NBFC Compliance in 2026: The Plain-English Guide to RBI Rules
An NBFC lends money like a bank but holds no banking licence. That gap means a separate, complex set of RBI rules — and one misstep can cost crores in penalties. Here's the plain-English map of what compliance actually demands in 2026.
- An NBFC is a company registered under the Companies Act whose principal business is lending; it cannot accept demand deposits.
- Every NBFC must register with the RBI under Section 45-IA of the RBI Act, 1934; operating without registration is illegal.
- The RBI Master Direction on KYC (2016, updated) applies to all NBFCs, requiring customer identity verification before any financial transaction.
- NBFCs with asset size of ₹500 crore or more must report to CRILC monthly, including any borrower with exposure of ₹5 crore or more.
- The RBI's Account Aggregator framework, operational since 2021, lets customers share financial data only with explicit, revocable consent.
- NACH e-mandates handle recurring payments of any amount; UPI e-mandates are capped at ₹15,000 per transaction for recurring debits.
- NBFC compliance starts with RBI registration under Section 45-IA of the RBI Act, 1934.
- KYC Master Direction applies to all NBFCs — it is a continuous duty, not a one-time form.
- NBFCs with assets of ₹500 crore or more must report borrowers with ₹5 crore+ exposure to CRILC monthly.
- Account Aggregator data sharing requires explicit, revocable customer consent every time.
- NACH handles recurring debits of any amount; UPI e-mandate is capped at ₹15,000 per transaction.
- A clean compliance record lowers an NBFC's own borrowing costs — compliance is a funding advantage.
What exactly is NBFC compliance?
NBFC compliance means following every rule the RBI sets for companies that lend money but are not banks. The core idea: an NBFC does the lending work of a bank, so it must follow similar safety rules — but without the full banking licence.
The rules cover everything from registration to customer verification to reporting large loans. The RBI's goal is simple: protect depositors and keep the financial system stable.
Who must comply? The NBFC definition
An NBFC is a company registered under the Companies Act whose main business is lending, buying shares or bonds, or leasing and hire-purchase. The key test: this lending must be its principal business, not a side activity.
If financial assets exceed 50% of total assets and income from those assets exceeds 50% of total income, the company is an NBFC. It must register with the RBI under Section 45-IA of the RBI Act, 1934. Operating without registration is illegal.
The KYC rule: your first compliance checkpoint
Every NBFC must follow the RBI Master Direction on KYC. This means verifying a customer's identity before any transaction. The rule exists to stop money laundering and terrorist financing.
For a deeper dive, see our plain-English guide to the RBI KYC Master Direction. KYC is not a one-time form-filling exercise; it is a continuous duty to keep customer records updated.
CRILC reporting: the ₹5 crore threshold
NBFCs must report large loans to the CRILC — the Central Repository of Information on Large Credits. This database helps the RBI track who is borrowing big across the system.
The rule: any NBFC with assets of ₹500 crore or more must report to CRILC. They must report any borrower with total exposure of ₹5 crore or more, and they must do this monthly. This reporting is how the RBI spots wilful defaulters.
BBPS: the bill payment system NBFCs use
The Bharat Bill Payment System (BBPS) is an integrated bill payment platform operated by the National Payments Corporation of India (NPCI) under RBI oversight. It lets customers pay electricity, water, gas, and other bills through a single window.
For an NBFC, being a Bharat BillPay Operating Unit (BBOU) means following NPCI's technical and business rules. The compliance duty: ensure every transaction is secure, settled on time, and reported correctly.
Account Aggregator: consent is the compliance
The RBI's Account Aggregator (AA) framework is a data-sharing system. It lets a customer share financial data — from bank accounts, mutual funds, or NBFC loans — with another institution. The catch: the customer must give explicit, revocable consent for every single share.
For an NBFC, compliance means never pulling a customer's data without live consent. The consent can be withdrawn anytime, and the NBFC must stop using the data immediately.
NACH vs UPI e-mandate: the recurring payment rules
When an NBFC collects a recurring loan repayment, it uses either NACH or UPI e-mandate. Both are auto-debit systems, but they differ in limits.
NACH handles recurring payments of any amount. UPI e-mandate is capped at ₹15,000 per transaction for recurring debits. Compliance means knowing which system to use based on loan size, and getting the customer's signed mandate before the first debit.
🔭 The unseen angle: compliance is your cheapest loan
Most articles treat NBFC compliance as a cost. The smarter view: compliance is a funding advantage. Banks and mutual funds check an NBFC's compliance record before lending to it. A clean record means cheaper borrowing from the market. A penalty or regulatory warning raises your cost of funds instantly.
So the NBFC that files its CRILC report on time and updates KYC records diligently is not just avoiding fines — it is quietly lowering its own interest costs. That is the angle nobody writes about.
Questions people ask
A bank has a banking licence and can accept demand deposits (money you can withdraw anytime). An NBFC cannot accept demand deposits. Both can lend money, but only banks are part of the payment and settlement system directly.
Yes. Any company whose principal business is lending must register with the RBI under Section 45-IA of the RBI Act, 1934. Operating without registration is illegal and attracts penalties.
An NBFC with an asset size of ₹500 crore or more must report to CRILC. Within that, any borrower with total exposure of ₹5 crore or more must be reported, on a monthly basis.
UPI e-mandate for recurring payments is capped at ₹15,000 per transaction. For amounts above that, an NBFC would typically use NACH, which has no such cap.
A customer gives explicit consent to share their financial data from one institution to another. The consent is revocable anytime, and the receiving institution must stop using the data immediately upon withdrawal.