Non-Banking Financial Companies Compliance Function Directions

RBI/DoS/2026-27/460 DoS.CO.PPG.54/11.01.005/2026-27 July 31, 2026

Reserve Bank of India (Non-Banking Financial Companies - Compliance Function) Directions, 2026

Table of Contents

Introduction Chapter I - Preliminary A. Short Title and Commencement B. Applicability C. Definitions Chapter II - Governance and Oversight A. Role of the Board B. Role of the Senior Management C. Compliance Policy Chapter III - Scope, Structure, and Responsibilities A. Scope B. Structure C. Staffing D. Roles and Responsibilities E. Internal Audit Chapter IV - Chief Compliance Officer A. Appointment B. Authority, Stature, and Independence C. Reporting Requirements D. Roles and Responsibilities Chapter V - Use of Technology for Monitoring Chapter VI - Repeal and Other Provisions A. Repeal and Saving B. Application of Other Laws Not barred C. Interpretations

Introduction

The Compliance function is a critical element of the corporate governance framework of a Non-Banking Financial Company. The provisions set out in these Directions represent minimum standards, based on the principle of proportionality, and the Non-Banking Financial Company shall structure its Compliance framework in line with its governance arrangements, scale of operations, risk profile and organisational structure.

In exercise of the powers conferred by Sections 45-JA, 45-L and 45-M of the Reserve Bank of India Act, 1934, and Section 6 of the Factoring Regulation Act, 2011, and all other provisions / laws enabling the Reserve Bank of India (‘RBI’) in this regard, RBI being satisfied that it is necessary and expedient in the public interest so to do, hereby, issues Directions hereinafter specified.

Chapter I - Preliminary

A. Short Title and Commencement

1. These Directions shall be called the Reserve Bank of India (Non-Banking Financial Companies - Compliance Function) Directions, 2026.
2. These Directions shall come into effect immediately upon issuance.

B. Applicability

3. These Directions shall be applicable to Non-Banking Financial Companies (hereinafter collectively referred to as ‘NBFCs’ and individually as ‘NBFC’) in the Middle Layer and Upper Layer, holding registration under the Reserve Bank of India Act, 1934 or the Factoring Regulation Act, 2011, unless specified otherwise.

Note: The applicability under these Directions is in line with the regulatory structure for NBFCs as set out in Reserve Bank of India (Non-Banking Financial Companies – Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025 .

C. Definitions

4. In these Directions, unless the context states otherwise, the terms herein shall bear the meaning assigned to them below:

• (1) ‘Compliance Risk’ shall mean the risk of legal or regulatory sanctions, material financial loss, or loss to reputation that an NBFC may suffer as a result of its failure to comply with laws, regulations, rules, and codes of conduct, applicable to its activities.

5. All other expressions unless defined herein shall have the same meaning as have been assigned to them under the Reserve Bank of India Act, 1934, the Banking Regulation Act, 1949, the Companies Act, 2013, or any statutory modification or re-enactment thereto or other regulations issued by RBI or the Glossary of Terms published by RBI or as used in commercial parlance, as the case may be.

Chapter II - Governance and Oversight

A. Role of the Board

6. The Board / Audit Committee of Board (ACB) shall ensure that an appropriate Compliance policy is put in place and implemented. It shall prescribe the periodicity for review of compliance risk.

B. Role of the Senior Management

7. The senior management shall carry out an annual compliance risk assessment to identify and assess major compliance risks faced by the NBFC and prepare a plan to manage the risks. It shall submit to the Board / ACB a review at the prescribed periodicity and a detailed annual review of Compliance. The annual review shall ensure coverage of at least the following aspects:

• (1) Compliance failures, if any, during the preceding year and consequential losses and regulatory action, as also steps taken to avoid recurrence of the same (appropriate remedial or disciplinary action);
• (2) Listing of all major regulatory guidelines issued during the preceding year and steps taken to ensure compliance;
• (3) Compliance with fair practices codes and adherence to standards set by self-regulatory bodies and accounting standards; and
• (4) Progress in the rectification of significant deficiencies and implementation of recommendations pointed out in various audits and RBI inspection reports.

C. Compliance Policy

8. The Board-approved Compliance policy shall clearly spell out its Compliance philosophy, expectations on Compliance culture, structure, and role of the Compliance function, the role of Chief Compliance Officer (CCO), processes for identifying, assessing, monitoring, managing, and reporting on compliance risk. The Policy shall be reviewed at least once a year.
9. The policy shall ensure coverage of the following aspects:

• (1) Measures to ensure the independence of the Compliance function and its responsibilities to freely disclose findings and views to senior management, Board / ACB;
• (2) Focus on various regulatory and statutory compliance requirements;
• (3) Monitoring mechanism for the compliance testing procedure;
• (4) Reporting requirements, including inter alia compliance risk assessment and change in risk profile to the senior management and to the Board / ACB;
• (5) The authority of the Compliance function to have access to information throughout the NBFC;
• (6) A mechanism for dissemination of information on regulatory prescriptions and guidelines among staff and periodic updating of operational manuals; and
• (7) The approval process for all new processes and products by the Compliance Department, prior to their introduction.

Chapter III - Scope, Structure, and Responsibilities

A. Scope

10. Compliance function shall ensure strict observance of all statutory and regulatory requirements for the NBFC, including standards of conduct, managing conflict of interest, treating customers fairly and ensuring the suitability of customer service.

B. Structure

11. The CCO shall head the Compliance Department, meeting the requirements prescribed under Chapter IV of these Directions. The NBFC is free to adopt its own organisational structure for the Compliance function. However, the function shall be independent and sufficiently resourced, its responsibilities shall be clearly specified, and its activities shall be subject to periodic and independent review.
12. In case of NBFCs having separate Departments / divisions looking after compliance with different statutory and other requirements, the Departments concerned shall hold prime responsibility for their respective areas, which shall be clearly outlined. Adherence to applicable statutory provisions and regulations shall be the responsibility of each staff member. However, the Compliance function shall ensure overall oversight.

C. Staffing

13. The staff in the Compliance Department shall primarily focus on Compliance function. However, the NBFC may assign some other duties to the Compliance staff while ensuring that there is no conflict of interest.
14. Apart from having staff with basic qualifications and practical experience in business lines / audit and inspection functions, Compliance function shall have adequate staff members with knowledge of statutory / regulatory prescriptions, law, accountancy, risk management, and information technology. The NBFC shall ensure appropriate succession planning to avoid any future skill gap.

D. Roles and Responsibilities

15. Compliance function shall be responsible for undertaking the following activities at the minimum:

• (1) Assist the Board and the senior management in overseeing the implementation of Compliance policy, including policies and procedures, prescriptions in compliance manuals, and internal codes of conduct.
• (2) Play the central role in identifying the level of compliance risk in the organisation. The compliance risks in existing / new products and processes shall be analysed and appropriate risk mitigants shall be put in place. The Compliance function shall subject all new products to intensive monitoring at least for the first six months of introduction to ensure that the indicative parameters of compliance risk are adequately monitored.
• (3) Compliance function shall monitor and test compliance by performing sufficient and representative compliance testing, and the results of such compliance testing shall be reported to the senior management. It shall periodically circulate the instances of compliance failures among staff, along with the required preventive instructions. The NBFC shall examine staff accountability for major compliance failures.
• (4) Ensure compliance of regulatory / supervisory directions given by RBI in both letter and spirit in a time-bound and sustainable manner. The NBFC shall put in place an effective Compliance Program where all Risk Mitigation Plan / Monitorable Action Plan points are complied with within the timelines prescribed. Compliance to RBI inspection reports shall be communicated to RBI necessarily through the office of the Compliance function.
• (5) Attend to compliance with directions from other regulators in cases where the activities of the entity are not limited to the regulation / supervision of RBI. Further, the Compliance function shall bring to the notice of RBI, any discomfort conveyed to the NBFC on any issue by other regulators, and action taken by any other authorities / law enforcement agencies.

16. The Compliance Department shall also serve as a reference point for the staff from operational Departments for seeking clarifications / interpretation of various regulatory and statutory guidelines.