RBI’s NBFC Draft Directions, 2026: A New Compliance Architecture

1. Introduction

The RBI has, through its April 2026 draft directions, initiated a fundamental recalibration of the regulatory framework governing NBFCs.

For NBFCs, this is not merely a consolidation of legacy circulars. It represents a transition toward a supervision-led regulatory architecture, with direct implications for governance, credit strategy, outsourcing models, and regulatory exposure.

This blog examines key elements emerging from select draft directions and their implications for NBFCs, fintechs, and regulated entities.

2. Compliance Function: Institutionalizing Control at the Core of NBFC Operations

The Reserve Bank of India (Non-Banking Financial Companies – Compliance Function) Directions, 2026 introduce:

• Annual Compliance Risk Assessment: Senior management is required to conduct a formal, enterprise-wide compliance risk assessment and implement a mitigation plan.

• Chief Compliance Officer (CCO) Framework:

  • Mandatory appointment of a CCO (including external hires);
  • Fixed minimum tenure of 3 years;
  • Direct reporting to MD & CEO and/or Board / Audit Committee.

• Board-Level Independence: Where the CCO reports to the MD & CEO, the Board / Audit Committee must hold quarterly one-on-one meetings with the CCO (excluding senior management presence).

• Product Governance Role: The CCO must be embedded in new product approval processes, ensuring ex-ante compliance validation.

3. Cybersecurity & Technology Risk: Regulatory Convergence for Digital NBFCs

The Cybersecurity, Technology Risk, Resilience and Assurance Directions, 2026 introduce a holistic technology governance regime.

• Formalised Policy Stack:

  • IT & Information Security Policy;
  • Cybersecurity Policy;
  • Business Continuity & Disaster Recovery (BCP/DR).

• Outsourcing & Vendor Risk Controls:

  • Mandatory legally vetted contracts;
  • RBI-prescribed clauses for enforceability and risk allocation.

4. PCA Framework: Expanding RBI’s Direct Influence on NBFC Business Models

The NBFC – Miscellaneous Supervisory Directions, 2026 provide critical insight into RBI’s evolving supervisory toolkit, especially under the Prompt Corrective Action (PCA) framework.

Trigger Mechanism:

• Based on financials and/or supervisory assessment

• RBI retains discretion to impose PCA at any time during the year

Scope of RBI Intervention (Illustrative):

A. Supervisory Actions:

• Special supervisory monitoring meetings (SSMMs);
• Targeted inspections;
• Initiation of insolvency proceedings under the IBC;
• Cancellation of Certificate of Registration.

B. Strategy & Business Model:

• Mandatory activation of recovery plans;

• Review of business model sustainability and profitability;

• Business process reengineering and restructuring.

C. Governance Actions:

• Direct engagement with Board;

• Change in management / Board recommendations;

• Removal of managerial personnel;

• Restrictions on compensation.

D. Capital & Balance Sheet Controls:

• Mandatory capital augmentation plans;

• Restrictions on high-risk exposures and investments;

• Conservation of capital through operational limits.

E. Credit Risk Measures:

• NPA reduction plans and monitoring;

• Restrictions on unsecured and low-rated exposures;

• Loan concentration limits and asset sales.

F. Market & Liquidity Controls:

• Borrowing restrictions;

• ALM mismatch controls;

• Deposit-related restrictions and escrow requirements;

G. Operational & HR Controls:

• Restrictions on expansion, outsourcing, and new business lines;

• Limits on hiring and compensation.

5. Auditor Oversight: Strengthening Regulatory Assurance

The NBFC – Auditor’s Report Directions, 2026 significantly expand the scope of statutory auditor reporting.

Key Reporting Areas:

• Public Deposit Compliance:

  • Acceptance limits, credit rating requirements, and regulatory breaches;
  • Defaults in repayment of principal or interest.

• Regulatory Filings & Prudential Norms:

  • Compliance with IRAC norms;
  • Accuracy of Capital Adequacy Ratio (CRAR);
  • Timely filing of returns (e.g., DNBS03).

• Governance & Board Actions:

  • Resolution on non-acceptance of public deposits;
  • Adherence to RBI directions.

• Eligibility & Financial Thresholds:

  • Net Owned Funds (NOF) compliance;
  • Deposit thresholds and exposure limits.

 Closing Perspective: What NBFCs Should Do Now

• Conduct a gap assessment against draft directions;

• Strengthen CCO role and compliance independence;

• Review outsourcing and fintech contracts;

• Align credit strategy with potential PCA triggers;

• Upgrade documentation and audit readiness frameworks.