NBFC risk management under RBI: scale based regulation explained

NBFC risk management under RBI depends on the layer the company sits in. Every NBFC needs a Risk Management Committee. Middle and Upper Layer NBFCs also need a Chief Compliance Officer, an internal capital assessment (ICAAP) and stronger audit and technology controls, and the larger ones need a Chief Risk Officer.

The rules were reorganised twice in the last year. This guide uses the current titles so that your tracker points to the right documents.

Where the NBFC rules sit now

Until late 2025 most teams worked from one document, the Master Direction – NBFC – Scale Based Regulation Directions, 2023. On 28 November 2025 RBI's Department of Regulation consolidated more than 9,000 circulars into function-wise Master Directions for each type of regulated entity. For NBFCs the single 2023 direction was replaced by a set of directions titled "Reserve Bank of India (Non-Banking Financial Companies – …) Directions, 2025". The ones that matter most for risk are:

• Registration, Exemptions and Framework for Scale Based Regulation
• Governance
• Prudential Norms on Capital Adequacy
• Concentration Risk Management
• Income Recognition, Asset Classification and Provisioning
• Managing Risks in Outsourcing

In 2026 the Department of Supervision did the same for supervisory instructions. On 31 July 2026 it issued NBFC directions on the Compliance Function, the Internal Audit Function, Fraud Risk Management and a Cybersecurity, Technology: Risk, Resilience and Assurance Framework, among others. Several 2025 directions have also been amended during 2026. Always check the "updated as on" date on rbi.org.in.

The four layers of scale based regulation

The layers are defined in the Registration, Exemptions and Framework for Scale Based Regulation Directions, 2025.

Once placed in the Upper Layer, an NBFC stays under the enhanced rules for at least five years. Government-owned NBFCs are kept in the Base or Middle Layer for now.

Risk governance: RMC, CRO and CCO

The Governance Directions, 2025 set out who must be in place.

• Risk Management Committee. Every NBFC, in every layer, must constitute an RMC at board or executive level. It evaluates the overall risks of the company, including liquidity risk, and reports to the board.
• Chief Risk Officer. NBFCs in the Middle and Upper Layers with assets above ₹5,000 crore must appoint a CRO. The CRO is a senior official with a fixed tenure approved by the board, reports to the MD and CEO or the board's risk committee, carries no business targets and has no "dual hatting". The CRO vets credit products. Early removal needs board approval and is reported to RBI.
• Chief Compliance Officer. Middle and Upper Layer NBFCs must appoint a sufficiently senior CCO and have a board-approved policy on the compliance function. The detailed expectations are now in the NBFC Compliance Function Directions, 2026.
• Audit Committee. Middle and Upper Layer NBFCs need an Audit Committee of at least three directors.

In June 2026 RBI also published draft amendments that would treat risk management, compliance and internal audit as "control functions" with common rules on independence and tenure. The draft for NBFCs is the Governance Amendment Directions, 2026. Check whether it has been finalised.

Credit, capital and liquidity risk

Financial risk management for an NBFC rests on three pieces.

Credit risk management

RBI expects board-approved credit policies, exposure limits under the Concentration Risk Management Directions, and asset classification and provisioning under the IRACP Directions. For larger NBFCs the CRO's review of credit products is part of the control design. The RMC is expected to see portfolio-level reporting, not only individual sanctions.

ICAAP

The Internal Capital Adequacy Assessment Process applies to the Middle Layer and above, under the Prudential Norms on Capital Adequacy Directions, 2025. The NBFC assesses its own capital need against credit, market, operational and other residual risks, in proportion to its scale and complexity. The board owns the result.

Liquidity risk

RBI's liquidity risk management framework for NBFCs dates from November 2019. It asks for board-approved liquidity policies, maturity buckets with tolerance limits, monitoring tools and stock ratios, and a liquidity coverage ratio for larger NBFCs and deposit takers. The asset-size thresholds are specific, so read the current text on rbi.org.in for your category.

Operational risk: technology, outsourcing and audit

Operational risk management in an NBFC is spread over several directions.

• Technology. RBI's Master Direction on IT Governance, Risk, Controls and Assurance Practices took effect on 1 April 2024 and did not apply to Base Layer NBFCs. On 31 July 2026 the NBFC technology and cyber requirements were reissued as the Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, which repealed the earlier IT framework and IT governance instructions for NBFCs. The new directions are tiered: baseline requirements for Base Layer NBFCs below ₹500 crore and for core investment companies, a fuller chapter for Base Layer NBFCs of ₹500 crore and above, and the most detailed chapter for the Middle Layer and above.
• Outsourcing. The Managing Risks in Outsourcing Directions, 2025 keep responsibility with the NBFC when an activity is outsourced.
• Internal audit. The Internal Audit Function Directions, 2026 apply to all deposit taking NBFCs and to non-deposit taking NBFCs with assets of ₹5,000 crore and above. They require a board-approved risk-based internal audit policy, an annual risk assessment and a Head of Internal Audit who does not report to business lines. The internal audit function cannot be outsourced.

NBFC fraud prevention and reporting

The NBFC Fraud Risk Management Directions, 2026, issued on 31 July 2026, replaced the July 2024 Master Directions. They apply to NBFCs, including housing finance companies, in the Upper and Middle Layers and to Base Layer NBFCs with assets of ₹500 crore and above.

• A board-approved fraud risk management policy.
• An early warning signal framework for Middle and Upper Layer NBFCs.
• Natural justice before a person or entity is classified as fraud: a detailed show cause notice, at least 21 days to reply, and a reasoned order.
• Reporting to law enforcement, and to RBI through Fraud Monitoring Returns within 14 days of classification.

Summaries of the 2026 text say it largely carries forward the 2024 framework. Confirm the wording that applies to your category.

How RegIntel Nexus helps

RegIntel Nexus does not measure credit risk or detect fraud. It helps an NBFC keep its obligations current as directions are consolidated and amended. The platform monitors RBI publications, classifies each direction and tracks amendments against the earlier version. Its research assistant answers questions with the document, clause and page cited. Each requirement becomes a clause-level obligation with an owner, a due date, a status and an escalation path, and is mapped to the business capability, process and application it affects. Source versions, approvals and SHA-256 integrity records are retained so that the team can show an inspector what was known and when.

This article is general information for compliance and risk professionals. It is not legal advice. Regulations are amended often; check the current text published by the regulator before acting.