Hiring a Chief Risk Officer for an Indian fintech

What the regulation actually requires

The RBI's Non-Banking Financial Companies (Governance) Directions, 2025 set out requirements that function as hiring constraints whether or not a brief acknowledges them. They carry forward and extend the earlier May 2019 circular on the appointment of a CRO, which is no longer the citable authority: a specification or board pack still referencing it is working from a superseded instrument.

For listed NBFCs there is an additional disclosure obligation to the exchanges on leadership changes.

The practical reading: the RBI has designed this role to be hard to influence and hard to remove. Candidates know that. The strongest ones will interrogate the reporting line and the board's appetite for independence before they engage seriously, and a vague answer loses them.

What the role owns in a fintech, as opposed to a bank

The title is borrowed from banking, and that causes most of the mis-hiring.

In a traditional lender, risk is largely credit risk assessed on documented income, collateral and bureau history, with decisions made by people. In a digital lending business, the same accountability sits over a fundamentally different machine:

Algorithmic underwriting. Decisions are made by models, at volume, without human review. The CRO is accountable for outcomes they cannot inspect case by case, which means their real control is over model governance, monitoring and the policy layer rather than individual approvals.

Alternative data. Bureau data is thin or absent for a large share of Indian borrowers, so scoring draws on bank statements, device signals, employment data and account aggregator feeds. Each source carries its own reliability, bias and regulatory question.

First loss default guarantee arrangements. Where lending is done in partnership, the allocation of first loss changes the real risk position materially, and the structure is a risk decision as much as a commercial one.

Co-lending and partnership risk. When the balance sheet is shared with a bank, the partner's credit policy and yours have to coexist, and the CRO owns the reconciliation of the two.

Collections as a risk function. Early delinquency containment and recovery architecture sit with risk in most digital lenders, including the conduct questions that come with them.

Model risk and drift. A model that performed through one credit cycle may not through the next. Someone has to own the question of when a model has stopped working, and that is not a data science decision alone.

The systems underneath this are covered in lending decision infrastructure and real-time fraud and risk decisioning.

Which backgrounds transfer

The reliable pattern is that the two halves of the job, regulatory risk governance and quantitative portfolio risk, sit in different people more often than in one. A brief that insists on both at a high level is describing a genuinely rare candidate, and the search should be priced and timed accordingly.

Where a client cannot find both, the usual resolution is to hire for the accountability half and build the analytical half beneath, because the regulator is holding the CRO responsible for governance and independence rather than for model design.

How to assess

Four areas, in the order they tend to be diagnostic.

Independence under pressure. Ask for a specific occasion when the candidate blocked something the business wanted, what it cost them, and what happened next. Candidates who have genuinely held the line have a concrete answer, often an uncomfortable one. Candidates who have not will answer in principle.

Model governance without being the modeller. Ask how they would satisfy themselves that a scorecard they did not build is fit to approve lending. Strong answers cover validation, challenger models, monitoring thresholds, and what would trigger them to withdraw it. Weak answers defer to the data science team.

Regulatory fluency. Ask what they would expect an RBI inspection to focus on in a digital lending book. A candidate who has been through one answers specifically. This question separates people fast.

Portfolio judgement. Ask about a book that deteriorated, what the early signals were, and whether those signals were in the reporting before anyone acted. The best risk leaders are precise about the gap between the data existing and the organisation responding.

The search reality

It takes longer than equivalent seats. A board-approved appointment with a fixed tenure involves more decision-makers than a standard executive hire, and the strongest candidates do diligence on the board's appetite for independence before they commit. Plan for a longer process than a comparable commercial role.

The pool is small and almost entirely passive. Few people have run risk for a digital lending book at scale in India, and the ones who have are in post. These searches are built from a named market map and direct approach, not from advertising. Our method is set out in how we search.

Hire before the threshold, not after. The most common pattern we see is a lender crossing ₹5,000 crore and only then starting a search, which puts a regulatory clock on a process that cannot be rushed without compromising it. Fast growth makes the crossing date forecastable; the hire should be timed against that forecast.

Compensation reflects the constraint, not just the level. A role that prohibits other responsibilities, carries a fixed tenure and exposes the holder to regulatory reporting on removal is priced differently from a general risk leadership seat. Candidates are explicit about this, and offers that treat it as a standard executive package tend to be declined late.

The adjacent regulated appointments are the Chief Compliance Officer, which has its own RBI framework and its own dual-hatting prohibition, and the CISO. Together they form the mandated leadership layer of an Indian fintech, and companies crossing into regulated scale usually need all three within the same eighteen months.