NBFC Compliance — RBI Returns & Filings
NBFC compliance runs on two timetables: the Reserve Bank of India’s, under the Scale Based Regulation framework, and the Registrar of Companies’, under the Companies Act. We track both, from quarterly DNBS returns and the yearly Statutory Auditor Certificate to AOC-4 and MGT-7.
What it is
NBFC compliance is everything a registered non-banking financial company must file and maintain to keep its Certificate of Registration (CoR). It answers to the RBI for its lending and to the ROC as a company. Two regulators, two calendars.
On the RBI side, the core rules sit in the RBI (Non-Banking Financial Companies – Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025, issued on 28 November 2025, with separate directions on KYC, credit reporting and governance. Since 31 July 2026, RBI returns follow the RBI (Non-Banking Financial Companies – Supervisory Returns) Directions, 2026. On the company side, the Companies Act, 2013 applies, with filings on the MCA V3 portal.
Under the principal business test, a company is treated as an NBFC when its financial assets are more than 50% of total assets and income from financial assets is more than 50% of gross income. Both tests must hold.
Who it applies to
Lend without deposits, below ₹1,000 crore? Base Layer
Non-deposit-taking NBFCs with assets below ₹1,000 crore, plus NBFC-P2P, NBFC-AA, NOFHCs and Type I NBFCs. They file DNBS02 every quarter and the yearly SAC.
Take deposits or cross ₹1,000 crore? Middle Layer
All deposit-taking NBFCs, whatever their size, and non-deposit-taking NBFCs with assets of ₹1,000 crore and above. HFCs, CICs, IDF-NBFCs, NBFC-IFCs and standalone primary dealers also sit here. Expect DNBS01, DNBS03, liquidity returns and CRILC.
Cross ₹1,00,000 crore? Upper Layer
The Upper Layer covers NBFCs with assets of ₹1,00,000 crore and above as per the latest audited balance sheet. RBI says the Top Layer should ideally remain empty.
The ₹10 crore NOF deadline
Net Owned Fund (NOF) is the capital RBI requires you to hold. For a new NBFC-ICC (investment and credit company), NBFC-MFI or NBFC-Factor, the floor is ₹10 crore from day one. Existing NBFCs were given a glide path:
| NBFC type | Earlier NOF | By 31 March 2025 | By 31 March 2027 |
|---|---|---|---|
| NBFC-ICC | ₹2 crore | ₹5 crore | ₹10 crore |
| NBFC-MFI | ₹5 crore (₹2 crore in the North East) | ₹7 crore (₹5 crore in the North East) | ₹10 crore |
| NBFC-Factor | ₹5 crore | ₹7 crore | ₹10 crore |
Here is the catch: an NBFC that does not reach the prescribed level in time is not eligible to hold its CoR, under paragraph 43 of the 2025 Directions. Picture a Faridabad NBFC-ICC that lends to small traders and cleared the ₹5 crore step in March 2025. It now has until 31 March 2027 to double that, through fresh equity or retained profit, and six months is not long for a board to raise capital.
Why it matters
Protect your licence to lend
The CoR under Section 45-IA of the RBI Act, 1934 is your licence to lend. Falling short on NOF or the principal business test puts it at risk.
Keep your own lenders comfortable
Banks and investors who fund an NBFC ask for its audited accounts, the SAC and proof that RBI returns are current.
Treat borrowers by the rulebook
RBI’s conduct rules protect your borrowers. A complaint about wrong credit data that is not resolved in 30 days costs the lender ₹100 for every extra day.
RBI returns at a glance
| Return | What it covers | Who files | When |
|---|---|---|---|
| DNBS02 | Important financial parameters | Base Layer (except P2P) | Quarterly, within 21 days |
| DNBS01 | Important financial parameters | Middle and Upper Layer (except CICs) | Quarterly, within 21 days |
| DNBS03 | Important prudential parameters | Middle and Upper Layer (except CICs and SPDs) | Quarterly, within 21 days |
| DNBS04A / 04B | Short-term and structural liquidity | Middle and Upper Layer; Base Layer with ₹100 crore or more | As prescribed for each |
| CRILC | Large credits | Middle and Upper Layer; Base Layer with ₹500 crore or more | Monthly, within 15 days |
| DNBS10 | Statutory Auditor Certificate (SAC) | All NBFCs | Yearly, within 5 working days of the auditor’s report, latest 31 December |
Returns are filed online on RBI’s portals; the SAC goes on CIMS. Credit data moves faster: every NBFC must be a member of all credit information companies (CICs) and report on the 9th, 16th, 23rd and last day of each month, with the full file by the 5th of the next month.
Documents required
Gather for the RBI returns
- Copy of the CoR
- Quarterly trial balance and loan book
- Asset classification and provisioning working
- Borrowings and maturity data
Gather for the audit and SAC
- Audited financial statements and auditor’s report
- NOF computation as on 31 March
- Principal business test working
- Board resolutions adopting the accounts
Keep on file for policies and the ROC
- Board-approved KYC policy and Fair Practices Code
- Fit-and-proper declarations of directors, renewed as on 31 March
- Names of the Designated Director and Principal Officer
- Director’s digital signature certificate and AGM papers
How it works
Map your layer and your returns
We read your latest audited balance sheet, confirm your layer and list every RBI return and ROC form with its due date.
Close the books every quarter
We reconcile the ledger with the loan book from your loan management software, so your DNBS returns match your accounts. Our online book-keeping team can run the ledger for you.
File the returns and credit data
Quarterly returns go in within 21 days; credit data reaches every CIC on four dates a month. A Ballabgarh two-wheeler lender that uploads only month-end data misses three of those dates, every month.
Finalise the audit, then file the SAC
RBI wants the balance sheet finalised within three months of 31 March. Once the auditor signs, the SAC goes on CIMS within five working days.
Complete the ROC and tax filings
We plan the AGM before 30 September, file AOC-4, MGT-7 and ITR-6 as part of your annual ROC compliance, and refresh the policies and director declarations.
Timelines
File quarterly returns within 21 days
DNBS01, DNBS02 and DNBS03 are due within 21 days of the quarter’s end. For the quarter ending 30 September 2026, that is 21 October 2026.
File the SAC by 31 December 2026
For FY 2025-26, the SAC is due within five working days of the auditor’s report, and in no case later than 31 December 2026. In practice, the December date is only the outer limit: if your auditor signs in September, the SAC is due within days, not in December.
File AOC-4 and MGT-7 after the AGM
With the AGM on 30 September 2026, AOC-4 is due by 30 October 2026 and MGT-7 by 29 November 2026. ITR-6 for audit cases is due by 21 November 2026, after CBDT’s 28 September extension.
What happens if an NBFC falls behind
Face RBI action and penalties
The Supervisory Returns Directions say that if an NBFC breaches them, RBI may take action, including a penalty or fine under the RBI Act, 1934.
Risk losing the CoR
An NBFC-ICC that has not reached ₹10 crore NOF by 31 March 2027 is not eligible to hold its CoR.
Pay ROC fees and penalties
AOC-4 and MGT-7 attract ₹100 a day of additional fee. Sections 92(5) and 137(3) add ₹10,000 plus ₹100 a day, up to ₹2 lakh for the company and ₹50,000 per officer.
Frequently asked questions
Which RBI returns does a small NBFC have to file?
A Base Layer NBFC files DNBS02 every quarter, within 21 days of the quarter’s end, and DNBS10, the yearly Statutory Auditor Certificate. Liquidity returns DNBS04A and 04B apply once assets reach ₹100 crore, and the monthly CRILC return at ₹500 crore. Credit data goes to every credit information company on four dates each month. Once set up, the calendar repeats every year.
What is the Statutory Auditor Certificate and when is it due?
The SAC is the yearly certificate from your statutory auditor, filed as return DNBS10 on RBI’s CIMS portal. It is based on the audited books for the previous financial year. It is due within five working days of the date the auditor’s report is signed, and no later than 31 December. Sign the audit early and the SAC follows in days.
Does an existing NBFC-ICC really need ₹10 crore of NOF?
Yes. Existing NBFC-ICCs had to reach ₹5 crore by 31 March 2025 and must reach ₹10 crore by 31 March 2027. An NBFC that misses the prescribed level is not eligible to hold its Certificate of Registration. NOF can be built through fresh equity or retained profits. Start the capital plan now, with six months to go, and the deadline is manageable.
Does an NBFC without public funds still need RBI registration?
Not always, from 1 July 2026. An NBFC that does not use public funds, has no customer interface and has assets below ₹1,000 crore is exempt from Sections 45-IA and 45-IC of the RBI Act. It must pass a board resolution at the start of each financial year and disclose in its notes to accounts that it is an “Unregistered Type I NBFC”. We check whether you qualify before you act.
Must an NBFC be a member of the credit bureaus?
Yes. RBI requires every NBFC, as a credit institution, to become a member of all credit information companies registered with RBI. Data is reported as on the 9th, 16th, 23rd and last day of each month, with the full file by the 5th of the next month. If a borrower’s complaint about credit data is not resolved within 30 calendar days, the borrower gets ₹100 a day. Regular uploads keep that risk small.
What KYC and anti-money-laundering steps must an NBFC follow?
An NBFC needs a board-approved KYC policy with four parts: customer acceptance, risk management, customer identification and transaction monitoring. It must name a Designated Director and a Principal Officer and send their details to FIU-IND and RBI. KYC is updated every two years for high-risk customers, eight for medium and ten for low. Transaction records are kept for at least five years. We draft the policy to fit your loan products.
Does an NBFC file DPT-3 with the ROC?
No. The Companies (Acceptance of Deposits) Rules, 2014, under which DPT-3 is filed, do not apply to NBFCs registered with RBI. Every other company filing still applies: the AGM by 30 September, AOC-4 within 30 days of it, MGT-7 within 60 days, ADT-1 and DIR-3 KYC. One less form, but the rest of the ROC calendar stays.
What does the Fair Practices Code say about charging interest?
Interest runs only from the day money reaches the borrower, not from sanction or signing. RBI lists unfair practices: EMIs on the sanctioned rather than disbursed amount, a full month’s interest when the loan ran only part of it, and advance instalments ignored when calculating interest. Changes to the amortisation schedule in the Key Facts Statement must be told to the borrower. We review your loan terms against these rules.
What it costs
Our fee plus the government fee that applies to your case, quoted before you commit. Tell us the situation and we will price it exactly.
On the ROC side, AOC-4 and MGT-7 each carry a normal fee of ₹200 to ₹600 by nominal share capital, plus ₹100 a day if filed late.
Ready to begin?
Send us your CoR and latest audited balance sheet, and we will map every RBI and ROC date your NBFC faces this year.