Reserve Bank of India (Small Finance Banks – Concurrent Audit) Directions, 2026
UR
- Applies toSmall finance banks
- StatusIn force
- RBI text changedRBI updated this document on October 01, 2026. BankPulse is re-reading it. BankPulse checked 34 points against RBI's new text on 21 October 2026. 33 stand. 1 are marked below and are being re-read.
- IssuedJul 31, 2026
- Amendmentsnone tracked
- Length34 points in 5 sections · 3 min read
The four dates on this rule
- PublishedJul 31, 2026The day RBI put this document out. This is the same day as the Issued date on this rule.
- Starts to applyJul 31, 2026The day this rule starts to apply, as RBI's own text states it.
- Time to get readyNoneIt starts to apply on the day it was published.
- Last date to actNot statedNo date to act by was found in this document. Other dates may sit inside single paragraphs.
Kept in your browser only. Your desk
Show me the points for
Nothing is removed from the page.
Show me the points about
30 of the 34 points name no product and bind every product. All products.
What it says
How firm is each point
Stated by RBI — RBI’s own paragraph says this. We have only made it plainer.
Our reading — BankPulse read RBI’s paragraph and shortened it. The paragraph is the authority, not this line.
Needs judgement — RBI leaves this to the bank to settle, so nobody can give you a fixed number here.
Chapter I. Preliminary
1. In force at once
These Directions came into effect immediately upon issuance.
2. Who is covered
These Directions apply to small finance banks.
Chapter II. Governance and Oversight
1. The committee approves scope
The board's audit committee must approve the detailed scope of the concurrent audit.
2. A yearly effectiveness review
Once a year the committee must review how well the audit system and the auditors work.
3. Tenure and pay upstairs
The audit committee fixes external auditors' maximum tenure and their pay.
Chapter III. Guidelines for Concurrent Audit
Must know
1. Risk areas never skipped
Areas the bank itself marks as risk sensitive must be covered.
2. Five years with the bank
An outside auditor may serve the bank at most five years in a row.
3. Three years per branch
No auditor stays with one branch or unit beyond three years.
BankPulse example. A concurrent auditor may stay with one branch for three years, and no longer. An auditor who starts in April 2024 moves on by April 2027. A retired staff member engaged as a concurrent auditor may not be over 70.
Do it
4. Random tests, large samples
Coverage must include random testing of a large enough sample of transactions.
5. Own staff must qualify
In house auditors must be experienced, trained, senior and independent of the unit they audit.
6. Accountability for own staff
A policy must fix accountability when the bank's own or retired staff slip seriously.
7. Pay matches the work
Pay must match the audit's scope, the skills, the staff and the time it needs.
8. Follow-up is priority
Head office must treat follow-up and rectification of audit findings as high priority.
Background
9. Audit head sets work
The internal audit head decides what work goes to the auditors, with the committee's prior approval.
10. Cash counted physically
Cash work is covered, including physically counting the cash.
11. Loans checked to end use
Loan work is covered end to end: securities, sanction powers, end use of funds and excess drawings.
12. KYC checks in scope
The audit covers KYC and anti money laundering work, including suspicious transaction reporting.
13. SWIFT messages watched
Remittances and bills are covered, including SWIFT messages and overdue purchased bills.
14. Housekeeping and ledgers
Housekeeping is covered: account reconciliation, control ledgers and internal account openings.
15. Treasury and foreign exchange
Treasury, non fund based business and foreign exchange all fall inside the audit.
16. Cards and mis-selling
Card business, employee conduct and product mis-selling are audited.
17. Processing centres covered
Every centralised processing centre, including those originating business, is covered.
18. A board approved policy
A board approved policy says whether the bank's own staff or outside auditors do the work.
19. Audit head picks auditors
When the work is outsourced, the internal audit head helps select the auditors and reviews their quality.
20. No board partner conflict
If a firm's partner sits on the bank's board, no partner of that firm may be its concurrent auditor.
21. A hearing before action
An external firm accused of serious lapses gets a hearing before any adverse action.
22. Proven lapses reported up
A proven lapse means cancellation and a report to the committee, RBI and the accountants' institute.
23. Retired staff up to seventy
Retired staff may work as concurrent auditors only up to age 70.
24. A structured reporting line
Findings arrive in a structured format the bank prescribes, under a committee approved reporting system.
25. Small fixes on the spot
Small irregularities are fixed on the spot; major ones go straight to head office.
26. A quarterly review upstairs
Every quarter the committee sees a review of what the audits found, zone by zone.
27. Fraud goes up at once
Detected fraud is reported at once to internal audit and the chief vigilance officer.
Chapter IV. Repeal and Other Provisions
1. Old guidance repealed
The earlier concurrent audit circulars for this kind of bank stand repealed.
2. Old actions stay governed
Action already taken under the old rules stays governed by them.
The same subject for other kinds of institution
The same subject for other kinds of institution.
Other RBI rules for small finance banks
RBI compliance officer and compliance function rules for small finance banks 2026
RBI credit bureau reporting rules for small finance banks 2025
RBI credit card and debit card rules for small finance banks 2025
RBI customer service and fair conduct rules for small finance banks 2025
Every rule page on BankPulse · Questions bankers ask, answered