NBFCs are, first and foremost, a regulated business. That's the starting point for understanding almost everything else about them. You can't just set up shop and start lending money the way you might start selling a product. From day one an NBFC sits inside a licensing and supervisory structure and that structure only gets thicker as the company grows. Part of the reason is that NBFCs occupy an odd spot in India's financial system: they lend, invest and finance in ways that look a lot like banking, yet they're built and controlled through company law first, financial regulation second. That dual identity is why more than one authority ends up with a say in how an NBFC runs. It's also why "who regulates NBFCs" doesn't really have a one-line answer.
Which Authorities Actually Regulate an NBFC
Start with the basic fact. An NBFC is, before anything else, a company. It comes into existence under the Ministry of Corporate Affairs (MCA), incorporated under the Companies Act, 2013, the same as any private limited company. MCA issues the Certificate of Incorporation, keeps track of directors and capital structure and charges and receives the annual filings.
But it can't just start lending the moment it's incorporated. Once its financial-asset business crosses the threshold that makes it "principally" a financial company (broadly speaking, financial assets above 50% of total assets, and financial income above half of gross income), it needs a Certificate of Registration from the RBI, under Section 45-IA of the RBI Act, 1934. From there RBI takes over as the primary prudential regulator. Capital adequacy, asset classification, exposure limits, governance even, following the 2026 amendments, whether registration is required at all for certain low-risk entities.
If the NBFC raises money from the public through securities, say debentures, commercial paper or an IPO, then SEBI gets involved for that part of the business, through its disclosure and listing rules. Insurance-distributing NBFCs answer to IRDAI. Pension-product NBFCs answer to PFRDA. Any NBFC borrowing abroad or taking foreign investment has to satisfy FEMA too, which RBI and the government administer jointly. So a large NBFC group can end up being a "company" under MCA, a "financial institution" under RBI and an "issuer" under SEBI, all at once, all applied to the same balance sheet.
What Each Regulator Is Actually Trying to Achieve
It's easier to make sense of this if you stop thinking of it as overlapping red tape and instead ask what each regulator actually cares about.
MCA cares about corporate governance and financial transparency. Not whether the loan book is risky. It wants accurate books, disclosed related-party dealings, directors who answer to shareholders and statutory filings AOC-4 for financials, MGT-7 for the annual return reaching the Registrar of Companies on time. Its main NBFC-specific tool is Division III of Schedule III to the Companies Act, a format MCA notified back on October 11, 2018 and expanded substantially on March 24, 2021. It prescribes exactly how an NBFC following Ind AS has to lay out its balance sheet, its profit and loss, its notes to accounts. This is actually where MCA and RBI's interests overlap in practice: Schedule III says that if RBI requires a disclosure it doesn't itself cover, that RBI requirement still applies on top of the Companies Act format. So an NBFC's financial statements end up doing double duty in one document satisfying MCA's format and audit-trail rules while carrying RBI's risk disclosures in the same set of notes.
RBI cares about financial stability and credit discipline. Shareholder disputes barely register with it. What matters is whether the NBFC can absorb losses, whether it's leaning too hard on one borrower or sector, and whether a failure there would hurt depositors or spill into the wider credit market. So its disclosure asks, layered on top of whatever MCA already requires, are about exposures, divergence in asset classification, liquidity coverage for the bigger NBFCs, covenant breaches. Not boardroom procedure.
SEBI cares about market integrity and investor protection, but only for the slice of an NBFC's business that touches public investors bond issuances, listed debt and for NBFC-Upper Layer entities, the listing requirement RBI has set within three years of that classification. SEBI isn't looking at the loan book at all. It wants to know whether people buying an NBFC's paper are getting accurate, timely information.
Put simply, MCA wants clean books and accountable boards. RBI wants a lender that's financially sound and won't rattle the system. SEBI wants an honest counterparty for anyone buying its securities. None of the three is doing the other's job they're just asking different questions of the same company.
What Compliance Actually Looks Like Across All Three
Strip away the jargon and a mid-sized NBFC's standing compliance list looks something like this, whatever specific category it falls into.
-
MCA filings. Annual return (MGT-7), financial statements (AOC-4), statutory registers kept up to date, board and shareholder approvals for related-party transactions under Section 188.
-
RBI registration and prudential reporting. The NBS series of periodic returns, capital adequacy computation, asset classification and provisioning and now, since the 2026 amendments, a Board-approved Credit Risk Management Policy that specifically covers related-party lending.
-
Dual-format financial statements. Ind AS accounts laid out per Schedule III Division III, carrying MCA's standard corporate disclosures and RBI's exposure and governance disclosures in the same notes.
-
Statutory and joint audits, mandatory since the 2021 audit framework for larger NBFCs, complete with tenure caps and a cooling-off period before an auditor can be reappointed.
-
SEBI compliance, but only if the NBFC has listed debt or equity disclosure filings, listing obligations and for NBFC-UL entities, work toward the RBI-mandated listing deadline.
-
FEMA filings, only if there's foreign investment or overseas borrowing involved reporting on end-use and maturity compliance to RBI's foreign exchange department.
None of this overlap is accidental. RBI, MCA and SEBI are each pulling their own thread out of the same rope and it's the NBFC's compliance team that has to weave all three into one filing calendar.
What the Government Is Actively Debating Right Now
RBI hasn't treated this framework as finished. Through 2025 and 2026 it's been reopening pieces of it and a few of these live debates are worth knowing about.
Take the new light-touch registration category first. The April 2026 exemption lets "Unregistered Type I NBFCs" entities under ₹1,000 crore with no public funds and no customer interface skip registration altogether. Almost immediately, critics pointed out the obvious risk: a corporate group could route lending through an internal entity purely to duck the requirement. RBI's fix so far has been to widen what counts as "public funds" to catch indirect receipts through group entities and to add an annual Board resolution plus an exception report the moment conditions are breached. Whether that closes the gap or just narrows it is still being argued.
Then there's the Upper Layer listing mandate, which is genuinely under strain. Systemically important NBFCs are supposed to list within three years of being classified NBFC-UL, but a large NBFC-UL group recently chose to exit the framework entirely rather than go public. That rather undercuts the point. It exposed something critics had been saying for a while asset size alone doesn't tell you much about actual risk, and a blunt listing requirement can just push big entities out of the regulated space instead of into better governance. Word is RBI is now rethinking whether size should keep driving UL classification at all.
Compliance is getting a formal upgrade too. Draft NBFC Compliance Function Directions, 2026 would swap out RBI's older, circular-based 2022 approach for a proper regulatory framework. Chief Compliance Officers would get statutory access to records and real-time, tech-enabled monitoring would replace after-the-fact manual checks.
And mis-selling hasn't gone away as an issue. RBI's February 2026 policy statement called for tighter rules on how NBFCs sell insurance and other third-party products alongside loans, plus a harmonised recovery-agent framework with certified training and clearer grievance channels. Both are a direct response to borrower complaints that had been building up.
Read together, these point in one direction. RBI is fine loosening its grip on the genuinely low-risk edge of the sector but it's tightening things considerably at the systemically important core governance, related-party dealings, consumer conduct.
Challenges Facing NBFCs and How the Government Is Responding
Funding: NBFCs lack any economical method of raising deposits and hence every rupee that is loaned out is sourced from borrowing. In November 2023, RBI increased the risk weight applicable to loaning money to NBFCs by banks to 125% from 100%, and as a result, the ratio of funding through banks has reduced from 22% (April 2023) to 15% (April 2024). The bond market, which is expected to become the major source of funding is thin (only nine ISIN issuances in a year by SEBI) and smaller NBFCs and NBFCs that have lower ratings suffer the most. Intervention by the government: Budget 2026 will help deepen the corporate bond market through measures like bond derivatives and municipal bonds besides the RBI backed co-lending scheme.
Asset-liability mismatch: Borrowing for providing long-term loans through short-term borrowings led to the emergence of the funding issue into a crisis for IL&FS in 2018. RBI initiative: Mandatory asset-liability management structure for NBFCs and LCR for NBFCs whose total assets are above ₹10,000 crore.
Compliance cost pressure. Overlapping regulators hit small and mid-sized NBFCs hardest worsened by Budget 2026's push to consolidate public-sector NBFCs into fewer, larger, sovereign-backed entities (the PFC/REC model). Response: exempting low-risk, no-customer-facing entities from registration, while actively encouraging consolidation among public NBFCs.
Cybersecurity. RBI's June 2026 Financial Stability Report ranked AI-enabled cyberattacks as the top risk for banks and Upper Layer NBFCs. Response: the 2025 Outsourcing Directions mandate a six-hour breach-reporting window and annual IS audits for NBFCs above ₹500 crore in assets.
None of these are quick fixes but together they target the structural weaknesses funding, liquidity, scale, security underneath the compliance framework itself.
Conclusion
An NBFC in India answers to MCA for how it's structured and how honestly it reports. It answers to RBI for whether it's financially sound and safe for the system. And depending on the activity, it may answer to SEBI, IRDAI, PFRDA or FEMA authorities too. None of this is a formality layered on for its own sake. Each regulator is solving a different problem, and a compliance calendar that treats them as one undifferentiated pile of paperwork will eventually miss something. What makes 2025–2026 a genuinely active period, rather than routine housekeeping, is that RBI is loosening the framework at one end (exempting small, closed-loop entities from registration) while tightening it at the other, through harder related-party lending rules, a more formal compliance function and closer scrutiny of how the Upper Layer listing requirement actually plays out in practice. For anyone running or advising an NBFC, the practical lesson hasn't really changed over the years: treat "compliant" as a moving target, not a box you tick once at registration.