TL;DR
- NBFC compliance software should track every RBI obligation that applies to the NBFC's layer: supervisory returns, KYC and FIU-IND reporting, digital lending controls and the compliance function itself.
- Since 31 July 2026, RBI's Compliance Function Directions require Middle and Upper Layer NBFCs to use an enterprise-wide, workflow-based compliance tool with escalation and a unified dashboard.
- Each obligation record should hold an owner, a due date, evidence and a status.
Quick Answer: NBFC compliance software should track every RBI obligation for the NBFC's layer, from supervisory returns and KYC to digital lending and the compliance function. Since 31 July 2026, RBI's Compliance Function Directions require Middle and Upper Layer NBFCs to use an enterprise-wide, workflow-based compliance tool. Every obligation record needs an owner, a due date, evidence and a status.
The Reserve Bank of India (RBI) rewrote most non-banking financial company (NBFC) rules into consolidated Directions on 28 November 2025 and 31 July 2026. Software configured against the older Master Directions now tracks repealed text. The first test of any NBFC compliance system is therefore currency: whether its obligation library cites the instruments in force today. The same test applies to any of the RegTech platforms used in Indian compliance.
What NBFC compliance software should track
| Obligation area | Current RBI instrument | What the system tracks |
|---|---|---|
| Layer and registration | Scale Based Regulation Directions 2025 | Layer, asset-size triggers, NOF, statutory reserve |
| Compliance function | Compliance Function Directions 2026 | CCO, policy, compliance testing, tool requirements |
| Supervisory returns | Supervisory Returns Directions 2026 | Each return, periodicity, CIMS filing evidence |
| KYC and AML | NBFC Know Your Customer Directions 2025 | CDD, periodic updation, reports to the Financial Intelligence Unit-India (FIU-IND) |
| Digital lending | Credit Facilities Directions 2025, Chapter III | LSP oversight, KFS, cooling-off, DLA reporting |
| Customer conduct | Responsible Business Conduct Directions 2025 | Fair Practices Code, grievance redressal |
What Must NBFC Compliance Software Track Under Scale Based Regulation?
It must start from the layer, because the layer decides which obligations apply. The Scale Based Regulation Directions 2025, updated as on 1 July 2026, set four layers.
| Layer | Who sits there | Provision |
|---|---|---|
| Base Layer | Non-deposit-taking NBFCs below ₹1,000 crore, plus P2P, account aggregator, NOFHC and Type I NBFCs | Para 10 |
| Middle Layer | All deposit-taking NBFCs; non-deposit-taking NBFCs of ₹1,000 crore and above; HFCs, CICs, IFCs, IDF-NBFCs and SPDs | Para 11 |
| Upper Layer | NBFCs with assets of ₹1,00,000 crore and above, identified by RBI with a 24-month transition | Paras 12 and 24 (substituted 24 June 2026) and para 27 |
| Top Layer | Ideally empty | Paras 13 and 14 |
Why Does the System Need an Applicability Engine?
Because applicability moves with size and activity. A Middle Layer NBFC must appoint a Chief Compliance Officer, while a Base Layer NBFC need not. An NBFC with no customer interface is outside the KYC Directions. Since 1 July 2026, certain NBFCs with no public funds, no customer interface and assets below ₹1,000 crore are exempt from sections 45-IA and 45-IC of the RBI Act.
Which Capital Thresholds Should the System Monitor?
Net owned fund floors are on a glide path under paragraphs 39 to 42 of the SBR Directions, so the system should hold each milestone as a dated obligation.
| NBFC type | Net owned fund requirement | Milestone |
|---|---|---|
| Investment and Credit Company | ₹10 crore | ₹5 crore by 31 March 2025, ₹10 crore by 31 March 2027 |
| NBFC-MFI | ₹10 crore | ₹7 crore by 31 March 2025 (₹5 crore in the North East), ₹10 crore by 31 March 2027 |
| NBFC-Factor | ₹10 crore | ₹7 crore by 31 March 2025, ₹10 crore by 31 March 2027 |
| P2P, account aggregator and Type I NBFCs | ₹2 crore | Current |
| NBFC-IFC and IDF-NBFC | ₹300 crore | Current |
What Do the 2026 Compliance Function Directions Require of the Tool?
Paragraph 32 of the Compliance Function Directions 2026, dated 31 July 2026, requires Middle and Upper Layer NBFCs to use an enterprise-wide, workflow-based compliance tool. It must support escalation, record approval of deviations and give senior management a unified dashboard. Paragraph 33 lets the tool scale with the NBFC's size.
The same Directions set the Chief Compliance Officer's tenure, seniority and reporting line, covered in the guide to NBFC Chief Compliance Officer rules.
Which KYC Obligations Should the System Track?
The NBFC Know Your Customer Directions 2025, dated 28 November 2025, replaced the 2016 KYC Master Direction for NBFCs. A compliance system should hold these obligations as dated, owned items.
| KYC obligation | Requirement | Provision |
|---|---|---|
| Periodic updation | At least every 2 years for high risk, 8 years for medium risk and 10 years for low risk | Para 42(1), KYC Directions 2025 |
| Designated Director | A Board-nominated person, which can include the MD or an authorised whole-time director; details to FIU-IND and RBI | Paras 5 and 14 |
| Principal Officer | Appointed, with details communicated to FIU-IND and RBI | Para 15 |
| Cash transaction reports | To FIU-IND by the 15th of the succeeding month | Rule 8(1), PML (Maintenance of Records) Rules 2005 |
| Suspicious transaction reports | Promptly, once the Principal Officer is satisfied the transaction is suspicious | Rule 8(2), PML Rules |
The Designated Director cannot also be the Principal Officer, under paragraph 14. The system should name each of these officers as owner of their items, in the same way it names the compliance officer for the wider programme.
Which Digital Lending Obligations Belong in the System?
For NBFCs, digital lending now sits in Chapter III of the Credit Facilities Directions 2025. Each control below is a recurring task for the compliance calendar. Holding recurring controls as dated, owned tasks is central to how compliance management software works.
- Lending service provider oversight: due diligence and periodic review, with the NBFC fully liable for its LSPs (para 6).
- Key Fact Statement: provided as the RBC Directions require (para 9(1)).
- Cooling-off period: set in the NBFC's credit policy at not less than one day (para 11).
- Grievance redressal: nodal officers at both the NBFC and the LSP, with 30 days before the borrower may escalate (para 12).
- DLA reporting: every digital lending app reported on the CIMS portal, certified by the CCO or a Board-designated official (para 18).
- Data localisation: borrower data stored only on servers in India; data processed abroad must be deleted there and brought back within 24 hours (para 14(4)).
Which Customer-Conduct Obligations Should the System Track?
Three instruments govern conduct, and each has its own applicability test.
| Obligation | Applies to | Current instrument |
|---|---|---|
| Board-approved Fair Practices Code and grievance mechanism | NBFCs with a customer interface | Responsible Business Conduct Directions 2025, paras 7 to 9 |
| Internal Ombudsman | Deposit-taking NBFCs with 10 or more branches, and non-deposit-taking NBFCs with assets of ₹5,000 crore or more and a public customer interface; HFCs, CICs, IDF-NBFCs, IFCs, NOFHCs, primary dealers and MGCs are excluded from both limbs | Internal Ombudsman Directions 2026, para 3 |
| Reserve Bank Integrated Ombudsman Scheme | Deposit-taking NBFCs, and NBFCs with a customer interface and assets of ₹100 crore or more | RB-IOS 2026, in force from 1 July 2026 |
The Internal Ombudsman applies six months after an NBFC first meets the test (if after 31 March 2025), and holds a fixed term of at least three years.
How Should Supervisory Return Deadlines Be Calendared?
By periodicity, from paragraph 22 of the Supervisory Returns Directions 2026, which apply to NBFCs in all layers except HFCs. Returns are filed on RBI's CIMS platform. The filing evidence then feeds internal compliance reporting across entities.
| Periodicity | Due | Provision |
|---|---|---|
| Weekly | By the Wednesday of the following week | Para 22 |
| Monthly | Within 15 days of the period end | Para 22 |
| Quarterly | Within 21 days of the quarter end | Para 22 |
| Yearly, as on 31 March | Within 21 days | Para 22 |
| Audited returns | Within 5 working days of the auditor's report being signed | Para 22 |
The full list of returns by layer belongs in an NBFC compliance checklist. Older return names such as NBS-1 and NBS-7 no longer appear on RBI's list of returns, so a calendar still carrying them is out of date.
What Fields Should Every Obligation Record Store?
Paragraph 32 asks for escalation and recorded approval of deviations, so the record has to carry more than a due date. Status fields feed a compliance dashboard, which gives senior management the unified view that paragraph 32 asks for.
| Field | Why it matters |
|---|---|
| Obligation and citation | The paragraph of the current Direction, so the item can be re-verified |
| Applicability rule | The layer or threshold that brings the obligation in |
| Owner and approver | Named persons, for escalation |
| Due date and periodicity | Including the trigger for event-based items |
| Evidence | The CIMS acknowledgement, FIU-IND receipt or Board minute |
| Status and deviation | Open, closed or deviated, with the recorded approval |
Where Does a Compliance Platform Fit an NBFC Programme?
A compliance management platform holds obligations with owners, due dates and evidence across entities. LexComply lists BFSI and financial services among the industries it serves, and its daily regulatory update dossiers cover RBI. Those updates matter here, because an NBFC library goes stale whenever RBI consolidates a Direction.
LexComply does not file returns or reports; the NBFC files them with RBI and FIU-IND. To test an obligation library against your layer, contact LexComply.
Common Mistakes to Avoid
- Running the library on the 2023 SBR Master Direction. The Scale Based Regulation Directions 2025 replaced it, and paragraph 24 now sets the Upper Layer at ₹1,00,000 crore of assets.
- Citing the 2022 CCO circular as current. Paragraph 34 of the Compliance Function Directions 2026 repealed it on 31 July 2026.
- Tracking STRs against a fixed day count. Rule 8(2) of the PML Rules requires suspicious transactions to be reported promptly once the Principal Officer is satisfied.
- Keeping NBS-1 and NBS-7 in the returns calendar. RBI's list of returns no longer carries the NBS series; current returns are filed on CIMS.
- Treating the digital lending rules as a standalone Direction. For NBFCs they sit in Chapter III of the Credit Facilities Directions 2025.
- Ignoring the 2026 exemption. Paragraph 38A of the SBR Directions exempts qualifying NBFCs from sections 45-IA and 45-IC from 1 July 2026.
Legal Disclaimer
This article is general information on Indian financial regulation, current as at the date shown above. It is not legal advice and does not take account of any particular NBFC's facts. Obtain professional advice before acting on any position described here.