RBI Compliance for NBFCs 2026: Updated Capital and Reporting Norms

Non-Banking Financial Companies form the connective tissue of India's credit system, reaching borrowers that formal banking cannot always serve efficiently. About 9,400 registered NBFCs operate under RBI supervision as of April 2026, managing aggregate assets exceeding ₹65 lakh crore. With scale has come heightened regulatory scrutiny.

The Reserve Bank's Scale-Based Regulation (SBR) framework, codified in the Master Direction issued in October 2023, replaced decades of piecemeal circulars with a coherent, risk-proportionate architecture. For NBFC compliance officers, finance teams, and promoters planning to set up or scale an NBFC, understanding this framework in detail is no longer optional.

This guide covers every material compliance requirement for FY 2026-27: capital norms, reporting timelines, COSMOS and XBRL mechanics, NPA provisioning, liquidity requirements, governance mandates, and the practical implications of the most recent RBI circulars through June 2026.

The Four-Tier Structure: Where Does Your NBFC Sit?

The SBR framework classifies every registered NBFC into one of four layers. The classification determines capital requirements, governance obligations, return-filing frequency, and supervisory intensity. Getting the classification right is the starting point for any compliance exercise.

Base Layer (NBFC-BL)

Base Layer covers NBFCs with total assets below ₹1,000 crore that do not access public funds or customer funds directly (or do not have a customer interface). NBFC-Peer-to-Peer Lending Platforms (NBFC-P2P), NBFC-Account Aggregators (NBFC-AA), and Non-Operative Financial Holding Companies (NOFHC) are categorically placed in BL regardless of asset size. Regulation here is lighter: entry-level capital, basic prudential norms, and no mandatory board-level Risk Management Committee.

Middle Layer (NBFC-ML)

Middle Layer includes all deposit-taking NBFCs (NBFC-D) regardless of asset size, NBFC-ND (non-deposit) with assets of ₹1,000 crore and above, NBFC-Housing Finance Companies (NBFC-HFC), NBFC-Infrastructure Finance Companies (NBFC-IFC), NBFC-Infrastructure Debt Funds (NBFC-IDF), Standalone Primary Dealers (SPD), and Core Investment Companies (CIC) with assets of ₹100 crore and above. ML regulation is more intensive: stricter governance, mandatory CRO, and enhanced provisioning norms.

Upper Layer (NBFC-UL)

Upper Layer consists of a specific list of NBFCs identified by RBI each September through a parametric scoring model. The September 2025 list identifies 16 NBFCs in this category. UL entities face near-bank regulatory standards: mandatory ICAAP submission, Pillar 3 web disclosures, IndAS financial statements, internal capital adequacy frameworks, and CRO and board committee requirements. Once an NBFC lands in UL, it stays there for at least 5 years before being considered for downgrade.

Top Layer (NBFC-TL)

The Top Layer is currently unpopulated. An UL NBFC migrates to TL if, for four consecutive years, it remains in UL and its assets exceed ₹1 lakh crore. TL regulation mirrors bank-equivalent supervision, including the possibility of conversion to a bank or universal finance institution.

Net Owned Funds: Calculating and Maintaining the Minimum

Net Owned Funds (NOF) is the bedrock capital metric for NBFCs. Under Section 45-IA of the RBI Act, 1934, registration as an NBFC requires meeting the minimum NOF threshold, and ongoing operations require continuous maintenance of that threshold.

NOF is computed as: Owned Funds minus Investments in shares of subsidiaries, companies in the same group, and other NBFCs exceeding 10% of owned funds, plus any deferred tax liabilities. Owned funds comprise paid-up equity capital, preference shares that are compulsorily convertible to equity, free reserves, securities premium, and capital reserves, reduced by accumulated losses, deferred revenue expenditure, and other intangible assets.

The current minimum NOF requirements (effective April 1, 2022) are:

NBFCs that fall below the minimum NOF threshold must immediately inform RBI, submit a restoration plan within 30 days, and refrain from new public deposits (for NBFC-D) until the threshold is restored. Failure to restore NOF within the timeline prescribed by RBI can result in cancellation of COR under Section 45-IA(6) of the RBI Act.

Capital Adequacy: CRAR, Tier-I, and Risk-Weighted Assets

Capital adequacy regulation prevents excessive leverage and ensures NBFCs have a buffer to absorb unexpected losses. The CRAR framework for NBFCs under SBR is modelled broadly on Basel III principles but calibrated to the NBFC context.

The minimum CRAR is 15% of aggregate risk-weighted assets (RWA) for all Middle Layer and Base Layer NBFCs. Within this, Tier-I capital must be at least 10% of RWA. Tier-II capital is limited to 100% of Tier-I capital. Upper Layer NBFCs must in addition maintain a Capital Conservation Buffer (CCB) of 2.5% above the minimum, effectively requiring total capital of 17.5% for UL entities.

Risk weights are assigned as follows: claims on central government and RBI carry 0% risk weight; claims on state governments carry 20%; claims on corporates carry 100%; claims on NBFCs carry 125%; consumer credit and personal loans carry 125% (raised from 100% by RBI in November 2023); commercial real estate carries 100% to 150% depending on quality; and exposures to cryptocurrencies carry 100%.

NPA Classification and Provisioning Norms

The income recognition and asset classification (IRAC) norms for NBFCs were harmonised with banks effective October 1, 2022. The key changes from the pre-SBR position are significant.

NPA Definition: Borrower-Wise, Not Account-Wise

Under the harmonised IRAC norms, an account becomes an NPA when it is overdue for more than 90 days. Critically, RBI mandates borrower-level NPA classification: if any credit facility to a borrower becomes NPA, all credit facilities to that borrower across the NBFC must be classified NPA simultaneously. This is a significant operational change for NBFCs that previously classified accounts individually.

Provisioning Matrix (Base Layer Incurred Loss Model)

Middle and Upper Layer NBFCs must transition to an Expected Credit Loss (ECL) provisioning model, effective FY 2024-25. Under ECL, provisions are computed on a forward-looking basis across three stages: Stage 1 (12-month ECL for performing assets), Stage 2 (lifetime ECL for significantly deteriorated assets), and Stage 3 (lifetime ECL for credit-impaired assets). This fundamentally shifts provisioning from a backward-looking rule to a statistical modelling exercise requiring robust data infrastructure.

Regulatory Reporting: NBS Returns and COSMOS Filing

Return filing is the most operationally intensive compliance obligation for NBFCs. RBI has consolidated all periodic returns on the COSMOS portal with mandatory XBRL-format submissions. Missed or late filings attract penalties and trigger supervisory alerts.

Key Returns and Deadlines

How COSMOS Works in Practice

COSMOS (Centralised OSS Monitoring System) is RBI's supervisory data collection and monitoring platform. NBFCs log in at https://cosmos.rbi.org.in using credentials provided during registration. The portal has the following key modules:

• Return Filing: XBRL-based filing for all NBS returns; the system validates data against taxonomy rules before acceptance.
• Compliance Certification: Annual compliance officer certification that all returns have been filed accurately.
• Inspection Data: Uploading data requested during RBI on-site inspections.
• Entity Information Update: Updating branch additions, director changes, registered office changes.
• Correspondence: All official RBI communication including show-cause notices and penalty orders is routed through COSMOS.

The XBRL taxonomy used by RBI for NBFC returns is maintained on the RBI website. NBFCs must update their filing software whenever RBI revises the taxonomy (typically at the start of each financial year). Filing data in an outdated taxonomy version is a common compliance error that leads to rejected returns.

Liquidity Coverage Ratio: New Norms from April 2025

The RBI issued its final directions on the Liquidity Coverage Ratio (LCR) for deposit-taking NBFCs and systemically important non-deposit NBFCs in early 2025, with phased implementation starting April 1, 2025. This is one of the most significant new compliance additions of the 2025-26 compliance cycle.

The LCR requires an NBFC to maintain an adequate level of unencumbered, high-quality liquid assets (HQLA) that can be converted to cash to meet liquidity needs over a 30-day period under a stress scenario. The formula is: LCR = HQLA / Total Net Cash Outflows over 30 days ≥ 100%.

HQLA is categorised into Level 1 (government securities, RBI approved securities) and Level 2 (corporate bonds rated AA- and above, equities in recognised indices). Level 2 assets cannot exceed 40% of HQLA, with Level 2B assets capped at 15%. The LCR requirement applies to NBFCs with total assets of ₹5,000 crore and above. NBFCs below this threshold are encouraged (but not mandated) to maintain robust liquidity buffers and must have a board-approved Liquidity Risk Management Policy irrespective of their size.

Fit-and-Proper Criteria and Corporate Governance

The Master Circular on Fit and Proper Criteria sets the baseline standards for NBFC directors and Key Managerial Personnel. Compliance with these norms is not a one-time exercise at registration; it is a continuous obligation.

Fit-and-Proper Standards

Every director and KMP must: have no criminal conviction involving moral turpitude; have no disqualification under Sections 164 or 167 of the Companies Act, 2013; not be a wilful defaulter as classified by any bank or financial institution; not be under a restraint order from SEBI, IRDAI, PFRDA, or any regulatory authority; have adequate qualifications and relevant experience; and maintain financial integrity with no ongoing insolvency or bankruptcy proceedings.

NBFCs must obtain annual self-declarations from all directors and KMPs. For Middle and Upper Layer NBFCs, these declarations must be reviewed by a Nomination and Remuneration Committee (NRC) and placed before the board. Any director who ceases to meet fit-and-proper criteria must be asked to vacate the position within 30 days, failing which the board must report the matter to RBI.

Board Composition Requirements

For Middle Layer NBFCs: the board must have at least one-third of directors as independent directors; no single promoter group director can serve as MD and Chairman simultaneously; and a dedicated board-level Risk Management Committee (RMC) must be constituted.

For Upper Layer NBFCs: in addition to ML requirements, the CEO tenure is capped at 15 cumulative years; the board must have an Audit Committee, NRC, RMC, and Customer Service Committee; and a Chief Risk Officer must be appointed with direct reporting line to the board's RMC (not through the MD/CEO).

Fair Practices Code and Customer Protection

The Fair Practices Code (FPC), mandated for all registered NBFCs under the Master Circular on Fair Practices Code, 2015, is periodically updated under SBR. The FPC ensures borrowers receive transparent, fair treatment across the credit lifecycle.

Key FPC requirements include: written loan application acknowledgment within a reasonable timeframe; loan agreement in the borrower's preferred language; clear disclosure of interest rate, processing fees, prepayment charges, and the Annual Percentage Rate (APR) before disbursement; no intimidation or harassment in recovery; and a board-approved grievance redressal mechanism with a designated Nodal Officer whose contact details are prominently displayed at all offices and on the NBFC's website.

NBFCs with assets of ₹5,000 crore and above must additionally implement the Internal Ombudsman (IO) Scheme (mandated from November 2021). The IO independently reviews complaints that the NBFC has fully or partially rejected. If a customer remains dissatisfied after the IO's order, they may approach the RBI Integrated Ombudsman at https://rbi.org.in/scripts/Complaints.aspx.

KYC and Anti-Money Laundering Obligations

All NBFCs are reporting entities under the Prevention of Money Laundering Act, 2002 (PMLA) and must comply with the RBI Master Direction on KYC, 2016. Non-compliance with KYC and AML obligations carries independent penalties under both the PMLA (enforced by the Enforcement Directorate) and the RBI Act.

The key KYC compliance pillars are: Customer Due Diligence (CDD) using OVDs (Officially Valid Documents) per the Prevention of Money Laundering (Maintenance of Records) Rules, 2005; periodic re-KYC (annually for high-risk customers, every 2 years for medium-risk, every 10 years for low-risk); Enhanced Due Diligence (EDD) for Politically Exposed Persons (PEPs), cross-border wire transfers above USD 1,000, and high-value cash transactions; Cash Transaction Reports (CTRs) for transactions above ₹10 lakh filed monthly with FIU-IND at https://fiuindia.gov.in; and Suspicious Transaction Reports (STRs) filed within 7 days of suspicion arising.

Penalties for Non-Compliance: What RBI Can Do

RBI has wide enforcement powers under the RBI Act. The penalty framework for NBFCs is as follows:

Beyond financial penalties, RBI publishes all penalty orders on its website with the NBFC's name, violation, and penalty amount. This public disclosure is a significant reputational consequence that financial institutions cannot afford in a trust-dependent sector. RBI also maintains a Prompt Corrective Action (PCA) framework for NBFCs under SBR, which triggers supervisory interventions (dividend restrictions, branch expansion curbs, capital-raising requirements) when CRAR, net NPA, or leverage thresholds are breached.

Recent RBI Circulars Affecting NBFCs in 2025-26

The regulatory environment for NBFCs has been active in 2025-26. Below are the most material circulars NBFC compliance teams must be aware of:

• October 2024 (RBI/2024-25/84): Harmonisation of IRAC norms for Base Layer NBFCs, aligning the 90-day NPA threshold across all categories and codifying borrower-level classification.
• November 2024 (RBI/2024-25/99): Revised guidelines for NBFC-Factors, expanding the definition of factoring to include invoice discounting platforms and raising minimum NOF to ₹5 crore.
• January 2025 (RBI/2025-26/12): Final directions on LCR for NBFCs, with phased compliance: 60% LCR from April 1, 2025; 80% from April 1, 2026; 100% from April 1, 2027.
• March 2025 (RBI/2025-26/35): Strengthening of fraud risk management framework for NBFCs, including mandatory Early Warning System (EWS) for ML and UL entities, quarterly fraud reporting to RBI, and board-level Fraud Monitoring Committee.
• September 2025: Annual publication of the Upper Layer NBFC list for 2025-26, with 16 entities identified and notified directly.
• April 2026 (RBI/2026-27/08): Updated XBRL taxonomy for NBS returns, mandatory for all filings from Q1 FY 2026-27 (April-June 2026) onwards, with revised data fields for ECL provisioning disclosures.

Practical NBFC Compliance Calendar for FY 2026-27

Managing NBFC compliance requires a calendar-driven approach. Below is a quarterly summary of key compliance milestones for FY 2026-27:

In addition to the above, monthly obligations include: NBS-6 filing (deposit-taking NBFCs); CTR submission to FIU-IND; and review of COSMOS correspondence for any RBI show-cause notices or information requests.

Building a dedicated compliance management system, even at spreadsheet level for smaller NBFCs, significantly reduces the risk of missed deadlines. Middle and Upper Layer NBFCs are encouraged to use compliance management software integrated with COSMOS for automated deadline tracking and XBRL generation.

For entities considering NBFC registration or operating an NBFC that needs to strengthen its compliance posture, IncorpX provides assistance for the preparatory documentation, COSMOS registration, and annual return filing coordination with the Reserve Bank of India. You can also explore related registrations such as GST registration, MSME (Udyam) registration, and IEC registration for the broader regulatory framework that financial service businesses operate within.