributed data collection
  • Mandatory consent ensures safety for the user’s data.
  • Reduced expenses due to unhackable security and fortified operational efficiency.
  • Accurate information validation with DLT
  • Real-time user data appraisal- blockchain technology updates the FI of any new addition of user data.

The Culmination of Blockchain Technology and KYC

Collating user data and processing is expensive and time-consuming. But it has always been a mandatory part of any KYC process. But now, this has changed.

Blockchain not only provides an alternative for this but also helps enterprises monitor and assess user behavior. It saves time from tedious, laborious tasks of data accumulation and processing. It uses this time for the companies to focus on finding solutions for more creative KYC challenges.

It is important to note that Blockchain Technology is not magic and hence not the answer to all problems in KYC. It mainly helps in data collation. The validation process still is an unavoidable task.

Blockchain coupled with AI and cognitive processing technologies helps resolve this. They will create a synergistic and efficient system. However, it is hard to find the right solutions for your enterprise in such a saturated market. Signzy offers state-of-the-art resources and solutions for all your fintech needs. Ranging from onboarding to KYC, we have customizable solutions powered by AI decision engines to get you the best in the industry. 

About Signzy

Signzy is a market-leading platform that is redefining the speed, accuracy, and experience of how financial institutions are onboarding customers and businesses – using the digital medium. The company’s award-winning no-code GO platform delivers seamless, end-to-end, and multi-channel onboarding journeys while offering totally customizable workflows. It gives these players access to an aggregated marketplace of 240+ bespoke APIs that can be easily added to any workflow with simple widgets.

Signzy is enabling 10 million+ end customer and business onboarding every month at a success rate of 99% while reducing the speed to market from 6 months to 3-4 weeks.  It works with over 240+ FIs globally including the 4 largest banks in India, a Top 3 acquiring Bank in the US, and has a strong global partnership with Mastercard and Microsoft. The company’s product team is based out of Bengaluru and it has a strong presence in Mumbai, New York, and Dubai.

Visit www.signzy.com for more information about us.

You can reach out to our team at reachout@signzy.com

Written By:

Signzy

Written by an insightful Signzian intent on learning and sharing knowledge.

 

References

1 2 3 4 5 6 12