Chapter 3A - Section 3a.8Portfolio Quality

Portfolio quality for all buckets (PAR >30 days and PAR >60 days, PAR>90 days, and PAR >180 days) has improved. Some NBFC-MFIs are reporting elevated PAR levels due to long-outstanding dues that remain unrecovered. The analysis is based on self-reported portfolio data from 85 NBFC-MFIs. The portfolio quality figures differ from those presented in Chapter 2 because MLI data reported to the CICs include technical write-offs, whereas the MLI data submitted to the SROs exclude technical write-offs.

Read More

Performance of NBFC-MFIs in Microfinance

3.A.8 Portfolio Quality

Portfolio quality for all buckets (PAR >30 days and PAR >60 days, PAR>90 days, and PAR >180 days) has improved. Some NBFC-MFIs are reporting elevated PAR levels due to long-outstanding dues that remain unrecovered. The analysis is based on self-reported portfolio data from 85 NBFC-MFIs. The portfolio quality figures differ from those presented in Chapter 2 because MLI data reported to the CICs include technical write-offs, whereas the MLI data submitted to the SROs exclude technical write-offs.

The PAR value for various buckets for different sizes of NBFC-MFIs is depicted in the table below.

Table 3 A.12: Portfolio Quality of NBFC-MFIs under different buckets (Based on weighted average values)
Size PAR>30 days PAR>60 days PAR>90 days PAR>180 days
Nano (<₹100 Cr.) 6.95% 6.00% 5.44% 5.04%
Small (₹100 Cr.-₹500 Cr.) 7.75% 6.62% 5.14% 3.98%
Medium (₹500 Cr.-₹2,000 Cr.) 7.87% 7.20% 6.34% 4.47%
Large (₹2,000 Cr. - ₹5,000 Cr.) 7.01% 6.24% 5.65% 4.29%
Very Large (>₹ 5,000 Cr.) 4.96% 4.67% 4.31% 3.50%
Overall 5.56% 5.15% 4.69% 3.71%

Note: DPD>30 days = all overdues above 30 days, including above 180 days; DPD>60 days = all overdues above 60 days, including above 180 days; DPD>90 days = all overdues above 90 days, including above 180 days. The portfolio quality figures differ from those presented in Chapter 2 because MLI data reported to CICs exclude technical write-offs, whereas data submitted to SROs include technical write-offs.

Box 3A.1: Cybersecurity Risk Management and Operational Resilience

As microfinance institutions increasingly adopt digital operations, cybersecurity and operational resilience have become critical to safeguarding customer data, ensuring uninterrupted services, and meeting regulatory expectations. While many of the MFIs are adopting cybersecurity measures, there is a specific case of SAVE Microfinance Pvt. Ltd. (SMPL). In case of SMPL, it has integrated cybersecurity, operational risk management, business continuity, and governance into its enterprise risk management framework.

SMPL regularly conducts Vulnerability Assessment and Penetration Testing (VAPT), Information Systems Audits, application security assessments, secure configuration reviews, and compliance assessments to identify vulnerabilities and strengthen security controls. Role-based access controls, periodic access reviews, audit logging, and continuous monitoring further protect critical systems from unauthorised access.

To build a strong security culture, the institution conducts regular employee awareness programmes on phishing, ransomware, malware, password security, social engineering, multi-factor authentication, cyber incident reporting, fraud prevention, and secure information handling.

Operational risks are managed through systematic risk assessments, standard operating procedures, maker-checker controls, segregation of duties, exception monitoring, and management oversight. Vendor and third-party risks are addressed through due diligence, contractual safeguards, periodic reviews, and performance monitoring.

SMPL has also strengthened its operational resilience through Business Continuity Planning (BCP), Disaster Recovery (DR) arrangements, secure data backups, and regular resilience testing. These measures enable uninterrupted customer service during disruptions while supporting regulatory compliance.

The institution’s governance framework is reinforced through Board oversight, internal policies, independent audits, compliance reviews, and structured reporting mechanisms that promote transparency, accountability, and continuous improvement.

Key Outcomes

  • Enhanced protection of customer information and critical business systems.
  • Stronger cybersecurity through regular security assessments and employee awareness.
  • Improved operational resilience through Business Continuity and Disaster Recovery planning.
  • Strengthened governance, internal controls, and regulatory compliance.
  • Better preparedness to detect, respond to, and recover from cyber and operational incidents.
  • Increased stakeholder confidence and long-term institutional sustainability.

SMPL has demonstrated that embedding cybersecurity, operational resilience, governance, and enterprise risk management into day-to-day operations creates a secure, resilient, and future-ready microfinance institution while strengthening customer trust and supporting sustainable financial inclusion.

Courtesy: SAVE Microfinance Pvt. Ltd. (SMPL)