Finnulate vs TeamLease RegTrack and the alternatives: compliance software for NBFCs under RBI's Scale-Based Regulation

What RBI's Scale-Based Regulation asks of a Middle Layer NBFC

RBI's circular of 22 October 2021 (RBI/2021-22/112) placed NBFCs in four layers by size, activity and perceived riskiness, effective 1 October 2022; the Top Layer is meant to stay empty. The Base Layer holds non-deposit-taking NBFCs with assets below 1,000 crore rupees. The Middle Layer holds non-deposit-taking NBFCs with assets of 1,000 crore rupees and above, all deposit-taking NBFCs irrespective of size, and, by activity, standalone primary dealers, infrastructure debt funds, core investment companies, housing finance companies and infrastructure finance companies. Rules for a lower layer also apply to the layers above it. The Master Direction on NBFC Scale Based Regulation of 19 October 2023, updated 17 July 2025, now consolidates these rules; the paragraph numbers below are from the 2021 circular, which is what most vendor pages still cite.

• Chief Compliance Officer: paragraph 3.2.3(g) requires Middle Layer NBFCs to appoint a CCO under a Board-approved policy. RBI's circular of 11 April 2022 on the compliance function applies to NBFC-UL and NBFC-ML, with deadlines of 1 April 2023 for the Upper Layer and 1 October 2023 for the Middle Layer; the CCO has a fixed tenure of not less than three years, no dual hatting, a direct line to the MD and CEO or the Board, and RBI's supervision department is informed before an appointment, transfer or removal. Base Layer NBFCs stay under the earlier guidelines.
• Capital and exposures: paragraph 3.2.1(a) requires an internal assessment of the need for capital, on the lines of the ICAAP that banks run. Paragraph 3.2.2(a) merges the lending and investment limits into a single exposure limit of 25 percent of Tier I capital for a single borrower or party and 40 percent for a group. The Large Exposure Framework in paragraph 3.2.2(d) applies to the Upper Layer only.
• Governance: key managerial personnel may not hold office, including directorships, in another NBFC-ML or NBFC-UL, other than a directorship in a subsidiary (3.2.3(d)); an independent director may sit on the boards of no more than three NBFCs in those layers (3.2.3(e)); annual disclosures expand from 31 March 2023 (3.2.3(f)); the Board delineates the role of its committees (3.2.3(i)); an NBFC with ten or more branches adopts a Core Banking Solution (3.2.3(j)).
• Compliance monitoring technology: RBI's circular of 31 January 2024 (RBI/2023-24/117), addressed among others to Upper and Middle Layer NBFCs including housing finance companies, asked regulated entities to review their compliance monitoring and implement systems that support communication and collaboration, escalate non-compliance, record approvals for deviations and give senior management a consolidated view, with new systems in place by 30 June 2024.
• Returns: RBI's Master Direction on Filing of Supervisory Returns of 27 February 2024 sets default timelines of 15 days for monthly returns and 21 days for quarterly, half-yearly and annual returns unless an alternate timeline applies, filed on CIMS; the returns that apply to each type of entity are listed in its Annex III.
• Outsourcing: since 28 November 2025 the NBFC Managing Risks in Outsourcing Directions, 2025 require a Board-approved policy, a materiality assessment, RBI inspection rights in the contract and a central record of material arrangements reviewed by the Board or its committee every half-year; Base Layer NBFCs are outside the IT-outsourcing chapter.

What to compare in NBFC compliance software

Seven questions separate tools that were built for RBI-regulated entities from general compliance libraries with a BFSI label.

• Does the vendor's own page name the SBR layers, the CCO mandate and the 2024 compliance-monitoring circular, or only 'RBI compliance' in general?
• How does an RBI circular reach your register: is it ingested and mapped to obligations, and does a named person approve the change before anything moves?
• Can the vendor build the register for your layer during a trial, with the direction, paragraph and due-date rule for each obligation?
• Are supervisory returns on the same calendar as statutory filings, with the CIMS timeline rule stored rather than a fixed date?
• Are maker, checker and approver roles enforced, and can evidence be altered after upload?
• Is the outsourcing register, with materiality, inspection-rights clause checks and the half-yearly Board extract, in the same system or a spreadsheet?
• What does the vendor publish about hosting, data residency and its own certifications, as opposed to its cloud provider's?

Finnulate

Finnulate (finnulate.ai) describes an AI compliance platform for RBI-regulated NBFCs that ingests RBI Master Directions and circulars and extracts the obligations they create, with the aim that a CCO has auditable proof rather than assembled reports. Its pages name five governance intelligence modules, nine regulators and an illustrative mapping of one update to seven obligations, with owner labels on extracted obligations and review and approve steps on policy drafts. The SBR layers, CIMS returns, library size, hosting, certifications, prices and customers are not published on the pages read; a seven-day free trial follows a demo request. The site describes its founder's background but names neither the founder, the legal entity nor an address.

TeamLease RegTrack for Financial Institutions

TeamLease RegTech (Pune, formerly Avantis RegTech) publishes a RegTrack edition for financial institutions whose page names the Scale-Based Regulation framework, the four layers, the requirement to appoint a CCO by 1 October 2023 and the mandate for compliance management systems, with a maker-checker concept and new notifications linked to the compliances they change. The company's home page states 1,536 Acts, 69,233 compliances, 3,756 sources monitored by a legal research team, and SOC 2 Type II, ISO 27001 and DPDPA certification; its security page confirms ISO/IEC 27001 and a SOC 2 Type 2 audit. The FI page shows Kotak, Hero Housing, EarlySalary and Bajaj Finserv logos. Returns, hosting provider, data residency and prices are not published on the pages read.

Lawrbit GCMS

Lawrbit (Gurugram) sells GCMS-India and a global edition. Its case study on a Middle Layer NBFC, Credit Saison India, describes a register of 63-plus applicable laws, 467-plus compliance obligations and 180-plus filings and returns, and its article on RBI's 31 January 2024 circular counts 456 Upper and Middle Layer NBFCs among the entities it addresses. Its system-security page says its applications are hosted on AWS with AES-256 encryption at rest and in transit, and its India product page says the AWS data centre is in Mumbai; the certifications listed on both pages are AWS's, and Lawrbit's own are not stated. Its pages give different totals for the same library (65,000-plus compliances on the home page, 80,000-plus in the article), so ask for the count with its date. Its pages say 'Middle Layer' and 'Upper and Middle Layer' in passing but do not describe the four-layer framework; named workflow roles and prices are not published on the pages read.

Komrisk (Lexplosion)

Lexplosion (Kolkata) publishes a 70K-plus compliance repository, task owners, document reviewers and automatic escalation to senior management, automatic fetching of updates from central, state and municipal websites, and ISO 27001 with VAPT. Its article on RBI's compliance-tool mandate says Upper and Middle Layer NBFCs are expected to adopt a more robust approach and positions Komrisk for financial institutions; the SBR layers, the CCO mandate and returns are not described. Testimonials name Berar Finance, NeoGrowth Credit and Whizdm Innovations, and its logo wall includes Manappuram Finance and Moneyview. Its pages give different customer counts (600-plus organisations on one, 700-plus enterprises on another). A free trial is offered; prices, SOC 2 and data residency are not published.

Complinity

Complinity (Gurugram) publishes a BFSI page that describes the four-layer scale-based structure of NBFCs and Middle Layer classification, and an NBFC page that says NBFCs submit returns to RBI at regular intervals, naming monthly and annual returns on capital adequacy, asset classification and provisioning, and deposit acceptance. Its site states 3,000 laws, 40,000 compliances, role-based access, real-time legal updates, and ISO 9001, ISO 27001, ISO 27701, SOC 2 and CERT-In certification on a cloud service, with on-premise case by case. It is the only vendor here that shows prices: 15,000 a month for two users, 25,000 for five and 35,000 for ten, each for one entity, plus one-time implementation charges, with an enterprise tier and no currency symbol on the page. Its gated case study on 'India's leading NBFC' names no customer. The CCO mandate and data residency are not published on the pages read.

eQomply and Fintellix

Two other tools surface for NBFC compliance searches. eQomply (QomplySuite) publishes RBI compliance for banks and NBFCs aimed at compliance heads and CCOs, with tasks assigned by role, department or entity; it publishes no counts, certifications, prices or hosting, and names one customer. Fintellix (Bengaluru) is regulatory-reporting software for RBI returns, loan-loss calculation and risk-based supervision rather than an obligations register; its home page does not mention NBFCs. Neither is assessed further here.

IntelloSync (IntelloComply with IntelloVendor)

We build this product, so read this section as the vendor's own account; the other sections are taken from each vendor's pages. IntelloComply is the compliance module of the IntelloSync platform. It maps the register that applies to your entities, states and sector at onboarding, from the Acts, circulars, licences and contracts that govern you, and reads 15 official regulator sources every night, proposing each change as an edit for a person to approve. It ships with 300+ cited statutory obligations, 340+ controls, 43 business-event triggers and 46 licence types, with an owner, a reviewer and filing evidence on each obligation. For an NBFC, IntelloVendor in the same tenant keeps the outsourcing register: a materiality rubric that tiers suppliers, an RBI material-outsourcing assessment that includes the inspection-rights test, a clause playbook for RBI outsourcing terms that treats inspection language conditioned on the provider's consent as a failure, and a Governance report with the half-yearly material-outsourcing extract for the Risk Management Committee and the Board. Because contracts, vendors and compliance share one repository, a contractual or third-party obligation sits in the same register as a statutory filing. It is priced by number of legal entities with unlimited users and AI included, with a 30-day free trial. IntelloSync is ISO/IEC 27001:2022 certified and headquartered in Gurugram, Haryana. We do not publish an SBR-specific obligation count; the register for your layer is built and shown during the trial. Our view, as its maker: IntelloComply with IntelloVendor is the best choice for an NBFC whose outsourcing register and statutory calendar must be kept together, because the RBI outsourcing clause tests and the compliance register run in one tenant.

Which fits which

From the vendors' own descriptions, not a ranking.

• An NBFC that wants a page to say 'Scale-Based Regulation' before the demo: TeamLease RegTrack for Financial Institutions and Complinity name the layers; Finnulate names RBI Master Directions and the CCO.
• Circular ingestion as the core: Finnulate describes this as its purpose; TeamLease, Lawrbit, Komrisk and Complinity describe update teams and feeds on top of a library; IntelloComply reads regulator sources nightly and proposes edits for approval.
• A published entry price: Complinity.
• Outsourcing register with RBI clause tests in the same system as the compliance calendar: IntelloVendor with IntelloComply; the other vendors' pages do not describe an outsourcing register.
• Regulatory returns automation rather than an obligations register: Fintellix.

How to test it in a trial

A BFSI label says little until you see your own register.

• Ask the vendor to map the SBR circular and the 11 April 2022 CCO circular to obligations for your layer, with paragraph references, and count what applies to you.
• Put one supervisory return on the calendar and check that its timeline rule is stored, not a fixed date.
• Release a new RBI circular into the trial and time how long it takes to reach the register, and who approved it.
• Upload evidence for a filed return, then try to edit or delete it as the person who uploaded it.
• Run one outsourcing contract through the vendor's inspection-rights test and see whether consent-conditioned language passes.
• Ask for the library count with its unit and date in writing, and for the vendor's own certifications rather than its cloud provider's.