Collections that stay inside the rules

Recovery work touches the most sensitive data you hold and the most regulated conversation you have. SentryFlow runs the repetitive part and stops at every point where a person is legally required to decide.

Book Enterprise DemoSee pricing

The situation

A mid-size NBFC runs collections across four buckets, three channels, and a recovery-agent network it does not directly employ. The data involved — outstanding amounts, employment details, family contact numbers — is exactly what borrowers complain about being mishandled, and the rules on when and how you may contact someone are specific. Most teams manage it in spreadsheets exported nightly, which is where both the errors and the exposure live.

  • The nightly spreadsheet

    Someone exports 11,000 overdue accounts from the loan management system every night and mails it to four agency partners. The file carries every column the export offered, including PAN and alternate contact numbers that no agent needed, and it now exists on machines you cannot audit or wipe.

  • Bucket rules that live in someone's head

    Which accounts escalate from reminder to field visit depends on days past due, ticket size, prior promise-to-pay, and whether the borrower disputed the charge. The logic is real but undocumented, so two team leads apply it differently and neither decision is reconstructable a quarter later.

  • Contact rules enforced by memory

    Calls are restricted to specific hours, repeat contact is capped, and a borrower who has raised a grievance must be routed differently. Enforcing that through agent training means the first evidence of a breach is usually the complaint itself.

  • No way to answer 'who contacted this borrower'

    When a grievance arrives, the honest answer is that a file was sent to an agency and the agency says it called. There is no single trail linking the account, the rule that selected it, the person who approved the escalation, and the contact that followed.

The workflow

Every step names the control that applies to it. The steps marked Human are the points where the workflow stops and waits for a person — by design, not because the automation is incomplete.

LMS → AI → Approval → Agency portal

  1. 01 / 07System

    Nightly overdue sync

    Reads the overdue ledger from the loan management system at 01:00 IST over a read-only connector scoped to six columns: account id, bucket, days past due, outstanding, last promise date, dispute flag. PAN, address, and alternate contacts are never requested, so they cannot leak from this workflow.

    Read-only scope, six columns, no PII beyond account id

  2. 02 / 07System

    Bucket classification

    Applies the written escalation matrix as a deterministic rule set, not a model: bucket plus days past due plus ticket size selects a treatment. The matrix is versioned, so the rule that classified an account on a given night can be produced months later.

    Versioned rule set, deterministic, no inference

  3. 03 / 07System

    AI drafts borrower-appropriate messaging

    For reminder-stage accounts the model drafts a message in the borrower's registered language. It receives the amount, due date, and bucket — never the name, PAN, or phone number, which are merged in after approval by the sending system.

    Redacted prompt: amounts and dates only, no identifiers

  4. 04 / 07System

    Suppression and contact-window check

    Drops any account with an open grievance, an active settlement, a legal hold, or contact already attempted twice this week. Suppression runs after drafting and before approval, so a suppressed account never reaches a human queue at all.

    Hard suppression list, contact frequency cap

  5. 05 / 07Human

    Collections manager approves the escalation batch

    Anything above the field-visit threshold stops here. The manager sees the account, the rule that selected it, the drafted contact, and the suppression checks that passed. Approving records their identity against every account in the batch; denying returns it with a reason.

    Named approver, per-batch, reason required on denial

  6. 06 / 07System

    Scoped dispatch to the agency portal

    Approved accounts are pushed to the agency portal as individual records with a 72-hour access window, not as a file. Each agency sees only its own allocation, and access expires whether or not the agent acted.

    Per-record access, 72-hour expiry, no bulk export

  7. 07 / 07System

    Append-only trail per account

    Writes the rule version, the drafted message, the approver, the dispatch time, and the agency that received it. Hash-chained, so a deleted or altered entry breaks verification instead of disappearing quietly.

    Hash-chained log, actor and outcome on every entry

Controls

Step-level controls stop a single action. These apply to the workflow as a whole, which is what makes the difference between a logic error and an incident.

  • Borrower data stays in region

    Every step in this workflow, including the model call, is pinned to an India region. The processing location is part of the workflow definition rather than an account-level default, so it cannot be changed by a settings edit somewhere else.

  • The connector cannot read what it does not need

    The loan management connector holds a read-only token limited to the six columns above. Adding a step that needs a seventh triggers a fresh consent naming that column, so scope creep is a visible event rather than a silent upgrade.

  • Grievance state outranks the rule engine

    An open grievance suppresses every automated contact for that account, and the suppression cannot be overridden inside the workflow. Reinstating contact is a deliberate action taken by a named person in the console, and it is logged as one.

  • Failed runs park with their inputs

    If the agency portal is unreachable, the run parks with its full input payload rather than retrying blindly. The engineer on call replays it once the portal returns, instead of reconstructing the batch from log lines.

The shape of the change

Each row states what the controls make possible or impossible, rather than a measured saving. The change is structural: the same work, with the risky path closed off.

  • Borrower columns leaving your systems

    WasWhole-table nightly export

    Only the fields a step declares, per record, expiring

  • Answering one grievance

    WasReassembled from separate systems

    One account timeline

  • Field escalations without a named approver

    WasMost of them

    None

Other workflows

The same controls apply across every use case. Only the steps and the thresholds change.