Posted on

DEPA is India’s structural response to AI’s prevailing political economy

The prevailing political economy of AI development and use is characterised by highly concentrated power and extractive economic models. By making access to valuable data and its responsible use for AI development less dependent on the scale and bargaining power of a handful of dominant market players, India is beginning to reshape who gets to participate in the AI economy, on what terms, and who benefits. The recent launch of DEPA for AI Training Handbook by the Ministry of Electronics and Information Technology marks India’s concrete step towards laying the foundations for a more equitable, safe and participatory AI economy.

The global artificial intelligence (AI) economy is taking shape around an unprecedented concentration of capabilities. A handful of frontier AI labs, hyperscalars, and advanced economies exercise disproportionate control over critical layers of the AI value chain, spanning energy, compute, data infrastructure, models and applications. This concentration is shaping not only who develops AI, but also who captures its economic value and sets the terms of participation, often through extractive models of value creation. This presents a fundamental political economy challenge. At its core, among other questions, is who controls and can access the data needed to develop AI.

Much of the high-value data needed to develop contextually relevant AI resides with hospitals, banks, universities, businesses and public institutions. Yet existing arrangements for accessing and using it often require institutions to risk compromising control over sensitive information, navigate cumbersome and expensive bilateral agreements or forgo participation altogether. At the same time, rising expectations around the enforcement of privacy, data rights and accountability in AI development and use are placing greater demands on AI developers—not that this is undesirable; these safeguards are crucial. However, the infrastructure and expertise needed to meet these expectations remain concentrated among well-resourced incumbents, potentially turning safety into another barrier to entry and reinforcing their unfair advantage.

The challenge is therefore to democratise the conditions for AI participation: making critical inputs accessible, enabling adaptation to local needs and embedding safeguards without concentrating control or imposing prohibitive costs on new market entrants.

Reimagining the economics of data access

India’s Data Empowerment and Protection Architecture (DEPA) for AI Training is a structural intervention in the prevailing political economy of AI. It seeks to decouple access to valuable institutional data for AI training from the need to surrender control over it. Rather than requiring institutions to transfer their underlying datasets, DEPA for AI Training enables models to be trained where the data resides. Confidential clean rooms, privacy-enhancing technologies such as differential privacy, machine-enforceable contracts and auditable records provide the safeguards to make this possible. Multiple institutions, both within and across borders, can therefore collaborate on training models within controlled environments without exposing or relinquishing custody of their respective datasets. 

This changes the economics of AI participation in two important ways:

First, it advances equity by widening access to the inputs needed to build AI. Valuable institutional datasets become usable without data owners relinquishing privacy, confidentiality, or institutional control. Common infrastructure and reusable safeguards reduce the costs of trusted collaboration, enabling resource-constrained developers and researchers to access data and participate in AI innovation on a more equitable footing alongside established players. Traceable data use, attribution and appropriate economic arrangements can also allow data providers to participate more meaningfully in the value generated from their contributions. DEPA for AI Training thus begins to shift the data economy from extraction and concentrated control towards rights-respecting access and distributed participation.

Second, it lowers the premium on safety by making safeguards part of the shared infrastructure. As the universe of AI trust and safety requirements expand and become more demanding, the cost of independently developing and demonstrating trustworthy AI risks becoming another market barrier, disproportionately favouring well-resourced incumbents. By embedding safeguards for privacy, data rights and accountability into shared digital public infrastructure, DEPA for AI Training can reduce this burden and make responsible AI development more accessible. Safety thus becomes an enabler of wider participation rather than a market barrier that favours only those with the resources to meet its rising costs.

In summary, DEPA for AI Training has laid the foundations for a more inclusive political economy of AI—one that broadens access to data for beneficial AI innovation and local adaptation, preserves institutional control for data custodians and rights holders, and makes responsible AI development accessible beyond well-resourced incumbents.

Please note: The blog post is authored by Raj Shekhar, a volunteer with iSPIRT.

Posted on

Reimagining Data Empowerment for the Age of Intelligence

The recent publication of the DEPA for AI Training Handbook has invited a necessary and rigorous public debate. Because the Handbook is explicitly a draft for discussion, this kind of sharp feedback is not just welcome, but essential for co-creation.

The debate raises two important questions: whether individual consent alone can adequately protect people in the context of AI training; and whether the presence of existing cryptographic primitives necessarily diminishes the architectural ingenuity of Digital Public Infrastructure (DPI).

An Evolvable, Modular Architecture

From its inception, DEPA was never conceived as a single product or a static specification. When iSPIRT first conceptualized DEPA in 2016, and NITI Aayog published the draft discussion paper in August 2020, it was explicitly framed as the final layer of India Stack—an evolving architectural philosophy aimed at resolving a singular paradox: How do we empower citizens and unlock the societal value of data without compromising privacy or concentrating market power?

Even the 2020 NITI Aayog paper anticipated going beyond consent, explicitly stating: “It goes without saying that consent alone cannot be the only backstop to prevent data misuse… Mechanisms that enable consent can exist on a spectrum.”

What launched in 2021 as the Account Aggregator (AA) rail was merely the first instantiation of DEPA—built using the primitives available at the time to solve for 1-to-1 retail data portability. Like previous digital public infrastructures, DEPA’s core mission of empowerment and protection remains invariant, even as its cryptographic primitives modularly expand to include Confidential Clean Rooms, Electronic Contracts, and Differential Privacy to solve for the age of AI.

This evolution can be understood through three complementary pathways: DEPA with consent, enabling individual data sharing through Account Aggregators; DEPA with informed consent, enabling privacy-preserving computation across institutional boundaries through Private Inferencing; and DEPA for AI Training, enabling collective data use for AI training. These pathways are complementary, not competing or sequential, and together support information flows at individual, institutional and industrial scales, while preserving Protection and enabling Empowerment.

The Genealogy and Limits of Digital Consent

“Notice and Choice” was designed for a 1-to-1 bilateral relationship where the user understands the exact deterministic outcome of sharing a record—such as porting a bank statement to secure a loan. Consent was always a means to an end; the primal goal is privacy itself.

When applied to modern machine learning, elevating individual consent above all other safeguards can lead to systemic failures. In 2004, the Canadian Stroke Network mandated that hospitals obtain individual, opt-in consent from every patient before their de-identified records could enter a national registry. Participation rates collapsed, and the resulting dataset was fatally skewed. In-hospital mortality among the “consented” patients was 6.9%; among the unconsented patients, it was 21.7%. By treating individual consent as the sole gateway to collective medical knowledge, the system produced a dataset that was scientifically blind to the very patients most at risk.

This illustrates a broader paradox: an over-reliance on individual consent can reduce empowerment to repeatedly clicking through consent requests without meaningful understanding or control, while excluding people from the benefits of collective data use. It can also introduce selection biases that leave vulnerable populations underrepresented. If India requires every rural clinic patient to execute a real-time retail portability flow before their de-identified clinical outcomes can inform a national oncology or tuberculosis model, its poorest citizens risk being statistically erased from the medical intelligence of the future. In trying to preserve individual agency through consent alone, we risk undermining it and defeating the larger objective of ensuring that individuals and communities can participate in and benefit from the data economy.

This does not mean that consent should be dispensed with where it is legally required. Rather, consent must be meaningful. Where the purposes of AI training are not clearly defined, or individuals lack meaningful and enforceable avenues to revoke consent and exercise their rights, consent risks becoming a procedural formality. This raises important questions about meaningful consent and informational autonomy under the Indian Digital Personal Data Protection Act, 2023 and the principles articulated in Puttaswamy (2017). What is right must be done even when it is difficult to implement.

More critically, consent is permission, not protection. Millions of users have clicked “I Agree” on platforms or signed up for workspace tools whose Terms of Service permitted AI training. Because neural networks are lossy compression systems, research has time and again proved that standard LLMs inadvertently memorize verbatim sequences from their training data. Through membership inference and divergence attacks, adversaries have extracted real names, phone numbers, and private medical discussions from models trained on “consented” data. Consent gave the AI lab legal immunity, while leaving the user with zero privacy.

This exposes the illusion of revocability. Under true data protection frameworks, consent must be revocable. You can seamlessly revoke access to a bank statement. However, once a neural network’s weights are updated via stochastic gradient descent, the mathematical influence of a single record is permanently diffused across billions of parameters. “Machine unlearning” remains an unsolved computer science problem without retraining the entire model from scratch at a cost of millions of dollars. 

The Novelty of the Data Economy

There also has been a mention of Finland’s Findata (2019), the UK’s NHS Secure Data Environments (2022), and the Penn Medicine Federated Learning project (2022) to argue that DEPA for Training lacks novelty.

But by this yardstick, no DPI in history is novel. Aadhaar did not invent biometrics; UPI did not invent QR codes or XML messaging. Every successful DPI is built on a triad: a market, a policy, and a technical architecture. The genius of DPI lies in protocolizing battle-tested primitives to solve market failures—collapsing the transaction costs of search, bilateral bargaining, and enforcement across an entire economy.

In fact, DEPA is not just a secure enclave. We agree that secure enclaves have existed for a really long time, but historical evidence shows that without an ecosystem protocol, seamless multi-party data collaboration and private inferencing simply have not happened at scale. A standalone clean room works when data is homogeneous and centrally held by a state monopoly, like the NHS. However, it completely breaks down for multi-party, cross-sectoral collaboration. If an agritech researcher wants to train a predictive model combining private insurance claims, localized crop yields, and real-time weather data, a singular enclave model fails. The data legally and technically cannot be pooled into one centralized repository.

Even successful federations, like the Penn Medicine brain tumor study (which achieved 99% accuracy), required 71 institutions to spend years negotiating bespoke legal agreements and custom IT integrations. In the private market today, cloud vendors are signing bespoke $200 million deals to run models inside proprietary clean rooms—locking data inside one vendor’s walled garden.

DEPA for Training turns Confidential Clean Rooms into an open, interoperable techno-legal rail. Any data provider can contract with any innovator using standardized machine-readable policies.

The novelty here is not necessarily in the individual components, but in their combination. A new drug can be novel even when its constituent ingredients are already known; the innovation lies in how those ingredients are combined and formulated. DEPA similarly brings established technical and institutional components together into a new interoperable architecture.

The Third Data Economy

Finally, a critique of AI architecture must answer who captures the downstream value. It has been argued that the Handbook overlooks Data Principals, benefiting only institutions and model builders.

This critique ignores the stark reality of today’s global AI economy. Right now, the market is bifurcated between two extractive structures: the free market model of bilateral data brokers, unlicensed web scraping, RL environment and synthetic annotation marketplaces (where annotators are paid pennies at the bottom of the value chain while foreign labs own the frontier models), and the China model of state-centralized pools. In both current structures, individual citizens receive absolutely zero downstream benefit from the intelligence their data helped create.

It also overlooks the institutional design laid out in the Handbook itself. Section 2.2 explicitly introduces Data Collaboratives. Historically, the marginal economic value of a single individual’s data point is near zero, making 1-to-1 monetization virtually impossible. However, by enabling data collabs individuals gain the collective bargaining power required to negotiate equitable terms with global AI labs while ensuring that individual privacy is not compromised. 

Most importantly, a Digital Public Infrastructure does not mandate a single, rigid business model; it builds the programmable rails that make equitable models technically possible for the first time.

DEPA proposes a third kind of data economy where true value is realized for individuals and institutions alike through three structural guarantees:

  1. Data never changes hands: Raw data stays with its fiduciaries or community cooperatives; the computation travels to the data inside an attested clean room.
  2. End-to-End Provenance: Every dataset card, contract signature, attestation log, and spent privacy budget is recorded on a verifiable ledger.
  3. Programmable Value Sharing: Because every training and inference run is cryptographically metered under an Electronic Contract, DEPA can build the exact rails required for ongoing royalties, per-use compensation, collaborative model ownership, and priority clinical access for the public hospitals and communities whose data powers the breakthroughs.

This is particularly important for recognising the collective value generated by individual contributions. Data Principals contribute data that can be pooled through Data Producers and Data Collaboratives to create a larger resource with economic value. Institutional arrangements can then provide a mechanism for attributing and sharing a proportionate part of that value with contributors.

When we unbundled payments with UPI and credit data with Account Aggregator, critics similarly argued that existing banking rails were sufficient or that the labels were imperfect. Yet protocols beat platforms every time. DEPA is not a departure from citizen empowerment—it is what empowerment looks like when we graduate from data governance to governance of intelligence.

Posted on

The EDF Backlash Is a Symptom of a Bigger Systemic Silos Problem in Government

EDF Backlash

There is a strong backlash over the Reserve Bank of India’s new Export Declaration Form (EDF), particularly from freelancers, gig workers and small service exporters, which deserves attention, not simply because of the compliance burden it may create, but because it exposes a larger problem in how the government regulates the economy.

The EDF form is an export declaration form under RBI’s Notification No. FEMA 23(R)/2026-RB, January 13, 2026. This notification was announced to remove Softex form and make export declaration f uniform across Software and other services. However, it resulted in trapping small exporters who were not filing Softex earlier becuase they were not exporting Software or were exporting Software that falls in to P802 purpose code. Many of these are Gig Workers (Freelancers) doing small exports and receiving foriegn exchange either directly or through some freelancer aggregator platform or from content platforms. All these were in some form providing data to RBI when remittance acceeptance and purpose code declaration is done. Hence, introduction of one more filing requirement in form of EDF created uproar in this category of exporters. This category may be small in export size but important for Gig economy.

An exporter does not operate under FEMA alone. Had RBI considered the other laws affecting exporters of all sizes, from smallest to largest, before preparing this new FEMA notification, the problem would not have arisen. 

This is not an argument against regulation. RBI has a legitimate responsibility to monitor foreign exchange and export realisation. But regulation designed in isolation can create unintended compliance costs and, more importantly, undermine the larger government’s Ease of Doing Business objective. 

The systemic problem is that one regulator does not consider or interact with other regulators. 

RBI can adopt a simple solution to the EDF problem

In the short run, RBI can consider exempting small exporters earning below 20 lakhs from GST registration. For exporters earning above 20 lakhs, RBI (through IBDIC) should create a digital EDF on common infrastructure, accessible to authorised banks and relevant government systems, with the necessary information flowing into EDPMS.

In the long run, everyone should be brought under this data capture and not abandon EDF. But make its implementation fully digital. For goods, exporters submit to ICEGATE; the EDF is auto-generated from the submitted data. Similarly, for Services and Intangibles, EDF can be auto-generated from data submitted by exporters to 

  1. From GSTR-1, from data submitted to GSTN for those registered with GST Or
  2. Banker at the time of remittance for those not registered with GST

This would also solve a problem for banks. Banks ultimately need to reconcile export proceeds and close the transaction in the regulatory system. If the export declaration, payment and realisation information are digitally connected, much of this reconciliation can move from manual compliance to straight-through processing.

The principle is simple: Declare once. Reconcile automatically. Share the information with every authorised government consumer.

Ensuring cross-regulatory sanctity and ease of doing business.

The exporter sees one transaction. The government sees multiple regulatory transactions because each department sees the transaction through its own statute.

The larger lesson from the EDF episode is that whole-of-government cannot mean merely asking departments to coordinate after a regulation has been designed.

Whole-of-government must begin at the design stage of regulation itself.

Before creating a new compliance requirement, the regulator should ask: Which other laws apply to this transaction? Which other departments regulate it? What thresholds already exist? What information has already been submitted? Which government system already holds it? Can the new requirement be fulfilled through an existing digital system rather than through another form?

These questions should become part of the regulatory design process.

The EDF episode is therefore a small but important warning.

Government must stop designing regulation department by department when businesses operate transaction by transaction.

The next generation of Ease of Doing Business will not come merely from removing regulations. It will come from making different regulations work together.

For this, the Government must pursue a Unified Digital Trade system. This requires a genuine whole-of-government approach—and, eventually, the Connected Digital Public Infrastructure (Digital Port) to make it possible.

Posted on

Digital Port as a Unified Cross-Border Trade System

Digital Port

A connected DPI system is needed as a solution

“Digital colonisation” is no longer theoretical. A handful of large US-based technology companies have dominated, but with AI, that colonisation can be completely disastrous. India remains primarily a consumer of foreign digital products and services. The need for “Sovereign AI” recognition alone is recent and very late. AI can flip our services trade, which accounts for over 40% of India’s exports, from export surplus to import surplus.

Digital trade governance is a challenge.

No one knows today how much businesses and individual consumers use ChatGPT or Claude. We lack the systems needed even to measure, track, or govern the consumption of foreign digital products. 

Reason → The system is broken – India’s trade governance architecture remains overwhelmingly goods-centric. Physical goods move through ports and customs checkpoints, but Digital products move through communication networks and “electronic transmissions” undetected. 

3  Corollaries arise from here 

  • Intuitively, what is digital must ultimately be governed through digital means. 
  • India has demonstrated its capability to build sovereign-scale digital infrastructure by creating DPI like UPI and Account Aggregator-led FinTech.
  • Trade governance can’t be done in regulatory silos in the data-driven AI era. 

Cross-border digital trade now requires a similar strategic intervention.

We need a reimagined trade management architecture. A unified digital framework for both goods and services. 

The digital silos of GST, DGFT, ICEGATE, and RBI must be connected to form a connected systems DPI. A unified DPI across these systems enhances trade governance for both goods and services. It helps manage the movement of physical goods through ports, as well as intangible assets like services and intellectual property, by positioning them as a “digital port”.  

The challenge is not a lack of data, but fragmented systems that don’t share it. The power of connected systems DPI is that it can be built:

  1. Without centralising data, and
  2. Departmental boundaries remaining intact

Gains from Digital Port are multiple: some early, some advanced.

  • Export Financing: GSTN has emerged as the primary source of truth for export invoices. The consequences are significant. Small exporters struggle to access export credit on time. GSTN and ICEGATE sharing invoices for verification will remove double-dipping of Invoices.
  • Unified Trade filing: Export and Import filing can become seamless if GSTN reconciles export invoices online with bank remittances. 
  • Domestic value addition (local content) measurement can be done for every firm and product. 
  • Cross-border digital e-commerce: presently, B2C digital trade leaks revenue. 
  • Fraud detection remains inefficient because visibility is fragmented.
  • Unified duty-free import schemes can be digitised and integrated. Proposed industrial parks and manufacturing corridors can offer a healthy mix of manufacturing and digitally managed export zones with integrated bond management systems.

This transformation is no longer optional.

BTN was announced in 2025. An effective way to achieve foolproof BTN is to connect DGFT, GSTN, ICEGATE, and RBI systems. This can evolve into a “Digital Port” or BTN++.

Conclusion – Overcome Slios & adopt Whole of Govt Approach

The Honourable Prime Minister has called for overcoming silos in Government and adopting a whole-of-government approach. Connected Systems DPI helps achieve this. The Concept of Digital Port is based on the same approach.

DGFT has taken up BTN development. However, a) BTN is limited to export financing for now, and b) it seems the approach is still to build BTN as another digital Silo and limit development within DGFT’s walls. 

  1. → BTN should not become another digital silo.
  2. → It should become the connective tissue of India’s trade architecture.
  3. → Establish a ‘Trade DPI’ Institution (or SPV) Quickly

Create or designate a neutral Trade DPI body, analogous to the role played by GSTN, to steward common standards, APIs, the interoperability layer, and the ecosystem.

With the formation of a three-member Secretary Committee, the Government of India has already made data sharing one of its top priorities. Government has to rally behind the concept to build a “Digital Port”. Data Sharing by GST, Customs and RBI is a necessity; any hurdles in the way must be removed.

This connected-systems DPI in foreign trade can be built as a vertical, as most of the systems are already digital in the set of GST, ICEGATE, RBI (EPDMS and IPDMS), and DGFT.

This would position India to build one of the world’s first “Digital Ports” for the Digital economy in the AI era, while also including physical goods. Our DPI can then be used across the entire Global South. This can be another milestone in our DPI journey and global DPI positioning, while strengthening our economy internally through frictionless trade and ease of doing business.

Posted on

AIIMS Delhi and SolarWinds: When Trust in Digital Infrastructure Collapses

One was a 2 week ransomware siege that forced India’s top public hospital onto pen and paper. The other was a month-long espionage operation, hidden inside trusted software that went undetected across the US government and Fortune 500 companies until a security firm found it by accident. Most major breaches aren’t masterminds at work, they are ordinary, known risks such as an unpatched server, an unwatched build pipeline that became a crisis. AIIMS Delhi and SolarWinds show two different failures: one loud and aimed at a hospital, the other silent and aimed at the software supply chain everyone quietly depends on.

AIIMS Delhi (India, November 2022)

On 23rd November 2022, engineers managing servers at AIIMS New Delhi, a 2,500 bed public hospital, found 5 of roughly 100 servers compromised. The e-Hospital system running registration, admissions, billing and lab scheduling went dark. For nearly two weeks the hospital ran entirely on paper and the digital services weren’t fully restored until 6 December.

Media reports, citing police sources, put the ransom demand at roughly ₹200 crore ($23–24 million), allegedly from LockBit, though no payment or attribution was ever confirmed. What is confirmed is that an estimated 30–40 million patient records were compromised. Delhi Police classified the case as cyberterrorism under Section 66F of the IT Act, and the CBI, NIA, Intelligence Bureau, and CERT-In all joined the probe, with jurisdiction itself a point of confusion.

The root cause was that the AIIMS systems hadn’t been meaningfully upgraded in decades along with the weak network segmentation due to which the 5 compromised servers took down the whole digital backbone. When AIIMS faced a second intrusion attempt in November 2023, the government confirmed no breach and no disruption thus proving that these attacks are survivable when checks are in place.

The SolarWinds Hack (United States, 2019–2020)

SolarWinds’ Orion platform is unglamorous network monitoring software used by roughly 33,000 organizations reflecting that it had privileged access deep inside their networks. Around September 2019, suspected hackers quietly entered SolarWinds’ own build environment. In February 2020, they inserted a backdoor SUNBURST into Orion’s source code before it was compiled and signed. Between March and June 2020, roughly 18,000 customers downloaded that legitimate, malware-laced update. It sat undetected until December 2020, when cybersecurity firm FireEye discovered its own breach traced back to a corrupted Orion update. Attackers had used the access to reach a smaller set of roughly 100–200 high value targets, reportedly including the US Treasury, State, Homeland Security, Commerce, Justice and the Energy departments plus the National Institutes of Health, Microsoft, Cisco, Intel and Deloitte.

Nothing was encrypted or ransomed, this was intelligence gathering, which makes the cost harder to tally but no less real. SolarWinds spent over $40 million in three months on remediation, paid $26 million to settle a shareholder lawsuit, and fought a 2 year SEC case naming its CISO for allegedly misleading investors. Some estimates put economy-wide cleanup costs as high as $100 billion. The deeper lesson, hackers didn’t breach 18,000 organizations one by one, they breached 1 trusted vendor and let its own signed update do the work, since standard practice wasn’t built to question a signed update from a known vendor.

What Each Stakeholder Should Take Away

CEOs and Board Members: AIIMS shows what happens when internal risk goes unexamined for years. SolarWinds shows a signed, trusted update can be the attack itself. Ask which vendors or systems could halt operations for two weeks, treat routine updates as verifiable and rehearse a prolonged outage before one happens for real.

Regulators: India had no data protection law when AIIMS was breached. The DPDP Act wasn’t notified until August 2023, with full enforcement not expected until 2027. The US moved faster, the executive order arrived within 6 months, mandating Zero Trust and SBOM requirements but the adoption has been uneven, and the SEC’s CISO case was ultimately dismissed. Even fast regulation can end up short on teeth.

The Public: AIIMS was directly disruptive — delayed labs, exposed diagnoses. SolarWinds was quieter, aimed at governments and corporations, not consumer data but it’s a reminder that software behind the institutions holding your health data can be compromised even when nothing looks wrong but is worth expecting real security discipline and not just a reassurance message.

Interested? Visit our website

Please note: The author of this blog is Shantanu Kohli, with inputs from Girish Elchuri & Rinka Singh.

Posted on

SAKRAM: A Practice

For a long time, cybersecurity was seen as a defensive measure used to block threats, fulfill compliance requirements and was considered a burdensome cost to be handled by the IT team alone. As technology has evolved, so has our perspective. Today, cybersecurity plays a direct role in driving business growth, ensuring operational continuity and building long term resilience. The questions organizations ask have changed as well. Instead of focusing only on how to prevent breaches, businesses now ask how to stay operational, recover quickly and maintain trust when incidents happen. This reflects an important shift from seeing cybersecurity as a simple protection measure to recognizing it as a foundation for resilience. 

Whether you’re running an IT services company, a financial institution, a manufacturing unit or a startup, your business runs on digital infrastructure. Data, applications, and platforms are now core business assets and when these are at risk, your entire business is at risk. This means cybersecurity can’t remain confined to the IT department. It needs to align with your business strategy, executive decisions, operational planning, and customer expectations. 

In cybersecurity, risk never disappears, it only changes owners. A strong cybersecurity strategy rests on 5 pillars that work together to build organizational resilience: 

  1. Governance & Leadership: When leadership is committed, cybersecurity becomes part of a company’s culture rather than just a technical concern. 
  2. Risk Management & Assessment: Regular assessments help identify critical assets, vulnerabilities, and potential impacts. Understanding what needs the most protection helps you allocate resources efficiently. 
  3. Incident Response & Recovery Planning: Even strong defenses can fail. A well tested incident response and recovery plan ensures quick detection, containment, and recovery while minimizing downtime and damage. 
  4. Employee Awareness & Training: Human error is still a leading cause of breaches. Regular training transforms employees
  5. Continuous Improvement & Adaptation: Threats evolve daily, so your defenses must adapt too. Cybersecurity is an ongoing journey of learning, testing, and improvement.

An effective cybersecurity program requires continuous focus and adaptation from every department and individual in the organization, becoming an ongoing practice rather than a one time project that works in loops to address alerts, issues, vulnerabilities, and changes as they happen.

At iSPIRT, SAKRAM is our proposed solution to comprehensively deal with cybersecurity threats. It is a comprehensive practice designed to help organizations strengthen their cybersecurity defenses and protect their digital assets, along with those of their partners and customers. It is built on the principle of continuous execution, facilitating what we call an “Always Secure” system. Over the coming weeks, we will be publishing a dedicated series of blogs (and videos) that unpack SAKRAM in depth: what it is, how it works and how your organization can put it into practice. Each piece will build on the last, giving you both the strategic picture and the practical tools to act on it.

Note: This is the first part of a multi-part blog series.

Interested? Visit our website

Please note: The author of this blog is Shantanu Kohli, with inputs from Girish Elchuri & Rinka Singh.

Posted on

Broadening Credit Access: The Quiet Evolution of OCEN

Financial ecosystems are rarely transformed overnight. Instead, they evolve through the steady
alignment of technology, policy, and trust. Over the past year, the Open Credit Enablement
Network (OCEN) has been moving quietly in this direction, acting as a digital bridge between
credit-starved MSMEs and a diverse pool of lenders.
The Growth Narrative: In Q1-2025, the network facilitated 5,641 loans totaling 19,795 Lacs.
Fast forward to Q1-2026, and the momentum has scaled to 35,485 loans with a disbursement
value of 112,484 Lacs. This represents a 468% surge in disbursement value—a testament not to
the protocol alone, but to the readiness of the Indian MSME to embrace digital, cash-flow-based
credit.

Strengthening the Foundation

Beyond the numbers, the structural progress of the ecosystem offers a glimpse into a more
inclusive future. Today, six diverse lenders—ranging from large Public Sector Undertakings
(PSUs) to agile NBFCs—are live on GeM Sahay and many others in the process of integration.
This diversity ensures that credit is not a ‘one-size-fits-all’ product but is tailored to the risk
appetite and specific needs of the borrower.
The horizon is also widening. We are currently piloting programs for Non-Sole Proprietors on
GeM Sahay, significantly expanding the eligible borrower base. Furthermore, MSME suppliers to
the CGDA can now avail finance against Purchase Orders via GeM Sahay, marking a critical step
in supporting those who serve our national interests.

The Quality of Growth

A frequent concern in rapid credit expansion is delinquency. However, OCEN’s emphasis on
cash-flow-based lending rather than traditional asset-based collateral has yielded encouraging
results. To date, lenders have observed negligibly low delinquency across programs, proving that
data-backed lending to the ‘unbanked’ is not just a social imperative, but a sound financial
strategy.

Looking Ahead: An Invitation to the Ecosystem

The journey has only just begun. We are actively developing programs that touch every corner of
the economy:

  • Micro-MSMEs: Providing vital credit to the gig economy and individual workers.
  • Agri & Dairy: Strengthening the backbone of rural commerce through value-chain
    financing.
  • Digital Sellers: Empowering e-commerce marketplace sellers and MSMEs using modern
    ERP/Accounting software.
  • Regional Clusters: Addressing the unique needs of localized industrial hubs.

For lenders, platforms, and technology providers, OCEN represents a unique opportunity to
participate in a high-growth, low-friction credit market. As we move forward, we remain
committed to a humble approach—learning from the data, listening to our partners, and ensuring
that every disbursed Rupee contributes to the broader story of India’s economic resilience.

OCEN: Empowering Growth, One Transaction at a Time.

For more information, please visit: http://ocen.dev

Please note: The blog post is authored by our volunteer, Rahul Bhaik

Posted on

A Budget that missed the opportunity for being bold on both Strategic Autonomy & Reform action

 iSPIRT Foundation, a technology think-and-do tank, believes India’s hard problems can be solved only by leveraging public technology for private innovation. iSPIRT, as a think-and-do-tank, pioneered the concept of Digital Public Infrastructure (DPI)

The Budget starts by acknowledging that India is facing “an external environment in which trade and multilateralism are imperilled and access to resources and supply chains are disrupted”. But the details aren’t in line with the idea. The Government also acknowledged AI and cutting-edge technologies as force multipliers for better governance. 

AI has been spoken about a few times at different places. However, there is no material proposal on AI, except as a tool for “Bharat-VISTAAR”—a multilingual AI tool in agriculture.

FM announced Manufacturing support to seven strategic and frontier sectors, including Bio-Pharma, Chemicals, Semiconductors, and Electronic Components. This will help the ecosystem build up in these sectors and, in a way, support the cause of “Product Nation” from a building capacity and infrastructure point of view. However, it does not address “strategic autonomy” and technological sovereignty as a thought process. 

The one that most closely links to “Aatmnirbhar Bharat” or strategic autonomy is the announcement on ISM 2.0, to produce equipment and materials, design full-stack Indian IP, and fortify supply chains, including skilling and training. Also, the mention of established dedicated Rare Earth Corridors is a welcome move to fill the gaps in the supply chain in these areas, given the geopolitical situations. 

Any Government announcement takes about 2 years to roll out in the field. The AI Mission, National Quantum Mission, Anusandhan National Research Fund, and Research and Development and Innovation Fund have been mentioned by the FM in speech. RDI is rolling out now. The government missed the bus to announce a “market access” scheme or a fund for the products developed after taking all the steps in R&D and frontier technology advancements. 

We have maintained that our Economic Policy will need to foreground Strategic Autonomy as a core pillar, which becomes all the more imperative in the current global geopolitical scenario. But Strategic Autonomy is not possible without technological sovereignty. While the government has taken steps to “reduce critical import dependencies,” at a time when “new technologies are transforming production systems”, incremental steps are not enough.

“A market access plan for Indian products designed and developed in India by resident Indian companies is the need of the hour for any fruitful outcome from R&D and product development. The Government must consider this with all seriousness in the future,” said Amit Agrahari, volunteer at iSPIRT Foundation.

Last year, Bharat Trade Net was announced as an integrated trading platform. This year’s announcement of “Customs Integrated System (CIS) as a single, integrated and scalable platform for all the customs processes and use of non-intrusive scanning with advanced imaging and AI technology for risk assessment, takes the thought to the next level.  This is very much in line with our National Regulatory Compliance Grid (NRCG) approach and use of advanced technology for data-driven governance. 

However, our proposal of building a NRCG for all regulatory systems is still waiting. “Unless we use a Grid approach for digital transformation and connect all regulators, it is going to be difficult to reduce the regulatory cholesterol”, said Sudhir Singh, an iSPIRT Volunteer looking after Ease of Doing Business, and Policy. 

Linking TreDS with the GeM portal is a welcome step towards unlocking true Digital potential in Ease of Doing Business for MSMEs. “This can further create a grid approach by connecting to the Open Credit Enablement Network (OCEN) and trade finances for SME exporters,” said Tanuvi Thakur, volunteer at iSPIRT Foundation. This will further aid EoDB through quicker and cheaper access to credit by MSMEs. 

The other major welcome step in this regard has been the in-principle movement from penalty and prosecution to fees. This has also been our core decriminalisation aim for achieving EoDB.

Overall, it’s a subdued Budget despite the challenging geopolitical environment rather than a bold Budget that speaks on both “strategic autonomy” and “reforms”.

About iSPIRT Foundation – We are a non-profit think-and-do tank that builds public goods for Indian product startups to thrive and grow. iSPIRT aims to do what DARPA or Stanford University did in Silicon Valley for startups. iSPIRT builds four types of public goods – technology building blocks (aka India Stack), startup-friendly policies, market access programs like M&A Connect, and Playbooks that codify scarce tacit knowledge for product entrepreneurs of India. For more, visit www.ispirt.in.

For further queries, please reach out via email:  [email protected], [email protected] 

Please note: The blog post is authored by our volunteers, Sudhir Singh, Tanuvi Thakur and Amit Agrahari

Posted on

EDF replaces Softex form. Your Bank can Certify Software Exports from October 01, 2026 

We had published a Blog in 2016 on Sofex form confusion. It became one of the most-read pieces on our blog. Read here for ready reference.

Since then, we have been exhorting the Government to remove the Softex and, more specifically, after GST came into existence. Softex forms have been replaced by RBI in a recent notification with a single form called the Export Declaration Form (EDF), for both Goods and Services. This Blog helps you decipher the Gazette Notification No. FEMA 23(R)/2026-RB given here (Click to read) dated 13 Jan 2026.

While we have been advocating for bold reform by the RBI and related foreign trade regulators, the RBI has delivered only on one part. A 100% digital transformation of regulatory systems could help India move from the 6-7% growth bracket to the 9-10% growth bracket. Unfortunately, the current policy step misses this opportunity. We hope there will be corrections to adopt a bold stance soon. 

We have analysed below what this current notification has in store for the exporters in the Software or Services sector from October 01, 2026, the date when this notification comes into force.

What does it mean for the software sector?

Is Softex abrogated?

The Softex form will not exist from 1st October 2026, but the export declaration will remain. RBI has mandated one single form known as the export declaration form (EDF). All goods and services (including Software) exporters will file EDF forms.

Is it still mandatory to get STPI certification?

RBI, through this notification, now recognises Authorised dealers as “Specified Authority” at par with STPI in DTA. Hence, STPI certification will not be mandatory, and Software, IT, or ITeS businesses in DTA will have the option to get it certified by bankers after 1 October 2026.

However, if an authorised dealer, i.e. your bank, wants STPI or SEZ to certify, then it may not be possible to bypass STPI. So this remains to be clarified after the banks notify their process, as the RBI has left the process to the banks.

Software definition

RBI has issued an interim relief earlier, asking IT-Enabled Services to be exempted from STPI /SEZ certification and to directly file with banks under the purpose code P802. This relief had come very recently, less than a year ago. Why code 802 came into existence is not known in the public domain.

The notification defines “Software” as “any computer programme, database, drawing, design, audio/video signals, any information by whatever name called in or on any medium other than in or on any physical medium.”

It is a very ambiguous definition, and it seems to include everything intangible. Effectively, this means only services that are delivered physically onsite in a cross-border geography will be out of the scope of this definition. After this notification, the distinction between Software, IT Services, and IT-enabled services will vanish. There is no clarity in the use of the purpose code in the notification. Perhaps this will evolve into standard operating procedure by banks in future and remove some of the anomalies.

It would have been better to accommodate this for the clear classification and separate purpose code for the following, or a way to map it with HSN and Service Accounting Code (SAC) as used by CBIC.

What and who is a specified Authority?

The notification does not define ‘specified officer’ but names them. The way this is defined will still keep some confusion alive.

(i)  Commissioner of Customs in the Domestic Tariff Area (DTA) and Development Commissioner of Special Economic Zone (SEZ) in SEZ, for goods;
(ii) An Authorised Dealer in DTA and Development Commissioner of Special Economic Zone (SEZ) in SEZ, for services other than software; and
(iii)  An Authorised Dealer or Software Technology Parks of India (STPI) in DTA, and Development
Commissioner of Special Economic Zone (SEZ) in SEZ, for software.

Only RBI can clarify why they used ‘and’ as a connector in (i) and (ii) and why they used an ‘or’ in (iii).

For now, it means that for Software as defined in the notification, it is either an Authorised Dealer or STPI in the Domestic Tariff Area (i.e. units not in SEZ) and an Authorised dealer or DC SEZ in a Special Economic Zone.

Conclusion

The Software or IT and ITeS businesses will file the new EDF instead of the SOFTEX form after 1st of October 2026. The DTA units have an option to get EDF certified by Authorised Dealers (your bank) or STPI, and Authorised Dealers (your bank) or DC SEZ in a Special Economic Zone.

All services exporters other than Software must now file an export declaration. This is a change, as earlier services exporters other than Software (IT and IT-enabled) services did not need to file an export declaration.

The operating process is largely left to Authorised Dealers, hence the Banks’ digital transformation in this area becomes the key, and what process the Banks adopt will be critical to ease of doing in business as the notification on its applicability after 1st October 2026.

Disclaimer: The write-up here and ideas expressed should not be construed as legal advice. This is written with the industry practitioners’ approach on policy implications for the Software sector, for the purpose of benefiting the Industry members.

Posted on

OCEN 2025

The calendar year 2025 has been a transformative period for the Open Credit Enablement Network (OCEN), evolving from a digital protocol into a powerhouse for financial inclusion. During 2025, OCEN successfully facilitated approximately 70,000 loans, resulting in over ₹1,600 Crore in disbursements.

This journey is not just about the numbers; it is about proving that a digital-first, cash-flow-based approach can solve the long-standing credit gap for underserved MSMEs with unparalleled efficiency.

A Year of Relentless Monthly Momentum

The 2025 journey began with a steady climb and rapidly escalated as more lenders and borrower agents integrated into the ecosystem. The monthly growth in the number of loans disbursed showcases a consistent upward trajectory. This steady monthly rise provided the foundation for the explosive quarterly growth that defined the year.

Consistent Quarterly Growth (QoQ)

When looking at the 2025 performance on a quarterly basis, the scale of adoption becomes even more evident. The network didn’t just grow; it accelerated every three months.

Period (2025)No. of LoansDisbursements (₹ Lakhs)
Quarter 15,64119,795
Quarter 213,51627,316
Quarter 322,14248,092
Quarter 428,12265,275

The jump from Q1 (5,641 loans) to Q4 (28,122 loans) represents an increase of nearly 400% in loan volume within a single year. Similarly, disbursements surged from ₹197.9 Crore in Q1 to over ₹652.7 Crore in Q4, demonstrating the massive appetite for small-ticket, short-tenure credit.

Portfolio Quality: The Ultimate Validator

The most significant achievement of 2025 isn’t just the volume—it’s the quality of the credit. Traditional MSME lending often suffers from high risk and significant non-performing assets (NPAs). OCEN has fundamentally challenged this narrative.

Participating lenders have seen highly encouraging results in portfolio health, characterized by strong performance, minimal portfolio losses and high confidence. The cash-flow-based underwriting model allows lenders to assess real-time business health rather than relying on stale collateral documents. Data-driven, short-tenure lending ensures high repayment rates.

The Future is Cash-Flow Based

OCEN’s 2025 journey proves that when you align technology with the actual business cycles of small enterprises, everyone wins. MSMEs get the “just-in-time” capital they need, and lenders gain access to a high-quality, low-risk asset class. With over ₹1,600 Crore disbursed in 2025, the protocol has set a new benchmark for how India can democratize credit and fuel the next wave of economic growth.

For more information, please visit: http://ocen.dev

Please note: The blog post is authored by our volunteer, Rahul Bhaik

Posted on

OCEN Crosses the ₹200 Crore Monthly Milestone: Redefining MSME Credit Quality

November 2025 has officially set a new standard for the future of cash flow based digital lending for MSMEs in India. For the first time, monthly disbursements through the OCEN protocol have breached the ₹200 Crore mark, proving that the shift toward cash flow-based lending is not just a pilot—it is a powerhouse.

As we move toward the close of 2025, the narrative is shifting from “how much” can be lent to “how well” it is being managed.

November 2025: By the Numbers

The growth trajectory of OCEN continues to follow a healthy curve. The protocol recorded its highest disbursement month to date, characterized by high-velocity, small-ticket lending that reaches the very grassroots of the MSME sector.

  • Total Disbursement: ₹207.40 Crore
  • Total Loans Disbursed: 9,446
  • Primary Loan Profile: Short-tenure, small-ticket working capital

This monthly performance brings the total calendar year disbursement to new heights, reinforcing OCEN’s role as an important digital highway for reducing the MSME credit gap.

The Quality Paradox: High Growth, Lowest Delinquency

In traditional lending, rapid growth often comes at the cost of asset quality. OCEN is turning this logic on its head. Despite the surge in volume, the participating lenders are reporting the lowest delinquency rates in the MSME segment.

The loan portfolio performance on OCEN has been exceptionally better than traditional MSME lending portfolios, which often struggle with high NPAs due to delayed data and static underwriting. By leveraging cash flow transaction data, OCEN allows for precision underwriting enabling the lenders see the actual health of a business today, not six months ago. As the Lenders focus on underwriting a Cash flow transaction rather than underwriting a borrower, the Short-tenure loans ensure that capital is cycled quickly linked to the Cash flow being financed, reducing long-term exposure risk.

This “quality-first” growth has sparked a wave of confidence across the participating lenders. We are currently seeing multiple new lenders and borrower agents at various stages of onboarding onto the OCEN framework. As more entities join, the network effect will only intensify, making credit even more affordable and accessible for the millions of “Rajnis” running small shops and enterprises across India. OCEN is not just lending money; it is building a system of trust where verified data, not just collateral, becomes the currency for growth.

For more information, please visit: http://ocen.dev

Please note: The blog post is authored by our volunteer, Rahul Bhaik

Posted on

India’s silent Credit Revolution: OCEN Surpasses 50,000 Loans and ₹1100 Crore in 2025

The Micro, Small, and Medium Enterprises (MSME) sector is the engine of the Indian economy, yet for years, it has been choked by a massive credit gap. Traditional, collateral-heavy lending processes simply could not keep pace with the dynamic, short-tenure funding needs of small businesses.

Open Credit Enablement Network (OCEN): Built on the principles of India Stack, this digital protocol is not just facilitating loans; it is fundamentally rewiring the architecture of MSME credit, making it instant, affordable, and accessible. The monthly growth witnessed in the calendar year 2025 proves the model is not just viable, but highly scalable, marking a new era of financial inclusion.

The Power of Cash Flow-Based Lending

OCEN’s disruptive approach lies in shifting the lending paradigm from asset-based to cash flow-based underwriting. For millions of creditworthy small businesses, their true financial health is reflected in their daily or monthly transactions, not in static, year-old balance sheets. By leveraging India’s digital public infrastructure, OCEN allows lenders to assess risk based on real-time, consented data helping them to take faster decisions and making small-ticket, short-tenure credit economically feasible for lenders.

This framework is specifically designed to solve for the underserved, those who need smaller loans for shorter periods but have previously been locked out of formal credit channels.

Demonstrating Growth and Inclusion

OCEN demonstrated its ability to deliver on its promise of democratizing credit. The network has disbursed 50,426 loans and amounting to ₹1142 Crore in total disbursement within the calendar year till October 2025.

October 2025: OCEN saw the highest ever monthly disbursement of 191 Crore across 9127 loans Catering directly to the daily needs of MSMEs. The growth highlights how the protocol’s architecture is perfectly suited for mass-market financial inclusion. The emphasis is clearly on the number of lives touched and the frequency of credit access, rather than just the size of the total loan book.

Validating the Model: Exceptional Portfolio Health

The true testament to OCEN’s cash flow-based underwriting is not just the speed and volume of disbursement, but the quality of the loan book. Crucially, the loans disbursed through the OCEN protocol have demonstrated very minimal Non-Performing Assets (NPAs). This performance is exceptionally better than the NPA figures typically observed in traditional MSME lending portfolios across the industry. This is not just a marginal improvement; it is a fundamental validation of the protocol’s ability to accurately identify and price risk among digitally visible, cash flow-rich MSMEs. By moving beyond outdated collateral requirements and relying on real-time transactional data,

OCEN is proving that digital, embedded credit is inherently safer and more sustainable than conventional lending practices, offering a high-growth, low-risk opportunity for participating lenders.

For more information, please visit: http://ocen.dev

Please note: The blog post is authored by our volunteer, Rahul Bhaik

Posted on

DEPA AI Chain: Empowerment Through Provenance

The DEPA AI Chain is central to operationalising data sharing for AI development and runtime use, while preserving privacy and maintaining verifiable provenance across the entire AI lifecycle — spanning dataset creation and licensing through training, release, inference, and content distribution. Risks and returns are managed through contracts and programmable controls; oversight is delivered via transparency logs and lightweight audits by a self-regulatory organisation (SRO), yielding an efficient and effective supervisory mechanism.

1.0 Unpacking Provenance

Provenance, in digital systems, refers to the systematic tracking of the origin of data and the complete history of the transformations and processes it undergoes throughout its lifecycle. It captures metadata about where the data came from, how it was created, and how it has been modified, combined, or interpreted over time.

Data provenance plays a critical role across a wide range of applications and scenarios. It is essential for ensuring the reproducibility of scientific experiments and computational workflows, enabling others to independently validate results. It supports fault diagnosis and fault tolerance by providing a traceable record that helps isolate and correct errors in complex systems. Provenance is also key to explainability (but also vastly different), as it clarifies how specific outcomes or decisions were derived, particularly in contexts such as AI and automated decision-making. In addition, provenance provides vital support for forensic investigations and auditing, where establishing the trustworthiness and integrity of data is crucial for compliance, accountability, and legal defensibility. By making the history of data transparent and verifiable, provenance serves as a foundational element of trustworthy digital systems.

In the context of personal data sharing, consent without provenance is an unauditable promise. There is a need to include a machine-readable trail linking consent or data protection compliance (the promise) to verifiable facts. 

The concept of provenance is increasingly critical in the context of modern AI systems, which are pervasive across numerous domains. In such systems — often characterised by Markovian or black-box behaviours — establishing clear causal relationships between inputs and outputs is inherently challenging. The opacity of many AI models, particularly deep learning models, makes it difficult to trace how specific outcomes arise, raising significant concerns around trust, accountability, and reproducibility.

Although parallel efforts exist under the banners of Explainable AI (XAI) and Trustworthy AI (TAI), provenance offers a complementary and, in many cases, more scalable and cost-effective approach to enhancing transparency. When thoughtfully designed and integrated into AI pipelines, provenance can provide a systematic, audit-friendly mechanism to capture the lineage and transformations of data and models, often with fewer assumptions than model-specific explainability techniques.

At its core, provenance in AI systems addresses concerns such as: (i) authenticity (of data and its origins), (ii) ownership, (iii) traceability, and (iv) (approximate) reproducibility. In contrast, frameworks such as TAI tend to emphasise aspects including (i) accuracy, (ii) fairness, (iii) explainability, and (iv) safety.

Yet, even with these clear distinctions, provenance is sometimes misframed in policy discussions. Treating any and all provenance artefacts as something that inevitably leads to identity disclosure is an error, one that conflates transparency with surveillance or identity tracking. As critics often put it in “Road to Perdition” terms, unfettered access to provenance data may indeed pose risks — but such access is not meant to be unfettered. It must come with safeguards, constrained by law and subject to due oversight. Framing the choice as either no provenance or dystopia ignores both context and the inevitability of provenance as part of the solution. Even references to Puttaswamy’s judgement, frequently invoked in this debate, are incomplete if not situated within its broader framework of proportionality and legitimate state aim. After all, without engaging with principles such as purpose limitation, retention bounds, or penalties for misuse, how else are systems meant to achieve reliability and harm reduction at scale? The answer lies not in abandoning provenance, but in advancing privacy-preserving provenance — mechanisms that preserve accountability and auditability without compromising individual rights.

1.1 Promise and Potential of AI Chain

The AI Chain is fundamentally a mechanism for capturing the lineage and transformations of data and models in a systematic, effective way, offering a complementary approach to XAI. The AI Chain promises to meet the following requirements:

  • Lineage: Lineage captures the complete journey of data and AI outputs—from consent and licensing, through training, to distribution—ensuring traceability, authenticity, and near-precise reproducibility of AI outcomes. It provides a granular record by assigning unique IDs to datasets and linking a Data Principal’s ID to their data and consent artefact, documenting how data is introduced, modified, combined, and interpreted. To preserve privacy, lineage can be applied to metadata rather than raw data. Cryptographic mechanisms such as hash chains and Merkle trees secure the integrity of the entire lineage.

  • Effective Verification and Its Impact on Liability Allocation: Verifiers can check provenance artefacts—including signatures, attestations, and log proofs—at scale. This may assist in liability and accountability allocation, since the responsibilities of Training Data Providers, Training Data Consumers, publishers, and platforms are clearly stated through policies and contracts, and their actions are immutably recorded in provenance artefacts.

Finally, this approach has second-order effects on data quality: established provenance artefacts increase the value of well-curated datasets.

1.2 What AI Chain Is Not Intended to Do

  • Truthfulness or correctness guarantees: The chain reveals who, what, when, and how a piece of content was created or modified—but it cannot confirm whether the content depicts reality.
  • Bias/fairness or safety adjudication: The chain records facts; value judgements belong to governance, post-facto audits, and external assessments.
  • Enforcement on off-chain actors: Entities falling outside the chain are not snapshotted and can ignore the guardrails.
  • Eliminate the need for legal process: The chain provides strong factual and indisputable evidence, not automatic verdicts.

We welcome feedback and suggestions from all stakeholders at [email protected]

Please note: The blog post is authored by Subodh Sharma, with inputs from Sunu Engineer and Raj Shekhar, all volunteers with iSPIRT.

Posted on

Cash Flow-Based Lending: Unlocking Credit Access for India’s MSMEs

Micro, Small, and Medium Enterprises (MSMEs) are the backbone of India’s economy, driving growth and generating millions of jobs. Yet, despite their importance, MSMEs continue to face a massive credit gap. Traditional collateral-based lending often leaves them underserved, making access to timely and affordable credit one of their biggest challenges.

Over the years, schemes like Mudra Loans, CGTMSE, Capital & Interest Subsidy Programs, and the TReDS (Trade Receivables Discounting System) have contributed meaningfully to MSME financing. TReDS, in particular, has shown encouraging results by enabling invoice-based financing for a segment of MSMEs. However, these efforts only address a part of the problem. The diverse working capital cycles and sector-specific needs of MSMEs demand customised, flexible credit solutions.

This is where Cash Flow-Based Lending (CFL) stands out as a transformative approach. Instead of relying on collateral, CFL assesses an enterprise’s actual business cash flows to determine loan eligibility. This not only expands credit access to previously excluded businesses but also enables lenders to design loan products that align with real business needs.

TReDS has already proven the power of cash flow-linked credit for receivables financing. But its scope is limited. India requires many more frameworks like TReDS, supported by scalable models such as OCEN (Open Credit Enablement Network), which democratise access to small-ticket, customised loans by leveraging digital cash flow data. While TReDS focuses on invoice-backed receivables, OCEN opens new possibilities through embedded finance and digital cash flow data. Both models are built on the same principle—cash flow as the foundation of creditworthiness—and can co-exist to bridge the critical MSME credit gap faster.

For more information, please visit: http://ocen.dev

Please note: The blog post is authored by our volunteer, Rahul Bhaik