NBFC-MFI Compliance Checklist 2026: RBI Requirements Every Small Lender Must Track

Chandu

22 Jul 2026 — 8 min read

Tracking loan portfolio health in real time — from risk flags to repayment trends, all in one dashboard built for India's NBFCs and MFIs.

Running a microfinance institution (MFI) or non-banking financial company (NBFC) in India means operating inside a regulatory framework that got meaningfully tighter in 2026. The RBI (NBFC – Registration, Exemptions, and Framework for Scale Based Regulation) Amendment Directions 2026, effective April 1, 2026, updated obligations around capital adequacy, reporting timelines, and fair practice standards. Many small lenders are still working out what those changes mean for their day-to-day operations.

If you manage between 50 and 2,000 active loans, this checklist is for you. It organises your compliance obligations by frequency — ongoing, monthly, quarterly, and annual — so your team knows exactly what needs to happen and when, without having to wade through dense circulars every quarter.

Why Compliance Tracking Breaks Down at Small Lenders

Most small NBFCs and MFIs do not fail compliance audits because they ignore the rules. They fail because their tracking is fragmented: KYC (Know Your Customer) documents live in a folder, repayment records sit in a spreadsheet, and agent activity logs exist only in someone's memory.

When a regulator asks for a PAR (Portfolio at Risk) ageing report or a borrower communication trail on short notice, manual systems cannot produce one cleanly. The gap is operational, not intentional.

This checklist helps you close that gap by making compliance a scheduled activity rather than a last-minute scramble.

The 2026 Regulatory Baseline: What Changed

The April 2026 amendment directions reinforced the Scale Based Regulation (SBR) framework, which categorises NBFCs into four tiers: Base Layer (NBFC-BL), Middle Layer (NBFC-ML), Upper Layer (NBFC-UL), and Top Layer. Most small NBFCs and MFIs fall into the Base Layer or Middle Layer.

Key 2026 updates relevant to small lenders:

NOF (Net Owned Fund) floors remain at INR 10 crore for most NBFC categories. The amendment clarified how subordinated debt is treated in NOF calculations.
CRAR (Capital to Risk-weighted Assets Ratio) minimums continue at 15% for NBFC-MFIs and 10% for NBFC-BL entities. Quarterly self-assessment is now explicitly required.
Exemption thresholds were revised for certain asset-holding NBFCs. If you previously relied on an exemption, confirm it still applies to your entity type.
Fair Practice Code (FPC) requirements were extended to include clearer disclosure of the total cost of credit — processing fees and insurance included — in all borrower-facing communications.

If you are unsure which layer your entity sits in, a statutory auditor or CA with NBFC practice experience can confirm it based on your asset size and activity type.

Compliance Checklist by Frequency

Ongoing (Daily and Weekly)

These are the activities that cannot wait for month-end.

KYC verification at onboarding. Every new borrower must be verified per the RBI Master Direction on KYC (updated 2016, with subsequent amendments) and PMLA 2002 (Prevention of Money Laundering Act). Acceptable documents include Aadhaar, PAN, Voter ID, and passport. Store originals or certified digital copies with a timestamp.
AML (Anti-Money Laundering) screening. Screen new borrowers against PEP (Politically Exposed Person) lists and sanctions databases at onboarding. For high-value or unusual transactions, file a Suspicious Transaction Report (STR) with the Financial Intelligence Unit (FIU-IND) within the prescribed timeline.
Loan disbursement documentation. Every disbursement must be accompanied by a signed loan agreement, a sanction letter stating the EMI (equated monthly instalment) schedule, and a key facts statement disclosing the annualised interest rate. The Fair Practice Code requires this to be in the borrower's preferred language where practicable.
Repayment recording. Log every repayment against the correct loan account on the date it is received. Delayed posting creates PAR misclassification, which flows directly into your NBS returns.
Agent activity logs. If you use field agents for collection or disbursement, maintain a record of each visit: date, borrower, amount collected, and agent ID. This is not optional during RBI inspections.

Monthly

PAR ageing and NPA classification. Classify loans as NPA (Non-Performing Assets) when overdue by more than 90 days for standard NBFCs, or 60 days for NBFC-MFIs. Update your PAR buckets — PAR 30, PAR 60, PAR 90 — at month-end. Provisioning must follow prescribed rates: 10% for sub-standard assets, 100% for loss assets, and specific rates for doubtful categories based on age.
Interest income recognition. Stop accruing interest on NPAs. Reverse any interest already accrued on accounts that crossed the NPA threshold during the month.
Borrower indebtedness check (NBFC-MFIs). Under MFIN (Microfinance Institutions Network) Guardrails, a borrower's total outstanding loans from all MFI sources must not exceed INR 2 lakh. If you are disbursing to existing MFI borrowers, pull a credit bureau report before each new disbursement to confirm this cap is not breached.
Complaint register update. Log all borrower complaints received during the month, the resolution timeline, and the outcome. The FPC requires complaints to be acknowledged within 5 business days and resolved within 30 days for most categories.
Liquidity monitoring. Track your asset-liability mismatch (ALM) across short-end buckets: 1 day, 2–7 days, 8–14 days, and 15–30 days. Base Layer NBFCs are not required to submit ALM returns to the RBI, but internal records must be maintained.

Quarterly

NBS-7 return filing. NBFC-MFIs must file the NBS-7 — Statement of Capital Funds, Risk Assets, and Risk-Adjusted Items — with the RBI's Department of Regulation each quarter. The deadline is typically 15 days after the close of the quarter. Errors in CRAR calculation are among the most common reasons for RBI queries at this stage.
DNBS return filings. Depending on your NBFC category, additional DNBS (Department of Non-Banking Supervision) returns may be due quarterly. Check the RBI COSMOS portal for your entity's specific return schedule.
CRAR self-assessment. Calculate your CRAR as of the last day of the quarter. If it falls below the regulatory minimum, notify your Board and initiate a capital restoration plan. Document this assessment even when CRAR is comfortably above the floor.
Board review of portfolio quality. Present PAR ageing, NPA ratios, and provisioning adequacy to your Board or equivalent governance body. Minute the discussion. RBI inspectors review this documentation.
Interest rate and fee review. Confirm that your lending rates comply with the interest rate ceiling for NBFC-MFIs — currently 22% per annum for individual lenders, or a margin cap over cost of funds, whichever is lower. If you adjusted rates during the quarter, verify that borrower communications were updated accordingly.

Annual

NBS-9 and statutory auditor certificate. NBFC-MFIs must submit the NBS-9 return (Annual Return on Microfinance Activities) along with a certificate from a statutory auditor confirming the accuracy of the data. This is separate from your annual financial audit. The certificate must specifically attest to the correctness of borrower count, portfolio outstanding, and income recognition.
ROC (Registrar of Companies) filings. File your annual return (MGT-7 or MGT-7A for small companies) and financial statements (AOC-4) with the Ministry of Corporate Affairs within the prescribed timelines after your AGM. Late filing attracts per-day penalties that compound quickly.
CERSAI registration. For secured loans, register all charges with CERSAI (Central Registry of Securitisation Asset Reconstruction and Security Interest) within 30 days of creation. An annual reconciliation of your CERSAI records against your loan book is good practice.
FIU-IND annual return. Entities covered under PMLA 2002 must file an annual return with FIU-IND. Confirm whether your entity type and transaction volumes trigger this obligation.
RBI registration renewal check. Your Certificate of Registration (CoR) does not expire, but any material change in business activity, ownership, or principal business criteria requires prior RBI approval. Review this annually.
Fair Practice Code review. Update your FPC document to reflect any regulatory changes during the year. The updated version must be approved by your Board and published on your website.
Audit trail reconciliation. Reconcile your loan management records against your general ledger. Discrepancies between the two are a consistent red flag during RBI inspections and statutory audits.

The Operational Gap: When Manual Systems Cannot Keep Up

The checklist above assumes you can produce clean records on demand. For lenders still running on spreadsheets or basic accounting software, that assumption tends to break down at the quarterly NBS-7 stage — and again at the annual NBS-9 stage.

PAR ageing requires you to know, at any point in time, exactly how many days overdue each loan account is. KYC compliance requires a timestamped record of when each document was collected and verified. Agent activity logs need to be structured records, not WhatsApp threads.

A loan management system that stores repayment data with timestamps, generates PAR ageing reports in real time, and logs every borrower communication creates the paper trail regulators expect. Freebird maintains audit-trail-enabled repayment logs, borrower communication records including WhatsApp reminders, and field agent activity data in a single system. When your statutory auditor asks for NBS-9 source data, you are pulling from one place rather than reconciling three spreadsheets.

This matters more as your portfolio grows. If you are benchmarking your portfolio health alongside compliance readiness, the NBFC-MFI Loan Portfolio Benchmarks 2026 article covers the PAR and NPA ratios that well-run small lenders are hitting this year. And if you are evaluating whether your current system can support your compliance obligations going forward, the Best Loan Management Software for NBFCs in India 2026 guide compares the main options at the sub-2,000-borrower scale.

Freebird offers a 7-day free trial with no credit card required. Request a live demo to see how the audit trail and reporting features work in practice.

FAQs

What is the CRAR requirement for NBFC-MFIs in 2026?
NBFC-MFIs must maintain a CRAR of at least 15% per RBI directions — higher than the 10% floor that applies to Base Layer NBFCs in other categories. Calculate and document CRAR at least quarterly.

What is the NOF requirement for a new NBFC registration in 2026?
The minimum Net Owned Fund for most NBFC categories is INR 10 crore. The April 2026 amendment directions clarified the treatment of certain instruments in NOF calculations. If you are close to the threshold, confirm the position with a CA.

How does the MFIN borrower indebtedness cap work?
Under MFIN Guardrails, a borrower's total outstanding loans from all MFI lenders combined must not exceed INR 2 lakh. You must verify this at the time of each new disbursement using a credit bureau report — not just at onboarding.

What is NBS-7 and who needs to file it?
NBS-7 is a quarterly return filed by NBFC-MFIs with the RBI covering capital funds, risk-weighted assets, and CRAR. It is due 15 days after the end of each quarter. Non-MFI NBFCs file different returns depending on their category and asset size.

What records do I need for an RBI inspection?
Inspectors typically ask for loan agreements, timestamped KYC documentation, repayment ledgers, NPA classification workings, Board minutes on portfolio reviews, the Fair Practice Code, and agent activity logs. Having all of this in one system significantly reduces the time it takes to prepare.

Does a small NBFC with fewer than 500 borrowers need to file DNBS returns?
It depends on your registration category and asset size. Some Base Layer NBFCs below certain asset thresholds have reduced return obligations, but confirm your specific schedule on the RBI COSMOS portal or with your statutory auditor. Do not assume an exemption applies without verifying it.

What happens if I miss an NBS-9 filing deadline?
Late or incorrect NBS-9 filings can attract RBI notices, penalties, and in persistent cases, restrictions on business activity. The statutory auditor certificate requirement means you cannot file without auditor sign-off, so work backward from your filing deadline to make sure your auditor has enough lead time.

Keep Compliance on Schedule

Compliance at a small NBFC or MFI is not a once-a-year activity. It is a set of ongoing, monthly, quarterly, and annual tasks that each depend on clean underlying data. The lenders who handle RBI inspections without disruption are the ones who treat compliance as a workflow — not a fire drill.

Use this checklist as a starting point. Review it with your statutory auditor to confirm which items apply to your specific registration category, and build the deadlines into your team's calendar now.

If your current loan management system cannot produce the reports this checklist requires, that is worth addressing before your next return filing. Request a live demo at usefreebird.com to see how Freebird handles audit trails, PAR reporting, and borrower communication logs in a single system.