“Ready for Disbursal” — Until You Click : Flexiloans Story

The phone lights up. The sender looks official: “FlexiLoans Technologies P…”. The tone is that of a completed decision, not a sales pitch.

“Dear Customer, This is an update regarding your FlexiLoans CGTMSE business loan of Rs. 2290737. Your loan has been pre-approved at 1% Interest and is ready for disbursal. Please review and complete your application using the link below. Team FlexiLoans.”

Minutes later, the same number, the same amount, a different story:

“Dear Customer, Your Rs. 2290737 business loan application is being reviewed. Ref ID: 352104. Kindly submit the pending details to move ahead with the verification process. Team FlexiLoans.”

Read those two paragraphs again. Slowly.

First the money is pre-approved. First it is ready for disbursal. First the rate is 1%. Then, before the tea has gone cold, the same file is only “being reviewed” and the customer must still “submit pending details” for “verification.”

That is not a drafting accident. That is a conversion script. “Your loan is ready” gets the thumb on the link. “You may be eligible if you apply” does not. An RBI-registered middle-layer NBFC knows the difference. The question is why it still talks like a carnival barker when the statute book talks like a compliance manual.

1. First, the company that wants your Aadhaar

FlexiLoans is not a shadowy APK from a Play Store gutter. That distinction matters, because it removes the usual alibi.

The legal entity is Epimoney Private Limited, CIN U71309TN1995PTC030536, formerly Urmila Investment & Securities (P) Ltd. It is on the Reserve Bank of India’s list of registered NBFCs as of 30 June 2026: Chennai Regional Office, non-deposit-taking, classification ICC, scale-based layer Middle, registered office No. 119, 2nd Floor, Greenways / Harita Towers, St. Mary’s Road, Abhiramapuram, Chennai 600018. The email printed on that official list is [email protected].

Corporate address: 7th Floor, South Annexe, Tower 2, One World Centre, 841 Senapati Bapat Marg, Lower Parel, Mumbai 400013. Founders, by the company’s own site: ISB alumni Deepak Jain, Manish Lunia and Ritesh Jain. Acuité’s June 2026 note lists directors including Deepak Surajmal Jain, Ritesh Jain and Sanjay Omprakash Nayar, among others. Subsidiary: FlexiLoans Technologies Private Limited, 100% held since 1 October 2019.

Middle layer is not a participation trophy. It is RBI saying: you are large enough, active enough and risky enough to sit above the base layer. You are supposed to know Fair Practices, Digital Lending Directions, CIC reporting and outsourcing rules in your sleep. You do not get to hide behind “we are just a startup app.”

2. The growth story they sell investors — and the book they actually run

The marketing line is syrup: Loan nahi, samjho tarakki hai. Progress. Mobility. The underserved MSME.

The ledger is larger, and colder.

FY24, company’s own annual report (Epimoney):

• AUM: ₹1,753.405 crore (from ₹1,063.950 crore in FY23) — about 65% growth
• Loan book: ₹1,030.208 crore (from ₹569.979 crore)
• Disbursements: over ₹3,200 crore; average term-loan ticket about ₹6.8 lakh
• Gross revenue: ₹261.909 crore (from ₹105.395 crore)
• Consolidated PAT: ₹3.034 crore (from ₹1.679 crore)
• On-book GNPA: 2.7% → 4.3%
• On-book NNPA: 1.07% → 2.83%
• FY24 annual report also states that during that year there were no material orders by regulators, courts or tribunals affecting going-concern status.

Later public figures:

• June 2025 company milestone: cumulative disbursements ₹10,000 crore, 1.7 lakh+ loans, 59,000+ MSMEs, 66% of borrowers from Tier-II/III/IV, 10%+ of book women-led, AUM then cited above ₹2,300 crore, 83% CAGR FY22–FY25, profitable three years running.
• Acuité (30 June 2026): disbursements ₹3,783.52 crore in FY26 (provisional) versus ₹1,756.11 crore in FY23; AUM ₹2,920.93 crore versus ₹1,064.47 crore; about 17.4% of FY26 AUM in supply-chain finance, rest unsecured business loans; typical ticket ₹5–20 lakh, tenor mostly above 24 months. Rating assigned/reaffirmed around ACUITE A- / A2+, Stable. Capital raised since inception cited at ₹824.31 crore.
• June 2025 Series C: ₹375 crore, after ₹290 crore in September 2024 — ₹665 crore in six months. Investors named in contemporaneous coverage: Fundamentum, Accion Digital Transformation, Nuveen, Maj Invest, and the UK’s British International Investment. Co-founder Deepak Jain told CNBC-TV18 the house was aiming at ₹4,000–5,000 crore AUM. Economic Times the same week put the then book near ₹2,300 crore, roughly half on own books, half with partners. Paisabazaar / marketplace sourcing and “digital marketing to get leads on its own website” were described as part of the engine.

So let us not pretend this is a kirana NBFC improvising SMS copy at midnight. This is a middle-layer lender with billion-rupee AUM, foreign DFIs on the cap table, and a stated ambition to keep stuffing the funnel. When a machine that size sends “pre-approved, 1%, ready for disbursal,” it is not a junior executive’s typo. It is acquisition policy wearing a smile.

3. The text that cannot survive a grown-up reading

Take the Inventiva-documented pair at face value as customer-facing copy. Do not need a forensic lab. Need a dictionary.

If the facility is ready for disbursal, verification is finished. If verification is pending, it is not ready for disbursal. Both sentences cannot be true at once. One of them is decoration. Decoration, in retail credit, is how you manufacture urgency.

Sister reports in the same Inventiva series describe a parallel script at about ₹27 lakh: no recent application; an old 2022 file already rejected; an agent, when called, saying there was no active approved application. A March 2026 Reddit thread on r/IsThisAScamIndia shows a student getting “₹20 lakh under review” then “₹25 lakh approved” and asking, reasonably, whether this is a loan or a phishing kit. Replies: do not open the link.

That is the product-market fit of this copy: it is built to be indistinguishable, at a glance, from both a real sanction SMS and a cloned phishing SMS. FlexiLoans’ own fraud-awareness PDF warns customers about exactly this genre — deceptive texts urging clicks — and lists only flexiloans.com and epimoney.in as trusted domains. The company is therefore on record that “approved, click here” is how thieves hunt. It still, on the public complaint record, talks that way itself.

4. “1% Interest” — the cheapest sentence in the message, and the least honest

Here the arithmetic stops being literary and becomes documentary.

CGTMSE is a credit guarantee, not a 1% loan shop. It does not set the borrower’s interest rate. Banks and NBFCs do. Typical CGTMSE-linked bank rates sit in a band often cited around 8.5–13% a year; NBFC ceilings under scheme literature have been discussed up to 18%. The fee CGTMSE actually publishes is an Annual Guarantee Fee. For a loan in the ₹10 lakh–₹50 lakh slab — which is where ₹22.90 lakh lives — the standard AGF from 1 April 2025 is 0.55% per year, not 1% interest. Mixing a guarantee fee with an interest rate is how you dress a charge in a costume.

Now read FlexiLoans in its own voice, not the WhatsApp voice.

On flexiloans.com and its blogs, MSME / unsecured business loans are sold as starting from “1% per month.” The same pages translate that, when they bother, as 12% per annum as a starting rate. Paisabazaar’s product card as of 1 September 2026: 1% per month onwards, amounts advertised up to ₹10 crore, tenure up to 5 years, processing up to 2%. Other FlexiLoans pages put processing at 2–6% plus GST, foreclosure 5% on pending principal, late fee ₹1,000 + GST, bounce ₹750. The company’s own explainer places NBFC/fintech MSME rates in the 15–24% per annum street. Eligibility chatter on product pages includes vintage, turnover floors and CIBIL around 700.

So what, precisely, is “pre-approved at 1% Interest” doing in a WhatsApp?

• If it means 1% per annum, it is a fantasy next to the firm’s published 12% p.a. starting line and the 15–24% NBFC band it cites for the industry.
• If it means 1% per month, the message hides the unit. “1%” without “per month” is how you make 12% a year look like a festival discount.
• Either way, there is no tenor, no APR, no processing load, no CGTMSE AGF, no penal-charge schedule. RBI’s Digital Lending Directions, 2025 and the April 2024 Key Fact Statement regime exist so that this exact fog cannot be the first official sentence a borrower reads.

And after the borrower is inside the tent, the overdue tariff in Epimoney’s own penal-charges policy is not 1% of anything gentle. Term-loan penal charges: up to 36% per annum on overdue EMI for the days in default. Supply-chain finance: the same 36% idea on overdue principal and interest. That document cites RBI’s Responsible Business Conduct Directions of 28 November 2025. The firm can find the circular when it wants to charge. It develops amnesia when it wants to acquire.

5. Consent is not a checkbox from 2022

Promotional credit texts are not “service updates” because the copywriter put “Dear Customer” at the top.

Under TRAI’s TCCCPR 2018, tightened by the Second Amendment Regulations, 2025 (notified 12 February 2025):

• Promotional messages cannot land on DND / NCPR numbers.
• They run in a time window (standard commercial window 9 a.m. to 9 p.m.).
• Headers are supposed to tell you what the message is. Dressing a lead-gen blast as a transactional “disbursal update” is how you borrow the privileges of a bank alert without earning them.
• Consent to finish an ongoing transaction is not a lifetime hunting licence; the 2025 amendments squeezed that pretence — consent tied to a live transaction is short-lived; implicit service consent dies with the contract.
• A sender is not supposed to keep knocking on a door the customer has closed.

RBI and TRAI have been building a Digital Consent Acquisition stack precisely because “you applied once in 2022, therefore we may text you forever that ₹27 lakh is approved” is the rotting beam under Indian financial spam. In December 2025 TRAI publicly described a DCA pilot with major banks so customers could see, manage and revoke promotional consents. That pilot exists because legacy consent is a mess. It is not a permission slip for an NBFC to announce a finished sanction that its own agent later cannot find on the system.

Epimoney’s website terms are the usual vacuum cleaner: you agree they and partners may call, mail and text; you authorise CIBIL pulls for creditworthiness. That language binds a person who applies. It does not turn an old rejection into a standing order to declare a fresh ₹23 lakh “ready for disbursal.” If the firm’s defence is “the customer once touched our funnel,” that is an argument that the consent framework was written to kill.

6. CIBIL: what is proven, what is alleged, what is convenient

This is where sloppy outrage and real harm have to be separated, or the piece becomes the thing it is attacking.

Proven, general mechanics — not unique to this lender:

• A lender pull on an application is a hard enquiry.
• TransUnion CIBIL’s Bhushan Padkil has said in published interviews that a few enquiries over time are normal; a cluster of hard enquiries and loans in a short span can affect the score and how the next lender reads the file.
• Industry explainers commonly peg a single hard pull in the region of a few points to about 5–10, with a cluster doing more; the enquiry remains visible for a long tail (often discussed around two years). Soft pulls — you checking yourself — do not score.
• Moneycontrol has separately recorded the naming confusion: the brand on the app is FlexiLoans; the legal name on the bureau file is Epimoney. People already stare at their report and think a stranger pulled them.

Alleged, in the FlexiLoans complaint pattern:

Public accounts compiled by Inventiva and echoed on forums describe this chain: unsolicited “approved” text → click → Aadhaar and PAN → rejection or “threat-detection” fail → later discovery of a hard enquiry → in some tellings, a later pitch for a secured / higher-cost product. Mouthshut reviews of Flexiloans, independent of Inventiva, are not a statistical sample, but they are not silent either: March 2026, “hidden charges and poor support”; January 2024, “fraudulent and suspicious,” Sunday Aadhaar verification “without consent”; April 2023, “never give any loans just collect your data.” Justdial’s Mumbai listing sits at 3.4/5 across 354 reviews — mixed, and many of them old, which is the opposite of a clean bill of health and also the opposite of a convicted crime.

What has not been put on a public court record, in the material reviewed for this article, is a finding that Epimoney designed hard enquiries as a weapon to cheapen a file and then resell gold-backed credit. That motive is an allegation. Treating it as a conviction would be doing the same thing the SMS does: overclaiming.

What does sit in plain sight is incentive. Hard pulls are the exhaust of a funnel that starts with a sentence that sounds like a sanction. If the customer never meant to apply, the exhaust is still in the chimney. The person who only wanted to know whether the text was real has now performed the one act the copy was written to extract: they entered the factory.

7. The compliance library versus the inbox

Epimoney is not short of PDFs.

There is a Grievance Redressal Policy citing RBI’s NBFC Responsible Business Conduct Directions, 2025; a complaints address [email protected]; a nodal mail [email protected]; a CIC-dispute section that even mentions ₹100 per day if credit-information correction is delayed beyond the prescribed window. There is a penal-charges policy. There is a phishing-awareness leaflet. There is a Fair Practices paper trail. The FY24 board report recites scale-based classification and statutory reserve transfers under section 45-IC.

Paper is cheap. An SMS that says “ready for disbursal” when the next SMS says “still being reviewed” is the operational document. RBI’s Digital Lending Directions, 2025 (8 May 2025) require creditworthiness assessment before a loan is extended; a Key Fact Statement before the contract; digitally signed KFS, sanction letter and terms on the RE’s letterhead after execution, to a verified email/SMS. They also nail the RE for what its LSPs and digital lending apps do. “The partner sent it” is not a doctrine. It is a shrug in a suit.

If FlexiLoans wishes to argue that every “approved” blast is a pre-qualification from bureau data, the adult way to say that is: “You may be eligible. This is not a sanction. No enquiry will be made unless you apply. Here is the APR range we actually charge.” The juvenile way is: “₹22,90,737 pre-approved at 1%, ready for disbursal — now hand over Aadhaar.”

One of those sentences belongs to a middle-layer NBFC. The other belongs in a spam folder.

8. Do not confuse this firm with the gutter apps — and do not give it that alibi either

Search “flexi loan” on complaint mills and you will drown in a different sewer: illegal APKs, contact-list harassment, photo threats, ₹3,000 sanctioned and ₹2,000 disbursed. The Ministry of Home Affairs / I4C still has to order Google to rip predatory titles off the Play Store — LoanOrbit, Hisab, Nexus Loan and their cousins in August 2026. Those are not Epimoney. Mixing them in is how a regulated NBFC steals innocence it has not earned.

The indictment here is narrower and, in a way, ruder. Fly-by-night apps break the law because they were built to. An RBI-listed middle-layer company with BII and Fundamentum on the wall, AUM near ₹3,000 crore, and a published starting rate of 12% a year does not get to borrow the grammar of those apps — fake finality, missing units on the rate, link-first KYC — and then point at the Play Store criminals as the real problem.

If the house is clean, publishing the header IDs, the DLT template numbers, the consent timestamp for each “approved” blast, and the exact CIC enquiry policy for incomplete click-throughs should be an afternoon’s work. Clean shops enjoy sunlight. Funnels do not.

9. What a serious investigation would actually pull

This is not a call for a press conference. It is a call for files.

TRAI / access providers
Pull DLT principal-entity registration for Epimoney / FlexiLoans Technologies. List every header and template that contains “approved,” “pre-approved,” “ready for disbursal,” “1%.” Count volumes. Scrub against NCPR. If promotional content rode a transactional header, that is the case.

RBI Department of Supervision / consumer protection
Ask the supervised entity for: (a) the underwriting state of Ref ID 352104 and every sibling file that received a “ready for disbursal” text in the same window; (b) whether a hard CIC pull is fired on link-open, on KYC upload, or only on a completed application; (c) LSP contracts and sample call/SMS scripts; (d) complaint registers tagged SMS / WhatsApp / CIBIL / consent for FY25 and FY26; (e) how “1% Interest” was authorised as template language against the firm’s own 1%-per-month / 12%-per-annum published floor.

Credit Information Companies
Match enquiry logs labelled FlexiLoans / Epimoney against customer declarations of “I did not apply.” Where the only “application” is a click on an unsolicited “already approved” link, say so in writing.

Serious Fraud / cyber cells, only where the facts support it
Cloned domains, UPI “processing fees,” OTP harvests — those are crime. Misleading commercial copy by a registered NBFC is first a conduct and UCC problem. Charging the wrong statute is how real cases die.

Timelines should not be ceremonial. UCC complaints already have a short window. CIC disputes have a 30-day clock and a compensation schedule the company itself recites. RBI’s Integrated Ombudsman Scheme, 2026, after the entity’s internal wait, can award consequential loss up to ₹30 lakh and harassment/cost up to ₹3 lakh. Those tools exist. They are idle if the only movement is another Fair Practices PDF.

10. The demand, without the perfume

RBI should treat “pre-approved / ready for disbursal” language from a middle-layer NBFC, sent before KYC and before a sanction letter, as a supervisory conduct issue, not a branding quirk. TRAI should treat that copy as promotional unless the sender can show a live, customer-initiated transaction. CICs should not allow a hard pull to be the silent souvenir of a spam click.

Epimoney should, if it wants the slogan tarakki to mean anything other than a joke:

1. Kill every template that says approved, pre-approved or ready for disbursal unless a sanction letter already exists.
2. Print per month and APR in the same breath as “1%,” or stop using the digit.
3. Publish, for 24 months, monthly counts of unsolicited credit texts, DND hits, CIC enquiries raised on incomplete journeys, and grievance outcomes.
4. Answer, on letterhead, the Inventiva and forum accounts — not with “we take compliance seriously,” with Ref IDs and consent logs.

Until then, the two WhatsApps remain the most honest document the firm has issued all year. They say the quiet part eight seconds apart: the loan is ready when they need the click. It is under review when they need the documents. The customer is a file. The file is a funnel. The funnel is the business.

Tarakki, they call it.

Some inboxes have another word.

Disclaimer

This article is an investigative examination of publicly reported customer complaints, contemporaneous journalism, the company’s own websites, policies and FY24 annual report, RBI’s published NBFC list and Digital Lending Directions, TRAI’s commercial-communication framework, rating-agency commentary, and generally applicable CIBIL guidance.

Allegations remain allegations. Descriptions of a “trap,” “scam,” “systematic fraud,” “deliberate CIBIL damage,” or a strategy to reject applicants in order to sell costlier secured credit are drawn from complaint narratives and published commentary. They are not findings of a court, tribunal, or the Reserve Bank of India.

As of the date of this article, no court of law has convicted Epimoney Private Limited, FlexiLoans Technologies Private Limited, or their identified founders or directors in respect of the SMS / WhatsApp / CIBIL matters discussed above. Searches of public RBI penalty lists and the company’s FY24 statutory disclosure did not turn up a published monetary penalty against Epimoney on these specific conduct issues. Absence of a conviction is not a certificate of virtue; it is a legal fact.

Readers who have received such messages should preserve screenshots, pull their CIC reports, use the entity’s grievance channel, TRAI’s DND / UCC route, bureau dispute portals, and, if unresolved, RBI CMS — and should not treat this article as a direction to withhold lawful dues on any loan they have actually taken.

This publication demands a tighter, faster supervisory and, where the evidence meets the statute, adjudicatory response: template-level scrutiny of “approved / ready for disbursal” texts, consent and DND audits, CIC-pull mapping on incomplete journeys, and time-bound disposal of consumer complaints — not another brochure.