NBFC Compliance, Mapped to the RBI Rulebook That's Actually Current

Every obligation on this page depends on one thing first: which Scale Based Regulation layer your NBFC sits in. That classification is set out in a dedicated 2025 RBI instrument — not the 2023 Master Direction many consultants still cite — and it has itself been amended since, most significantly on how the Upper Layer is identified.

Smaller, typically non-deposit-taking NBFCs — asset size below ₹1,000 crore — sitting under RBI's lightest layer of regulation.

Every deposit-taking NBFC, whatever its size, plus non-deposit-taking NBFCs with asset size of ₹1,000 crore and above.

NBFCs with asset size of ₹1,00,000 crore (₹1 lakh crore) and above, on the latest audited balance sheet, identified by RBI once a year.

A reserved category that RBI intends to keep empty, used only to escalate a specific Upper Layer NBFC whose systemic risk has grown substantially.

Layer is not the only axis that decides what binds you. Deposit-taking status pulls an NBFC into the Middle Layer or above regardless of size, and several categories run on their own category-specific RBI Directions, layered on top of — not instead of — the generic layer rules.

Before treating any later date or duty on this page as yours, answer four questions. Asset size: under ₹1,000 crore, between ₹1,000 crore and ₹1,00,000 crore, or ₹1,00,000 crore and above? Deposit-taking: does your NBFC accept public deposits? Listed: is it listed, or planning to list, on a stock exchange? Category: a plain NBFC-ICC, or a specialised category such as MFI, P2P, CIC, HFC, IFC or SPD?

Most Bharat Cred compliance clients are NBFC-ICC (Investment and Credit Company) in the Base Layer or Middle Layer — non-deposit-taking lenders below, at, or modestly above the ₹1,000 crore line, not the handful of NBFCs large enough to be Upper Layer. Wherever an obligation described later on this page binds the Upper Layer only, we say so explicitly next to it, rather than leaving you to guess.

Base Layer — No RBI-prescribed CRAR. Instead, a leverage ratio cap: total outside liabilities ÷ owned fund must not exceed 7, at all times. Middle Layer — Minimum CRAR of 15% of risk-weighted assets, with minimum Tier 1 capital of 10% of RWAs (NBFCs predominantly lending against gold jewellery: Tier 1 ≥12%, CRAR ≥15%). Upper Layer — Everything Middle Layer requires, plus minimum Common Equity Tier 1 (CET1) capital of 9% of RWAs. Tier 2 capital is capped at 100% of Tier 1 capital.

Base Layer — 0.25% of outstanding standard assets. Middle Layer — 0.40% of outstanding standard assets. Upper Layer — Category-differentiated rates (e.g. 0.25% for individual housing/SME loans, up to 1.00% for commercial real estate); 0.40% is the default for everything else. All three layers: the provision sits outside net-NPA computation and must be shown separately as "Contingent Provisions against Standard Assets."

Base Layer — 90 days overdue. The old 180→150→120→90-day glide path finished on 31 March 2026; as of today every Base Layer NBFC is on the same 90-day clock as everyone else. Middle Layer — 90 days overdue (no glide path — already on this norm). Upper Layer — 90 days overdue.

Base Layer — Mandatory. An RMC at Board or executive level, responsible for evaluating overall risk — including liquidity risk — and reporting to the Board. Middle Layer — Same RMC requirement, sitting alongside the Middle Layer's own Audit Committee and Nomination & Remuneration Committee. Upper Layer — Same RMC requirement, within the fuller Upper Layer governance chapter set.

Base Layer — Mandatory. At least one director must have relevant experience of having worked in a bank or an NBFC. Middle Layer — Same requirement. Upper Layer — Same requirement.

Base Layer — Not required by RBI. (A Base Layer NBFC-ICC may still need one independently under the Companies Act, 2013 once it crosses certain capital, turnover or borrowing thresholds — a company-law trigger, not an RBI one. We check this against your actual financials in the free compliance assessment.) Middle Layer — Mandatory: an Audit Committee of at least three Board members (Companies Act s.177 powers) and an NRC (s.178 powers). Upper Layer — Same as Middle Layer.

Base Layer — Not applicable. Middle Layer — Mandatory. A CCO on a minimum three-year tenure, reporting to the MD & CEO and/or the Board/Audit Committee, with no "dual hatting," plus an annual compliance risk assessment placed before the Board. Upper Layer — Same as Middle Layer.

Base Layer — Not applicable. Middle Layer — Mandatory once asset size exceeds ₹5,000 crore. The CRO reports to the MD & CEO or the Risk Management Committee, carries no business targets, and has no reporting line into business verticals. Upper Layer — Same ₹5,000-crore trigger (in practice, most Upper Layer NBFCs already exceed it).

Base Layer — Not required. Middle Layer — Mandatory. Upper Layer — Mandatory.

Base Layer — Mandatory set: a Board-approved concentration-risk policy, a Fair Practice Code with a grievance-redressal mechanism, a KYC policy, and an outsourcing policy (the full framework minus the IT-services-specific chapters, which start at Middle Layer). Middle Layer — All of the above, plus Board-approved policies on director fit-and-proper vetting, the CCO's role, and compensation (see the two rows below for what those actually require). Upper Layer — All Middle Layer policies, plus the Upper Layer's own board-composition and pre-listing disclosure policies.

Base Layer — No RBI-prescribed numeric ceiling. A Board-approved internal policy sets the single-borrower and single-group limits, plus mandatory sub-limits for unsecured consumer credit and a ₹1 crore-per-borrower cap on IPO financing. Middle Layer — 25% of Tier 1 capital to a single party, 40% to a single group (NBFC-IFC: 30%/50%), with a further 5%/10% headroom for infrastructure exposure. Upper Layer — The Large Exposure Framework applies instead: 20% of eligible capital base to a single counterparty (the Board may extend this, never beyond 25%), and 25% to a group of connected counterparties.

Base Layer — Not applicable. Middle Layer — Mandatory Board-approved policy covering fixed/variable pay structure and malus/clawback provisions, overseen by the NRC. Guaranteed bonuses are barred. Upper Layer — Same as Middle Layer.

Base Layer — Not applicable. Middle Layer — A Key Managerial Person cannot hold office (including directorships) in any other Middle or Upper Layer NBFC, other than a subsidiary. An independent director cannot sit on more than three Middle/Upper Layer NBFC boards at once. (Directorships in Base Layer NBFCs are unrestricted.) Upper Layer — Same rule as Middle Layer.

Base Layer — Required for any change in management resulting in more than 30% of directors changing, excluding independent directors and directors re-elected on retirement by rotation (tested cumulatively), filed through RBI's PRAVAAH portal. Middle Layer — Same 30%-of-directors rule. Upper Layer — Same 30%-of-directors rule. This 30%-director-change trigger is a distinct, additional test from the 26%-shareholding / change-of-control trigger in the row below — the two sit in two separate 2025 Directions (this one in the Governance Directions, 2025, para 10; that one in the Acquisition of Shareholding or Control Directions, 2025) and both can apply to the same transaction. Both are filed through PRAVAAH.

Base Layer — Required for (a) any takeover or acquisition of control, whether or not it changes management, or (b) acquisition/transfer of 26% or more of paid-up equity capital, including progressive increases over time — filed through PRAVAAH. Middle Layer — Same 26%/control rule. Upper Layer — Same 26%/control rule.

Base Layer — Not applicable. Middle Layer — Not applicable. Upper Layer — Mandatory listing within three years of Upper Layer classification, with listed-company-style disclosure required even before listing actually happens. (Exempt only for an NBFC-UL fully owned and controlled by Government.)

NOF is a category test, not a layer test — it does not change as you move from Base to Upper Layer the way the other rows here do. NBFC-ICC, NBFC-MFI, NBFC-Factor — ₹10 crore. Existing companies in these three categories are on a glide path: the intermediate milestone (₹5 crore for NBFC-ICC; ₹7 crore for NBFC-MFI and NBFC-Factor, ₹5 crore for NBFC-MFI in the North East Region) fell due 31 March 2025 and has passed; the final ₹10 crore milestone is due 31 March 2027, with no discount for the North East Region on the end figure. Miss a milestone and the NBFC is not eligible to hold its Certificate of Registration. NBFC-P2P, NBFC-AA and Type I NBFC — ₹2 crore. NBFC-IFC and IDF-NBFC — ₹300 crore. HFC, MGC, Standalone Primary Dealer, NOFHC, and a Factor/ICC registered only under the Factoring Regulation Act run on separate NOF regimes set out in their own category-specific RBI Directions — applicability depends on your NBFC's exact category, so we confirm the figure and glide-path milestone that actually applies to you in the free compliance assessment.

Every obligation above comes from the Reserve Bank of India (NBFC – Governance) Directions, 2025 and the sibling Directions RBI issued the same day — 28 November 2025 — on Prudential Norms on Capital Adequacy, Concentration Risk Management, Credit Facilities and roughly thirty other subject-wise NBFC Directions, all via circular DOR.RRC.REC.302/33-01-010/2025-26. Together they superseded the Master Direction – NBFC – Scale Based Regulation Directions, 2023 in full. Most compliance guides you'll find online still cite that 2023 Master Direction as if it were current — it isn't. A second wave followed on 31 July 2026: standalone Directions on the Compliance Function, Internal Audit Function, Statutory Audit and Fraud Risk Management replaced the 2021-2023 circulars on the Chief Compliance Officer, risk-based internal audit and statutory-auditor appointment, and a Cybersecurity, Technology: Risk, Resilience and Assurance Framework Direction replaced the 2017/2023 IT-governance Master Directions. Separately, the Reserve Bank – Integrated Ombudsman Scheme, 2021 was replaced by RB-IOS, 2026 with effect from 1 July 2026, and the NBFC Internal Ombudsman requirement now sits in its own standalone Direction dated 14 January 2026.

Purpose: FIU-IND registration is the prerequisite for every AML/CFT report your NBFC owes under the PML Act — you cannot file a single Suspicious Transaction Report or Cash Transaction Report without it. Process: registration runs in three sequential stages on the FINnet 2.0 portal — the entity first, then the Principal Officer, then the Designated Director. No report can be filed until all three are complete. Why this is urgent right now: FIU-IND publishes the names, CINs and registered addresses of NBFCs that haven't finished registering, and reviews the list every quarter. As of the most recent list we could independently verify (28 February 2026), 3,910 of 8,560 Base Layer NBFCs and 102 of 564 Middle Layer NBFCs were still on it. FIU-IND has since published newer lists on fiuindia.gov.in — most recently dated 17 August 2026 — so we check the current list against your CIN before telling you where you stand, rather than relying on this snapshot.

Purpose: pushes a new customer's verified KYC record into India's single central registry (CKYCR) so other lenders can pull it instead of re-verifying the customer from scratch. Deadline: upload within 10 days of commencement of the account-based relationship — the clock starts when the relationship begins, not when your KYC paperwork is finished. A separate 7-day clock applies whenever you push updated customer information to CKYCR. This is the registry filing itself, distinct from the ongoing KYC policy duties (risk review, periodic updation) covered elsewhere on this page.

Purpose: records the security interest you take over a borrower's assets, so the charge is enforceable and visible to other lenders before they extend credit against the same collateral. Deadline: file within 30 days of creating, modifying or satisfying the security interest; a further 30-day window is available on payment of additional fees if you miss it. Applicability: this binds NBFCs notified as "financial institutions" under SARFAESI — in practice, RBI-registered NBFCs with asset size of ₹100 crore and above. A smaller secured lender may still register, but without the same enforcement rights — worth confirming which track applies to you.

Requirement: every NBFC that is a "credit institution" must be a member of all four RBI-registered CICs — not just one — to report and pull borrower credit data. Cadence (the part most guidance still has wrong): effective 1 July 2026, reporting moved off the fortnightly cycle you'll see described everywhere else. It is now four reference dates a month — the 9th, 16th, 23rd and last day — with the full month-end file due by the 5th of the following month, and incremental files (new, changed or closed accounts) due within 4 calendar days of each of the three interim dates. Governing instrument: RBI (NBFC – Credit Information Reporting) Directions, 2025 (RBI/DOR/2025-26/349), as amended.

Section 215 of the IBC requires every financial creditor — which includes an NBFC extending credit facilities — to submit financial information, including records of default, to a registered Information Utility such as National E-Governance Services Limited (NeSL). What gets submitted, and how often, depends on your lending book and whether a default has actually occurred — there's no single blanket deadline to quote here. We map the exact scope for your NBFC during the free assessment rather than guess at one.

If RBI rejects a registration application, or moves to cancel an existing Certificate of Registration, the company has a statutory right of appeal to the Central Government — but only within 30 days of the order being communicated. Before any appeal can be rejected, the company must be given a reasonable opportunity of being heard; the Central Government's decision (or RBI's own decision, if no appeal is filed) is final. Every registration above — FIU-IND, CKYC, CERSAI, the CICs — sits downstream of your Certificate of Registration. If RBI ever issues an order against it, the 30-day appeal window is the first call to make, not an afterthought.

For a contravention or default under Section 58B of the RBI Act that doesn't fall under the heavier limb below, the ceiling is ₹25,000. Applies to every RBI-registered NBFC, regardless of layer.

This is the provision RBI actually uses against NBFCs, read with Section 58B(5)(aa) — failure to comply with any direction RBI has issued under Chapter IIIB of the RBI Act. Because every Master Direction (KYC, Fair Practices, IRACP, Recovery Agents, Scale Based Regulation, and the rest) is issued under Chapter IIIB, breaching any one of them is, by itself, a penalisable default under this clause. The ceiling: ₹10 lakh or twice the amount involved in the contravention, whichever is more, plus up to ₹1 lakh for every day after the first that a continuing default persists.

A ₹5 lakh ceiling — with a ₹5,000 base penalty and ₹25,000/day continuing default — still circulates widely in compliance checklists, consultancy material, and even some bare-act aggregator sites. Those are the pre-amendment figures, superseded by the Finance (No. 2) Act, 2019 (Act 23 of 2019, s.143(B)) with effect from 9 August 2019. We checked this against RBI's own consolidated text of the Act, not a third-party legal-database mirror — several of those mirrors still reproduce the unamended wording verbatim, which is exactly how the stale figure keeps circulating. The ₹10 lakh / twice-the-amount / ₹25,000 / ₹1-lakh-per-day figures above have been the actual law for more than six years.

Every NBFC monetary penalty we found on RBI's record for 2025-26 falls between ₹2.70 lakh and ₹33.10 lakh. That range is the statutory ceiling doing its job, not an enforcement failure — the crore-scale penalties you may have read about belong to banks, under a different law entirely (the Banking Regulation Act, 1949, Section 47A). Don't read a small fine as low risk: for an NBFC, the sharper consequence is never the penalty itself.

The Prompt Corrective Action framework — the escalating dividend, branch-expansion and capital-infusion restrictions triggered by breaching CRAR, NPA or leverage thresholds — binds every deposit-taking NBFC and every non-deposit-taking NBFC in the Middle, Upper and Top Layers. It expressly excludes the Base Layer. A non-deposit-taking NBFC-ICC in the Base Layer carries no PCA exposure at all — a genuine relief most Base Layer compliance calendars don't bother to mention.

The RBI Act gives you no statutory appeal against a Section 58G monetary penalty — your only practical recourse is a writ petition before a High Court. Compare that to Section 45-IA(7), which gives an NBFC a 30-day appeal to the Central Government against rejection or cancellation of its Certificate of Registration. A filing or KYC-control error is, in effect, final the moment RBI decides it. That's the real argument for getting it right the first time, not for contesting it afterward.

Money-laundering reporting failures aren't charged under Section 58G at all — FIU-IND has its own penalty power under the PMLA, charged per failure, which we've already covered under KYC, AML and PMLA Obligations above. The RBI Act ceiling isn't your only exposure.

Every NBFC is also a 'Data Fiduciary' under the Digital Personal Data Protection Act, 2023 — it holds customer KYC, credit and repayment data. That Act's penalty schedule became enforceable once the DPDP Rules, 2025 were notified on 14 November 2025, operationalising the Data Protection Board of India. Failing to maintain reasonable security safeguards against a data breach draws a penalty of up to ₹250 crore. Failing to notify the Board and affected customers of a breach, and breaching the extra safeguards around a minor's data, each draw up to ₹200 crore. Any other violation of the Act or Rules draws up to ₹50 crore. This runs entirely outside RBI's s.58G process above — a different Act, a different regulator, and exposure that dwarfs every RBI Act figure on this page. The Rules gave every Data Fiduciary an 18-month runway to get compliant; that runway ends 14 May 2027, so this is a live deadline, not a future one.

RBI ordered IIFL Finance to stop sanctioning or disbursing gold loans with immediate effect — gold-purity assaying deviations, Loan-to-Value breaches, cash disbursals beyond statutory limits, and opaque customer charges. This wasn't a fine; it was issued under Section 45L(1)(b), RBI's power to directly restrict how a regulated entity conducts its business, with no show-cause process required first. The restriction held for roughly six and a half months before being lifted.

RBI directed four NBFCs — two microfinance lenders and two NBFC-ICCs (Asirvad Micro Finance, Arohan Financial Services, DMI Finance, Navi Finserv) — to stop sanctioning and disbursing loans, over excessive spreads between cost of funds and the rate charged to borrowers, plus income-assessment and asset-classification lapses. All four were eventually cleared after remediation: Navi Finserv first, on 2 December 2024; Arohan Financial Services in early January 2025; Asirvad Micro Finance and DMI Finance on 8 January 2025.

The largest NBFC penalty on record in this window — for charging interest from a date before actual loan disbursement, failing to classify 90-day-plus overdues as NPAs, upgrading NPA accounts to 'standard' without full repayment of arrears, and issuing multiple customer IDs instead of one Unique Customer Identification Code per borrower.

Not a fine — RBI cancelled Datta Finance and Trading Private Limited's Certificate of Registration outright, because it had outsourced its core lending decisions (sourcing customers, due diligence, disbursement) to third-party apps instead of making them itself. The company can no longer operate as an NBFC. This is the consequence that ends a business, and it's recent.

A second penalty on the same NBFC — for recovery calls placed before 8 a.m. or after 7 p.m., plus messaging that didn't follow the required protocol. The underlying inspection looked back to the company's position as of 31 March 2024, almost two years before the order issued: your record has to hold up on inspection long after the fact, not just at the time.

Northern Arc Capital was penalised for incomplete complaint disclosure and failing to auto-escalate rejected grievances to its Internal Ombudsman. Muthoot MCred, for upgrading NPA accounts to 'standard' without full arrears recovery. Fusion Finance, for exactly one lapse — not running the six-monthly risk-categorisation review of customer accounts that the current KYC Directions require, the same review we cover under KYC, AML and PMLA Obligations above. A missed six-monthly process check, on its own, produced a real penalty order. Of everything on this page, that's the clearest proof these aren't theoretical obligations.

Every RBI Act or PMLA figure on this page is a monetary penalty — the kind you can provision for. The scenario that actually ends a business is the one we've flagged under Registrations Every NBFC Needs above: surrendering your CoR doesn't pause your compliance obligations. They continue, in full, until RBI actually processes the cancellation.

- Certificate of Registration (CoR) issued by RBI, plus any layer-classification or category-change letters received since - Memorandum and Articles of Association (MOA/AOA), with all amendments to date - CIN, PAN and GST registration details - Copies of supervisory returns already filed (current DNBS-series filings on CIMS, or legacy NBS-series returns still being transitioned) for the last 2–3 reporting cycles - Any RBI correspondence on file — inspection letters, show-cause notices or compounding orders, if applicable

- Board and committee minutes/resolutions for the period under review (Risk Management Committee, Audit Committee, NRC — whichever already apply to your layer) - Existing Fair Practice Code and customer grievance-redressal policy - Existing KYC-AML/PMLA policy, with current Designated Director and Principal Officer details - Outsourcing policy, if any financial or IT function is outsourced to a third party - Existing risk-management or credit-concentration policy, with Board-approved limits if already set - Register of directors/KMP and their DIN status

- Audited financial statements for the last 2–3 financial years, plus limited-review financials for the current year if ready - Loan portfolio data: disbursements, outstanding balances, overdue ageing and current asset-classification/NPA tagging - Net Owned Fund (NOF) workings or auditor's certificate, if one is already on file - Statutory Auditor's Certificate (SAC) or equivalent, if already filed for a prior year - Details of outstanding borrowings, NCDs or bank credit lines

- Existing customer KYC records due for periodic refresh, sorted by your current risk categorisation - FIU-IND FINnet 2.0 registration status — entity, Principal Officer and Designated Director stages, if completed - CKYC Records Registry upload history and login credentials, if already registered with CERSAI - CERSAI security-interest registration status, for any secured lending book - Membership confirmation with the Credit Information Companies (CIBIL, CRIF High Mark, Experian, Equifax), if already enrolled

Bharat Cred managed compliance: We track every RBI Direction, amendment and repeal as it is issued and update your compliance calendar the same week — so you are never filing against an instrument that has already been superseded.

Bharat Cred managed compliance: We start from your NBFC's actual layer, category and asset size, as set out in 'Which of These Rules Actually Bind Your NBFC?' above, and hand you only the obligations that bind you — not a rulebook written for every kind of NBFC there is.

Bharat Cred managed compliance: We prepare and file your CIMS returns and coordinate directly with your statutory auditor on the filings that have to come from them — exactly as described under 'What's Included in Our NBFC Compliance Engagement' and 'How an Engagement Actually Runs' above.

Bharat Cred managed compliance: We read the instruments themselves, not just RBI's summary pages — which is how we caught the conflict flagged earlier on this page, where RBI's own returns-list page still shows a different Base Layer asset-size threshold for certain ALM returns than the binding 2026 Directions use. We tell you which one to file against, not both.

Bharat Cred managed compliance: One point of contact at Bharat Cred owns your compliance calendar end to end. The same CA, CS and legal team who built it, described under 'Why NBFCs Choose Bharat Cred Solutions for Compliance' above, is the team you call when something changes.

A compliance calendar is a snapshot. Your NBFC's obligations are not. Between the November 2025 restructuring of the Scale Based Regulation framework and the July 2026 rebuild of the supervisory-returns rules, anything you printed a year ago is already out of date in more than one place — and no downloaded template or one-time filing exercise updates itself. That's the case for an ongoing engagement instead: see our engagement tiers below.