Complete Checklist for NBFC Compliance in India

Non-Banking Financial Companies have quietly become one of the most important pillars of India's credit ecosystem. They fund small businesses that banks won't touch, they finance two-wheelers in towns without a single bank branch, and they have made lending faster and more accessible for millions of Indians. But this growing influence comes with a price: the Reserve Bank of India now watches NBFCs almost as closely as it watches banks. A single missed filing, an outdated policy document, or a lapsed KYC procedure can invite penalties, public reprimand, or in serious cases, cancellation of the Certificate of Registration itself.

This is exactly why a well-structured checklist for NBFC compliance is no longer optional paperwork sitting in a compliance officer's drawer. It is the operating manual that keeps an NBFC's licence, reputation, and business continuity intact. In this article, we break down every layer of NBFC compliance in India — from registration and capital norms to monthly returns, governance requirements, and cybersecurity obligations — in a way that's actually useful for founders, compliance teams, and finance professionals trying to stay ahead of RBI's ever-tightening supervisory framework.

What Exactly Does "NBFC Compliance" Mean?

NBFC compliance refers to the entire body of regulatory obligations that a Non-Banking Financial Company must fulfil under the Reserve Bank of India Act, 1934, the Companies Act, 2013, and the various Master Directions and circulars issued by RBI from time to time. It covers everything from the minimum Net Owned Fund an NBFC must maintain, to how it classifies its assets, to how quickly it must report a data breach.

Unlike a one-time registration formality, compliance for an NBFC is continuous. It has daily, monthly, quarterly, half-yearly, and annual layers, each with its own portal, format, and deadline. Since the RBI introduced the Scale Based Regulation (SBR) framework, the compliance burden has also started varying by "layer" — Base Layer, Middle Layer, Upper Layer, and Top Layer — meaning larger and more systemically important NBFCs face significantly stricter requirements than smaller ones.

Why Has NBFC Compliance Become So Strict in Recent Years?

If you have been in the NBFC space for more than a few years, you have likely noticed the shift. NBFCs once operated with considerably more flexibility than banks. That changed sharply after a series of high-profile defaults and governance failures shook investor confidence in the sector. RBI responded by tightening prudential norms, introducing the Scale-Based Regulation framework, mandating stronger board oversight, and increasing the frequency and depth of its inspections.

Today, RBI treats NBFCs as an extension of the formal financial system rather than a loosely regulated alternative to it. That means asset classification norms similar to banks, stricter capital adequacy requirements, mandatory risk management committees for larger NBFCs, and far more rigorous reporting through digital platforms like the XBRL portal and COSMOS. Non-compliance today doesn't just attract a notice — it can trigger monetary penalties under Section 58B of the RBI Act, restrictions on business activity, or outright cancellation of the Certificate of Registration.

What is the Basic Checklist for NBFC Compliance Required Before an NBFC Can Even Begin Operating?

Before compliance calendars and monthly returns come into the picture, an NBFC needs to get its foundation right. This starting checklist for NBFC Compliance is often overlooked by newer entities eager to launch operations quickly.

Getting the Basics Right at Incorporation and Registration

First, the entity must be incorporated as a company under the Companies Act, 2013, with financial activity clearly stated as its principal business. Second, it must obtain a valid Certificate of Registration from the RBI, without which it cannot legally describe itself as an NBFC or carry out lending, investment, or deposit-related activities. Third, and perhaps most critical, is maintaining the Minimum Net Owned Fund prescribed by RBI, which currently stands at ₹10 crore for most categories of NBFCs, with certain specialised categories subject to different thresholds. Finally, the company's board composition, fit-and-proper criteria for directors, and shareholding pattern must all align with RBI's ownership and governance expectations right from day one.

Getting any of these building blocks wrong doesn't just cause future compliance headaches — it can delay or derail the registration itself. Here's a quick snapshot of what needs to be in place before you go live:

What Are the Core Prudential Norms Every NBFC Must Maintain?

Once operational, an NBFC's financial health is judged against a set of prudential norms that RBI monitors continuously. The Capital to Risk-Weighted Assets Ratio, commonly called CRAR, is one of the most closely watched figures — NBFCs are generally required to maintain a CRAR of 15%, ensuring they hold enough capital cushion against the risks on their books.

Important Financial Ratios and Norms to Track

Asset classification is another pillar. NBFCs must categorise their loan assets as standard, sub-standard, doubtful, or loss assets based on defined ageing criteria, and must provision for these accordingly — much like banks do. Income recognition norms determine when interest income can actually be booked as revenue versus when it must be deferred due to asset stress. On top of this, exposure norms cap how much an NBFC can lend to a single borrower or group, preventing concentration risk from building up unchecked. Liquidity Coverage Ratio requirements have also been extended to larger NBFCs to ensure they can meet short-term obligations even during periods of market stress.

Together, these norms exist to make sure an NBFC's balance sheet reflects reality, not an optimistic version of it.

What Returns and Filings Must an NBFC Submit to RBI?

This is where most compliance teams spend the bulk of their time, because the filing calendar for NBFCs is genuinely dense. Monthly, quarterly, half-yearly, and annual returns each serve a different regulatory purpose, and missing even one can trigger a compliance flag.

NBFC Filing Calendar

On a monthly basis, most non-deposit-taking NBFCs above the specified asset threshold must file returns capturing their financial position and asset-liability profile, generally due within the first week of the following month. Quarterly filings include statements on capital funds, risk-weighted assets, and asset classification, giving RBI a running picture of financial health throughout the year rather than a single annual snapshot.

Half-yearly filings often cover statutory auditor certificates and specific structured liquidity statements for applicable categories. Annually, NBFCs must submit audited financial statements, the NBS-7 return (a comprehensive annual return capturing capital adequacy, asset quality, and other prudential parameters), a statutory auditor's certificate confirming continued eligibility to hold a Certificate of Registration, and details of foreign investment where applicable — most of these carrying a deadline of 30th June each year.

Almost all of these filings are now submitted digitally through RBI's dedicated reporting platforms, and the shift to XBRL-based reporting has made data accuracy and internal reconciliation far more important than they used to be.

How Does the Scale-Based Regulation Framework Change the Compliance Burden?

One of the most significant shifts in recent years is that NBFC compliance is no longer "one size fits all." Under the Scale-Based Regulation framework, NBFCs are grouped into four layers — Base Layer, Middle Layer, Upper Layer, and Top Layer — based on their size, interconnectedness, and systemic importance.

How do compliance expectations rise with each SBR Layer?

A small Base Layer NBFC faces relatively lighter governance and reporting requirements. As an NBFC moves up into the Middle and Upper Layers, expectations rise sharply: mandatory constitution of a Risk Management Committee, more stringent corporate governance disclosures, tighter exposure norms, and additional regulatory reporting akin to what banks follow. Upper Layer NBFCs are even subject to a differentiated regulatory framework similar in spirit to how systemically important banks are supervised.

This means that as your NBFC grows its balance sheet, your compliance checklist doesn't just get longer — it fundamentally changes in nature.

What Governance and Board-Level Compliance Does RBI Expect?

Compliance isn't only about returns and ratios; RBI places significant weight on governance structure. NBFCs are expected to have a board-approved Fair Practices Code that governs how they interact with customers, from loan sanction to recovery practices. A KYC and Anti-Money Laundering policy, aligned with guidelines from RBI and the Financial Intelligence Unit-India, must be in place and actively followed, not just documented for the sake of an audit.

Board Committees and Director-Level Obligations

Larger NBFCs must also constitute specific board committees — an Audit Committee, a Nomination and Remuneration Committee, and, depending on the layer classification, a Risk Management Committee. Director appointments and resignations must be intimated to RBI within 30 days, and any change in management or shareholding beyond specified thresholds requires prior RBI approval. Fit-and-proper due diligence on directors isn't a one-time exercise either — it needs to be reaffirmed periodically to ensure ongoing eligibility.

What are the Company Law and Tax Compliance Requirements Alongside RBI Norms?

The following are the Company law and tax compliance requirements alongside RBI Norms:

ROC and Companies Act Obligations

Because every NBFC is first and foremost a company registered under the Companies Act, it must simultaneously comply with standard corporate compliance requirements administered by the Registrar of Companies. This includes holding the Annual General Meeting within the prescribed timeline, filing Form AOC-4 for financial statements and Form MGT-7 for the annual return, maintaining statutory registers, and ensuring board meetings are held at the required frequency with proper minutes recorded.

GST and Income Tax Obligations

On the tax side, NBFCs must file GST returns where applicable, including GSTR-9 and GSTR-9C for entities crossing the specified turnover threshold, along with regular income tax filings and TDS compliance. Because NBFCs often deal with interest income, loan processing fees, and recovery-related transactions, their GST and income tax positions can get complicated quickly, making accurate bookkeeping essential rather than optional.

Why has Cybersecurity Become a Non-Negotiable Part of NBFC Compliance?

As NBFCs have digitised lending, collections, and customer onboarding, RBI has correspondingly tightened its cybersecurity expectations. A board-approved cybersecurity policy is now mandatory, covering data confidentiality, integrity, and availability across the NBFC's systems. This isn't a document that can be drafted once and forgotten — it needs periodic review as threats and technology evolve.

Practical Cybersecurity Obligations Beyond the Policy Document

Practical obligations flowing from this policy typically include regular vulnerability assessments and penetration testing, a defined incident response mechanism, timely reporting of cybersecurity incidents to RBI's CERT-In framework, and strong access management controls across core systems. For NBFCs relying on outsourced technology vendors or cloud infrastructure, vendor risk governance has become equally important, since RBI holds the NBFC accountable even when a breach originates with a third-party service provider.

What Happens if an NBFC Fails to Meet These Compliance Requirements?

The consequences of non-compliance have grown considerably more serious over the years. Under Section 58B of the RBI Act, penalties for specific violations can range from fines running into lakhs of rupees to imprisonment for serious or repeated offences. Beyond direct penalties, RBI can impose restrictions on an NBFC's ability to accept deposits, expand its branch network, or undertake certain categories of lending.

What the Escalation Ladder Typically Looks Like:

In the most severe cases — typically involving persistent governance failures, fund diversion, or repeated non-filing of returns — RBI has the authority to cancel the Certificate of Registration altogether, effectively shutting the NBFC out of the business it was built for. Even short of these extreme outcomes, a poor compliance track record damages an NBFC's ability to raise funds, since banks, rating agencies, and institutional lenders increasingly factor regulatory compliance history into their credit assessments.

How Can an NBFC Build a Reliable, Ongoing Compliance System?

Given how layered and continuously evolving NBFC compliance has become, treating it as a periodic scramble before deadlines rarely works. The NBFCs that manage this well tend to build a compliance calendar that maps every monthly, quarterly, half-yearly, and annual obligation against clear internal ownership — so nobody is scrambling to figure out who's responsible for a filing three days before it's due.

They also invest in getting their asset classification and CRAR calculations reviewed regularly rather than only at year-end, since these numbers directly affect regulatory standing and lending eligibility. Board-approved policies — Fair Practices Code, KYC-AML, and cybersecurity — are treated as living documents reviewed periodically rather than static paperwork. And increasingly, NBFCs are automating parts of their reporting workflow to reduce the manual errors that so often creep into XBRL filings and monthly returns.

Where Does Professional Guidance Fit into this Process?

Reading through everything above, it's easy to see why NBFC compliance can feel overwhelming, especially for newer or growing entities without a dedicated in-house regulatory team. The rules change frequently, the filing formats get updated, and the difference between a smooth RBI relationship and a stressful one often comes down to whether someone is genuinely tracking these obligations in the background, month after month.

This is the kind of ongoing support that firms like StartRight4U typically step in for — helping NBFCs set up their compliance calendars correctly from the start, keeping track of RBI's evolving Master Directions, and making sure returns, board resolutions, and policy documents are filed accurately and on time. For a founder or finance team already juggling lending operations, collections, and fundraising, having someone quietly manage this compliance backbone can be the difference between growing with confidence and constantly worrying about the next regulatory notice.

Whether you're a newly registered NBFC building your first compliance calendar, or an established one navigating the tighter expectations that come with moving into a higher SBR layer, the underlying principle stays the same: compliance isn't a hurdle to clear once a year — it's an ongoing discipline that protects the licence your entire business depends on.