Quarterly staff access reviews for brokers and NBFCs, ready for inspectors
TL;DR Permitwell connects to the 20–60 apps a mid-size broker or NBFC runs, lists who can do what, suggests sensible roles and sends each manager a short review to approve or revoke. The compliance or IT head pays a yearly subscription. It replaces the spreadsheet scramble before every audit.
Indians lost ₹22,845.7 crore to cyber fraud in 2024[1], and regulators have responded by writing access control into rules. RBI's IT governance direction says staff should get access only for a valid business need, under procedures approved by the IT strategy committee, and that people with elevated access must have their activity logged and reviewed[2].
At a mid-size lender or stockbroker that means exporting user lists from the core system, the trading back office, email, the CRM and a dozen cloud tools, then chasing managers to tick boxes in spreadsheets. Not fun.
Leavers keep their accounts for weeks. I found no Indian data on how often this fails, so treat it as the first thing to test.
What it does, in regulatory terms: compliance tooling for the buyer's own staff access. It holds no customer funds or securities and needs no licence.
Permitwell reads user and permission lists from each connected app, matches them to the HR roster, and flags leavers, dormant accounts and people whose rights look unlike their peers'. A clustering model suggests roles, such as "branch credit officer", from the rights people actually hold. A human approves every role and every revocation. Each quarter it sends managers a one-page review and keeps a signed record for inspectors.
I narrowed the seed, which pitched AI persona mapping for identity governance in general. That market belongs to large global vendors, and good luck fighting them. The opening is firms too small for those vendors but now facing written duties.
The reviewers are line managers. The payer is the CISO, chief technology officer or compliance head at a stockbroker, depository participant or middle-layer NBFC with 200–2,000 staff. Global identity suites are priced and sold for large enterprises[3], while Permitwell would charge a flat yearly fee by headcount band. There's no public Indian price benchmark to compare against.
SEBI issued its Cybersecurity and Cyber Resilience Framework for regulated entities on 20 August 2024[4]. RBI's IT governance direction came into force on 1 April 2024 for banks and for NBFCs in the middle layer and above[2]. Both push smaller firms to show evidence, not intent.
No public figure exists for Indian spending on access-review tools. The signal is the set of firms newly obliged to act under the SEBI framework[4] and the RBI direction[2]. Adjacent: one global identity-governance vendor says it secures over 100 million identities worldwide[3], evidence that enterprises pay for this category. That is context, not your market.
Global identity-governance vendors sell full identity governance suites to large enterprises worldwide[3]. Indian firms in the mid-market mostly use spreadsheets, scripts or the review module inside one big tool. No Indian product turned up that's priced and packaged for brokers and NBFCs of this size, though the search was limited.
| Difficulty | Moderate (39/100) |
| Starting capital | ₹60 L–1.1 Cr |
| Time to launch | 6–9 months |
The hardest part is connectors. Indian back-office and core lending systems often lack clean APIs, so you'll be parsing exports - lots of them. Selling security software to regulated firms also means passing their own vendor-risk review, which can take a quarter on its own.
No licence is needed for the product itself. Your buyers are regulated, and they'll judge you on how well you map to their rules.
Expect buyers to ask for ISO 27001 and pen-test reports before they scale.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI revoke access by itself. Cutting the wrong person out of a lending system stops work, so every revocation is approved by a human.
Want to work out the AI layer for Permitwell? Talk to Yash →
I think this is a good bet for a founder who has run IT or audit at an Indian broker or NBFC and knows its systems. If you don't have that access then it is a weak fit. First prove that ten firms can name a recent access finding and that one export format covers most of their back-office systems.
Plan for roughly ₹60 L–1.1 Cr, mostly for app connectors, engineering and selling to brokers and NBFCs.
No product licence. You map your reports to SEBI CSCRF and RBI's IT governance direction, and act as a DPDP processor for staff data.
Yes. Financial regulators everywhere expect access reviews. Map the product to your local rules before you sell.
The free Permitwell validation kit has the line-by-line capital breakdown, the effort scoring, the SEBI, RBI and data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for CISOs and compliance heads, and 5 assumptions to test. Download the kit →
Thinking about building Permitwell or something close to it? The make-or-break work is building connectors for local back-office systems without turning into a services firm, and I'm glad to think that through with you. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.