What changed
RBI extended the Risk-Based Internal Audit (RBIA) mandate to all deposit-taking NBFCs regardless of size, non-deposit NBFCs (including CICs) with asset size of ₹5,000 crore and above, and UCBs with asset size of ₹500 crore and above. These entities must implement RBIA by March 31, 2022, following the guidelines in the annex to the circular. A committee of senior executives must be formed to plan the transition and report progress to the board.
What it means for you
Banks and lenders now have a uniform internal audit standard across similar financial intermediaries, reducing inconsistencies and gaps. NBFCs and UCBs must overhaul their audit processes to be risk-focused, requiring investment in skilled resources and technology. The move enhances supervisory comfort and strengthens governance, but compliance costs and change management will be significant for affected entities.
What you must do
- Form a committee of senior executives to draft an action plan for RBIA implementation by March 31, 2022.
- Review and align your internal audit policy with the RBIA guidelines provided in the annex.
- Ensure the board oversees the transition and receives periodic progress reports from the committee.
- Place this circular before the board at its next meeting for formal acknowledgment.
- Assess current audit resources and professional competence gaps to meet RBIA requirements.
Who it affects
All deposit-taking NBFCs (any size), Non-deposit taking NBFCs (including Core Investment Companies) with asset size ≥₹5,000 crore, Primary (Urban) Co-operative Banks with asset size ≥₹500 crore, Boards and senior management of these entities, Internal audit departments and committees
What is the deadline for implementing RBIA?
The deadline is March 31, 2022, as per the circular dated February 3, 2021.
Which NBFCs are covered under this mandate?
All deposit-taking NBFCs (any size) and non-deposit taking NBFCs (including Core Investment Companies) with asset size of ₹5,000 crore and above are covered.
Do UCBs with assets below ₹500 crore need to comply?
No, only UCBs with asset size of ₹500 crore and above are required to implement RBIA as per this circular.