For housing finance

KYC document processing for home loan files

A home loan file is the largest document set in Indian retail lending: applicant and co-applicant KYC, income proof, property papers, a title chain going back decades. Then it is retained for the life of the loan — twenty years or more. Everything unmasked in it stays unmasked for that long.

Talk to our technical team → — for integration questions, a security review or a volume estimate.

Why HFCs carry more of this risk than anyone

The number of unmasked identifiers in a mortgage portfolio is roughly files × people × documents. It is the largest such exposure in retail lending and it is the one most often left until an audit raises it.

Property documents are the part nobody handles

KYC documents at least have a defined format. A sale deed or a title chain does not — it is a scanned legal document of arbitrary length, frequently carrying the Aadhaar and PAN of people who are not your customer and never consented to anything.

The problem
An identifier-specific masker needs to know what document it is looking at. A title deed is not an Aadhaar card, so it is skipped entirely.
What we do
/redact-pii is document-agnostic. It does not try to recognise the document; it finds the identifiers wherever they are printed. Aadhaar, VID, PAN, passport, voter EPIC, driving licence, GSTIN, IFSC, phone and email.
Why false positives matter
Redacting a survey number because it looks like an account number destroys the legal document. Every type we detect is checksum-validated or structurally distinctive, and bank account numbers are off by default precisely because nine to eighteen digits describes a plot number too.
Multi-page
A forty-page title chain is one call. Each page is rasterised, processed and rebuilt into a PDF where the redaction cannot be undone.

Where to put the call

At login
Mask applicant and co-applicant KYC as it is collected. The masked copy becomes the file of record.
At legal vetting
Run /redact-pii across property documents before they go to external counsel. External counsel is a different organisation with a different retention policy.
At disbursement
Batch the whole packet through /bulk/anonymise before it is archived. One call, a ZIP back, a manifest telling you exactly which documents contained what.
At assignment
Anything leaving for a co-lender, an insurer or a securitisation buyer goes masked. This is the moment a regulator will ask about.

Questions we get asked

Can it handle a 40-page scanned title deed?

Yes. Multi-page PDFs are processed page by page and rebuilt. Because pages are rasterised before redaction, the resulting PDF has no recoverable text layer under the redaction — which matters more on a legal document than anywhere else.

Property papers contain identifiers of people who are not our customer. Can you redact those?

That is exactly what /redact-pii is for. It is document-agnostic and identifier-driven, so it finds an Aadhaar or PAN on a sale deed without needing to know it is a sale deed. Prior owners' identifiers are covered along with everyone else's.

We have twenty years of files already stored unmasked. Can you help with the backlog?

Yes. The batch endpoints take many documents per call and return a manifest giving per-document status, including the documents where nothing was found — those come back unchanged and are the ones that still need handling. Tell us the volume and we will size throughput for a backlog run rather than for your steady state.

Do we need separate integrations for KYC and property documents?

No. Same API, same key. Use the Aadhaar and PAN endpoints where you know the document type and want the fields extracted, and the generic redaction endpoint everywhere else.

Related

Talk to us about your document volume

Tell us how many documents a month you process and what your peak looks like. We will size a plan, provision a key with a test quota, and answer a security questionnaire if you need one.