NBFC Regulatory Compliance in India 2026: RBI Master Directions and Scale-Based Regulation

## The Regulatory Evolution of NBFCs Non-Banking Financial Companies have been a cornerstone of India's credit delivery architecture, particularly for segments underserved by scheduled commercial banks — MSME credit, vehicle finance, gold loans, microfinance, and affordable housing. The NBFC sector, comprising over 10,000 registered entities as of 2024, ranges from systemically important deposit-taking entities with assets exceeding Rs. 50,000 crores, to small non-deposit taking companies serving niche local markets. The Reserve Bank of India's regulatory approach to this sector changed fundamentally after the IL&FS crisis of 2018 and the subsequent stress in DHFL, Reliance Capital, and other large NBFCs. The K.V. Kamath Committee recommendations (2020) and the Internal Working Group report on NBFCs (2021) laid the groundwork for the Scale-Based Regulation (SBR) framework, which the RBI introduced through a comprehensive circular in October 2021, effective October 2022. Understanding where your NBFC sits in the SBR framework — and the compliance obligations that flow from that classification — is the starting point for any regulatory compliance review in 2026. ## The Scale-Based Regulation Framework: Four Tiers The SBR framework classifies all NBFCs into four layers: ### NBFC-Base Layer (NBFC-BL) The lowest tier, comprising: - Non-deposit taking NBFCs with asset size below Rs. 1,000 crores - NBFCs not undertaking any other activity that would make them NBFC-ML or above - Peer-to-peer lending platforms, Account Aggregators, non-operative financial holding companies, and mortgage guarantee companies are categorised here Compliance requirements at the Base Layer are relatively light — principally the extant regulations governing specific NBFC categories, KYC/AML obligations, and fair practices code. ### NBFC-Middle Layer (NBFC-ML) Comprises: - All deposit-taking NBFCs (regardless of asset size) - Non-deposit taking NBFCs with asset size of Rs. 1,000 crores and above - Housing Finance Companies - Infrastructure Finance Companies, Standalone Primary Dealers, and Infrastructure Debt Funds The Middle Layer faces enhanced regulatory requirements including: - Mandatory appointment of Chief Risk Officer - Mandatory large exposure framework (single/group borrower limits) - Internal audit and compliance function requirements modelled on bank norms - Liquidity risk management framework - Disclosure requirements in financial statements ### NBFC-Upper Layer (NBFC-UL) The RBI identifies specific NBFCs for inclusion in the Upper Layer based on a scoring methodology that accounts for asset size, interconnectedness, complexity, and supervisory concerns. Entities in the Upper Layer are subject to bank-like regulation including: - Mandatory listing within three years of Upper Layer classification - CET1 capital requirements - Net Stable Funding Ratio requirements - Leverage ratio requirement - Differential standard asset provisioning aligned to bank norms ### NBFC-Top Layer (NBFC-TL) Reserved for systemically critical NBFCs where the RBI determines that enhanced regulatory intervention is warranted. No entities have been publicly identified in the Top Layer as of 2026, but the framework exists as a supervisory tool. ## RBI Master Directions: The Compliance Framework The RBI has consolidated NBFC regulations into a set of Master Directions that are updated periodically. The principal directions applicable in 2026: ### Master Direction — NBFC Acceptance of Public Deposits (Reserve Bank) Directions, 2016 (as amended) Governs deposit-taking NBFCs. Key restrictions include: maximum deposit amount (1.5x of Net Owned Funds), maximum deposit tenure (60 months), interest rate caps, mandatory credit rating (minimum BBB- for deposit-taking), and advertisement restrictions. ### Master Direction — Systemically Important Non-Deposit taking NBFCs (Reserve Bank) Directions, 2016 (as amended) Governs Middle and Upper Layer NBFCs on prudential norms — capital adequacy (minimum CRAR of 15% for most categories), asset classification, provisioning, concentration norms, and disclosure requirements. ### Master Direction — Non-Systemically Important Non-Deposit taking NBFCs (Reserve Bank) Directions, 2016 Governs Base Layer NBFCs on basic prudential and operational norms. ### Master Direction — Know Your Customer (KYC) Direction, 2016 (as amended to 2024) Applicable to all RBI-regulated entities including all NBFCs. The KYC Master Direction underwent significant amendments in 2024 incorporating: - V-CIP (Video Customer Identification Process) as a valid account opening method - Updated risk categorisation requirements (High, Medium, Low risk customers) - Beneficial ownership identification thresholds aligned with PMLA rules - Periodic updation requirements (2 years for high-risk, 8–10 years for medium/low risk) ### Master Circular — Fair Practices Code for NBFCs (as updated) The Fair Practices Code requires NBFCs to: - Provide loan application acknowledgements - Communicate loan sanction terms in the vernacular language of the borrower - Not interfere in the day-to-day affairs of borrowers beyond what is specified in loan agreements - Follow RBI guidelines on recovery — no coercive recovery methods, recovery agents trained and certified as per IBA/RBI guidelines - Disclose all charges upfront including processing fees, prepayment penalties, and penal interest The Microfinance NBFC guidelines (updated 2022) additionally cap total indebtedness of microfinance borrowers and prescribe household income limits. ## AML and CFT Obligations All NBFCs registered with the RBI are "reporting entities" under the Prevention of Money Laundering Act, 2002 (PMLA). This means: - Mandatory appointment of a Principal Officer and Designated Director for AML reporting - Filing of Suspicious Transaction Reports (STRs) and Cash Transaction Reports (CTRs) on the FIU-IND portal within prescribed timelines - Risk-Based Transaction Monitoring (RBTM) systems to flag unusual patterns - Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) for high-risk customers and PEPs (Politically Exposed Persons) The Enforcement Directorate has increasingly focused on NBFC AML compliance in investigations involving real estate, cryptocurrency, and hawala networks. NBFCs that serve Delhi NCR's real estate financing market are particularly exposed given the sector's historical cash-intensity. ## Key Compliance Failures and Regulatory Responses The RBI has been significantly more willing to use its enforcement powers since 2020. Common grounds for regulatory action include: 1. **Governance failures**: Directors without requisite financial expertise, related party transactions not at arm's length, promoter loans camouflaged as investment 2. **KYC violations**: Incomplete customer identification, failure to update KYC periodically, failure to maintain records in accessible format 3. **Recovery misconduct**: Use of recovery agents who engage in harassment, threats, or public shaming — the RBI has issued show-cause notices for viral social media incidents involving NBFC recovery agents 4. **Excessive concentration**: Single-borrower or group-borrower exposure exceeding prescribed limits, often in real estate 5. **Liquidity mismanagement**: Asset-liability mismatches where short-term liabilities fund long-term assets without adequate liquidity buffers — the primary structural weakness exposed in the IL&FS crisis ## The 2026 Compliance Priorities For NBFCs operating in Delhi NCR — whether in the MSME lending, housing finance, or commercial vehicle financing segments — the compliance priorities for 2026 are: - **SBR layer assessment**: Annual review of asset size to determine whether the NBFC has crossed the Rs. 1,000 crore threshold triggering Middle Layer requirements - **Board composition audit**: Ensuring independent directors, a risk management committee, and a CRO (for Middle Layer and above) are in place - **IT systems alignment**: The RBI's 2024 circular on IT governance for NBFCs has introduced enhanced requirements for cybersecurity, data governance, and audit trails - **CRILC reporting**: All NBFCs with loan exposure of Rs. 5 crores and above to a single borrower must report to the Central Repository of Information on Large Credits (CRILC) — compliance audits frequently identify gaps here - **Digital lending compliance**: NBFCs engaged in digital lending (including through lending service providers and digital lending apps) must comply with the RBI Digital Lending Guidelines (2022) and the subsequent FAQ-based clarifications Corpus Juris Legal advises NBFCs at all tiers on regulatory compliance, RBI inspection response, licence applications, and governance restructuring. Our banking and finance practice has advised NBFCs operating in Delhi, Gurugram, and Noida on compliance frameworks that meet RBI expectations in the SBR era.