What RBI's consolidated 2025 Directions require of an NBFC's balance sheet, board and regulatory returns, who they apply to layer by layer, and what RBI has actually penalised, from leverage breaches and late returns to NPA upgrades and cross-directorships, in plain language, linked to the source.
Keep the balance sheet within the limits set for your layer, keep the board and its key people within the governance rules, classify and disclose honestly, and file every return on time and correctly. Most penalties here are one of those four loops quietly failing.
Since 28 Nov 2025 the NBFC rulebook is a set of entity-class Directions that all read their applicability from the Scale Based Regulation framework: four layers (Base, Middle, Upper and a Top Layer that RBI keeps empty unless systemic risk demands otherwise). The Governance Directions set who may sit where and which policies the board must own; Capital Adequacy and Concentration Risk cap leverage and exposure; IRACP fixes when a loan is non-performing and when it may be upgraded; Financial Statements fix what the notes to accounts must disclose; and the Supervisory Returns Directions of 31 Jul 2026 fix what is filed with RBI and by when. Commercial banks carry parallel 2025 Directions, with their asset-classification rules being replaced from 1 Apr 2027.
A Base Layer NBFC's leverage ratio (total outside liabilities divided by owned fund) may not exceed seven at any point of time. Middle Layer and above hold a minimum CRAR of 15 per cent, with Tier 2 capped at 100 per cent of Tier 1. A leverage breach drew a penalty this year.
A Middle Layer NBFC's credit and investment exposure may not exceed 25 per cent of Tier 1 capital to a single party or 40 per cent to a single group (with a small infrastructure add-on). Upper Layer NBFCs follow the Large Exposure Framework at 20 per cent of eligible capital. Two NBFCs were penalised for breaching these in July 2026.
Except for a subsidiary, Key Managerial Personnel may not hold any office, including a directorship, in any other NBFC-ML or NBFC-UL. Directors must pass a board-approved fit-and-proper test at appointment and on a continuing basis, and NBFCs above ₹5,000 crore must appoint a Chief Risk Officer.
An account is non-performing once interest or an instalment is overdue for more than 90 days. An NPA may be upgraded to standard only when the entire arrears of interest and principal are paid, and where a borrower has several facilities, across all of them. Restructured accounts follow the Resolution of Stressed Assets Directions in addition.
The notes to accounts must carry a summary of customer and Ombudsman complaints (pending, received, disposed, rejected) and the amount of fraud reported for the year. Two NBFCs were penalised in 2026 for disclosing these incorrectly or incompletely.
Under the Supervisory Returns Directions, 2026, returns are due within 15 days of a month-end and within 21 days of a quarter-end or year-end; audited returns within five working days of the auditor's signature; a fraud monitoring return within 14 days of classification. Data must be accurate and complete, and RBI may fine for a breach.
20 of the actions in our tracker cite a prudential, governance or reporting failure, and they cluster tightly. NPAs upgraded before the arrears were cleared or not recognised on restructuring, a managing director or KMP sitting on another NBFC's board, a group exposure over the limit, returns and a balance sheet filed late, complaints and frauds misstated in the notes to accounts, a synthetic securitisation structure, interest paid on current accounts. Each is a known rule that a process stopped enforcing. The actions below are drawn from RBI press releases.
Each entry states only the reason cited in the RBI press release. Where a penalty covered more than one issue, the amount shown is the total and is not attributable to any single reason.
Showing 3 of 20 prudential, governance and reporting actions, see all of them in the enforcement tracker.
A leverage cap, an exposure limit or a returns calendar only holds if the people who approve loans, appoint directors and file returns know the current rule and can prove they do. Here's an honest split of what a policy distribution-and-attestation layer like PolicyCentral.ai does and does not address.
The "did everyone get it, read it, and can you show an auditor" layer around your prudential and governance framework.
We're explicit about scope, these are jobs for your loan, treasury and reporting stack, not a policy platform.
Being clear about this is the point, sophisticated compliance teams trust a vendor that names its boundaries.
A practical checklist of the board-approved policies the 2025 NBFC Directions expect for your layer, the governance rules to brief directors on before every appointment, the returns calendar under the 2026 Supervisory Returns Directions, and the audit-trail evidence to keep ready for a supervisory review.
Request the checklistPolicyCentral.ai shows you, live and team-by-team, exactly who has read and acknowledged each prudential policy, governance rule and returns procedure, and every update, with a tamper-evident trail you can export for an RBI review. Walk through it on your own data.
Book a walkthrough