Regulatory Updates

RBI Supervisory Consolidation for NBFCs – Detailed Overview, Key Changes & Draft Directions

RBI Supervisory Consolidation for NBFCs – Detailed Overview, Key Changes & Draft Directions

The Reserve Bank of India (RBI) has undertaken a major consolidation of supervisory instructions to enhance clarity, accessibility, and compliance efficiency across regulated entities.

This initiative follows RBI’s earlier consolidation exercise in 2025, wherein over 9,000 regulatory circulars were rationalised into 238 Master Directions (MDs) spanning over 30 functional domains. Building upon that foundation, the RBI has now extended a similar harmonisation exercise to the supervisory landscape.

Under this initiative:

For NBFCs, this marks a shift from a fragmented circular-based regime to a structured, function-wise Master Directions framework, bringing greater clarity, consistency, and ease of implementation.

REGULATED ENTITIES COVERED: The consolidation applies across a wide spectrum of financial institutions, including:

Commercial Banks	Urban & Rural Co-operative Banks
Small Finance Banks	All India Financial Institutions
Payments Banks	Non-Banking Financial Companies (NBFCs)
Local Area Banks	Asset Reconstruction Companies
Regional Rural Banks	Credit Information Companies

The newly consolidated framework spans critical supervisory domains:

Compliance Function	Concurrent Audit	Cybersecurity & Technology Risk
Digital Payments Security Controls	Fraud Risk Management	Internal Audit Function
Statutory Audit	Supervisory Returns	Miscellaneous Instructions

Structural & Drafting Enhancements

The RBI has introduced a refined and intuitive “continuous-flow” format, ensuring that the Directions are more coherent and accessible. Key improvements include:

Integration of Advisory Guidance: Advisory elements, previously scattered across circulars, are now seamlessly embedded within the main text using appropriate suggestive language.
Conversion of FAQs into Regulatory Text: Supervisory instructions earlier issued via FAQs have now been formalised into structured paragraphs within the Directions.
Streamlined Annexures: Annexures are now limited strictly to formats and prescribed forms, reducing clutter and improving usability.
Centralised Board Responsibilities: All instructions relating to the roles and responsibilities of the Board have been consolidated into a single section within each Direction—enhancing governance clarity.

Detailed Analysis of Proposed Draft Master Directions for NBFCs

Proposed Draft Direction	Updates
Reserve Bank of India (Non-Banking Financial Companies – Compliance Function) Directions, 2026	Existing Circulars / Instructions (Proposed to be Consolidated / Repealed): Compliance Function and Role of Chief Compliance Officer (CCO) -NBFCs Streamlining of Internal Compliance monitoring function – leveraging use of technology Key Updates: ▪️Consolidate existing circulars without major substantive changes ▪️Introduce a critical clarification that in the absence of a New Product Committee, the Chief Compliance Officer (CCO) must evaluate all new products prior to launch ▪️Mandate that all compliance responses to RBI inspection reports be routed through the Compliance Function ▪️Removal of the earlier explicit reference to penal action for non-compliance—indicating a shift towards a more principle-based supervisory approach by the Reserve Bank of India. Impact on NBFCs: ▪️NBFCs will need to strengthen internal governance by formally embedding the CCO’s role in product approval and centralising all regulatory communication through the Compliance Function. ▪️Additionally, the shift towards a principle-based framework (with removal of explicit penal language) places greater onus on NBFCs to ensure robust internal controls, documentation, and proactive compliance culture.
Reserve Bank of India (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance) Directions, 2026	Existing Circulars / Instructions (Proposed to be Consolidated / Repealed): Master Direction – Information Technology Framework for the NBFC Sector 2017 Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023 Key Updates: ▪️Extending applicability to Core Investment Companies (CICs) ▪️Mandating baseline controls such as Public Key Infrastructure (PKI) and digital signatures even for smaller NBFCs ▪️Introducing a stringent 6-hour timeline for cyber incident reporting ▪️For larger NBFCs, enhanced governance through IT Steering Committees, Information Security Committees, and mandatory Chief Information Security Officers strengthens accountability. Impact on NBFCs: ▪️Significantly increase compliance requirements for NBFCs, especially through mandatory cybersecurity controls and faster incident reporting. ▪️Smaller NBFCs may face higher costs and operational challenges, while larger NBFCs will see stronger governance and accountability structures.
Reserve Bank of India (Non-Banking Financial Companies – Digital Payment Security Controls) Directions, 2026	Existing Circulars / Instructions (Proposed to be Consolidated / Repealed): Master Direction on Digital Payment Security Controls 2021 Key Updates: ▪️Strengthen oversight by requiring vendors to conduct RCSA (Risk and Control Self-Assessment), which must be evaluated by credit card–issuing NBFCs enhancing third-party accountability ▪️Credit card–issuing NBFCs must comply with detailed technical security standards, with compliance status reported to the IT Steering Committee (ITSC) for review and action. ▪️The Directions also emphasize a stronger role of the Board in overseeing digital payment risks, policies, and fraud management. ▪️Additionally, they introduce tighter controls around authentication, fraud monitoring, and data protection, aligning with evolving cyber risks. Impact on NBFCs: ▪️The proposed Directions by the RBI will increase compliance and monitoring responsibilities for NBFCs, especially in managing vendor risks and meeting technical security standards. ▪️NBFCs may face higher operational costs and governance expectations but will benefit from improved fraud control, stronger customer trust, and more secure digital payment systems.
Reserve Bank of India (Non-Banking Financial Companies – Fraud Risk Management) Directions, 2026	Existing Circulars / Instructions (Proposed to be Consolidated / Repealed): Master Directions on Fraud Risk Management in Non-Banking Financial Companies (NBFCs) (including Housing Finance Companies) 2024 FAQs on Master Directions on Fraud Risk Management in Regulated Entities (REs), 2024 Key Updates: ▪️While there are no substantive changes, as only FAQs are integrated with the circular but the consolidation improves clarity, consistency, and ease of compliance for NBFCs.
Reserve Bank of India (Non-Banking Financial Companies – Internal Audit Function) Directions, 2026	Existing Circulars / Instructions (Proposed to be Consolidated / Repealed): Risk Based Internal Audit (RBIA) 2021 Key Updates: ▪️No substantive changes.
Reserve Bank of India (Non-Banking Financial Companies – Statutory Audit) Directions, 2026	Existing Circulars / Instructions (Proposed to be Consolidated / Repealed): Guidelines for Appointment of Statutory Central Auditors (SCAs)/Statutory Auditors (SAs) of Commercial Banks (excluding RRBs), UCBs and NBFCs (including HFCs) 2021 FAQs on Guidelines for Appointment SCAs/ SAs of Commercial Banks (excluding RRBs), UCBs and NBFCs (including HFCs) 2021 Key Updates: ▪️Consolidate the existing guidelines along with related FAQs into a single, comprehensive framework without introducing substantive changes.
Reserve Bank of India (Non-Banking Financial Companies – Supervisory Returns) Directions, 2026	Existing Circulars / Instructions (Proposed to be Consolidated / Repealed): Master Direction – Reserve Bank of India (Filing of Supervisory Returns) Directions – 2024 LIST OF RETURNS SUBMITTED TO RBI Key Updates: ▪️Renaming of returns such as DNBS09, DNBS09 Return on Defaulted Borrowers ▪️Revisions in fraud reporting nomenclature (FMR-I to FMR, FMR-III to FUA, and FMR-IV to FMR 4) ▪️Expansion of disclosure requirements—such as increasing reporting from top 10 to top 20 exposures for Upper Layer NBFCs. ▪️The Directions also mandate fully digital submission, with Form A Certificate to be filed online (Auditor Allocation System of RBI) and discontinuation of physical or email-based submissions unless specified. ▪️Additionally, new reporting requirements have been introduced for certain entities like SPDs. Impact on NBFCs: ▪️NBFCs will need to upgrade systems to ensure timely and accurate digital filings and adapt to revised reporting formats and expanded disclosures. ▪️While this may increase compliance effort initially, it will improve reporting efficiency, data accuracy, and regulatory oversight in the long run.
Reserve Bank of India (Non-Banking Financial Companies – Miscellaneous) Supervisory Directions, 2026	Existing Circulars / Instructions (Proposed to be Consolidated / Repealed): Implementation of ‘Core Financial Services Solution’ by Non-Banking Financial Companies (NBFCs) 2022 Fair Practices Code for Lenders – Charging of Interest 2024 Coverage of customers under the nomination facility 2025 Prompt Corrective Action (PCA) Framework for Non-Banking Financial Companies (NBFCs) 2021 Key Updates: ▪️Consolidate multiple existing guidelines—covering areas such as Core Financial Services Solution (CFSS), Fair Practices Code, nomination facilities, and the PCA framework—into a single unified framework. ▪️A key change is the removal of phased implementation timelines for CFSS, as the requirements are now effective.
Reserve Bank of India (Non-Banking Financial Companies – Auditor’s Report) Directions, 2026	Existing Circulars / Instructions (Proposed to be Consolidated / Repealed): Master Direction – Non-Banking Financial Companies Auditor’s Report (Reserve Bank) Directions, 2016 Master Direction – Reserve Bank of India (Filing of Supervisory Returns) Directions – 2024 Key Updates: ▪️Primarily replace the 2016 framework and consolidate related provisions, including those on DNBS-10 (SAC), into a single updated direction. ▪️There are no major substantive changes.