NBFC compliance calendar: what an RBI-regulated NBFC files and when (2026)

Which RBI rulebook governs an NBFC's calendar now?

Two consolidations in nine months replaced most of what NBFC compliance teams had bookmarked. On 28 November 2025 RBI's Department of Regulation issued function-wise Master Directions for each category of regulated entity and repealed 9,445 circulars with immediate effect. Layers, governance, KYC, fair practices and the registration rules for NBFCs now sit in those 2025 Directions.

On 31 July 2026 the Department of Supervision did the same for its own instructions: 628 circulars, Master Circulars and Master Directions were consolidated into 64 Master Directions, described by RBI as the sole library of instructions administered by that department. For NBFCs the supervisory returns, the compliance function, internal audit and the auditor's report are now each a separate 2026 Direction.

The practical consequence is that the Master Direction on Filing of Supervisory Returns of 27 February 2024, which most NBFC calendars were built on, no longer governs NBFC returns. Paragraph 27 of the RBI (NBFC – Supervisory Returns) Directions, 2026 repeals the existing directions, instructions and guidelines on supervisory returns as applicable to NBFCs. A calendar row that still cites the 2024 Direction has the right dates for now but the wrong authority, and will miss the next change.

Which layer is the NBFC in?

Almost every return and governance rule below depends on the NBFC's layer under scale-based regulation, so the calendar starts there. The current text is the RBI (NBFC – Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025 of 28 November 2025. Paragraph 10 puts in the Base Layer non-deposit taking NBFCs below an asset size of 1,000 crore rupees, together with peer-to-peer lending platforms, account aggregators, non-operative financial holding companies and Type I NBFCs. Paragraph 11 puts in the Middle Layer all deposit taking NBFCs irrespective of asset size, non-deposit taking NBFCs with assets of 1,000 crore rupees and above, and standalone primary dealers, infrastructure debt funds, core investment companies, housing finance companies and infrastructure finance companies.

The Upper Layer is populated by RBI each year from NBFCs it identifies as warranting enhanced regulation (paragraph 12), and paragraph 24, as substituted by the Second Amendment Directions of 24 June 2026, sets the threshold at an asset size of 1,00,000 crore rupees and above on the latest audited balance sheet. The Top Layer will ideally remain empty (paragraph 13). Two dates follow from the layer rules themselves: paragraph 20 requires statutory auditors to certify the asset size of every NBFC in a group as on 31 March each year, and paragraph 22 applies Middle Layer rules once an NBFC reaches 1,000 crore rupees.

Net owned fund is a calendar item too. Paragraph 39 sets 10 crore rupees as the net owned fund required of an NBFC-ICC, NBFC-MFI and NBFC-Factor, with a glide path in paragraph 42 that ends on 31 March 2027, and paragraph 43 makes an NBFC that misses its step ineligible to hold its certificate of registration.

Which supervisory returns does an NBFC file, and when?

The RBI (NBFC – Supervisory Returns) Directions, 2026 apply to all categories of NBFC other than housing finance companies (paragraph 3) and took effect on issue. Paragraph 22 sets the default timelines: weekly returns run off a Friday reference date and are due on or before the Wednesday of the following week; monthly returns are due within 15 days of the reference date; quarterly and yearly returns within 21 days. Audited returns, wherever applicable, are due within five working days of the auditor's report being signed under section 134 of the Companies Act, 2013. Paragraph 23 lists the exceptions, including the statutory auditor's certificate.

The table below restates paragraph 21 for the returns most NBFCs meet. Returns specific to standalone primary dealers, core investment companies and peer-to-peer platforms are omitted. The 'who files' column is condensed; read the applicability cell in the Direction before relying on it for an entity near a threshold.

What must the compliance function, audit and the board do each year?

Compliance function. The RBI (NBFC – Compliance Function) Directions, 2026 of 31 July 2026 apply to Middle and Upper Layer NBFCs (paragraph 3). The compliance policy is reviewed at least once a year (paragraph 8), a detailed annual review of compliance goes to the Board or its audit committee (paragraph 7), the Chief Compliance Officer is appointed for a fixed minimum tenure of not less than three years (paragraph 21), and the NBFC gives prior intimation to its Senior Supervisory Manager at RBI before appointing or removing the CCO (paragraph 29). Paragraph 34 repeals the earlier compliance-function instructions, of which the circular of 11 April 2022 was the operative one for Middle and Upper Layer NBFCs.

Internal audit. The RBI (NBFC – Internal Audit Function) Directions, 2026 apply to all deposit taking NBFCs and to non-deposit taking NBFCs with assets of 5,000 crore rupees and above (paragraph 3). The Board or audit committee approves the risk-based internal audit plan (paragraph 5), and the risk assessment is conducted at least annually (paragraph 25).

Auditor's report. Under the RBI (NBFC – Auditor's Report) Directions, 2026 the statutory auditor verifies each year that the NBFC is engaged in the business of a non-banking financial institution requiring a certificate of registration under section 45-IA of the RBI Act and is eligible to hold it (paragraph 6); that certificate is the DNBS10 return in the table above. The older rule, from a 2009 circular, was within one month of finalising the balance sheet and in any case by 30 December; the 2026 rule is five working days from signing, and not later than 31 December.

Board and directors. The RBI (NBFC – Governance) Directions, 2025 apply chapter by chapter according to layer (paragraph 3). Every NBFC continues to inform RBI of any change in its directors or management (paragraph 10). Middle and Upper Layer NBFCs obtain an annual declaration from each director as on 31 March that the information already provided has not changed (paragraph 13), and file a quarterly statement on changes of directors within 15 days of the quarter's close, with the March quarter's statement certified by the auditors (paragraph 14). An NBFC with assets above 5,000 crore rupees appoints a Chief Risk Officer (paragraph 19). Separately, the RBI (NBFC – Miscellaneous) Directions, 2025 require notice of a change in the names and residential addresses of directors, or in the auditors, not later than one month after the change (paragraph 7).

Customer-facing items. The RBI (NBFC – Internal Ombudsman) Directions, 2026 of 14 January 2026 cover deposit taking NBFCs with ten or more branches and non-deposit taking NBFCs with assets of 5,000 crore rupees and above that have a public customer interface, assessed as on 31 March 2025, with later qualifiers covered six months after meeting the criteria; the ombudsman's details go to RBI within five working days of appointment and a quarterly report is due on or before the 15th of the month after the quarter (clause 16), with reports to the Board at least half-yearly (clause 13). The RBI (NBFC – Responsible Business Conduct) Directions, 2025 require a Board-approved Fair Practices Code, periodic review of compliance with it reported to the Board, and publication on the NBFC's website (paragraphs 7, 8 and 21).

What KYC and anti-money-laundering dates recur?

The RBI (NBFC – Know Your Customer) Directions, 2025 set the periodic-updation cycle: at least once every two years for high-risk customers, once every eight years for medium-risk and once every ten years for low-risk customers (paragraph 42). KYC records are uploaded to the Central KYC Records Registry within 10 days of the start of an account-based relationship (paragraph 63). Reports to the Financial Intelligence Unit – India are furnished under rules 7 and 8 of the Prevention of Money-laundering (Maintenance of Records) Rules, 2005, and paragraph 51 makes a delay beyond the Rule's time limit a separate violation.

The RBI text itself carries no day counts for those reports. FIU-IND's April 2026 AML and CFT guidelines, issued for trust and company service providers, say a suspicious transaction report is furnished promptly once the principal officer is satisfied that a transaction is suspicious, under rule 8(2). The figures often quoted in vendor calendars, seven working days for an STR and the 15th of the following month for other reports, appear in an undated FIU-IND brochure; we could not read the Rules on 9 November 2026 to confirm them, so treat those two dates as unverified until you have.

What does the Companies Act add?

An NBFC is a company first, so the Companies Act filings every company tracks sit on the same calendar: the annual general meeting, the financial statements in AOC-4 and the annual return in MGT-7 that run off it, director KYC, the deposit return, the half-yearly MSME payments return and the CSR return where applicable. Our compliance calendar article sets out those rules with their sections and sources, and the SEBI LODR items for a listed NBFC are in our LODR calendar. We could not read the Ministry of Corporate Affairs pages on 9 November 2026, so this page does not restate the Companies Act dates.

Where does IntelloComply fit?

IntelloComply builds this calendar from your entities, states and sector, with owners, reviewers and evidence, and reads official regulator sources every night. Whatever tool you use, build the NBFC calendar so that the layer is a property of the entity, each return in the table above is a rule anchored to its reference date rather than a typed-in date, and the auditor's certificate, director declarations and policy reviews carry the same owner and evidence fields as the returns. When RBI consolidates again, the rows that cite a repealed direction are the ones to re-read first, which is why every row should record its source.