Cloud adoption in the NBFC sector is moving beyond infrastructure modernisation. As financial institutions look to strengthen resilience, meet growing compliance requirements and manage technology costs, the focus is shifting towards building a cloud foundation that can support the next phase of digital and AI-led innovation. In this conversation with Tech Achieve Media, Shankar Morwal, Founder and CTO, HabileLabs, discusses why NBFCs should take a phased approach to cloud migration, strengthen data protection and disaster recovery, bring financial discipline to cloud spending, and prepare their technology environments for responsible AI adoption.
TAM: Cloud migration in financial services often fails during sudden “big bang” shifts. Why is a phased cloud migration essential for NBFCs, and how should leaders prioritize legacy workloads?
Shankar Morwal: A big-bang migration exposes an NBFC to several risks at the same time, including operational disruption, data inconsistencies, customer-facing outages, and regulatory concerns. A phased approach reduces this exposure by moving applications and data in manageable stages. Each phase can be tested, stabilized, and reviewed before the next begins.
Modern migration methods allow new cloud-based services to be introduced gradually alongside existing systems. Appropriate data synchronization and reconciliation mechanisms can then help reduce the risk of information loss, duplication, or inconsistency during the transition. A phased approach also allows security, governance, audit, and access controls to mature progressively, while avoiding large upfront investments and reducing the possibility of system-wide failure.
Leaders should prioritise workloads using five considerations, including business criticality, sensitivity of the information involved, dependence on other systems, readiness for cloud migration, and ease of recovery or reversal if an issue occurs. The first phase should normally include lower-risk supporting applications, reporting tools, and document-processing systems. These workloads help the organisation establish cloud governance, access controls, monitoring, and operating discipline.
The next phase can include scalable customer-facing and partner-facing services. Transaction-heavy platforms, core lending systems, and ledgers should be migrated only after resilience, reconciliation, security, and control mechanisms have been proven. HabileLabs supports NBFCs in building a migration roadmap that balances modernisation with operational stability. The objective is not to migrate everything quickly, but to move each workload at the right time, for the right business reason, and with controlled risk.
TAM: How does AI-driven data masking help NBFCs satisfy strict compliance standards without creating operational friction or system latency?
Shankar Morwal: NBFCs manage large volumes of sensitive information, including Aadhaar numbers, PAN details, financial records, credit histories, banking information, and customer documents. This information may be spread across databases, scanned files, reports, emails, applications, and third-party systems. AI-assisted data masking helps identify sensitive information across both structured data and unstructured documents. Once detected, the appropriate protection can be applied, including masking, redaction, tokenization, anonymization, and restricted display based on user roles. This allows the organisation to protect information according to who is accessing it, why it is required, and how it will be used.
Operational friction can be reduced by applying the appropriate protection method to each use case. Large document repositories may be processed in advance, while dynamic masking may be used for selected user-facing applications. This avoids placing heavy processing requirements on every business transaction. These controls support alignment with RBI guidelines, the Digital Personal Data Protection Act, PCI DSS, where applicable, and information-security standards such as ISO 27001.
However, data masking is only one part of compliance. It must work alongside consent management, access governance, retention policies, audit controls, vendor oversight, and human review. HabileLabs helps NBFCs implement scalable data-protection capabilities that strengthen compliance readiness while allowing business, technology, and analytics teams to operate efficiently.
TAM: What are the critical elements of an active-active disaster recovery framework that prevent operational downtime during unexpected outages?
Shankar Morwal: An active-active disaster recovery framework allows two or more production environments to operate simultaneously at two different geographical locations for different environments. If one environment becomes unavailable or degraded, customer and application traffic can be redirected to another healthy environment, helping to limit customer-facing disruption.
A reliable framework depends on the following elements:
- Clearly defined recovery objectives
The institution must define Recovery Point Objective (the maximum acceptable level of data exposure during an incident) and Recovery Time Objective (how quickly critical services must be restored). These targets should vary according to the importance of each application.
- Continuous data protection
Data must be synchronized across environments according to business and regulatory needs. The design must also address duplicate transactions, incomplete processing, reconciliation failures, temporary data conflicts, and delayed updates between environments.
- Intelligent traffic management
Automated health checks should identify degraded environments and redirect traffic toward healthy systems with minimal manual intervention. Non-critical and heavy data processing tasks can be directed toward a replicated environment to enhance the performance of customer-facing applications since an active-active framework gives real-time data sync.
- Resilient application design
Applications should not depend on a single server, database, network connection, cloud region, or third-party service.
- Consistent security controls
Access to policies, firewall rules, monitoring, user permissions, and security configurations must remain aligned across all active environments. In an Active-Active infrastructure, the replication environment should be treated as a production environment; it is not a backup environment. We are running two parallel production environments, both of which are indistinguishable. mechanisms.
- Regular recovery testing
A disaster recovery framework is only credible when it is tested through failover exercises, backup, cyber-recovery drills, operational simulations, and failback and rollback testing. A process has to be established to safeguard one environment in case the other is compromised through automated fail-fast and isolation. A well-designed active-active framework reduces dependence on manual intervention, strengthens business continuity, and helps maintain customer confidence during unexpected disruptions. HabileLabs helps institutions design recovery frameworks around actual business priorities, regulatory requirements, and operational realities, rather than applying a generic technology model.
TAM: How do cloud-native services reduce total infrastructure overhead and control costs while scaling operations?
Shankar Morwal: Cloud-native services allow NBFCs to shift their focus from maintaining infrastructure to delivering business value. Managed cloud services can reduce the effort required for routine activities such as server maintenance, software patching, backups, infrastructure monitoring, capacity management, and manual upgrades This allows technology teams to devote more time to customer journeys, business automation, product development, and service improvement.
Cloud resources can also be increased or reduced according to actual demand. This is particularly useful during seasonal lending surges, promotional campaigns, partner launches, month-end processing, and regulatory reporting cycles. Instead of maintaining expensive excess capacity throughout the year, an NBFC can align its infrastructure more closely with business activity. It helps in the optimum utilization of resources, which is the main KRA of the IT department, and can only be fulfilled with the cloud native infrastructure.
However, cloud adoption does not automatically reduce costs. Without strong financial governance, cloud spending can become fragmented and difficult to control. Long-term saving is possible through optimization. Effective cloud cost management requires a FinOps discipline, bringing finance, engineering, and business teams together to manage technology expenditure.
Important practices include tagging resources by product, department, or customer journey, shutting down non-production environments when they are not required, removing unused capacity and storage, selecting appropriate purchasing commitments, monitoring unusual cost increases, managing storage and data-transfer costs, and measuring unit economics, such as technology cost per loan application or customer served.
Cloud-native platforms also make it easier to introduce fraud detection, risk analytics, customer automation, and AI-enabled services without investing in separate specialised hardware for every initiative. Most of the new technologies and innovations are cloud-ready, native, and easy to adopt, and cloud native platforms help organisations access cloud native applications.
HabileLabs combines cloud engineering with FinOps governance so that scalability does not come at the expense of financial discipline.
TAM: Once an NBFC achieves reliability, compliance, and cost control, what comes next? How does this cloud foundation position institutions to rapidly deploy future AI and digital financial products?
Shankar Morwal: Reliability, compliance, and cost control are not the outcomes of cloud transformation. They form the launchpad for continuous innovation. Once an NBFC has secure digital services, governed data, reusable integrations, and scalable infrastructure, it can introduce new capabilities without rebuilding the underlying foundation for every initiative. Introducing new capabilities means moving on from existing technology, so if the organisation is already compliant and cost-optimized, they can focus and invest in technology that can have the highest business impact. This cloud foundation can support faster digital lending journeys, AI-assisted document processing, fraud and anomaly detection, improved credit assessment, underwriting support tools, personalised customer communication, intelligent collections, account aggregator integrations, co-lending platforms, embedded finance, partner-led financial products, and real-time risk and business insights
The greater challenge is not gaining access to AI models. It is deploying them responsibly within a regulated financial environment. While AI adoption is essential for NBFCs to remain competitive, the current AI ecosystem is not yet fully aligned with the sector’s stringent data compliance and regulatory requirements. Hence, while maintaining strong compliance and cost control, organizations must invest strategically in AI adoption to remain competitive and accelerate their transformation toward responsible AI. Responsible AI adoption requires three broad capabilities that include controlled deployment, reliable and governed data, and continuous monitoring. AI governance should also include Human oversight, Model validation, Bias and fairness testing, Data lineage, Audit trails, Privacy controls, Explainability, Rollback mechanisms, and Monitoring of incorrect or unexpected outputs
HabileLabs enables NBFCs to bridge the gap between AI experimentation and enterprise-scale adoption by embedding robust data governance, security, observability, deployment controls, and auditability into their cloud environments. This creates a resilient, compliant, and cost-efficient foundation that empowers institutions to accelerate innovation, launch new financial products faster, and scale AI initiatives with confidence.
