CFSS for NBFCs: Quarterly Compliance, SSM Reporting and Key Requirements

If you run a Middle Layer or Upper Layer NBFC, you have likely heard the term CFSS many times. Your auditor may have raised it. Your RBI inspection team may have asked about it. Your board may have approved a plan for it.

But what does CFSS for NBFCs really mean? Who needs it? What must you report each quarter? And what happens now that the final deadline has passed?

This guide answers all of that in plain words. We cover NBFC CFSS compliance, CFSS quarterly reporting, CFSS SSM reporting and the main NBFC CFSS requirements. We also share key dates, numbers and a simple action plan. At the end, you will find a set of FAQs.

A Quick Note on the Name

Many people search for “Centralised Financial Statement System NBFC”. That is not the official name. The RBI term is Core Financial Services Solution (CFSS).

The idea is the same one people have in mind when they search that phrase. The RBI wants NBFCs to run on one strong, central system. That is why the RBI says CFSS is “akin to” the Core Banking Solution (CBS) used by banks.

So when you see CFSS in a circular, read it as Core Financial Services Solution. Use that exact name in your board notes and RBI replies.

What is CFSS for NBFCs?

CFSS is a core technology system for NBFCs. It brings customer service, accounts, data and reports onto one connected platform.

The RBI said the CFSS should do four main things:

• Give customers a smooth digital experience, with anywhere and anytime access.
• Connect the different functions of the NBFC.
• Keep a central database and accounting records.
• Create useful MIS reports for internal use and for the RBI.

Think of it like this. Before CFSS, many NBFCs ran loans in one tool, accounts in another and reports in a spreadsheet. Staff had to move data by hand. Errors crept in. Reports came late.
CFSS for NBFCs aims to fix this. One system. One set of numbers. Fewer manual steps.

Where Did the CFSS Rule Come From?

The RBI issued a circular on February 23, 2022. It came as part of the Scale Based Regulation (SBR) framework for NBFCs. The directions were issued under Sections 45L and 45M of the RBI Act, 1934.

The rule did not disappear over time. The RBI’s 2026 Miscellaneous Supervisory Directions for NBFCs carry the CFSS requirement forward. They repeat the same core points: who must implement it, and that a quarterly progress report must go to the Senior Supervisory Manager (SSM).

CFSS at a Glance: Key Data and Dates

Here are the main facts in one place.

Today is November 2026. The September 30, 2025 deadline is over. So for covered NBFCs, the question is no longer “when will we start?”. It is “are we fully live, and can we prove it?”

Who Must Follow NBFC CFSS Requirements?

Not every NBFC is covered. The rule depends on two things: your layer and your number of branches.

Step 1: Check your layer

Under the RBI’s scale based framework:

• Middle Layer includes all deposit-taking NBFCs, whatever their size. It also includes non-deposit-taking NBFCs with assets of ₹1,000 crore and above.
• Upper Layer includes NBFCs that the RBI specifically names.
• Base Layer is the smallest group. CFSS is not mandatory for them.

Step 2: Count your fixed point service delivery units

A fixed point service delivery unit is a place where the NBFC does its financial business. It is run by the NBFC’s own staff or by outsourced agents. It carries the NBFC’s name on its signage. And it works under the NBFC’s administrative control.

Administrative offices and back offices do not count if they have no direct contact with customers.

Step 3: Apply the rule

10 or more units in the Middle or Upper Layer: CFSS is mandatory.

Fewer than 10 units, or Base Layer: CFSS is not mandatory. But the RBI says these NBFCs may think about it for their own benefit.

A tip from advisory work: many NBFCs count their units wrongly. Keep a signed list of all units, with the reason each one is counted or left out. This list will help during an RBI inspection.

Core NBFC CFSS Requirements

The RBI circular is short. It does not give a long list of modules. But it sets some clear basics. Here is how to understand each one.

Digital customer interface

Customers should be able to use your services online. For a lender, this often means checking loan eligibility, doing KYC, paying EMIs, seeing e-statements, and updating personal details.

Anywhere, anytime access

The system should not depend on a branch visit. Customers should reach their account at any hour.

Integration of functions

Your systems should talk to each other. Data should move without hand-typing. You can still use existing tools, but they must connect well with the CFSS.

Central database and accounting records

The RBI wants one trusted source of data. The system should also keep logs of all changes and edits. It must be open to audit. The point is data accuracy and consistency, not any fixed server design.

MIS and regulatory reporting

The CFSS should make reports in the formats the RBI asks for. Good reports help you spot red flags early and catch fraud sooner.

Accounting entries and trial balance

The system should capture accounting entries and produce a trial balance. This is basic, but many older tools handle it poorly.

These six areas are the heart of NBFC CFSS requirements. If your system does these well, you are on solid ground.

CFSS Quarterly Reporting: What the RBI Expects

This is where many NBFCs slip. CFSS quarterly reporting is a repeating duty. It did not end with the 2025 deadline.

The RBI says the NBFC must send a quarterly progress report on CFSS implementation. The report should include the milestones approved by the Board or Committee of the Board. The first report was due for the quarter ending March 31, 2023.

The four reporting quarters

NBFCs follow the usual financial year. So the quarters end on:

• June 30
• September 30
• December 31
• March 31

The latest quarter-end was September 30, 2026. The next one is December 31, 2026. Check with your SSM office for the exact submission date and method, as these details can differ.

What a good quarterly report should show

The RBI circular does not give a fixed template. So use a clear and honest format. A strong CFSS quarterly reporting pack often includes:

• Number of fixed point service delivery units covered by the rule.
• Number of units live on CFSS, with the percentage.
• Board-approved milestones and the status of each (done, on track, delayed).
• Reasons for any delay, and a new date with board approval.
• Vendor and integration status, such as which systems are linked.
• Key risks, such as data migration issues or cyber findings.
• Next quarter plan.

Keep the numbers consistent from one quarter to the next. If a number changes, explain why.

CFSS SSM Reporting: Who Is the SSM?

SSM stands for Senior Supervisory Manager. This is the RBI officer or office that supervises your NBFC. CFSS SSM reporting simply means sending your CFSS progress report to this office.

Good habits for CFSS SSM reporting:

• Know your SSM office. Keep the contact details updated.
• Send on time. Late reports look bad, even when the work is fine.
• Match the board record. The milestones in your report should match your board minutes.
• Keep proof. Save the submission receipt or email trail.
• Name one owner. Pick one senior person, such as the CIO or Head of Compliance, to own the report.

If the RBI later asks, “Show me what you reported in June 2025,” you should be able to find it in minutes.

The Board’s Role in NBFC CFSS Compliance

The circular clearly links the milestones to the Board or Committee of the Board. This means CFSS is not just an IT project. It is a governance matter.

For strong NBFC CFSS compliance, the board should:

• Approve the CFSS plan and its milestones.
• Review progress every quarter, before the report goes out.
• Ask for a clear status of the 70% interim milestone and the final 100% milestone.
• Make sure the budget is enough.
• Record all this in minutes.

A short, well-kept board paper each quarter can protect you a great deal.

How CFSS Connects with Other RBI Rules

CFSS does not stand alone. It must work with other rules, such as:

• The IT Framework Master Direction for NBFCs. This covers information security, cyber security and IT audits.
• The KYC Master Direction. This sets rules for KYC checks and records.
• IT outsourcing rules. Many CFSS tools are hosted on the cloud by a vendor. Outsourcing rules then apply.

In simple terms: choosing a CFSS vendor is not enough. You must also check the vendor’s security, data location, backup plan and audit rights.

Common Challenges in Rolling Out CFSS for NBFCs

From advisory work, these are the usual hurdles.

High cost

Bank-grade systems can be expensive. NBFCs usually offer a narrow set of products. So pick only the modules you need. Do not buy a full bank suite for a simple loan book.

Integration with old systems

Middle and Upper Layer NBFCs often have a loan management system, a CRM and a risk tool already. Replacing them all can be costly and risky. A common path is to run the new system alongside the old one and move customers in phases. But this needs strong data checks, fallback plans and clear cut-over dates.

Staff and customer adoption

Banks faced staff resistance when they moved to CBS. NBFCs can expect the same. Plan training early. Pick a system that is easy to use.

Branch-level gaps

The 70% and 100% milestones were counted by branches. A system that works in the head office but not in the field does not meet the rule.

A Simple 10-Step CFSS Compliance Roadmap

If you are still closing gaps, use this plan.

• Confirm applicability. Check your layer and unit count.
• Make a master list of units. Mark each as covered, live or pending.
• Do a gap study. Compare your current systems against the six core requirements.
• Choose your approach. Single platform, or linked systems.
• Get board approval. Record milestones, dates and budget.
• Check vendor risk. Review security, cloud, backup and audit rights.
• Test before going live. Run security tests, functional tests and data checks.
• Roll out in phases. Keep a clear tracker for each unit.
• Prepare the quarterly pack. Use one format each quarter.
• Audit and improve. Ask internal audit to review CFSS every year.

Common Mistakes to Avoid

• Treating CFSS as only an IT job. It needs compliance, finance and the board.
• Wrong unit count. This can hide a gap.
• Reports that do not match records. The SSM report and board minutes must agree.
• No audit trail in the system. The RBI expects logs of all changes.
• Late or missed reports. Quarterly reporting is a standing duty.
• Assuming small size means no rule. Count your units honestly. A deposit-taking NBFC is always in the Middle Layer, whatever its size.

What Happens If You Do Not Comply?

The RBI issued these directions under its powers in the RBI Act. A failure to follow RBI directions can lead to supervisory action. This can include observations in an inspection, a need to submit a corrective plan, or stronger measures.

The exact action depends on the case. The safest path is to stay current, report honestly and fix gaps early. If you are behind, it is better to tell your SSM with a board-approved plan than to stay silent.

Quick Compliance Checklist

Use this list before each quarterly submission:

• Unit list updated and signed off
• Percentage of units live on CFSS calculated
• Board or Committee approval noted
• Delays explained, with new dates
• Vendor and cyber audit status reviewed
• Report matches board minutes
• Proof of submission saved

Final Thoughts

CFSS for NBFCs is more than a technology upgrade. It is a shift to cleaner data, better control and faster reporting. The final implementation deadline of September 30, 2025 has passed, so covered NBFCs should now focus on two things: running a fully live and audit-ready system, and keeping up steady CFSS quarterly reporting.

To sum up:

• Know whether you are covered (Middle or Upper Layer, with 10 or more units).
• Meet the six core NBFC CFSS requirements.
• Keep your board involved every quarter.
• Send your CFSS SSM reporting on time, with proof.
• Link CFSS with IT, KYC and outsourcing rules.

Do this well, and NBFC CFSS compliance becomes a routine part of your year, not a last-minute rush.

Need help with CFSS gap studies, board papers or SSM reports? Our NBFC Advisory team can guide you from planning to filing, so your compliance stays smooth and audit-ready.