Reserve Bank of India (Non-Banking Financial Companies - Compliance Function) Directions, 2026

1. Sized to the lender

The rules are minimum standards; the compliance setup must match the lender's size, risk and structure.

1. In force at once

These rules came into force on the day they were issued.

2. Who is covered

These rules bind finance companies in the middle and upper layers of RBI's scale-based framework.

3. What compliance risk is

Compliance risk is the punishment, money loss, or lost trust a lender faces for breaking the rules.

1. The board sets the policy

The board or its audit committee must put a compliance policy in place and set how often risk is reviewed.

BankPulse example. A written compliance policy sitting in a drawer is not enough. The board must ensure an appropriate compliance policy is put in place and implemented. Implemented is the word that does the work.

2. A yearly risk check

Management must assess the main compliance risks every year and prepare a plan to manage them.

3. The annual review's contents

The yearly review must cover failures, losses, regulatory action, new rules, and the steps taken.

BankPulse example. A year with no compliance failures still needs the review written. Where there were failures, the review carries the losses, any regulatory action, and the steps taken to avoid recurrence. Listing the failure without the remedy is half a review.

1. New products watched

Every new product gets intensive compliance monitoring for at least its first six months.

BankPulse example. A bank launches a new deposit product in April. Compliance watches it closely until October, which is six months. The intensive monitoring runs from introduction, not from the first complaint.

2. Strict observance

The function must ensure strict observance of every statutory and regulatory requirement.

3. Free to structure

The company may shape its own compliance structure, but the function must stay independent and well resourced.

4. Other duties allowed

Compliance staff may take on some other duties, but only where no conflict of interest arises.

BankPulse example. A small bank asks its compliance staff to help with training. That is allowed. Some other duties may be assigned, provided no conflict of interest arises. Asking the same person to run the business they must check is not allowed.

5. Skills and succession

The team needs staff who know the rules, law, accounts, risk and technology, with succession planned.

6. The central role

The function plays the central role in finding the level of compliance risk in the organisation.

BankPulse example. Two departments disagree about how much compliance risk a new process carries. The compliance function plays the central role in identifying the level of compliance risk in the organisation. It is not one voice among several.

7. Audited itself

Compliance risk joins the internal audit framework, and the function itself is audited regularly.

BankPulse example. The compliance function checks everyone else. It is checked too. Compliance risk sits in the internal audit risk assessment framework, and the function is subject to regular internal audit.

1. A three year term

The officer serves a fixed minimum tenure of not less than three years.

2. One year relaxation

In exceptional cases the board may relax the term by one year, with succession planned.

BankPulse example. The board may relax the minimum tenure by one year, and no more. It may do so only where succession planning is already in place. A relaxation of two years is not available to it.

3. A clean record

The officer must have a clean track record and unquestionable integrity.

4. Tell RBI first

RBI must be told in advance of any appointment, early transfer, resignation or removal, with a fit and proper certificate.

5. Chosen by committee

A board committee recommends the chief compliance officer; the board decides, and outside hiring is allowed.

BankPulse example. The chief executive cannot simply name the chief compliance officer. A committee constituted by the Board recommends, and the board decides. Hiring from outside the bank is open to it.

6. Hard to remove

Removing the officer early needs rare grounds and the board's clear prior approval.

BankPulse example. A chief compliance officer who reports an uncomfortable finding cannot be moved out quietly. Removal before the term ends needs exceptional circumstances and the explicit prior approval of the board. It also needs a well-defined and transparent internal administrative procedure.

7. Rank can relax once

The officer sits within two levels of the chief; middle layer companies may relax this by one more level.

8. Direct line to RBI

The officer has the freedom and authority to deal with the regulators directly.

9. A private quarterly meeting

If the officer reports to the chief, the board meets the officer alone every quarter.

10. No business ties

The officer reports to no business vertical, and the board reviews the officer's appraisal.

11. One hat only

No dual hatting: the officer takes no role that conflicts with compliance work.

1. One dashboard

Workflow tools must track compliance and give management one dashboard view of the whole lender.

1. What it replaces

Earlier compliance circulars for this class of lender stand repealed by these Directions.