NBFC · Compliance · Playbook
NBFC Compliance Checklist — A Practical Guide for Indian NBFCs
A working checklist covering RBI registration, scale-based regulation, KYC/AML, lending conduct, asset classification, returns and governance — the seven areas where NBFC compliance is usually tested. Use it as a quarterly review sheet, then run the records through the BlackBull NBFC Tool for document control, escrow workflow and compliance tracking.
Who this checklist is for
Compliance officers, company secretaries, CFOs and founders of NBFCs registered with the Reserve Bank of India. Requirements differ by layer and by deposit-taking status, so confirm each line against the RBI Master Directions that apply to your category before you sign off. Treat this as a structuring aid, not a legal opinion.
The 7-part NBFC compliance checklist
Assign an owner and a due date to each line, and log evidence — filing acknowledgement, board minute or policy version — against every item.
1. Registration & Entity Status
- Certificate of Registration (CoR) from the RBI, with the activity category it permits
- Net Owned Fund (NOF) maintained at or above the level prescribed for your NBFC category
- Principal business criteria monitored — financial assets and financial income tested each year
- Any change in control, address, directors or shareholding above prescribed thresholds notified to the RBI
- Company law hygiene: MOA object clause, ROC filings, statutory registers and directors' KYC
2. Scale-Based Regulation (Base / Middle / Upper Layer)
- Confirm your layer under the RBI Scale Based Regulation framework and the norms that follow it
- Deposit-taking vs non-deposit-taking status documented, including NBFC-ND-SI asset-size testing
- Capital adequacy (CRAR) and leverage limits tracked against the norms for your layer
- Concentration limits on single-borrower and single-group exposure monitored monthly
- Upper-layer additions where applicable — common equity requirement, board committees, disclosure pack
3. KYC, AML & Customer Onboarding
- KYC policy approved by the board and aligned to the RBI Master Direction on KYC
- Customer Due Diligence, risk categorisation and periodic re-KYC schedule in place
- PMLA obligations: Principal Officer and Designated Director appointed, FIU-IND reporting live (CTR/STR)
- Sanctions and PEP screening on customers, beneficial owners and counterparties
- Record retention of identity and transaction records for the statutory period
4. Lending, Pricing & Recovery Conduct
- Board-approved interest rate model with a published, non-discriminatory pricing policy
- Key Fact Statement / sanction letter and loan agreement issued in a language the borrower understands
- Fair Practices Code displayed, plus a grievance redressal officer and escalation path to the RBI Ombudsman
- Digital lending rules followed where an LSP or app is used — direct disbursal and repayment flows, no pass-through accounts
- Recovery agent conduct policy, call-time discipline and outsourcing accountability documented
5. Asset Classification, Provisioning & Credit Bureau
- Income recognition, asset classification and provisioning (IRACP) applied, including daily NPA tagging and upgrade rules
- Ind AS financials reconciled with IRACP provisioning through the impairment reserve where required
- Credit information reported to all four bureaus, with correction turnaround tracked
- Restructuring, write-off and settlement approvals recorded at the correct authority level
6. Returns, Audit & Statutory Filings
- RBI returns filed on the supervisory portal per the schedule for your category (monthly, quarterly and annual as applicable)
- Statutory Auditors' Certificate on continuation of NBFC business filed annually
- Internal audit, concurrent audit where applicable, and Risk-Based Internal Audit for eligible NBFCs
- Statutory transfer to reserve fund out of profits, and dividend payout limits observed
- Income tax, GST and TDS filings reconciled with the books before RBI submissions
7. Governance, IT & Outsourcing
- Board committees constituted as required — audit, risk management, nomination and remuneration, ALCO
- Fit-and-proper declarations for directors renewed annually
- IT governance and cyber-security policy, business continuity plan and incident reporting to the RBI
- Outsourcing agreements with due diligence, audit rights and data-localisation compliance
- DPDP Act readiness for borrower data, consent artefacts and breach notification
Build a compliance calendar from the checklist
- Map each item to a frequency — event-based, monthly, quarterly, half-yearly or annual.
- Name a single accountable owner per item, with a reviewer who is not the preparer.
- Attach the evidence — portal acknowledgement, certificate, policy PDF or board minute.
- Track exceptions in a register with root cause, remediation and closure date.
- Report to the board quarterly with a Red / Amber / Green view per checklist area.
Verify every due date against the current RBI Master Directions and circulars for your NBFC category — timelines and thresholds are revised periodically.
Run it through the BlackBull NBFC Tool
The BlackBull NBFC Tool is a financial command centre for NBFC control — document library, transaction control, escrow workflow, compliance checklist tracking and a legal support dashboard with internal review and approval. Pair it with BBMASTERREPORT for an NBFC Analysis report covering financial health, debt safety, liability exposure and portfolio strength.