TL;DR
- Middle Layer and Upper Layer NBFCs must appoint a Chief Compliance Officer under the RBI (Non-Banking Financial Companies - Compliance Function) Directions 2026, dated 31 July 2026.
- Base Layer NBFCs are outside the requirement.
- The CCO serves a minimum three-year tenure, sits not below two levels from the CEO, reports to the MD and CEO or the Board, and any appointment or removal needs prior intimation to RBI.
Quick Answer: Middle Layer and Upper Layer NBFCs must appoint a Chief Compliance Officer under RBI's Compliance Function Directions 2026, dated 31 July 2026. Base Layer NBFCs are outside the rule. The CCO serves a minimum three-year tenure, sits not below two levels from the CEO, and any appointment or removal needs prior intimation to RBI.
The Chief Compliance Officer (CCO) leads an NBFC's compliance function: identifying the obligations that apply, testing compliance and reporting breaches to senior management and the Board. Since 31 July 2026 the CCO's tenure, seniority and reporting rules sit in one instrument, the Reserve Bank of India (Non-Banking Financial Companies - Compliance Function) Directions 2026.
Chief Compliance Officer of a non-banking financial company (NBFC) at a glance
| Point | Position | Provision |
|---|---|---|
| Who must appoint | Middle Layer and Upper Layer NBFCs | Para 3, Compliance Function Directions 2026 |
| Selection | Selection committee constituted by the Board or Audit Committee | Para 18 |
| Minimum tenure | 3 years, relaxable by one year in exceptional cases | Para 21 |
| Seniority | Not below two levels from the CEO | Para 23 |
| Reporting line | MD and CEO, or the Board or Audit Committee | Para 25 |
| RBI notice | Prior intimation before appointment, removal or change in tenure | Para 29 |
Which NBFCs Must Appoint a Chief Compliance Officer?
Middle Layer and Upper Layer NBFCs, under paragraph 3 of the Compliance Function Directions 2026. The layer comes from the Scale Based Regulation Directions 2025.
| Layer | Who sits there | CCO required? |
|---|---|---|
| Base Layer | Non-deposit-taking NBFCs below ₹1,000 crore; P2P, account aggregator, NOFHC and Type I NBFCs | No |
| Middle Layer | All deposit-taking NBFCs; non-deposit-taking NBFCs of ₹1,000 crore and above; HFCs, CICs, IFCs, IDF-NBFCs and SPDs | Yes (HFCs: under Governance Directions para 25, not these Directions) |
| Upper Layer | NBFCs with assets of ₹1,00,000 crore and above, identified by RBI with a 24-month transition | Yes |
The Governance Directions 2025 separately require a Middle or Upper Layer NBFC to appoint a sufficiently senior CCO and adopt a Board policy on the role, under paragraph 25.
When Does a Growing NBFC Need One?
When it moves into the Middle Layer. A non-deposit-taking NBFC that reaches ₹1,000 crore of assets crosses the line. Group assets are consolidated for this threshold, and a group total of ₹1,000 crore or more moves each ICC, MFI, Factor and MGC in the group into the Middle Layer (paragraphs 17 and 18 of the SBR Directions).
What Do the 2026 Directions Require of the CCO?
Paragraphs 18 to 31 set selection, tenure, seniority and independence. The CCO's role differs from the general compliance officer's role in a multinational.
How Is the CCO Selected and for How Long?
A selection committee constituted by the Board or Audit Committee runs the process, and the Board or Audit Committee decides. The CCO may be hired from outside, and must have a clean track record and integrity under paragraph 19. Paragraph 21 sets a fixed minimum tenure of three years, which may be relaxed by one year in exceptional cases with a succession plan.
Who Does the CCO Report To?
Directly to the MD and CEO, the Board or the Audit Committee, under paragraph 25. Where the CCO reports to the MD and CEO, the Board or Audit Committee must meet the CCO one-to-one every quarter. The Board or Audit Committee also reviews the CCO's performance appraisal. Board-level reporting of this kind is covered in the guide to compliance reporting across entities.
How Is Independence Protected?
| Safeguard | Requirement | Provision |
|---|---|---|
| Seniority | Not below two levels from the CEO; a Middle Layer NBFC may go one level further | Para 23 |
| Reporting | No reporting line to business verticals | Para 26 |
| No dual-hatting | No business role; may sit on purchase or sanction committees in an advisory capacity only | Para 27 |
| Removal | Before the end of tenure only in exceptional circumstances, with the Board's or Audit Committee's explicit prior approval | Para 22 |
What Changed for NBFC Chief Compliance Officers in 2026?
The 31 July 2026 Directions consolidated the rules and repealed the 11 April 2022 circular on the compliance function, under paragraph 34. Most CCO rules were carried forward; two were not in the 2022 circular, including a tool requirement of the kind that RegTech platforms are built for.
| Rule | Status in 2026 | Provision |
|---|---|---|
| Prior intimation to RBI before appointment, premature transfer, resignation or removal | Carried forward from the 2022 circular | Para 29 |
| Prior intimation before a change in tenure terms | Not in the 2022 circular | Para 29 |
| One-level seniority relaxation for the Middle Layer | Carried forward | Proviso to para 23 |
| Quarterly one-to-one meeting with the Board or Audit Committee | Carried forward | Para 25 |
| Enterprise-wide, workflow-based compliance tool with escalation and a dashboard | Not in the 2022 circular | Para 32 |
The workflow and dashboard elements of the paragraph 32 tool are explained in how compliance management software works and the guide to a compliance dashboard.
How Is a CCO Appointment Notified to RBI?
An appointment is notified to the Senior Supervisory Manager, Department of Supervision, with a profile and a fit and proper certificate from the MD and CEO.
Where the full set of NBFC obligations is needed, see the NBFC compliance checklist.
How Is the CCO's Remit Evidenced?
Paragraph 32 turns the CCO's work into records: each obligation, its owner, its escalation and any approved deviation. A compliance management platform holds the obligations, owners and escalations with dates and evidence.
LexComply does not appoint, approve or report anything to Reserve Bank of India (RBI); the NBFC's Board and the CCO do. To see how the remit would be tracked, get in touch.
Common Mistakes to Avoid
- Relying on the April 2022 compliance function circular. It was repealed on 31 July 2026, and the 2026 Directions now govern the CCO's tenure and independence.
- Appointing a CCO in a Base Layer NBFC as a regulatory requirement. Paragraph 3 applies the Directions to Middle and Upper Layer NBFCs only.
- Notifying RBI after the event. Paragraph 29 requires prior intimation before an appointment, removal or change in tenure.
- Giving the CCO a business target or line. Paragraphs 26 and 27 bar a reporting line to business verticals and any business role.
- Removing a CCO mid-tenure on management approval. Paragraph 22 requires the Board's or Audit Committee's explicit prior approval, and only in exceptional circumstances.
- Assuming a minimum years-of-experience test. The 2026 Directions set seniority and integrity, not a fixed number of years' experience.
Legal Disclaimer
This article is general information on Indian financial regulation, current as at the date shown above. It is not legal advice and does not take account of any particular NBFC's facts. Obtain professional advice before acting on any position described here.