“Making the UL list isn’t a trophy. It’s a to-do list.”
Let me paint you a picture.
The RBI releases its NBFC Upper Layer list. Your company’s name is on it. The mood in the office is bright. Someone drafts a press note. Someone else wants to order sweets.
Now walk down the hall to the compliance head’s desk. She has read the same news. But she is not smiling. She is opening a blank spreadsheet and typing one line at the top: “What must we fix, and by when?”
She is the one who has read the list correctly.
In this blog, I will walk you through what the RBI announced, who made the list, and what the work looks like from here. I will also share what mid-sized NBFCs near the line should do today. Grab a coffee. This one matters.
So, What Actually Happened?
On August 6, 2026, the RBI released the NBFC Upper Layer list for FY 2026-27. Seventeen NBFCs made the cut. The list uses financials as of 31 March 2026, and it follows the new size-led criteria that the RBI reviewed during 2025-26.
If you wondered why there was no list for 2025-26, here is the answer. The RBI spent that year reviewing the rules. This list is the first one to come out of that review.
Now for the biggest change. The rule has become easy to say out loud. If your assets are ₹1 lakh crore or more, based on your latest audited balance sheet, you are in the Upper Layer.
The old system was more complex. It used a scoring method. That method looked at size, borrowing levels, how tightly a firm was linked to others, and more. The new test starts and ends with size.
And there is one more thing to note. The RBI plans to review this threshold every three years. So the line can move.
First, a Quick Refresher on the Layers
The RBI sorts NBFCs into four layers under its Scale Based Regulation. The idea is fair and simple. The bigger and more important you are, the more rules you follow.
Think of a school. A small tuition class does not need a principal, a governing board and an audit team. A big school with thousands of students does. The RBI thinks about NBFCs in the same way.
The Upper Layer is the third of the four layers. It holds the NBFCs that the RBI sees as most important to the financial system. Their rules look a lot like the rules banks follow. That is why compliance in this layer feels so different from compliance in the lower ones.
Who Made the List?
Here are the 17 names: REC Limited, Power Finance Corporation, Indian Railway Finance Corporation, HUDCO, Bajaj Finance, Bajaj Housing Finance, Shriram Finance, LIC Housing Finance, Cholamandalam Investment and Finance, Tata Capital, Tata Sons, Muthoot Finance, Aditya Birla Capital, Mahindra & Mahindra Financial Services, L&T Finance, HDB Financial Services and Piramal Finance.
Two things stand out.
First, look at the four new faces: REC, PFC, IRFC and HUDCO. These are government-owned lenders. Their arrival shows that the RBI now looks at size first. It does not matter who owns you.
Second, look at who is missing. PNB Housing Finance and Sammaan Capital are not on the new list. Before anyone cheers, there is a catch. Once an NBFC is classified as Upper Layer, it stays under the tougher rules for at least five years. That holds even if it no longer meets the size test.
So leaving the list does not mean leaving the homework.
Why the RBI Cares So Much About Big NBFCs
Imagine a very large bridge in a busy city. Thousands of people cross it every day. If a small footbridge cracks, a few people get wet. If the big bridge cracks, traffic stops across the whole city.
Large NBFCs are like that big bridge. They borrow from banks, mutual funds and bond markets. They lend to millions of families and small businesses. If one of them stumbles, the shock can travel far and fast.
So the RBI wants these firms to run with bank-like discipline. Stronger rules mean fewer surprises for everyone. And for the NBFC itself, one big thing changes. Compliance moves out of the back office and into the boardroom.
Now let’s look at the actual homework. There are four subjects.
Subject One: Governance
Governance is the first and biggest subject on the list.
Upper Layer NBFCs are expected to have a Chief Risk Officer, or CRO. They also need stronger board committees. And they must run an internal process to judge how much capital they really need. That process is called ICAAP, short for Internal Capital Adequacy Assessment Process.
The compliance team gets a bigger role too. Middle and Upper Layer NBFCs must appoint a Chief Compliance Officer, or CCO. They must also keep an independent compliance team.
Pay attention to the word “independent.” A CCO who reports to the business head and cannot speak freely is a box ticked, not a real control. The RBI wants a compliance team that can raise its hand and be heard.
Capital rules get tighter as well. Upper Layer NBFCs must hold Common Equity Tier 1 capital of at least 9%. Common Equity Tier 1 is the purest form of capital. It is money that can soak up losses without a fight. Your CFO should already track this number on a dashboard.
Here is a question to ask in your next leadership meeting: If our CRO and CCO disagreed with the CEO, would the board hear about it?
If the answer is “not sure,” you know where to begin.
Your action: Review every board committee charter. Confirm that your CRO and CCO can reach the board directly. Give the compliance team its own staff and budget. Track CET1 capital every month. And make sure board minutes show real challenge, not just approval.
Subject Two: IT and Data
Years ago, regulators asked, “Do you have a policy?” Today they ask, “Can you prove it works?”
For Upper Layer NBFCs, this puts IT and data in the spotlight. Weak data leads to weak compliance. If a report is wrong at the source, no amount of polish can fix it later.
Let’s talk about models. Many lenders now use automated tools to score credit, spot fraud and manage collections. Each of these tools is a model. And every model carries risk.
The RBI’s direction on model risk asks Upper Layer NBFCs for several things. You need a full model inventory. You need independent checks of each model. You need ongoing monitoring. And you need board-level reporting, plus compliance oversight of any AI-driven workflow.
In plain words: if an algorithm decides who gets a loan, someone senior must own it, test it and be able to explain it.
IT governance and cyber security also get closer attention at this scale. Think of audit trails, access controls and tested recovery plans. A backup that has never been tested is only a hope.
Try this simple test: Can you list every model you use, and name the owner of each one? If that takes a week, you have found your first project.
Your action: Build a model inventory. Give each model one clear owner. Set a schedule for independent validation. Test your disaster recovery plan every year. And make sure regulatory reports come from one trusted data source.
Subject Three: Disclosure
Bigger firms live in a glass house.
Upper Layer NBFCs must publish Pillar 3 disclosures on their websites. They must also submit their ICAAP and prepare financial statements under Ind AS.
Pillar 3 is the one that surprises many teams. It puts details of your risk and capital position where everyone can read them. Analysts will read them. So will rating agencies, rivals and journalists.
This is not only a reporting job. It is a data job. If your numbers live in ten spreadsheets and three email inboxes, disclosure season will hurt. Even a small mismatch between two reports can raise big questions.
The fix is not glamorous, but it works. Build a disclosure calendar. Name one owner for each item. Set a review date before every publication. And ask someone outside the preparing team to check the final numbers.
Your action: List every disclosure you must make, with due dates. Assign a preparer and a reviewer for each. Reconcile figures across reports before release. Keep a record of sign-offs. And move away from manual spreadsheets wherever you can.
Subject Four: Listing
Now we reach the item that changes a company’s life.
A classified NBFC must list on a stock exchange within three years of being identified. There are two exceptions. Bank-group NBFCs treated as UL by default are exempt. So are government-owned NBFCs in the Upper Layer.
For everyone else, listing is a much bigger step than it looks. SEBI rules apply on top of RBI oversight. Your board answers to public shareholders. Your results get judged every three months.
Three years sounds like a long time. It is not. A good listing needs clean books, a strong independent board and a story investors can follow.
Your action: Clean up related-party dealings. Strengthen board independence. Speed up your financial closing process. Fix audit comments that keep coming back. And draft a listing timeline with owners and dates.
A Small Twist: The Tata Sons Question
One name on the list has raised a few eyebrows.
Tata Sons appears as a Core Investment Company. The RBI has said its inclusion is without prejudice to its pending application for deregistration.
Some legal experts ask a fair question. Should a private holding company with no public-facing lending be pushed to list? Reasonable people can disagree on that.
For other NBFCs, the lesson is simple. The framework is still being tested, and details may shift. Follow RBI updates closely, and do not assume today’s reading is final.
Living Close to the Line? Read This Part
Now a special word for mid-sized NBFCs. If your assets are moving toward ₹1 lakh crore, treat today as the start of your preparation.
You are already in the exam hall. The paper has not reached your desk yet, but the clock is ticking.
Here is the tricky part. One number now decides your layer. That creates a temptation. Some firms may think about splitting their balance sheet through a demerger. Others may think about slowing growth to stay under the mark. Experts have already flagged this risk.
I would call it a fragile plan. The threshold is reviewed every three years, and regulators can change their approach. Also, giving up business just to avoid rules that your competitors already follow is a strange trade.
A calmer path is to prepare early. Track your assets every quarter, so you know how far you are from the line. Run a gap check against the Upper Layer rules. Budget for new hires, better technology and higher audit costs. Brief your board so no director is surprised. And sketch a listing roadmap, even a rough one.
Firms that prepare early move calmly. Firms that wait will scramble.
Five Mistakes to Avoid
Many NBFCs stumble in the same places when they move up a layer. Here are five to watch for.
Mistake one: treating it as a legal task only. Upper Layer compliance touches finance, IT, risk, HR and the board. If only the legal team owns it, gaps will appear.
Mistake two: writing policies but skipping proof. Writing a new policy is easy. Showing that people follow it is harder. Regulators care about proof.
Mistake three: ignoring data quality. Bad data makes bad reports. Fix the source before you polish the output.
Mistake four: planning for listing too late. Listing work takes many months. Delay makes it costly and stressful.
Mistake five: forgetting the five-year rule. Some firms think that dropping below the threshold ends their duties. It does not. Enhanced rules continue for at least five years.
Your 90-Day Plan
You do not need to fix everything at once. Here is a plan you can start on Monday.
In the first 30 days, find the gaps. Run a gap analysis across governance, capital, IT and disclosure. Write down every gap, however small. Rate each one as high, medium or low.
On days 31 to 60, build the base. Fill key roles such as CRO and CCO if they are vacant or weak. Update board committee charters. Make sure reporting lines are clear and independent.
On days 61 to 90, test and plan. Test your data, reporting and model controls. Fix what breaks. Then draft a listing roadmap with dates and owners.
Ninety days will not finish the job. But it will show you exactly where you stand, and that is half the battle.
What Good Looks Like
Let’s picture a well-prepared NBFC one year from now.
Its board meets the risk and compliance heads privately, without the CEO in the room, at least once a quarter. Its CCO leads a real team with a real voice. Every model has an owner and a validation date. The finance team publishes its Pillar 3 disclosures on time, and the numbers match across every report. The listing roadmap sits on the board’s agenda every quarter.
None of this needs a miracle. It needs clear owners, steady habits and steady attention from the top.
The Bottom Line
The Upper Layer is not a reward. It is a message from the regulator: you matter to the financial system, so we will hold you to a higher standard.
The smartest NBFCs will read it that way. They will skip the victory lap, open the checklist and start ticking things off. They will see governance, IT and disclosure not as burdens, but as proof of strength. Strong compliance also builds trust with lenders, investors and customers.
So, one last time: making the UL list isn’t a trophy. It’s a to-do list. The only question is how quickly you begin.
Not sure where your NBFC stands on the Upper Layer journey? Our NBFC Advisory team can run a quick gap check on your governance, IT and disclosure readiness, so you can turn the RBI’s to-do list into a clear plan. Connect with our NBFC Advisory experts today.
Need expert guidance? Get in touch with our consultants today.
📞 Call NBFC Advisory: +91 93287 18979
🌐 Visit: nbfcadvisory.com
