New Compliance Changes Affecting NBFCs in India

The Non-Banking Financial Company (NBFC) sector in India is changing fast. In 2026, the Reserve Bank of India (RBI) introduced several new compliance requirements for NBFCs. Some of these changes reduce the compliance burden for smaller companies. Others bring stricter rules for larger NBFCs that have a greater impact on the financial system.

The goal behind these changes is simple. RBI wants a stronger, safer, and more transparent financial sector. It wants NBFCs to improve governance, strengthen risk management, protect customers, and build better compliance systems.

These changes affect almost every type of NBFC. They also affect fintech companies, investors, lenders, and businesses planning an NBFC takeover. Understanding these regulations is important for avoiding penalties and ensuring smooth business operations.

In this guide, we explain the major compliance changes introduced by RBI in 2026. We also discuss what these changes mean for NBFCs and the steps companies should take to remain compliant.

Why RBI Keeps Updating NBFC Regulations

Under this approach, smaller NBFCs have fewer compliance requirements because they create less risk for the financial system. Larger NBFCs must follow stricter rules for governance, risk management, and compliance.

Another key goal is financial stability.

RBI wants NBFCs to build stronger internal systems. It also wants them to protect customers, maintain enough liquidity, and improve their compliance processes. These steps can help make the financial sector safer and more stable.

The first objective is proportionate regulation.

Over the past few years, RBI has increased its focus on:

• Corporate governance
• Board oversight
• Compliance monitoring
• Liquidity management
• Recovery practices
• Cyber security
• Customer protection

The 2026 updates continue this trend.

Once these objectives are understood, the latest regulations become much easier to interpret. They are not isolated changes. They are part of a larger effort to strengthen India’s financial ecosystem.

New Registration and Exemption Rules Effective from April 1, 2026

One of the biggest regulatory changes in 2026 is the introduction of the NBFC Registration, Exemptions and Scale Based Regulation Amendment Directions, 2026.

These directions create a new category known as an “Unregistered NBFC.”

What is an Unregistered NBFC?

A company may qualify for this category if it satisfies the 50-50 test.

This means:

• More than 50% of total assets are financial assets.
• More than 50% of total income comes from financial activities.

In addition, the company:

• Must not accept public funds.
• Must not have customer-facing financial activities.

If these conditions are satisfied, RBI registration under Section 45-IA may not be required.

This is a significant relief for many companies that previously had to obtain RBI registration solely because they met the 50-50 test.

Annual Compliance Requirements Still Apply

Although registration may not be required, certain compliance obligations remain.

Every year:

• The Board of Directors must approve a resolution confirming eligibility for exemption.
• The exemption status must be disclosed in financial statements.
• The statutory auditor must certify compliance with exemption conditions.

This means the exemption is not automatic forever. Companies must continue meeting the conditions each year.

One-Time CoR Surrender Window

Companies that already possess an RBI Certificate of Registration (CoR) but qualify under the new exemption framework may voluntarily surrender their registration.

Applications can be submitted through RBI’s PRAVAAH portal until September 30, 2026.

This change is particularly beneficial for:

• Holding companies
• Family offices
• Treasury entities
• Investment companies using only their own funds

These entities often do not raise public funds or interact with customers. The new framework reduces unnecessary regulatory burden on such businesses.

NBFC Reclassification from July 1, 2026

On April 29, 2026, RBI announced changes to the NBFC classification framework under its Scale Based Regulation (SBR) system.

The framework continues to divide NBFCs into four layers:

• Base Layer (NBFC-BL)
• Middle Layer (NBFC-ML)
• Upper Layer (NBFC-UL)
• Top Layer (NBFC-TL)

The revised framework updates asset-size thresholds and activity-based criteria used to determine an NBFC’s regulatory layer.

Why Classification Matters

An NBFC’s classification determines the level of regulation it must follow.

Companies in the Base Layer generally face fewer compliance requirements.

As an NBFC moves into the Middle Layer or Upper Layer, compliance obligations increase significantly.

Additional requirements may include:

• Appointment of a Chief Compliance Officer
• Formation of additional board committees
• Enhanced governance requirements
• Stronger risk management systems
• More detailed reporting obligations
• Greater supervisory oversight

Because of this, NBFCs should carefully assess how the revised classification framework affects them.

Steps NBFCs Should Take

Management teams should compare:

• Current classification
• Classification after July 1, 2026
• Additional compliance requirements under the new category

Early planning can help avoid future compliance challenges.

Revised Branch Authorisation Rules

RBI has also finalized the NBFC Branch Authorisation Directions, 2026.

The objective is to make branch expansion easier while maintaining adequate regulatory supervision.

Key Changes

The revised framework:

• Simplifies branch approval procedures.
• Reduces paperwork.
• Aligns branch regulations with other RBI directions.
• Supports faster geographic expansion.

For growing NBFCs, this is a positive development.

Opening branches in new locations often involves lengthy approval processes. The revised framework reduces administrative hurdles while maintaining RBI oversight.

NBFCs that plan to open new branches should review the new branch rules first. This can help them make informed business decisions and avoid compliance issues.

Government-Owned NBFCs Included in Upper Layer Classification

Historically, government-owned NBFCs were often treated differently from private NBFCs.

In many cases, government ownership reduced the likelihood of Upper Layer classification.

The revised framework changes this approach.

Government-owned NBFCs will now be assessed using the same rules that apply to private NBFCs. This means both will be evaluated under the same regulatory framework.

If a government-owned NBFC crosses the required thresholds, it may be classified as an NBFC-UL.

Impact of the Change

Once classified as NBFC-UL, the entity must comply with:

• Enhanced governance requirements
• Stronger disclosure obligations
• Additional risk management standards
• Board oversight requirements
• Increased regulatory supervision

This change creates a level playing field for all large NBFCs. It ensures that similar rules apply to large institutions, whether they are government-owned or privately owned.

Draft NBFC Compliance Function Directions, 2026

RBI has also released the Draft NBFC Compliance Function Directions, 2026.

These new directions are based on RBI’s earlier rules. Under those rules, NBFCs in the Middle Layer and Upper Layer must have a separate compliance team. This team helps ensure the NBFC follows RBI rules and other legal requirements.

The draft framework strengthens compliance governance further.

Key Proposals

The proposed directions require:

• Independence of the Compliance Function.
• Direct reporting access for the Chief Compliance Officer (CCO).
• Protection against management interference.
• Technology-enabled compliance monitoring.
• Greater board accountability.

Why This Matters

Compliance is no longer viewed as a support function.

RBI now expects compliance teams to take a bigger role in the organization. They should help identify compliance risks, monitor regulatory requirements, and ensure the NBFC follows all applicable rules and laws.

NBFCs should review:

• Compliance reporting structures
• Roles and responsibilities of the CCO
• Compliance technology systems
• Board oversight processes

Making these changes early can help companies prepare for future regulatory expectations.

Tighter Concentration and Liquidity Norms

RBI has also strengthened risk management requirements through tighter concentration and liquidity norms.

Single Borrower Exposure Limit

For NBFC-Middle Layer entities, the single borrower exposure limit has been reduced.

The limit has been lowered from 25% to 20% of Tier I Capital.

Why This Matters

Large exposure to a single borrower increases risk.

If the borrower defaults, the NBFC could face significant losses.

The revised limit encourages better diversification and reduces concentration risk.

Liquidity Coverage Ratio (LCR)

NBFC-Upper Layer entities must gradually increase their liquidity buffers.

The LCR requirement will eventually reach 100% by 2027.

Purpose of the LCR

The Liquidity Coverage Ratio ensures that an NBFC has enough liquid assets to survive periods of financial stress.

This strengthens financial resilience and improves overall stability.

Revised Code of Conduct for Recovery Agents

RBI has introduced new rules for recovery agents. These rules aim to protect borrowers and ensure fair recovery practices.

The goal is simple. Borrowers should be treated fairly, while NBFCs can continue their recovery activities in a proper and professional manner.

Major Changes

The revised framework includes:

• Mandatory training and certification requirements.
• Clear rules regarding borrower contact timings.
• Written grievance communication before recovery action.
• Accountability of NBFCs for agent misconduct.
• Applicability to both outsourced and in-house recovery teams.

Impact on NBFCs

NBFCs should immediately review:

• Recovery policies
• Collection procedures
• Training records
• Vendor agreements
• Customer communication processes

Companies that fail to follow these standards may face regulatory scrutiny and reputational risks.

Cyber Security, IT Governance and Digital Payment Compliance

Technology risk continues to be a major area of focus for RBI.

As digital lending grows, cyber security becomes increasingly important.

New Expectations for NBFCs

NBFC-Middle Layer and NBFC-Upper Layer entities must:

• Adopt board-approved cyber security policies.
• Conduct annual vulnerability assessments.
• Perform penetration testing.
• Strengthen outsourced IT controls.
• Improve incident response procedures.

Why Cyber Security Matters

Financial institutions handle large amounts of sensitive customer data.

Weak cyber security controls can lead to:

• Data breaches
• Financial fraud
• Operational disruptions
• Regulatory penalties

Strong cyber security practices protect both customers and businesses.

Digital Payment Requirements

RBI’s updated payment framework also introduces stronger authentication and fraud management requirements.

NBFCs involved in digital lending and payment partnerships should review their technology systems carefully.

Timeline of Major NBFC Compliance Changes in 2026

What NBFCs Should Do Now

To remain compliant, NBFCs should take the following steps:

• Check eligibility under the Unregistered NBFC framework.
• Review classification under the revised SBR structure.
• Assess branch expansion plans.
• Evaluate Compliance Function and CCO reporting structures.
• Recalculate borrower exposure limits.
• Review liquidity management practices.
• Audit recovery procedures and agent certifications.
• Strengthen cyber security controls.
• Brief boards and senior management regarding regulatory changes.

Taking proactive action today can reduce future compliance risks.

Why These Changes Matter Beyond Compliance

Many NBFCs view compliance as a regulatory requirement. However, RBI’s latest approach shows that compliance is becoming a strategic business function.

The 2026 framework affects:

• NBFC takeover transactions
• Investor confidence
• Due diligence exercises
• RBI inspections
• Fintech partnerships
• Fundraising activities
• Governance assessments
• Expansion plans

Strong compliance systems improve business credibility and reduce operational risks.

Companies that adapt early will be better positioned for future growth.

Final Word

NBFC compliance in India is entering a new phase in 2026.

RBI is making compliance easier for smaller and lower-risk NBFCs. At the same time, it is introducing stricter rules for larger NBFCs. These rules focus on governance, liquidity, risk management, and compliance.

Smart NBFCs will not see these changes as just new regulations. They will see them as part of RBI’s plan to build a stronger and safer financial system.

If you are reviewing your NBFC classification, planning an NBFC takeover, expanding your business, improving compliance, or preparing for an RBI inspection, it is best to act early. Early planning can help reduce compliance risks and avoid future issues.

Need help understanding these changes?

NBFC Advisory can help you review your compliance requirements, identify gaps, improve governance, and implement practical solutions for your NBFC.

Need expert guidance? Get in touch with our consultants today.

📞 Call NBFC Advisory: +91 93287 18979
🌐 Visit: www.nbfcadvisory.com