When an NBFC, housing finance company or bank must ask RBI before shares change hands, control passes or the board turns over, the two thresholds that trigger it, the public notice that follows, and what RBI has actually penalised, in plain language, linked to the source.
Before anyone acquires control, before shareholding crosses 26 per cent, and before more than 30 per cent of the non-independent directors change, RBI's written permission must already be in hand. The approval comes first, the public notice second, the transaction last.
Since 28 Nov 2025 the obligation is split. The Acquisition of Shareholding or Control Directions, 2025 cover ownership: any takeover or acquisition of control, whether or not management changes, and any change in shareholding, including progressive increases over time, that reaches 26 per cent of paid-up equity. The Governance Directions, 2025 cover the board: any change in management that turns over more than 30 per cent of the directors, excluding independent directors. Both need RBI's prior written permission, both are applied for through the PRAVAAH portal, and the first also requires a public notice at least 30 days before the transfer. Every penalty under this theme is one of those two thresholds crossed without the approval.
Any takeover or acquisition of control of an NBFC needs prior written permission of RBI, "which may or may not result in change of management". Control takes its meaning from the SEBI Takeover Regulations, so it can pass without a majority of shares.
Any change in shareholding that results in 26 per cent or more of paid-up equity being acquired or transferred needs prior approval, and the Directions say so explicitly for progressive increases over time. Two NBFCs were penalised in 2026 for crossing this line without asking.
Any change in management that results in a change of more than 30 per cent of the directors, excluding independent directors, needs prior written permission under the Governance Directions. Most penalties under this theme cite exactly this rule.
The application goes through PRAVAAH on the company's letterhead with information on the proposed shareholders, their sources of funds, declarations that they are not linked to unincorporated deposit-takers, rejected CoR applicants or criminal cases, and a bankers' report.
A public notice in one leading national and one local vernacular newspaper, given by the NBFC and the transferee after RBI's permission and at least 30 days before the sale of shares or transfer of control, stating the intention, the transferee's particulars and the reasons.
A new investor from or through a FATF non-compliant jurisdiction may not acquire significant influence, and such fresh investors together must stay below 20 per cent of voting power. Banks go further: no major shareholding from such jurisdictions at all.
6 of the actions in our tracker cite a change of control or management without RBI's prior approval, and the pattern is unusually clean: no other theme has such a short list of reasons. Directors appointed until more than 30 per cent of the board had changed, and shares transferred past 26 per cent, each without the application that had to come first. These are small penalties on small and mid-sized NBFCs, and each one is a threshold that the board or the company secretary did not have in front of them at the moment it mattered. The actions below are drawn from RBI press releases.
Each entry states only the reason cited in the RBI press release. Where a penalty covered more than one issue, the amount shown is the total and is not attributable to any single reason.
Showing 3 of 6 change of control actions, see all of them in the enforcement tracker.
This is the rare RBI rule where the failure is almost always a knowledge gap at the top of the organisation: a threshold nobody checked before a board resolution or a share transfer was signed. Here's an honest split of what a policy distribution-and-attestation layer like PolicyCentral.ai does and does not address.
The "did everyone get it, read it, and can you show an auditor" layer around your change-of-control controls.
We're explicit about scope, these are jobs for your secretarial, legal and registry systems, not a policy platform.
Being clear about this is the point, sophisticated compliance teams trust a vendor that names its boundaries.
A one-page checklist of the two thresholds, the cumulative counts to keep, what the PRAVAAH application pack must contain, the public-notice wording and timing, and the audit-trail evidence to keep ready for a supervisory review.
Request the checklistPolicyCentral.ai shows you, live and person-by-person, exactly which directors and officers have read and acknowledged the change-of-control policy and every update, with a tamper-evident trail you can export for an RBI review. Walk through it on your own data.
Book a walkthrough