RBI compliance for NBFCs under India’s scale based framework
a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}
RBI compliance for NBFCs is now a layered obligation
RBI compliance for NBFCs is no longer a single annual checklist. As at October 31, 2026, an NBFC first needs to identify its regulatory layer and activity category, and then map registration, capital, governance, KYC, asset classification, reporting, audit, fraud, technology and customer conduct obligations to that profile.
The main shift is consolidation. The Reserve Bank of India reorganised much of the NBFC rulebook through entity-specific directions issued in 2025. It then added a further set of supervisory directions on July 31, 2026 covering compliance function, cybersecurity, digital payment security, fraud risk management, internal audit, statutory audit, auditor reporting and supervisory returns. You can also explore more in Regulation and Compliance.
For readers tracking broader financial regulation, see our Regulation and Compliance section. This article is an editorial overview, not legal advice. NBFCs should verify the latest RBI master directions, amendments and entity-specific communications before taking action.
Why the scale based framework matters
The starting point for RBI compliance is the scale based regulation framework. Under this model, NBFCs are grouped broadly into Base Layer, Middle Layer, Upper Layer and Top Layer. The classification is not a branding label. It determines the intensity of prudential regulation, governance expectations, reporting frequency and supervisory scrutiny.
Smaller non-deposit taking NBFCs with lower systemic risk generally sit in the Base Layer. Deposit-taking NBFCs, large non-deposit taking NBFCs and certain specialised entities are placed in the Middle Layer. The Upper Layer consists of NBFCs identified by RBI as requiring enhanced requirements because of size, complexity, interconnectedness or other risk factors. The Top Layer is intended for entities that may require still higher supervisory attention, although RBI can decide whether it remains empty at a given point in time.
This structure means two NBFCs can both be compliant while operating with different control environments. A small Type I NBFC, a peer-to-peer lending platform, a microfinance institution, a housing finance company and a systemically important investment and credit company do not face identical obligations. A useful compliance programme therefore begins with four questions:
- What is the NBFC’s RBI registration category and certificate status?
- Which scale based layer applies today, and has the entity crossed an asset-size or activity threshold?
- Does the entity accept deposits, access public funds, or have a customer interface?
- Which specialised directions apply because of the business model, such as microfinance, factoring, account aggregation, housing finance, digital lending or peer-to-peer lending?
Recent RBI framework timeline
The following timeline gives compliance teams a practical reference point when reviewing the current rulebook. Several obligations that were previously spread across older circulars have been reorganised into newer NBFC-specific master directions.
| Date or period | Regulatory development | Compliance impact |
|---|---|---|
| October 2022 | Scale based regulation became the operating framework for NBFC supervision. | NBFCs had to align capital, governance, exposure, disclosure and reporting controls to layer-based requirements. |
| October 19, 2023 | RBI issued the Master Direction on NBFC scale based regulation, later updated in 2024. | The 2023 direction became a central reference for registration, layer classification and prudential obligations until later consolidation. |
| November 28, 2025 | RBI issued consolidated NBFC directions covering registration, exemptions, scale based regulation, governance, capital adequacy, KYC, asset classification and other areas. | Compliance mapping shifted from older circular-by-circular tracking to a more entity-specific master direction structure. |
| July 31, 2026 | RBI issued a package of supervisory directions for NBFCs, including compliance function, cybersecurity, fraud risk management, internal audit, statutory audit and supervisory returns. | Boards and senior management need stronger evidence of oversight, data quality, independent control functions and timely regulatory reporting. |
| March 31, 2027 | Existing NBFC-ICC, NBFC-MFI and NBFC-Factor entities are expected to meet the final net owned fund endpoint of ₹10 crore under the prescribed glide path. | Entities still below the threshold need capital planning before the deadline, because failure to meet prescribed NOF levels can affect eligibility to hold registration. |
Core compliance areas for an NBFC
A practical RBI compliance framework should group obligations by risk area, not by document name alone. This reduces the risk that a team files returns on time but misses the board approvals, policy reviews, customer disclosures or data controls that support those filings.
| Compliance area | What it covers | What management should evidence |
|---|---|---|
| Registration and layer classification | Certificate of registration, principal business criteria, net owned fund, exemptions and activity-specific approvals. | Current CoR records, NOF calculations, layer assessment, threshold monitoring and RBI approvals where required. |
| Capital and prudential norms | Capital adequacy, leverage, concentration risk, asset classification, provisioning and stressed asset treatment. | Board-reviewed capital assessment, asset quality reports, provisioning workings, portfolio limits and exception logs. |
| Governance | Board composition, fit and proper criteria, risk governance, committees, policy approvals and senior management accountability. | Board minutes, committee terms of reference, annual policy reviews, director declarations and risk dashboards. |
| KYC and AML | Customer due diligence, beneficial ownership, ongoing monitoring, sanctions screening and CKYCR-related processes. | Risk categorisation, CDD records, screening logs, periodic updation schedules and internal audit findings. |
| Consumer conduct | Fair practices, transparent loan terms, grievance redressal, recovery practices, interest and fee disclosures. | Standard customer communications, grievance MIS, loan agreement templates and monitoring of outsourced agents. |
| Reporting and returns | Supervisory returns, prudential returns, fraud reporting, auditor certificates and event-based filings through RBI portals. | Return calendar, maker-checker controls, CIMS or portal submission records, reconciliation packs and escalation notes. |
| Audit and assurance | Internal audit, statutory audit, auditor reporting and board oversight of corrective actions. | Risk-based audit plan, audit committee review, issue ageing, closure evidence and auditor communications. |
| Technology and fraud controls | Cybersecurity, digital payment security, fraud risk management, early warning signals and operational resilience. | IT risk assessment, incident response testing, fraud monitoring, access controls and business continuity evidence. |
Governance and prudential controls to prioritise
Governance is the control layer that connects RBI obligations across the business. The 2025 and 2026 directions reinforce that compliance cannot sit only in a filing team. It needs to be visible in board agendas, risk committees, internal audit reports, product approvals and management information systems.
For Middle Layer and Upper Layer NBFCs, the compliance function is especially important because RBI expects an independent and adequately resourced function with clear responsibility for compliance risk. In practice, this means the Chief Compliance Officer or equivalent function should do more than circulate circulars. It should assess regulatory impact, test whether business units have implemented controls, monitor new products, escalate breaches and report material issues to senior management and the board.
Prudential controls also require close attention. NBFC-Middle Layer entities generally face more demanding capital and risk management expectations than Base Layer entities, and Upper Layer NBFCs face still higher scrutiny, including enhanced capital quality expectations. Category-specific rules can change the position further. Microfinance, housing finance, infrastructure finance, factoring, peer-to-peer lending and account aggregation each carry additional compliance points.
The net owned fund requirement is another area where deadline tracking matters. Under the prescribed glide path, existing NBFC-ICC, NBFC-MFI and NBFC-Factor entities are expected to reach ₹10 crore NOF by March 31, 2027. NBFC-P2P, NBFC-AA and certain NBFCs without public funds and without customer interface have different NOF treatment, while infrastructure finance and infrastructure debt fund NBFCs have much higher requirements. A compliance review should therefore verify both the amount and the applicable category, not just the headline threshold.
Reporting, audit and data quality after the 2026 supervisory directions
The July 31, 2026 supervisory directions make data quality a central compliance issue. Returns are not just administrative submissions; they represent the regulated entity’s official risk data. A return that is late, inconsistent with audited figures, unsupported by source systems or not approved through a documented process can create supervisory concern even where the underlying business is sound.
NBFCs should treat regulatory reporting as a controlled process with defined ownership. A strong process includes a return inventory, source-data owners, validation checks, maker-checker review, senior sign-off, evidence retention and a clear route for correcting errors. The board and senior management should be able to see whether returns are submitted on time, whether exceptions recur, and whether technology systems can produce accurate data without manual workarounds. See also: Blockchain Technology.
Internal audit is equally important. RBI’s 2026 internal audit direction emphasises risk-based internal audit as a third line of defence for applicable NBFCs. This means the audit plan should be linked to the NBFC’s risk profile and should not be limited to branch cash checks or sample loan files. It should test governance, controls, risk management, regulatory reporting, IT systems, outsourced activities and corrective action closure. The head of internal audit should have sufficient independence and direct access to the board, audit committee or senior leadership as required.
A practical implementation checklist
For an NBFC reviewing its compliance posture, the most useful approach is to move from document collection to control testing. The following checklist can help management convert RBI obligations into an operating programme.
- Confirm the regulatory profile. Document the registration category, layer, asset-size thresholds, deposit status, customer interface status and specialised business permissions.
- Create a direction-wise applicability matrix. Map every 2025 and 2026 NBFC master direction to the entity, marking applicable, partly applicable, not applicable and pending legal confirmation.
- Update board-approved policies. Review policies on compliance, KYC, credit, provisioning, fair practices, outsourcing, IT security, fraud risk, internal audit and grievance redressal.
- Build a regulatory calendar. Include periodic returns, event-based filings, board reviews, audit committee reporting, KYC updation cycles, policy review dates and capital deadlines.
- Test data lineage. Reconcile numbers used in RBI returns with the general ledger, loan management system, customer records, fraud records and audited financial statements.
- Review customer-facing controls. Check whether loan agreements clearly state due dates, repayment frequency, principal-interest breakup, overdue treatment and NPA implications where applicable.
- Strengthen incident and breach escalation. Define who reports compliance breaches, fraud indicators, cybersecurity events, customer harm issues and material audit observations.
- Track remediation to closure. Maintain ageing for internal audit findings, RBI observations, statutory auditor comments, KYC exceptions and customer complaint root causes.
Common compliance mistakes to avoid
The most common mistake is relying on an outdated annual compliance checklist designed before the 2025 consolidation and the 2026 supervisory directions. A second mistake is treating Base Layer status as an exemption from governance discipline. Requirements are proportionate, but smaller NBFCs still need evidence that they understand and monitor their obligations.
Another recurring weakness is poor linkage between policy and practice. A board-approved KYC or fair practices policy has limited value if the loan origination workflow, call centre scripts, collection agency training and grievance records do not reflect it. Similarly, a cybersecurity policy is not enough without access reviews, incident playbooks, vendor oversight and periodic testing.
Finally, many NBFCs under-invest in regulatory change management. RBI directions may be amended, substituted or clarified, and entity-specific communications can create additional obligations. Compliance teams should maintain a live change log rather than a static folder of circulars downloaded once a year.
Frequently asked questions
What is the first step in RBI compliance for an NBFC?
The first step is to confirm the NBFC’s regulatory profile: registration category, scale based layer, asset size, deposit status, customer interface and specialised business model. Without that profile, the entity may apply the wrong capital, governance, KYC or reporting requirements.
Does every NBFC follow the same RBI compliance checklist?
No. RBI compliance is proportionate and activity-based. Base Layer, Middle Layer and Upper Layer NBFCs face different requirements, and specialised entities such as NBFC-MFI, NBFC-Factor, NBFC-P2P, account aggregators, housing finance companies and infrastructure finance companies have additional or different obligations.
What changed in 2026 for NBFC compliance teams?
On July 31, 2026, RBI issued several NBFC supervisory directions covering compliance function, cybersecurity, digital payment security, fraud risk management, internal audit, statutory audit, auditor reporting, supervisory returns and miscellaneous supervisory matters. The practical effect is greater focus on board oversight, control independence, data quality and evidence-based compliance.
Is KYC applicable to all NBFCs?
RBI’s NBFC-specific KYC directions apply across NBFC categories and layers unless specified otherwise, but NBFCs without customer interface are treated differently. Each entity should verify the exact wording that applies to its model, especially if it operates through digital channels, agents, partners or overseas branches and subsidiaries.
Why is March 31, 2027 important for some NBFCs?
It is the final endpoint in the prescribed net owned fund glide path for existing NBFC-ICC, NBFC-MFI and NBFC-Factor entities to reach ₹10 crore. Entities affected by this requirement should review capital plans well before the deadline rather than treating it as a year-end filing issue.
