Question 1

Which RBI rulebook actually governs our NBFC's compliance right now — and why can't we just follow last year's checklist?

Accepted Answer

As of 31 July 2026, NBFC supervisory returns are governed by the Reserve Bank of India (Non-Banking Financial Companies – Supervisory Returns) Directions, 2026 (RBI/DoS/2026-27/466) — not the 2024 Master Direction many consultants were still citing in mid-2026. That package, part of a 64-Direction RBI consolidation, sits on top of an earlier 28 November 2025 overhaul that broke the old Scale Based Regulation Master Direction (19 Oct 2023) into 34 separate, topic-wise 'Non-Banking Financial Companies – [Subject] Directions, 2025' covering Registration & SBR Framework, Governance, KYC, Credit Information Reporting, Asset Liability Management, and more — each with its own paragraph numbers. An NBFC still working off the 2023 SBR Master Direction or the 2024 Returns Master Direction is, by definition, working from a superseded document: not because the underlying idea of compliance changed, but because instrument names, section numbers, and several real thresholds (credit-bureau reporting frequency, Upper Layer criteria, ALM asset-size triggers) moved. Housing Finance Companies are governed separately and aren't covered by any of this.

Still Have Questions?

Talk to a dedicated CA or CS about your NBFC's exact obligations -- no generic checklist.

Get Free Compliance Assessment

or Call Now: +91 92895 67208

Question 2

Which RBI returns does our NBFC actually have to file, and on what portal?

Accepted Answer

Every applicable return is filed online on RBI's Centralised Information Management System (CIMS) — hard copy, courier, or email is treated as not submitted except as a stopgap when the portal itself is down. The full list runs to 20 returns, but most Base Layer NBFC-ICCs under ₹100 crore in assets really only file four: DNBS02 (quarterly, within 21 days), DNBS13 Overseas Investment (quarterly, a NIL return is mandatory even with zero overseas exposure), DNBS10 the Statutory Auditor's Certificate (annual, filed by your auditor, not you), and Form A on appointment of your statutory auditor. Cross into Middle Layer or past the ₹100 crore / ₹500 crore asset thresholds and DNBS01, DNBS03, the ALM returns DNBS04A/04B, the monthly CRILC return (still labelled DNBS08 on CIMS itself), and the weekly defaulted-borrower return DNBS09 come into play. We map the exact list to your layer and category in the free assessment rather than handing you a generic checklist.

Question 3

Besides filing returns ourselves, what RBI-facing paperwork does our statutory auditor have to handle?

Accepted Answer

Two things most NBFCs don't plan for. First, the Statutory Auditor Certificate (DNBS10) — your auditor files it on CIMS, due within 5 working days of signing the audit report and never later than 31 December of that year; the process now sits in the Reserve Bank of India (Non-Banking Financial Companies – Auditor's Report) Directions, 2026, which replaced the 2016 Directions of the same name. Second, Form A, a one-month-from-appointment intimation about your statutory auditor, under the 2026 Statutory Audit Directions — RBI's own returns list still calls it 'All NBFCs,' though a non-deposit-taking NBFC below ₹1,000 crore can continue its existing appointment procedure if it prefers. We coordinate both directly with your audit firm as part of the retainer.

Question 4

What is an NBFC's 'layer,' and why does it change what we actually have to do?

Accepted Answer

Every NBFC sits in Base, Middle, Upper, or (rarely) Top Layer, and the layer decides which returns, committees, and approvals actually bind you. The framework itself is now the Reserve Bank of India (Non-Banking Financial Companies – Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025 — not the 2023 Master Direction most checklists still cite. Base Layer is broadly non-deposit-taking NBFCs under ₹1,000 crore in assets; Middle Layer is every deposit-taking NBFC regardless of size, plus any non-deposit-taking NBFC at or above ₹1,000 crore. The detail that trips founders up: if your NBFC sits in a group with sister NBFCs, RBI consolidates the group's total NBFC assets to test the Middle Layer threshold — so a smaller NBFC-ICC can land in Middle Layer, with everything that implies for governance and returns, purely because of what its sister entities hold, even though it looks Base Layer standalone.

Question 5

We're a Base Layer NBFC-ICC — do we actually need an Audit Committee, a Chief Compliance Officer, or RBI-style lending caps?

Accepted Answer

No, not from RBI. Under the current Governance Directions, 2025, a Base Layer NBFC is bound only by Chapter III: at least one director with bank or NBFC experience, a Risk Management Committee (Board or executive level), and RBI's prior written approval before more than 30% of your directors change at once. The Audit Committee, Nomination & Remuneration Committee, Chief Compliance Officer, Chief Risk Officer, and ICAAP are all Middle-Layer-and-above requirements — and a Base Layer NBFC has no RBI-prescribed numeric single-party lending cap, only a Board-approved internal concentration policy. One honest caveat: the Companies Act, 2013 can independently require an Audit Committee or NRC once your paid-up capital or bank borrowings cross certain thresholds, regardless of your RBI layer — that's a separate trigger we check for every client rather than assume away.

Question 6

We're nowhere near a large NBFC — does the 'Upper Layer' classification matter to us at all?

Accepted Answer

Only as context, but RBI changed the test and it's worth knowing. Since mid-2026, Upper Layer is a flat ₹1,00,000 crore asset-size threshold identified annually by RBI, replacing the older scoring methodology and the old 'top ten NBFCs are always Upper Layer' rule. Once an NBFC is classified Upper Layer, it stays under the enhanced regime for at least five years even if its assets later drop below the line. For a Base or Middle Layer NBFC-ICC this is a non-event today — but it's the kind of detail that matters the moment a funding round or acquisition conversation puts real scale on the table.

Question 7

What are the core ongoing KYC/AML obligations every NBFC has to run, day to day?

Accepted Answer

Four building blocks. A Board-approved KYC policy naming a Designated Director (overall PMLA compliance) and a separate Principal Officer (who files reports and monitors transactions) — RBI's current KYC Directions, 2025 expressly bar nominating the same person as both. A system that reviews every customer's risk categorisation at least once every six months — the single most actively enforced KYC control point right now, as recent penalty orders show. Periodic KYC updation on a risk-based clock: every 2 years for high-risk customers, 8 years for medium-risk, 10 years for low-risk. And record retention on two different clocks, not one: transaction records for 5 years from the transaction date, customer identification records for 5 years after the relationship ends.

Question 8

Do we need to register with FIU-IND separately from RBI, and what's the real risk if we haven't gotten to it?

Accepted Answer

Yes — every NBFC is a 'reporting entity' under PMLA and must complete a three-stage registration (entity, then Principal Officer, then Designated Director) on FIU-IND's FINnet 2.0 portal before it can file a single report. This isn't theoretical: FIU-IND publishes a named, quarterly-reviewed list of non-compliant NBFCs — as on 28 February 2026 it showed roughly 3,910 of 8,560 Base Layer NBFCs and 102 of 564 Middle Layer NBFCs still unregistered, each listed by name, CIN and registered address. Beyond the reputational exposure, PMLA itself allows a penalty of ₹10,000 to ₹1,00,000 for each failure to comply — chargeable to the company, its Designated Director, or an employee personally, not a single capped fine.

Question 9

How often do we need to report to credit bureaus, and do we really have to be members of all four?

Accepted Answer

Yes — membership in all four RBI-registered Credit Information Companies (CRIF High Mark, Equifax, Experian, and TransUnion CIBIL) is mandatory for any NBFC with customer interface, with fees capped at ₹10,000 one-time and ₹5,000 annual per CIC. The bigger operational change: reporting is no longer fortnightly. With effect from 1 July 2026, you report on four reference dates a month — the 9th, 16th, and 23rd (incremental accounts only, within 4 calendar days) and the last day of the month (the full file, due by the 5th of the following month). A lot of compliance calendars still say 'fortnightly' — that regime ended 30 June 2026.

Question 10

What's the actual deadline for uploading a new customer's KYC to CKYC?

Accepted Answer

10 days — but the clock starts from commencement of the account-based relationship, not from when you finish KYC, a distinction a lot of checklists blur. Any later update to a customer's information has to reach CKYCR within 7 days. One relief worth knowing: since 29 December 2025, whichever regulated entity last uploaded or updated a customer's record in CKYCR is the one responsible for verifying that customer's identity and address — so if you're relying on a current, compliant CKYCR record, you don't have to re-verify it yourself, though you're still on the hook for every other part of your own due diligence.

Question 11

What actually happens if we miss an RBI return filing deadline?

Accepted Answer

There are two separate risks here, and they're not the same size. RBI's Supervisory Returns Directions set no fixed rupee fine for a late return — the stated consequence is only that RBI 'may take necessary action including imposition of a penalty/fine' under the RBI Act. In practice that's capped under Section 58G at up to ₹25,000 for a general default, or up to ₹10 lakh (or twice the amount involved, whichever is more, plus up to ₹1 lakh per day it continues) for a direction breach — and real NBFC penalty orders run small: recent cases we tracked range from about ₹2.70 lakh to ₹33.10 lakh, nothing like bank-scale fines. The consequence that actually hurts is supervisory, not monetary: RBI can order an NBFC to stop sanctioning and disbursing loans under Section 45L(1)(b) — it did exactly this to four NBFCs in October 2024 over pricing and asset-classification concerns, lifting each restriction only after the company proved remediation, over roughly six to twelve weeks. In the most serious cases, RBI has cancelled a Certificate of Registration outright for conduct failures, most recently in September 2025.

Question 12

What's the penalty exposure specifically for falling behind on KYC/AML compliance?

Accepted Answer

This is where RBI has actually been most active against NBFCs recently. On 14 August 2026 alone, RBI fined Fusion Finance Limited ₹2.70 lakh for not running the six-monthly KYC risk-categorisation review, and on 10 February 2026 it fined Navi Finserv Limited ₹3.80 lakh for contacting customers for recovery outside the permitted window. Both orders ran under Section 58G(1)(b) read with Section 58B(5)(aa) of the RBI Act — meaning a breach of any RBI KYC, Fair Practices, or Recovery Agents direction is, by itself, a penalisable default, separate from the PMLA exposure (₹10,000–₹1,00,000 per failure) that sits with FIU-IND. Neither order carries any right of appeal to a tribunal — the only statutory appeal in the RBI Act is against rejection or cancellation of your Certificate of Registration, not against a monetary penalty.

Question 13

How is ongoing NBFC compliance support priced — is there a flat fee?

Accepted Answer

There's no flat industry fee, and we won't invent one on a page about accuracy — your RBI category, layer, and return load drive the workload, so pricing has to follow it. Our NBFC Compliance engagement runs as an ongoing monthly or quarterly retainer, scoped to your specific NBFC category during a free compliance assessment before anything is quoted. A Base Layer NBFC-ICC filing four returns a year costs meaningfully less to support than a Middle Layer NBFC running CRILC, ALM, and a full governance stack — we'll tell you which one you actually are before we talk numbers.

Question 14

What does Bharat Cred's NBFC compliance service actually cover, month to month?

Accepted Answer

We run it as a standing function, not a once-a-year scramble: current RBI returns and filings on CIMS mapped to your layer and category (not a generic list), board and committee governance support, Fair Practices Code and KYC-AML policy updates as RBI's Directions get re-issued, statutory and internal audit coordination, and a compliance calendar tracking every return, renewal, and six-monthly review so nothing is left to memory. Engagement starts with a gap assessment against RBI's current Directions, then remediation of anything out of date, then ongoing management with regulatory-change monitoring — because as this year alone has shown, the instrument names and thresholds genuinely change underneath you. You get one dedicated point of contact backed by our in-house CA, CS, and legal team, rather than a filing inbox.

Question 15

Is Bharat Cred affiliated with RBI, and can you guarantee our licence, approval, or that we'll avoid penalties?

Accepted Answer

No on both counts, and we'd rather say so plainly than have you find out later. Bharat Cred Solutions Private Limited is a privately owned professional consulting firm — we are not affiliated with, endorsed by, or acting on behalf of RBI, the Ministry of Corporate Affairs, or any other government or regulatory authority. Every decision on a licence, registration, approval, or the outcome of an RBI inspection rests solely with RBI; no consultant can guarantee it, and anyone who tells you otherwise is the one to be wary of. What we commit to is running your compliance correctly and on time against the current Directions, and flagging risk early enough that you have a real chance to fix it before RBI does.

Obligation	Filed With	Applies To	Due	Source
DNBS04B — Structural Liquidity & Interest Rate Sensitivity (ALM)	RBI, Department of Supervision — via CIMS portal (cims.rbi.org.in)	(i) NBFC-UL; (ii) NBFC-ML except Standalone Primary Dealers; (iii) NBFC-BL with asset size ₹100 crore and above (solo or Group-consolidated) — excluding BL NBFCs with no public funds and no customer interface, NOFHCs, NBFC-P2P, NBFC-AA and Mortgage Guarantee Companies. Note: this return was HALF-YEARLY under the old NBS-ALM2/ALM3 framework — it is now MONTHLY.	Within 15 days of each month-end reference date (e.g. 31 Aug → due 15 Sep)	Source
CRILC-Main (NBFCs) — Central Repository of Information on Large Credits	RBI, Department of Supervision — via CIMS portal (still labelled "DNBS08" on CIMS and RBI's own List of Returns page)	(i) NBFC-UL except CICs; (ii) NBFC-ML except CICs; (iii) NBFC-BL that are ICC, MFI or Factor with asset size ₹500 crore and above (excluding BL NBFCs with no public funds/no customer interface). Every deposit-taking NBFC is Middle Layer by definition and therefore files CRILC irrespective of asset size.	Within 15 days of each month-end reference date; a NIL return is mandatory if no qualifying borrower (≥₹5 crore fund+non-fund exposure) exists that month	Source
Credit Information Reporting to CICs — month-end full file	All 4 RBI-registered Credit Information Companies: TransUnion CIBIL, CRIF High Mark, Experian, Equifax	All NBFCs that are "Credit Institutions" under the Credit Information Reporting Directions — NBFC-D, NBFC-ICC, NBFC-Factor, NBFC-MFI, NBFC-IFC, IDF-NBFC, HFC, NBFC-P2P, CIC — all layers.	Full file covering the last-day-of-month reference date must reach each CIC by the 5th day of the following month	Source
Credit Information Reporting to CICs — incremental updates (9th / 16th / 23rd)	All 4 RBI-registered Credit Information Companies: TransUnion CIBIL, CRIF High Mark, Experian, Equifax	Same Credit Institutions as above. Effective 1 July 2026 this replaced the earlier fortnightly cycle — fortnightly reporting is no longer correct.	Incremental-accounts file for each of the 9th, 16th and 23rd reference dates must reach each CIC within 4 calendar days of that date	Source
Cash Transaction Report (CTR)	Financial Intelligence Unit - India (FIU-IND)	All NBFCs registered as "reporting entities" under PMLA, all layers.	By the 15th of the month following the month in which the qualifying cash transactions occurred	Source
File monthly transaction report — high-value cash (>₹10L), connected cash series, NPO receipts (>₹10L), counterfeit-currency and cross-border wire transfers (>₹5L) [Rule 3(1) clauses A/B/BA/C/E]	Director, FIU-IND (filed by the Principal Officer)	All NBFCs as PMLA 'reporting entities'	By the 15th day of the succeeding month (Rule 8(1), PML Maintenance of Records Rules, 2005)	Source
Submit credit information to all 4 Credit Information Companies — incremental files on the 9th/16th/23rd plus a full file as on month-end	CRIF High Mark, Equifax, Experian and TransUnion CIBIL (all four registered CICs)	NBFC-D, NBFC-ICC, NBFC-Factor, NBFC-MFI, NBFC-IFC, IDF-NBFC, HFC, NBFC-P2P, CIC (excludes MGC, NBFC-AA, Standalone Primary Dealers, NOFHC and NBFCs without customer interface)	Incremental accounts within 4 calendar days of the 9th, 16th and 23rd; full file (all active + closed accounts) by the 5th day of the following month — regime effective 1 July 2026 (para 10(2), NBFC Credit Information Reporting Directions, 2025)	Source
GSTR-1 — outward supplies statement	GST Network (GSTN)	Every GST registration the NBFC holds — one set of returns per State, not one nationally.	11th of the following month for monthly filers; QRMP filers report via IFF for the first two months of the quarter instead.	Source
GSTR-3B — summary return and tax payment	GST Network (GSTN)	Every GST registration the NBFC holds.	20th of the following month for monthly filers; QRMP (quarterly) filers file by the 22nd or 24th of the month after the quarter, depending on the State.	Source
GSTR-6 — Input Service Distributor return (only once ISD-registered)	GST Network (GSTN)	Multi-State NBFCs with a head office that receives tax invoices for common third-party input services (audit, IT, advertising, rating-agency fees) on behalf of the NBFC's other State registrations — ISD registration has been MANDATORY for this scenario since 1 April 2025, not merely optional cross-charging.	Monthly, once ISD-registered.	Source

Obligation	Filed With	Applies To	Due	Source
DNBS02 — Important Financial Parameters (Base Layer)	RBI, Department of Supervision — via CIMS portal	Base Layer NBFCs — NBFC-ICC, NBFC-MFI, NBFC-Factor, NBFC-AA, NOFHC and Type I NBFCs — except NBFC-P2P Lending Platforms. (This return was ANNUAL under the old NBS-8/NBS-9 framework — it is now QUARTERLY.)	Within 21 days of quarter-end: 21 April / 21 July / 21 October / 21 January	Source
DNBS01 — Important Financial Parameters (Middle/Upper Layer)	RBI, Department of Supervision — via CIMS portal	Middle Layer and Upper Layer NBFCs — all deposit-taking NBFCs regardless of size, plus non-deposit-taking NBFCs with asset size ₹1,000 crore and above (solo or after Group consolidation). Not filed by Base Layer NBFCs, which file DNBS02 instead.	Within 21 days of quarter-end: 21 April / 21 July / 21 October / 21 January	Source
DNBS03 — Important Prudential Parameters (Middle/Upper Layer)	RBI, Department of Supervision — via CIMS portal	Middle Layer and Upper Layer NBFCs — same scope as DNBS01.	Within 21 days of quarter-end: 21 April / 21 July / 21 October / 21 January	Source
DNBS04A — Short Term Dynamic Liquidity (ALM)	RBI, Department of Supervision — via CIMS portal	(i) NBFC-UL; (ii) NBFC-ML except Standalone Primary Dealers; (iii) NBFC-BL with asset size ₹100 crore and above (solo or Group-consolidated) — excluding BL NBFCs with no public funds/no customer interface, NOFHCs, NBFC-P2P, NBFC-AA and Mortgage Guarantee Companies. Caution: RBI's own List of Returns web page still shows a ₹500 crore Base Layer trigger for this return — the binding 2026 Directions figure is ₹100 crore, and the conservative compliance position is to file from ₹100 crore.	Within 21 days of quarter-end: 21 April / 21 July / 21 October / 21 January	Source
DNBS13 — Statement on Overseas Investment (including NIL return)	RBI, Department of Supervision — via CIMS portal	Base Layer NBFCs, per the applicability column of para 21 of the 2026 Directions — filed even as a NIL return when the NBFC has no overseas investment.	Within 21 days of quarter-end: 21 April / 21 July / 21 October / 21 January	Source
CFSS implementation progress report	RBI — reported to the NBFC's Senior Supervisory Manager (SSM); not a CIMS return	NBFC-Upper Layer and NBFC-Middle Layer with 10 or more "fixed point service delivery units." Middle/Upper Layer NBFCs with fewer units, and all Base Layer NBFCs, may adopt CFSS voluntarily and sit outside this reporting duty.	Quarterly — the Directions do not prescribe a specific calendar day; confirm the cut-off with your SSM	Source
Nomination-coverage progress report (deposit accounts)	RBI — reported to the NBFC's Senior Supervisory Manager (SSM) via the DAKSH portal	Deposit-taking NBFCs (NBFC-D), excluding Housing Finance Companies.	Quarterly — the Directions do not prescribe a specific calendar day	Source
Board/RMC meets CRO privately (without MD&CEO)	Board / Risk Management Committee (internal governance record)	NBFC-ML and NBFC-UL with asset size above ₹5,000 crore (where the CRO reports to the MD&CEO)	At least once every quarter	Source
Board/ACB one-to-one meeting with CCO (without senior management)	Board / Audit Committee of the Board (internal)	NBFC-ML and NBFC-UL (where the CCO reports to the MD&CEO)	Quarterly	Source
Quarterly statement on change of directors + fit-and-proper certificate	RBI Department of Supervision, Regional Office (NHB for HFCs)	NBFC-ML and NBFC-UL (also NBFC-AA and NBFC-P2P, despite their Base Layer classification)	Within 15 days of the close of each quarter; the March-quarter statement must be auditor-certified	Source
Liquidity Coverage Ratio (LCR) website disclosure	Company website (public disclosure)	All deposit-taking NBFCs and non-deposit-taking NBFCs with asset size ₹5,000 crore and above (CICs covered, other than this LCR chapter)	Every quarter, on an ongoing basis	Source
Funding-concentration / liquidity-risk disclosure	Company website (public disclosure); also carried annually in the financial statements	Non-deposit-taking NBFCs with asset size ₹100 crore and above, CICs, and all deposit-taking NBFCs	Every quarter on the website; repeated annually in the financial statements	Source
IT Strategy Committee (ITSC) meeting — ML/UL/TL	Board (ITSC minutes placed before the Board)	NBFC-ML, NBFC-UL and NBFC-TL (excluding Core Investment Companies)	At least once every quarter	Source
IT Steering Committee meeting	Senior management IT Steering Committee (reports into the ITSC)	NBFC-ML, NBFC-UL and NBFC-TL (excluding Core Investment Companies)	Quarterly	Source
Board Meetings – minimum statutory cadence	Internal statutory record (Board Minutes Book, Section 173)	All NBFCs. The relaxed 2-meetings-per-year rule is available only to an OPC, small company, dormant company or start-up private company — treat it as unavailable unless small-company status is positively established.	At least 4 meetings per financial year, with no more than 120 days between consecutive meetings; first meeting within 30 days of incorporation.	Source
TDS Statements — Form 24Q/salary (renamed Form 138 from FY 2026-27) and Form 26Q/payments to residents other than salary (renamed Form 140 from FY 2026-27), filed under Rule 219 of the Income-tax Rules, 2026 from that year	Income Tax Department (TRACES / e-filing portal)	All NBFCs as deductors. NBFCs are heavy Form 140/26Q filers — interest, professional fees, DSA commission, rent, contractor payments. Periods up to March 2026 stay in the old 24Q/26Q format.	31 July, 31 October, 31 January and 31 May for Q1–Q4 respectively — the due dates are unchanged by the renumbering.	Source
Advance Tax instalments	Income Tax Department (e-payment; reconciled in the annual return, no separate return form)	All NBFC companies — no first-instalment exemption for companies.	15% cumulative by 15 June, 45% by 15 September, 75% by 15 December, 100% by 15 March.	Source

Obligation	Filed With	Applies To	Due	Source
IT Strategy Committee (ITSC) meeting — Base Layer ≥₹500cr	Board (ITSC minutes placed before the Board)	NBFC-BL with asset size ₹500 crore and above	Not more than six months between meetings	Source
Review and re-categorise customer risk ratings (low/medium/high)	Internal — Board-approved KYC policy (subject to RBI supervisory inspection)	All NBFCs with customer interface, every layer (Base/Middle/Upper/Top)	At least once every six months (para 41(1))	Source
MSME Form I – outstanding payments to micro/small enterprise suppliers beyond 45 days	Registrar of Companies (MCA, V3 portal)	Every NBFC that is a 'specified company' under Section 405 — i.e. has any payment to an MSE supplier outstanding beyond 45 days. NBFCs are not exempt; vendor payments (IT, valuation, collection agencies, facilities) routinely trigger it.	31 October (for the April–September half) and 30 April (for the October–March half).	Source

Obligation	Filed With	Applies To	Due	Source
DNBS10 — Statutory Auditor Certificate (SAC)	RBI, Department of Supervision — via CIMS portal, filed by the NBFC's Statutory Auditor using Super-User credentials the NBFC creates	All NBFCs — every layer and category, deposit-taking or not, regardless of asset size, including dormant Base Layer NBFCs.	Within 5 working days of the Statutory Auditor signing the audit report (Companies Act s.134); outer limit 31 December of the same calendar year, for FY ended 31 March	Source
Annual compliance risk assessment + compliance review to Board/ACB	Board / Audit Committee of the Board	NBFC-ML and NBFC-UL	Annually	Source
Internal audit quality assurance review + annual risk position to Board/ACB	Board / Audit Committee of the Board	All deposit-taking NBFCs; non-deposit-taking NBFCs with asset size ₹5,000 crore and above (and corresponding HFCs)	At least once a year	Source
Statutory auditor annual eligibility reconfirmation + performance review	Board / Audit Committee of the Board; serious lapses reported to RBI DoS	All NBFCs (non-deposit-taking NBFCs below ₹1,000 crore may continue their extant procedure instead)	Annually, each year of the 3-year term; serious lapses reported to DoS within two months of completing the annual audit	Source
Annual director fit-and-proper declaration (31 March)	Company records, scrutinised by the Nomination & Remuneration Committee	NBFC-ML and NBFC-UL	Annually, as on 31 March	Source
Annual disclosures in financial statements	Annexed to the balance sheet under the Companies Act, 2013	All NBFCs for the base (C.1) disclosures (customer complaints, loans to directors/senior officers); NBFC-ML and NBFC-UL additionally for the C.2 disclosures (CRAR, Tier 1/Tier 2 ratios, etc.)	Annually, with the financial statements	Source
Dividend-declaration eligibility check	Board of Directors (internal); no RBI filing needed if criteria are met	All NBFCs, in any year dividend is proposed to be declared	Annually, at the time of declaring dividend	Source
Internal audit of Internal Ombudsman mechanism	Internal Audit Department report to the Board/ACB	Deposit-taking NBFCs with 10 or more branches; non-deposit-taking NBFCs with asset size ₹5,000 crore and above and public customer interface (as on 31 March 2025, or 6 months after later meeting these criteria)	Annually	Source
File Form 61B (FATCA/CRS statement) or a NIL report	Income Tax Department e-filing portal, digitally signed by the Designated Director	ONLY NBFCs that qualify as a 'Reporting Financial Institution' under Income-tax Rule 114F (custodial/depository institution, investment entity, or specified insurance company) — not every NBFC. Every NBFC must still determine and document this status (para 64, NBFC KYC Directions, 2025)	By 31 May following the calendar year reported (Rule 114G(8), Income-tax Rules, 1962)	Source
Pay annual membership fee to each Credit Information Company	Each of the 4 CICs	Credit institutions required to hold CIC membership (same scope as the monthly CIC reporting row above)	Annual; fee capped at ₹5,000 per CIC (para 8, NBFC Credit Information Reporting Directions, 2025)	Source
AOC-4 – Financial Statements (or AOC-4 NBFC (Ind AS) / AOC-4 CFS NBFC (Ind AS) if the NBFC is above the Ind AS net-worth thresholds; NBFCs are exempt from XBRL filing regardless of which form applies — do not list 'AOC-4 XBRL')	Registrar of Companies (MCA21 V3 portal)	All NBFCs incorporated as companies, all layers. Ind AS forms apply only above ₹500cr net worth (Phase I) / ₹250cr (Phase II, unlisted); an NBFC below that threshold files the ordinary AOC-4 and cannot voluntarily early-adopt Ind AS.	Within 30 days of the AGM date (e.g., AGM 30 Sep 2026 → AOC-4 due 30 Oct 2026). If financial statements are NOT adopted at the AGM, the unadopted statements must still be filed within 30 days of the AGM, with the adopted version re-filed within 30 days of the adjourned AGM — the 180-days-from-FY-end rule many pages quote is an OPC-only proviso and never applies to an NBFC.	Source
MGT-7 – Annual Return (MGT-7A only if the company genuinely qualifies as a 'small company' under the revised ₹10cr capital/₹100cr turnover test effective 1 Dec 2025 — whether an RBI-registered NBFC counts as 'governed by a special Act' and is therefore excluded from that test is unresolved, so file MGT-7 unless this is confirmed for your entity)	Registrar of Companies (MCA21 V3 portal)	All NBFCs that are not OPCs. Small-company MGT-7A eligibility for RBI-registered NBFCs is a genuinely open legal question, not a settled exemption.	Within 60 days of the AGM (e.g., AGM 30 Sep 2026 → MGT-7 due 29 Nov 2026). Where no AGM is held, the 60 days run from the date it should have been held, with reasons stated.	Source
MGT-8 – Annual Return certification by a Company Secretary in practice	Annexed to MGT-7 on the Registrar of Companies (MCA) portal	Listed NBFCs, OR any NBFC with paid-up share capital ≥ ₹10 crore, OR turnover ≥ ₹50 crore (any one limb triggers it — the RBI net-owned-fund glide path pushes many growing Base Layer NBFC-ICCs past the capital limb even when previously exempt).	Certified and filed together with MGT-7 — i.e., within 60 days of the AGM.	Source
ADT-1 – Intimation of statutory auditor appointment/re-appointment	Registrar of Companies (MCA)	All NBFCs — on every AGM re-appointment and on any casual-vacancy appointment.	Within 15 days of the meeting (AGM or board meeting) at which the auditor is appointed or re-appointed.	Source
CSR-2 – CSR reporting, filed separately after AOC-4 (no longer an AOC-4 addendum)	Registrar of Companies (MCA, V3 portal)	Only an NBFC covered by Section 135(1): net worth ≥ ₹500 crore, OR turnover ≥ ₹1,000 crore, OR net profit ≥ ₹5 crore in the immediately preceding FY. Many profitable Middle Layer NBFCs are caught by the ₹5 crore net-profit limb alone even with modest turnover.	Fixed year-by-year by MCA notification, filed after AOC-4 is filed. FY 2024-25 was due 31 December 2025; a date for FY 2025-26 has not yet been notified (do not assume 31 December repeats).	Source
Annual General Meeting (AGM) — drives the AOC-4 and MGT-7 filing clocks	Statutory meeting of members (Section 96) — not itself a filing, but its date sets the AOC-4/MGT-7 due dates	All NBFCs. No NBFC-specific extension exists.	First AGM within 9 months of the close of the first FY; every later AGM within 6 months of FY close, with no more than 15 months between two AGMs. For FY 2025-26 (year-end 31 March 2026), AGM is due by 30 September 2026.	Source
Secretarial Audit Report (Form MR-3)	Annexed to the Board's Report under Section 134(3) — not separately e-filed	Every listed NBFC; every public-company NBFC with paid-up capital ≥ ₹50 crore or turnover ≥ ₹250 crore; and any NBFC (private or public) with outstanding loans/borrowings from banks or public financial institutions ≥ ₹100 crore — a large share of Middle Layer lenders.	Annual, prepared ahead of and annexed to the Board's Report that accompanies the AGM notice.	Source
Tax Audit Report — Form 3CA/3CB-3CD for FY 2025-26 (AY 2026-27)	Income Tax Department (e-filing portal), under Section 44AB of the Income-tax Act, 1961	All NBFC companies subject to tax audit. Income earned up to 31 March 2026 is governed by the 1961 Act regardless of the new Income-tax Act, 2025 coming into force on 1 April 2026.	30 September 2026 — this is the statutory date; CBDT has extended tax-audit deadlines in several recent years, so confirm nearer the date rather than treating 30 September as immovable.	Source
Tax Audit Report — consolidated Form No. 26 (replaces Forms 3CA, 3CB and 3CD) under Section 63, Income-tax Act 2025	Income Tax Department (e-filing portal)	All NBFCs subject to tax audit, for tax years commencing on or after 1 April 2026 (i.e., first applies to FY 2026-27, NOT FY 2025-26 — a page saying only 'Form 26' for the current audit cycle would be wrong).	One month before the return due date: 30 September where the ITR due date is 31 October; 31 October where the ITR due date is 30 November (transfer-pricing cases).	Source
Income Tax Return — Form ITR-6 for FY 2025-26 (AY 2026-27)	Income Tax Department (e-filing portal)	All NBFC companies. ITR-6 was notified 30 March 2026 with a corrigendum on 10 April 2026.	31 October 2026; 30 November 2026 if transfer-pricing provisions (Section 92E) apply.	Source
GSTR-9 (Annual Return) and GSTR-9C (Reconciliation Statement)	GST Network (GSTN), per GSTIN	GSTR-9 is mandatory above ₹2 crore aggregate turnover (PAN-wide, exemption below that renewed by annual notification); GSTR-9C above ₹5 crore. A multi-State NBFC is usually above both and files in every State where it is registered.	31 December following the financial year.	Source
FLA Return — Annual Return on Foreign Liabilities and Assets	RBI, via the FLAIR portal	Any NBFC that has received FDI (inward) or made overseas direct investment in the current or any previous year and still has outstanding foreign assets or liabilities.	15 July each year, reporting position as at 31 March. If audited accounts are not ready, file on provisional/unaudited figures by the due date and submit a revised return after audit — do not wait past 15 July for audited numbers.	Source

Obligation	Filed With	Applies To	Due	Source
Form A Certificate — Statutory Central Auditor / Statutory Auditor appointment	RBI, Department of Supervision — Central Office (Mumbai Region NBFCs) or the jurisdictional Regional Office (all other NBFCs); submission mode is hard copy/digital, not CIMS	Listed as "All NBFCs" in the 2026 Supervisory Returns Directions, triggered on every appointment or reappointment of a Statutory Central Auditor/Statutory Auditor (SCA/SA); a non-deposit-taking NBFC with asset size below ₹1,000 crore may instead continue its existing auditor-appointment procedure under the RBI (NBFC – Statutory Audit) Directions, 2026.	Within one month of the date of appointment (or reappointment) of the SCA/SA	Source
Fraud Monitoring Return (FMR)	RBI, Department of Supervision — via CIMS portal	NBFC-Upper Layer; NBFC-Middle Layer; NBFC-Base Layer with asset size ₹500 crore and above.	Within 14 days of the Fraud Classification Date (the date due approval for classification is obtained) — not the date of detection, and not subject to any amount threshold	Source
CKYC upload / update to the Central KYC Records Registry (CKYCR)	Central KYC Records Registry, operated by CERSAI (ckycindia.in)	All NBFCs subject to the RBI (NBFC – KYC) Directions, 2025 — individual accounts opened on/after 1 April 2017 and Legal Entity accounts opened on/after 1 April 2021, all layers.	New customer: within 10 days of commencement of the account-based relationship (not from completion of KYC). Updated KYC information on an existing customer: within 7 days of obtaining it.	Source
Suspicious Transaction Report (STR)	Financial Intelligence Unit - India (FIU-IND)	All NBFCs registered as "reporting entities" under PMLA, all layers.	Within 7 days of concluding/forming the opinion that a transaction (or pattern) is suspicious	Source
Registration of security interest with CERSAI	Central Registry of Securitisation Asset Reconstruction and Security Interest of India (CERSAI)	NBFCs that take security interest over borrower assets under SARFAESI (e.g. secured-lending NBFC-ICCs, HFCs).	Typically within 30 days of creation, modification or satisfaction of the security interest, with a further condonation window available on additional fee	Source
NOF glide path — final ₹10 crore milestone	RBI — condition of retaining the Certificate of Registration	Existing NBFC-ICC, NBFC-MFI and NBFC-Factor not yet at ₹10 crore Net Owned Fund	By 31 March 2027 (the intermediate ₹5cr/₹7cr milestone of 31 March 2025 has already passed)	Source
Mandatory stock-exchange listing (UL)	Stock exchange listing process; pre-listing disclosures per a Board-approved policy	NBFC-UL (not applicable to an NBFC-UL fully owned and controlled by Government)	Within three years of identification in the Upper Layer	Source
Report 26%+ shareholding trigger (buyback/capital reduction)	RBI (NHB for HFCs)	Any NBFC (HFC via NHB) where shareholding crosses 26% solely due to a buyback of shares or a court-approved capital reduction	Within one month of occurrence	Source
Update Digital Lending App (DLA) list on CIMS	RBI Centralised Information Management System (CIMS) portal, certified by the CCO or another Board-designated official	NBFC-D, NBFC-ICC, NBFC-Factor, NBFC-MFI, NBFC-IFC, IDF-NBFC and HFC engaged in digital lending (partially, NBFC-P2P); not applicable to MGC, NBFC-AA, SPD, NOFHC or Type I NBFC	As and when a Digital Lending App is deployed, joined, or an engagement ceases	Source
Periodic KYC updation / re-verification per customer (PAN re-verified against issuing authority database)	Internal customer file	All NBFCs with customer interface — cadence set by the customer's risk category, not a single calendar date	High risk: every 2 years; Medium risk: every 8 years; Low risk: every 10 years, counted from account opening or last KYC updation (para 42(1))	Source
File a Suspicious Transaction Report (STR)	Director, FIU-IND (filed by the Principal Officer)	All NBFCs as PMLA 'reporting entities'	Promptly, and not later than 7 working days from being satisfied the transaction is suspicious (Rule 8(2); FIU-IND FAQ)	Source
Upload a new customer's KYC records to CKYCR	Central KYC Records Registry (CKYCR / CERSAI)	All NBFCs with customer interface, every new account-based relationship	Within 10 days of commencement of the account-based relationship (Rule 9(1A) PML Rules; para 63(1) NBFC KYC Directions, 2025)	Source
Furnish updated/additional customer KYC information to CKYCR	Central KYC Records Registry (CKYCR / CERSAI)	All NBFCs with customer interface	Within 7 days of obtaining additional or updated customer information (Rule 9 PML Rules; para 63(7))	Source
Register creation, modification or satisfaction of a security interest	CERSAI (Central Registry)	NBFCs notified as 'secured creditor' financial institutions under SARFAESI s.2(1)(m)(iv) — per S.O. 856(E) dated 24 Feb 2020, generally NBFCs with asset size ≥ ₹100 crore; confirm your entity's notified status before relying on this	Within 30 days of the transaction; condonable for a further 30 days on payment of additional fee (Rule 5, SARFAESI Central Registry Rules, 2011)	Source
Communicate the Designated Director's name, designation, address and contact details	FIU-IND and RBI	All NBFCs with customer interface	On appointment, and on any change (para 14, NBFC KYC Directions, 2025) — neither the Directions nor PML Rule 7(1) sets a fixed day-count	Source
Communicate the Principal Officer's name, designation, address and contact details	FIU-IND and RBI	All NBFCs with customer interface	On appointment, and on any change (para 15, NBFC KYC Directions, 2025)	Source
Complete three-stage FINnet 2.0 registration (entity → Principal Officer → Designated Director)	FIU-IND FINnet 2.0 portal	All NBFCs as PMLA 'reporting entities' — one-time per entity; re-done whenever the Principal Officer or Designated Director changes	Must be completed (all three stages) before any PMLA reporting can begin	Source
Issue periodic-KYC-updation advance intimations and post-due reminders to each customer	Customer (with internal audit-trail logging against each customer record)	All NBFCs with customer interface	At least 3 advance intimations before the due date and at least 3 reminders after (each set including ≥1 letter); control required to be operational since 1 January 2026 (para 42(7), NBFC KYC Directions, 2025)	Source
DIR-3 KYC (DIR-3-KYC-Web) – director KYC. No longer an annual filing.	MCA (Central Government, DIN database)	Every individual holding a DIN, including every director of an NBFC.	Once every 3 consecutive financial years, on or before 30 June of the year following the third FY (next general cycle due 30 June 2028 for directors current on KYC). A change of mobile number, email or address must still be reported separately within 30 days and does NOT reset the 3-year cycle; a lapsed DIN is reactivated on filing with a ₹5,000 fee.	Source
Event-based ROC filings — DIR-12 (director appointment/resignation/change), INC-22 (registered office change), SH-7 (increase in authorised capital), PAS-3 (return of allotment), MGT-14 (specified board/shareholder resolutions), BEN-2 (significant beneficial ownership)	Registrar of Companies (MCA)	All NBFCs, triggered by the underlying corporate event.	DIR-12, INC-22 and SH-7: within 30 days of the event. PAS-3: within 30 days for a public allotment, but within 15 days for a private placement under Section 42 — the route NBFC capital raises almost always use, making 15 days the number that matters in practice.	Source
Form 145 (remitter's declaration) and Form 146 (accountant's certificate) for foreign remittances — replace Forms 15CA/15CB for remittances made on or after 1 April 2026	Income Tax Department (e-filing portal), before the remittance is processed via the Authorised Dealer bank	Any NBFC making foreign remittances — ECB interest, foreign consultancy, software/data licences, royalty, group-service charges. Form 146 is generally required where taxable remittances exceed ₹5 lakh in the year and no Assessing Officer certificate is obtained.	Filed before each qualifying remittance (event-based, not calendar-based).	Source
Form FC-GPR — reporting of equity-instrument issuance to a person resident outside India	RBI, via the FIRMS portal (through the AD Category-I bank)	Every NBFC with foreign shareholders, on every allotment to a non-resident.	Within 30 days of the date of issue of the equity instruments. Runs in parallel with PAS-3 under the Companies Act (30 days for a public allotment / 15 days for a private placement) — two filings, two portals, two clocks.	Source
Form FC-TRS — reporting of transfer of capital instruments between a resident and a non-resident	RBI, via the FIRMS portal (through the AD Category-I bank)	Any share transfer in an NBFC involving a non-resident on either side, including secondary sales in a change-of-control transaction.	Within 60 days of the transfer of capital instruments, or of receipt/remittance of the consideration, whichever is earlier.	Source
Form ECB-2 — External Commercial Borrowings reporting (now event-based, not a routine monthly filing, following the 16 February 2026 ECB framework reform)	RBI, via the AD Category-I bank	NBFCs with outstanding or new External Commercial Borrowings.	Within 7 calendar days from the end of the month in which a drawdown or debt-servicing event actually occurs — no filing is due for a month with no such event. This replaces the pre-2026 routine monthly filing (which ran 7 working days after month-end regardless of activity).	Source

NBFC Compliance Help, From People Who Track Every RBI Rule Change

Get Your Free NBFC Compliance Assessment

Two Rulebook Rewrites in Nine Months — Is Your Compliance Current?

28 Nov 2025

31 Jul 2026

Your risk

Base, Middle, or Upper Layer — Your Obligations Aren't the Same

Base Layer

Middle Layer

Upper Layer

What a Compliance Engagement With Us Actually Covers

Returns & filings

Governance & policy

KYC/AML & registries

One point of contact

What Happens After You Submit the Form Below

1. You tell us your layer & category

2. We map your actual obligations

3. You get a straight answer

A Downloaded Compliance Calendar Can't Track a Rulebook RBI Just Rewrote Twice

A PDF

Bharat Cred managed compliance

Every Recurring NBFC Compliance Obligation, With Its Real Source

Monthly (10)

Quarterly (17)

Half-yearly (3)

Annual (22)

Event-based (24)

Real RBI Enforcement Actions Against NBFCs

Compliance Support Scoped to Your NBFC

Compliance Starter

Compliance Management

Upper Layer & Specialized NBFC

Frequently Asked Questions

Still Have Questions?

Get Your Free NBFC Compliance Assessment

Regulatory Sources (92)