NBFC Regulations in India: Legal Obligations and Licensing Requirements

Non-Banking Financial Companies (NBFCs) play an important role in India’s financial system by providing loans, financing, investment and other financial services outside the traditional banking sector. However, an entity cannot simply begin carrying on regulated financial activities and operate as an NBFC without meeting the applicable regulatory requirements.

The Reserve Bank of India (RBI) is the principal regulator for NBFCs and has established a comprehensive regulatory framework covering registration, capital adequacy, governance, lending practices, KYC, anti-money laundering, customer protection and ongoing reporting. The regulatory requirements can vary depending on the nature, size, activities and systemic importance of the NBFC.

For businesses planning to establish an NBFC, understanding the licensing process and continuing legal obligations is therefore essential.

What Is an NBFC in India?

An NBFC is a company engaged principally in financial activities such as lending, financing, investment or other activities specified under the applicable regulatory framework. Unlike banks, NBFCs generally cannot perform all banking functions, particularly those involving demand deposits and payment systems.

NBFCs are incorporated under company law but are also subject to RBI regulation when they fall within the statutory definition and regulatory framework applicable to NBFCs.

The distinction is important because incorporating a company does not, by itself, give the company permission to conduct regulated NBFC business. A business intending to undertake activities requiring RBI registration must satisfy the applicable conditions and obtain the required Certificate of Registration (CoR).

NBFC vs Bank: What Is the Difference?

Banks and NBFCs both provide financial services, but their regulatory permissions and business models differ.

Banks can generally accept demand deposits and participate directly in payment and settlement systems, subject to applicable banking regulations. NBFCs operate under a separate regulatory framework and their ability to accept deposits, if any, depends on their specific regulatory status and RBI permission.

This distinction is particularly important for fintech and lending businesses that may assume that offering loans automatically makes them an NBFC. A company may provide technology or intermediary services to lenders without itself being an NBFC, depending on the structure and substance of its activities.

Who Needs an NBFC Licence in India?

Businesses that principally carry out activities falling within the regulated financial business framework may need RBI registration as an NBFC.

The requirement depends on the company’s actual activities, financial assets, income and applicable statutory and regulatory conditions. Businesses involved in lending, financing, investment and certain specialised financial activities should therefore assess their regulatory position before commencing operations.

When RBI Registration Becomes Necessary

A company generally needs to examine whether its principal business involves financial activity covered by the RBI’s NBFC framework. The assessment is not based solely on what the company calls itself; the nature of its business and financial activities is critical.

Companies intending to operate a lending or financing business should establish their regulatory classification before launching the business model, raising funds or dealing with customers.

Businesses That May Fall Within the NBFC Framework

Depending on their activities and regulatory classification, the NBFC framework can cover businesses such as loan companies, investment companies, asset finance companies, microfinance institutions, factoring companies, infrastructure finance entities and certain specialised financial platforms.

The RBI also has specific regulatory frameworks for activities such as peer-to-peer lending and account aggregation. Consequently, a business should determine the precise regulatory category applicable to it rather than assuming that all NBFCs follow identical rules.

Businesses That May Not Require an NBFC CoR

Not every company involved in financial services requires an NBFC licence. Certain entities and activities may fall outside the NBFC framework or qualify for specific exemptions.

For this reason, businesses should assess their proposed activities against the applicable RBI directions and statutory provisions before concluding that registration is unnecessary.

Types and Categories of NBFCs Under RBI’s Scale-Based Regulation

The RBI follows a Scale Based Regulation (SBR) framework under which NBFCs are organised into four regulatory layers: Base Layer, Middle Layer, Upper Layer and Top Layer.

Base Layer

The Base Layer generally covers smaller and lower-risk NBFCs that fall within the relevant regulatory criteria. These entities remain subject to important requirements concerning capital, governance, customer protection, reporting and prudential management.

Middle Layer

The Middle Layer covers larger NBFCs and entities carrying out particular regulated activities. These companies are subject to enhanced prudential, governance and risk-management requirements.

Upper Layer

The Upper Layer is intended for NBFCs that present greater systemic significance or risk. Entities placed in this layer face additional regulatory and governance requirements because problems at such institutions can have a wider impact on the financial system.

Top Layer

The Top Layer is intended for exceptional circumstances involving NBFCs that present significant systemic risk. RBI’s scale-based approach allows regulatory requirements to increase in proportion to an institution’s size, complexity and potential impact.

NBFC Licensing Requirements in India

Obtaining an RBI Certificate of Registration is a key requirement for a company that falls within the applicable NBFC regulatory framework.

Incorporation of the Company

The proposed NBFC must first be incorporated as a company under the Companies Act, 2013. Its constitutional documents and proposed objects should appropriately reflect the intended financial activities.

The company’s ownership, management structure and proposed business model should also be carefully designed before the RBI application is submitted.

Minimum Net Owned Fund Requirement

An applicant must satisfy the applicable minimum Net Owned Fund (NOF) requirement prescribed by the RBI for its category.

NOF broadly represents the company’s eligible owned funds after taking into account deductions and adjustments prescribed by the regulatory framework. The applicable requirement can differ according to the type of NBFC and relevant regulatory provisions.

Because RBI requirements can be amended, applicants should verify the current NOF requirement applicable to their proposed category before filing an application.

Fit and Proper Management and Promoters

The RBI examines the background and suitability of promoters, directors and management. Relevant considerations can include financial standing, professional experience, integrity, regulatory history and the ability to operate the proposed financial business responsibly.

Applicants should therefore establish appropriate governance and management structures rather than treating registration as merely an administrative filing.

Business Plan and Financial Projections

A credible business plan is important when establishing an NBFC. It should explain the proposed financial activities, target customers, funding strategy, risk-management approach, expected revenues and projected financial position.

The applicant should also demonstrate that it has appropriate systems, controls and personnel to comply with applicable regulatory requirements.

Application for RBI Certificate of Registration

The general process involves incorporating the company, meeting applicable capital requirements, preparing corporate and financial documentation and submitting the prescribed application to the RBI.

The RBI may assess the applicant’s ownership, management, financial position, proposed activities and compliance capabilities before deciding whether to grant the Certificate of Registration.

Importantly, company incorporation and RBI registration are separate steps. A company should not assume that incorporation itself authorises it to conduct regulated NBFC activities.

Documents Required for NBFC Registration

The exact documentation depends on the proposed NBFC category and RBI requirements, but applicants should generally be prepared to provide corporate, financial, management and business information.

Corporate Documents

These can include the Certificate of Incorporation, Memorandum and Articles of Association, registered-office information and relevant board resolutions.

Promoter and Director Information

Information relating to promoters and directors may include identity documents, professional profiles, financial information, declarations and other details required for assessing their suitability.

Financial and Business Documents

Applicants may need financial statements, evidence relating to capital and net worth, bank information, source-of-funds documentation, business plans and financial projections.

Compliance and Governance Documents

Depending on the proposed activities, applicants should also establish appropriate KYC, AML, risk-management, internal-control and customer grievance frameworks.

Key Legal and Regulatory Obligations of NBFCs

RBI registration is not a one-time compliance exercise. An NBFC must continue meeting applicable regulatory requirements throughout its operations.

Capital Adequacy and Prudential Norms

NBFCs must maintain applicable capital and prudential requirements. Depending on the regulatory category, these can cover capital adequacy, leverage, provisioning, asset classification and other financial safeguards.

Income Recognition and Provisioning

NBFCs must appropriately classify assets and recognise income in accordance with applicable RBI requirements. Correct provisioning is particularly important because it ensures that financial statements reflect the quality and recoverability of the institution’s assets.

Exposure and Concentration Limits

Applicable RBI regulations may restrict the extent to which an NBFC can be exposed to an individual borrower, group or particular investment. These limits are designed to prevent excessive concentration of risk.

Governance and Board Responsibilities

The board and senior management have an important role in ensuring regulatory compliance. Depending on the NBFC’s category, governance requirements can include risk-management systems, internal audit, compliance functions, internal controls and board-level oversight.

KYC, AML and Customer Due Diligence Requirements

NBFCs must establish appropriate systems for identifying customers and managing financial crime risks.

KYC Requirements

Know Your Customer procedures generally involve customer identification and verification, beneficial ownership checks and ongoing monitoring where required.

Prevention of Money Laundering Obligations

NBFCs must comply with applicable anti-money laundering requirements, including maintaining appropriate records, monitoring transactions and reporting relevant transactions to the competent authorities.

Digital Lending and Outsourcing Compliance

NBFCs using digital lending platforms or outsourcing operational functions must ensure that third-party arrangements do not undermine regulatory responsibilities. The regulated entity remains responsible for complying with applicable RBI requirements even when certain functions are performed by external service providers.

NBFC Consumer Protection and Fair Practices

NBFC regulations also place considerable emphasis on protecting borrowers and ensuring transparent financial practices.

Fair Practices Code

NBFCs should communicate loan terms, interest rates, charges and other material conditions clearly to customers. Borrowers should receive adequate information to understand their financial obligations.

Loan Agreements and Disclosure Requirements

Loan documentation should clearly establish important terms, including repayment obligations, interest, applicable charges and other relevant conditions.

Grievance Redressal Mechanism

NBFCs must maintain an appropriate mechanism for receiving and resolving customer complaints. Customers should be informed about how they can raise concerns and escalate unresolved complaints under the applicable framework.

RBI Reporting and Ongoing Compliance Requirements

NBFCs are subject to continuing reporting and record-keeping requirements.

Periodic Regulatory Returns

Depending on their category and activities, NBFCs may have to submit regulatory information concerning financial position, capital, asset quality, prudential requirements and other prescribed matters.

Annual Compliance and Statutory Filings

NBFCs may have obligations under multiple regulatory regimes, including RBI requirements, company law, taxation laws and applicable audit requirements. Maintaining a compliance calendar can help prevent missed filings and regulatory defaults.

Maintenance of Books and Records

Accurate financial and regulatory records are essential for demonstrating compliance and supporting audits, inspections and regulatory reporting.

Can an NBFC Accept Public Deposits?

Not every NBFC is permitted to accept public deposits.

Deposit-taking is subject to specific RBI requirements and permissions. An NBFC should not assume that obtaining an NBFC Certificate of Registration automatically gives it the right to accept deposits from the public.

Businesses considering deposit-taking activities must separately examine the applicable RBI framework and eligibility conditions.

Penalties for Non-Compliance with NBFC Regulations

Failure to comply with NBFC regulations can expose an institution to regulatory action. Depending on the nature and seriousness of the breach, consequences may include monetary penalties, regulatory directions, restrictions on business activities and, in appropriate circumstances, cancellation of the Certificate of Registration.

Non-compliance can also create significant commercial consequences, including reputational damage, increased regulatory scrutiny and loss of customer or investor confidence.

Common NBFC Compliance Mistakes

Some of the most common mistakes include:

• Starting lending activities without first determining whether RBI registration is required.
• Assuming RBI registration is a one-time compliance obligation.
• Failing to maintain applicable capital requirements.
• Maintaining inadequate KYC and AML controls.
• Providing insufficient disclosures to borrowers.
• Ignoring exposure and concentration limits.
• Treating outsourced activities as outside the NBFC’s regulatory responsibility.
• Missing RBI regulatory returns.
• Failing to update internal policies after regulatory changes.
• Confusing a fintech intermediary with an NBFC.

NBFC Compliance Checklist for Businesses

Before commencing and throughout NBFC operations, businesses should review:

• Company incorporation and constitutional documents
• RBI Certificate of Registration
• Applicable Net Owned Fund and capital requirements
• Board and management governance
• KYC and AML systems
• Prudential and exposure requirements
• Lending and Fair Practices Code
• Customer grievance mechanism
• RBI reporting and regulatory returns
• Audit and statutory filings
• Outsourcing and digital lending arrangements
• Periodic review of RBI regulatory changes

Frequently Asked Questions About NBFC Regulations

Is RBI approval mandatory to start an NBFC in India?

Where a company falls within the regulatory framework requiring NBFC registration, it must obtain the applicable RBI Certificate of Registration before undertaking regulated NBFC business.

What is the minimum capital required to register an NBFC?

The applicable Net Owned Fund requirement depends on the relevant NBFC category and current RBI regulations. Businesses should verify the latest applicable requirement rather than relying on an outdated fixed figure.

How long does NBFC registration take?

The timeframe can vary depending on the completeness of the application, the applicant’s structure, documentation, regulatory review and whether further information is required.

Can an NBFC accept deposits from the public?

Only eligible NBFCs meeting the applicable regulatory requirements and permissions may undertake deposit-taking activities. NBFC registration alone does not automatically authorise public deposit-taking.

What are the major compliance requirements after NBFC registration?

Major areas include capital and prudential norms, KYC and AML, governance, lending practices, customer protection, regulatory reporting, record keeping and applicable audit requirements.

Can a fintech company operate as an NBFC without an RBI licence?

A fintech company must determine whether its actual business activities fall within the NBFC regulatory framework. Merely describing a business as a fintech does not exempt it from applicable financial regulations.

What happens if an NBFC violates RBI regulations?

Depending on the violation, the RBI can take regulatory action that may include penalties, directions, restrictions on activities and, in serious cases, cancellation of registration.

NBFC regulation in India extends far beyond obtaining an RBI Certificate of Registration. Businesses must establish an appropriate corporate and capital structure, satisfy licensing requirements and maintain continuous compliance with prudential, governance, KYC, AML, lending, reporting and consumer-protection obligations.

Because RBI regulations are periodically updated and requirements can differ significantly between NBFC categories, businesses should verify the latest regulatory position before launching a financial product or relying on a particular exemption, capital threshold or compliance procedure. Professional legal and regulatory advice can be particularly important when determining whether a proposed fintech or lending model requires RBI registration.