NBFC Compliance — RBI Returns & SBR Norms Guide

The SBR framework — which layer are you in, and what does it demand?

The Scale Based Regulation framework, notified October 22, 2021 and consolidated in the Master Direction of October 2023, replaced one-size-fits-all NBFC regulation with four layers. Your layer determines nearly every compliance obligation you have.

Base Layer (NBFC-BL). Non-deposit-taking NBFCs with assets below ₹1,000 crore. Also: NBFC-P2P, NBFC-Account Aggregators, and non-operative financial holding companies always sit here. Regulation is lightest — basic governance, standard DNBS returns, the 90-day NPA norm (fully applicable from March 2026), and proportionate capital norms. Most new NBFCs start here.

Middle Layer (NBFC-ML). All deposit-taking NBFCs (regardless of size), non-deposit-taking NBFCs with assets of ₹1,000 crore or more, plus HFCs, CICs, NBFC-IFCs, SPDs and IDF-NBFCs by activity. Enhanced norms: 15% CRAR (Tier I 10%), board-level committees (audit, risk, nomination-remuneration), stricter governance and disclosure, ALM discipline, and closer supervision.

Upper Layer (NBFC-UL). NBFCs specifically identified by RBI through a scoring methodology — the top 10 by asset size enter automatically. RBI published 15 names for 2024-25. Bank-like regulation: CET1 9%, Tier I 11.5%, total CRAR 15%, Large Exposure Framework, mandatory stock-exchange listing, liquidity coverage ratio and net stable funding ratio (NSFR from April 2025), and enhanced disclosures.

Top Layer (NBFC-TL). Designed to remain empty. RBI moves a UL entity here only on a substantial increase in systemic risk — and then applies a resolution-style framework. If you are reading this page, this layer is not your problem; it is the system's firebreak.

Why the layer matters for compliance planning: crossing ₹1,000 crore in assets is not just a business milestone — it is a regulatory event that moves you from BL to ML and switches on the 15% CRAR, committee, and disclosure machinery. Plan the capital and governance build-out before you cross, not after.

---

The DNBS return calendar — what you file, when

RBI's supervision runs on returns filed through the DNBS portal. Missing them is the fastest way to attract adverse attention.

Quarterly returns:

• DNBS-01 — financial indicators: assets, liabilities, P&L, exposure to sensitive sectors. Due within 15 days of quarter-end.
• DNBS-03 — prudential norms: capital adequacy, asset classification, provisioning, NOF. Due within 15 days of quarter-end.
• DNBS-04A — short-term dynamic liquidity (ALM). Due within 15 days of quarter-end.
• DNBS-08 (CRILC) — large borrower exposures above ₹5 crore. Due within 21 days of quarter-end.
• DNBS-13 — overseas investment (where applicable). Quarterly.

Monthly returns:

• DNBS-04B — structural liquidity / ALM (for applicable categories).
• DNBS-08 — CRILC large-exposure reporting runs monthly for specified NBFCs.

Weekly:

• DNBS-09 — borrower default / SMA reporting (for specified NBFCs), every Friday.

Annual returns:

• DNBS-02 — annual financial parameters for non-deposit-taking non-systemically-important NBFCs.
• DNBS-10 — annual return for all NBFCs and ARCs.
• Statutory Auditor Certificate (Form A) — the auditor certifies the NBFC continues to carry on NBFI business requiring the CoR under Section 45-IA. Due within one month of balance-sheet finalisation, not later than December 31.
• FLA return — Foreign Liabilities and Assets, due July 15 each year (for NBFCs with foreign investment).

Event-based: FMR-1/FMR-3 for specified events, fraud reporting, and change-in-management filings requiring RBI's prior approval.

---

Capital adequacy — the 15% CRAR discipline

Middle Layer: minimum CRAR of 15%, with Tier I capital at 10%.

Upper Layer: CET1 at 9%, Tier I at 11.5%, total CRAR at 15% — phased in per the SBR timeline.

Capital is not a one-time entry ticket. CRAR must be maintained continuously, computed on risk-weighted assets per RBI's prescribed risk weights. Rapid book growth without parallel capital raising is the classic way healthy NBFCs breach CRAR — monitor it monthly internally, not just at quarter-end for the return.

---

Asset classification, NPA recognition and provisioning

The NPA norm converged to 90 days past due — the same as banks. Base-layer NBFCs completed the glide path from the old 180-day norm by March 2026. Classification runs: standard, sub-standard, doubtful, loss — with provisioning percentages prescribed for each bucket.

SMA (Special Mention Account) reporting — SMA-0, SMA-1, SMA-2 — creates early-warning discipline before the NPA tag. DNBS-09 weekly reporting covers borrower defaults for specified NBFCs. Provisioning hits P&L directly, which is why credit underwriting quality and NPA recognition discipline are the same thing viewed from different ends.

---

ALM and liquidity — the lesson of IL&FS

Asset-Liability Management is where NBFC supervision got serious after the IL&FS crisis. Requirements scale by layer:

• Base Layer: basic ALM framework, structural liquidity discipline.
• Middle Layer: formal ALM returns (DNBS-04A quarterly, 04B monthly), board-approved ALM policy, liquidity risk monitoring.
• Upper Layer: Liquidity Coverage Ratio (LCR) and Net Stable Funding Ratio (NSFR, applicable from April 2025) — bank-grade liquidity standards.

The principle: do not fund long-term assets with short-term borrowings without measuring and limiting the mismatch. Your ALM returns are how RBI checks.

---

KYC, AML and conduct — the everyday compliance

KYC/AML under the Prevention of Money Laundering Act and RBI's KYC Directions: customer identification, beneficial-ownership verification, transaction monitoring, suspicious transaction reporting to FIU-IND, and periodic KYC updates. Digital lenders face additional data-localisation and consent requirements.

Fair Practices Code: board-approved, covering interest-rate transparency (no hidden charges), the Key Fact Statement (KFS) for borrowers, grievance redressal with defined turnaround times, and the ban on penal charges framed as penalties (RBI's penal-charges circular reframes them as penal interest with disclosure).

Digital lending conduct: the Digital Lending Guidelines require disclosures through the regulated entity, data collection limited to need-based access with borrower consent, and grievance redressal extending to LSP (lending service provider) conduct.

---

Credit concentration and large exposures

Middle Layer: internal board-approved concentration limits; single and group borrower exposure norms per SBR.

Upper Layer: the Large Exposure Framework (LEF) — exposures to a single counterparty and groups of connected counterparties face regulatory ceilings, with board-determined internal limits for capital-market, commercial real estate and NBFC-sector exposures specifically called out.

Concentration is how good NBFCs die — one sector, one group, one geography. RBI's framework forces the board to set the limits before the business tests them.

---

Governance — boards, committees and fit-and-proper

SBR governance intensifies by layer: audit committee, risk management committee, nomination and remuneration committee (ML and above); independent director requirements; fit-and-proper assessments for directors on appointment and ongoing; disclosure norms approaching listed-company standards for UL entities (which must also list on stock exchanges).

The 2024-25 UL list included Tata Sons (a CIC) with a listing mandate — governance is not theoretical at the top of the pyramid.

---

Is a managed compliance programme right for your NBFC?

You need structured compliance support if:

• You are a newly licensed NBFC setting up the return-filing, ALM and audit-certification machinery for the first time.
• You are approaching ₹1,000 crore in assets and need to prepare for the BL-to-ML transition — capital planning, committees, disclosures.
• DNBS returns have been filed late or with errors, and you want to clean up before supervision escalates.
• You are in the Upper Layer or approaching it, and need bank-grade compliance architecture.

You may not need us if:

• You are a Type I NBFC (no public funds, no customer interface) below ₹1,000 crore — the 2026 Amendment Directions exempt you from registration entirely, though Chapter III-B provisions still apply.
• Your NBFC is dormant or surrendering its CoR — the requirement is an orderly wind-down and surrender process, not an ongoing programme.

---

What must be decided before building the programme

Your SBR layer, confirmed. Do not assume — classify formally based on deposit-taking status, asset size, and activity. The layer drives the entire obligation set.

Return ownership. Who prepares, who reviews, who files — with maker-checker discipline. DNBS returns signed off by one overworked accountant invite the errors that draw queries.

The compliance calendar. Map every return, certificate and disclosure to a date, an owner, and a review checkpoint — quarterly, monthly, weekly and annual, plus event-based triggers.

Systems. Loan management, accounting and ALM systems must produce return-ready data. Manual spreadsheet compilation at quarter-end is where errors breed.

Capital planning. Project CRAR under growth scenarios. If the plan shows CRAR touching 15% within 18 months, the capital raise starts now.

---

Advantages of getting NBFC compliance right

Supervisory goodwill is a business asset

RBI's supervision is risk-based. NBFCs with clean filing records, stable CRAR and honest NPA recognition get lighter-touch supervision. Those with chronic return delays and evergreening get inspections. Goodwill compounds.

No penalties, no public orders

RBI publishes penalty orders. A monetary penalty under the RBI Act is bad; the public order naming your NBFC is worse — borrowers, lenders and investors all read them. Prevention costs a fraction of cure.

Fundraising and ratings depend on it

Bank lines, NCD issuances and credit ratings all diligence compliance history. A CRISIL/ICRA rating note citing "regulatory compliance issues" reprices your cost of funds across the entire book.

Smooth layer transitions

Growing from BL to ML — or ML toward UL — is a business achievement. Doing it with the capital, committees and disclosures already in place turns a regulatory event into a non-event.

Acquisition readiness

NBFC takeovers require RBI approval, and the acquirer's diligence starts with your compliance record. Clean returns and certificates are deal currency.

Early warning before trouble

A properly run compliance programme — monthly CRAR tracking, honest SMA reporting, ALM discipline — surfaces problems while they are fixable. Most NBFC failures were visible in the returns quarters before they became crises.

---

Documents and data the programme needs

Financials: trial balances, loan book cuts, NPA/SMA reports, provisioning workings, CRAR computation sheets, ALM statements.

Governance: board and committee minutes, fit-and-proper declarations, policy documents (KYC/AML, fair practices, ALM, risk management, grievance redressal).

Regulatory: CoR, prior DNBS filings, RBI correspondence and inspection reports, statutory auditor certificates, credit ratings.

Systems access: loan management system, accounting system, and the DNBS portal credentials — with maker-checker roles defined.

---

Building the compliance programme — step by step

Step 1 — SBR classification and gap assessment

Confirm your layer, map every applicable obligation (returns, capital, governance, disclosures), and score current-state compliance. The gap report is the programme's foundation.

Step 2 — The compliance calendar

Build the dated calendar: DNBS-01/03/04A quarterly, DNBS-04B monthly, DNBS-09 weekly, DNBS-02/10 annual, auditor certificate, FLA return, board/committee meeting cycles. Assign owners and reviewers.

Step 3 — Return preparation workflow

Standardise data extraction, computation templates (CRAR, NPA, provisioning, ALM), maker-checker review, and filing on the DNBS portal — with a pre-filing reconciliation to the audited financials.

Step 4 — Capital and ALM monitoring

Monthly internal CRAR computation, ALM mismatch monitoring, and liquidity dashboards — so quarter-end holds no surprises.

Step 5 — Governance activation

Constitute required committees, calendar their meetings, run fit-and-proper assessments, and ensure policies are board-approved and actually implemented.

Step 6 — Audit and certification cycle

Coordinate the statutory audit with the Form A certificate timeline, the internal audit programme, and RBI inspection readiness — a standing state, not a pre-inspection scramble.

Step 7 — Ongoing supervision management

Respond to RBI queries and deficiency letters completely and on time, track supervisory findings to closure, and report compliance status to the board quarterly.

---

How long does it take to set up?

• New Base Layer NBFC: 4–6 weeks for the full calendar, templates and first filing cycle.
• BL-to-ML transition preparation: 3–6 months (capital planning, committees, systems).
• Remediation (cleaning up late/erroneous filings): 2–4 months depending on backlog.

---

Government fees

Nil — RBI levies no fee for DNBS return filing. The costs are professional (compliance management, audit, systems) and the penalties for non-compliance, which under the RBI Act can be monetary and, for serious violations, extend to prosecution provisions.

---

How ComplyKart helps in this entire process

Compliance health check. We run the SBR classification, score your current filings and capital position, and deliver a gap report with prioritised remediation — before RBI's supervision does it for you.

Return filing, managed. We prepare and file DNBS-01, DNBS-03, DNBS-04A/04B, DNBS-08, DNBS-10 and the annual returns on schedule, with maker-checker review and reconciliation to your financials.

Capital and NPA discipline. Monthly CRAR computation, NPA/SMA tracking against the 90-day norm, and provisioning reviews — so the board sees the real picture every month.

Governance setup. Committee constitution, meeting calendars, fit-and-proper documentation, and board-approved policies drafted for your layer — not generic templates.

Supervision management. We draft responses to RBI queries, deficiency letters and inspection findings, and track every supervisory item to closure.

Layer-transition planning. Approaching ₹1,000 crore or UL identification? We build the capital plan, committee structure and disclosure upgrade path in advance.

What we do not do: we cannot file returns with data you have not provided, backdate filings, or present a non-compliant position as compliant to the regulator. If the numbers are wrong, we tell you — and fix the underlying process.

---

What happens after the programme is running

In the first 30 days: the calendar is live, the first filing cycle is prepared under review, and the board gets its first compliance status report.

In the first 6 months: two full quarterly cycles completed on time, the first clean auditor certificate, monthly CRAR/ALM discipline embedded, and any historical filing gaps remediated.

---

The recurring rhythm you are signing up for

Weekly: DNBS-09 (where applicable). Monthly: DNBS-04B, internal CRAR and ALM review. Quarterly: DNBS-01, DNBS-03, DNBS-04A, DNBS-08, board compliance report. Annually: DNBS-02, DNBS-10, statutory auditor certificate (Form A), FLA return, policy reviews. Event-based: fraud reports, management-change approvals, RBI query responses.

---

Common mistakes and how to avoid them

Treating DNBS returns as a data-entry task. The returns are RBI's supervisory lens. Errors in NPA classification or CRAR computation do not just invite queries — they mislead your own board. Maker-checker and reconciliation are non-negotiable.

Discovering the BL-to-ML transition after crossing ₹1,000 crore. The asset threshold is measured on audited financials — by the time the audit confirms it, you are already late on committees, CRAR and disclosures. Track assets against the threshold quarterly.

Evergreening to avoid NPA recognition. Restructuring or refinancing to keep a 95-DPD account "standard" is the fastest route to a supervisory finding — and the provisioning hit when caught is worse than honest recognition.

No capital plan behind growth. Lending 40% more with the same capital base compresses CRAR silently. Project it, raise ahead of it.

Ignoring the 2026 exemption reassessment. If you are a Type I NBFC below ₹1,000 crore, the registration exemption may apply — but the classification must be formally established, and Chapter III-B still binds you. Do not self-certify informally.

---

Penalties that actually bite

RBI's enforcement toolkit: monetary penalties under the RBI Act (published as public orders naming the NBFC), directions restricting business activities, and for serious violations, the prosecution provisions of Sections 58B/58C. Beyond money: enhanced supervision, restrictions on branch or business expansion, and — for UL entities — the reputational damage of a public order at the top of the pyramid. Persistent DNBS non-filing can ultimately support CoR cancellation proceedings.

---

Sources

This page is built on the Master Direction — RBI (NBFC – Scale Based Regulation) Directions, 2023 (as updated, including the May 2025 update), the RBI (NBFC – Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025 (November 28, 2025), the Amendment Directions, 2026, RBI's October 22, 2021 SBR framework notification, RBI's FAQs on NBFCs (February and April 2026), the Master Direction on NBFC Returns (DNBS return framework), RBI's Digital Lending Guidelines, and RBI press releases on Upper Layer identification. Return formats and timelines change — we verify the current DNBS calendar at each engagement. Unverifiable claims are marked [NEEDS VERIFICATION].

---