2026 has been an unusually dense year for NBFC regulation. RBI has reworked how NBFCs are registered and classified, revised concentration and credit facility norms, issued a consolidated recovery conduct framework, extended board level cybersecurity accountability to NBFCs, and set a firm date for the transition to Expected Credit Loss based provisioning. For compliance, risk, and legal teams, 2026 has not been a year of isolated circulars, it has been a year of structural change across almost every major area of NBFC regulation.
This blog consolidates the key RBI regulations and updates that shaped NBFC compliance through 2026, organised by theme so risk and compliance teams can map their own institution’s exposure against each one.
1. The April 2026 Registration and Exemption Overhaul
RBI issued the Non-Banking Financial Companies, Registration, Exemptions and Framework for Scale Based Regulation, Amendment Directions, 2026 on April 29, 2026, introducing the most structurally significant registration change NBFCs have seen in years. The amendment formally classifies NBFCs into Type I and Type II, and creates a new category, Unregistered Type I NBFC, for entities that neither avail public funds nor have any customer interface. This update carries several obligations institutions need to track through the rest of the year.
- Eligibility depends on having no public funds and no customer interface, directly or indirectly, verified through board resolutions
- Existing registered NBFCs meeting the criteria can apply for deregistration through the PRAVAAH portal within a window running to September 30, 2026
- Deregistration applications require three years of audited financial statements along with confirmation of public fund and customer interface status
- Statutory auditors carry an ongoing reporting obligation and must submit an exception report to RBI if eligibility conditions are breached
- Unregistered Type I NBFCs still carry ongoing compliance confirmations, board level oversight, and disclosure requirements even after exemption
- RBI has reserved the right to issue specific instructions to Unregistered Type I NBFCs if concerns or risks are observed
2. Concentration Risk Management Amendments
NBFCs continued operating under a Concentration Risk Management framework that saw more than one amendment through 2025 and into 2026, including a revised definition of infrastructure lending and a further amendment reviewing the definition of Tier 1 capital used for concentration norm compliance. Since concentration ceilings are calculated as a percentage of capital, this capital definition change directly affects how much lending headroom an NBFC has against a single borrower or group.
3. Credit Facilities Directions
NBFC specific Credit Facilities Directions continued to govern how loans are structured, secured, and monitored through 2026, covering collateral eligibility, loan to value norms, and end use monitoring. These directions work closely with the concentration risk framework, since both draw on shared definitions for terms like collateral, primary security, and eligible exposure categories, meaning updates to one framework regularly carry implications for the other.
4. The August 2026 Loan Recovery Overhaul
RBI’s August 2026 Responsible Business Conduct amendments introduced a consolidated recovery framework that applies across banks, NBFCs, and housing finance companies, coming into force January 1, 2027. This is one of the most operationally significant updates of the year, reshaping how recovery agencies can be engaged and how borrowers must be treated during collections. Key changes NBFCs need to prepare for include the following.
- Recovery contact permitted only between 8 am and 7 pm, with limited exceptions
- A broadened definition of recovery agency covering any outsourced entity performing recovery functions, regardless of contract label
- Mandatory advance intimation to borrowers before a recovery agency’s first visit
- A public, regularly updated list of empanelled recovery agencies on the NBFC’s website
- Explicit prohibition of harsh practices, including contacting a borrower’s employer or relatives as leverage
- Near total prohibition on device locking as a recovery tool, with narrow, tightly conditioned exceptions
- Mandatory compensation provisions for borrowers harmed by non-compliant recovery conduct
- Call recording and six month retention requirements for recovery related communications
5. Cybersecurity and Technology Risk Governance
NBFCs were brought within RBI’s Cybersecurity, Technology Risk, Resilience and Assurance Framework directions, issued as one of seven parallel circulars across regulated entity categories in mid 2026. This update extended board level cyber governance expectations, including board approved policies, defined incident reporting timelines, and continuous board training requirements, directly to NBFCs rather than treating technology risk as a bank specific concern.
6. Fraud Risk Management Expectations
Through 2026, NBFCs continued to be expected to maintain board approved fraud risk management policies, Early Warning Signal systems, and structured reporting mechanisms consistent with RBI’s broader fraud risk management framework, including timely classification decisions, staff accountability, and reporting to law enforcement and RBI where required. Given how quickly fraud typologies evolve, particularly around digital lending and payment fraud, this remains an area where policy alone is insufficient without active monitoring capability.
7. The Road to Expected Credit Loss Provisioning
RBI confirmed during 2026 that the transition to Expected Credit Loss based provisioning will take effect from April 1, 2027, a milestone NBFCs are now actively preparing for. This shifts NBFCs from largely incurred loss based asset classification toward forward looking credit risk modelling, covering probability of default, loss given default, and exposure at default, a capability many NBFCs are still in the process of building out.
Tracking These Updates as a Connected System
Given how many of these 2026 updates interact with each other, sharing definitions, capital bases, and reporting channels, NBFCs benefit from tracking regulatory change as a connected system rather than isolated circulars filed separately by different teams. A practical tracking process should assign clear ownership for each regulatory theme, map every requirement to the specific roles responsible for implementation, and review the full inventory whenever RBI issues a new direction, draft guidance, or amendment.
Conclusion
2026 has reshaped NBFC compliance across registration, concentration risk, recovery conduct, cybersecurity, and provisioning within a single year. NBFCs that treat these updates as a connected, continuously tracked system will be far better positioned heading into 2027 than those still catching up circular by circular.
Build This Capability with RMAI
RMAI supports NBFC risk and compliance teams through structured courses covering Credit Risk Management, Governance, Risk and Compliance (GRC), Fraud Risk Management, and Cyber Security and Technology Risk Management in Banking. Explore RMAI’s complete suite of risk management courses to build a learning path suited to your institution’s regulatory priorities.
