Yes!
Governance Matters
June 04, 2026
From Registration to Revocation: The RBI’s Evolving Approach to NBFC Supervision
Introduction:
On May 14, 2026, the Reserve Bank of India (“RBI”) issued a press release exercising its authority under Section 45-IA(6) of the Reserve Bank of India Act, 1934 (“RBI Act”) to cancel the Certificate of Registration (“CoR”) of 150 Non-Banking Financial Companies (“NBFCs”).1 The RBI has also declared that these entities shall not transact the business of a NBFC.2 Notably, the cancellation orders were actually effected between April 6, 2026 and April 21, 2026, which indicates that it was a structured supervision rather than a reactive action by the RBI.3 Simultaneously, seven other NBFCs have also voluntarily surrendered their CoR for reasons including amalgamation, merger, dissolution, or classification as unregistered Core Investment Companies (“CICs”) not requiring registration.4
For years, India’s NBFC sector has operated with a long tail of inactive, dormant, and lightly supervised entities retaining RBI registrations despite limited or no meaningful financial activity. May 14, 2026 action is a significant signal of the RBI’s continuing effort to clean up India’s shadow banking ecosystem and eliminate dormant, non-compliant, and potentially misused financial entities from the regulatory framework.
While the immediate effect is the removal of non-compliant entities from the regulatory perimeter, the broader significance lies in what the action reveals about the RBI’s evolving supervisory philosophy. The action reflects a decisive shift from registration-based regulation towards continuous supervision, governance-led oversight and substance-based compliance. The implications extend beyond the affected entities and are relevant to NBFC boards, promoters, investors, fintech companies, private equity sponsors and financial sector participants across the ecosystem.
At one level, the exercise may be viewed as regulatory housekeeping. However, viewed in the context of the RBI’s reforms over the last several years, the cancellations are far more significant. They indicate that regulatory authorisation is no longer treated as a one-time entry condition. Instead, registration is increasingly viewed as a continuing privilege that must be justified through ongoing compliance, governance maturity, operational substance and adherence to regulatory expectations.
Possible Regulatory Triggers Behind the Cancellation of CoRs:
Although the RBI has not publicly disclosed entity-specific reasons, several plausible explanations emerge from existing regulatory requirements and prior enforcement trends. Firstly, dormancy and abandonment can be a reason. Companies that obtained CoRs might have failed to operationalise their financial business and subsequently abandoned regulatory compliance. Under the Master Direction – Reserve Bank of India (Filing of Supervisory Returns) Directions, 2024 (“FSR Master Directions”) all NBFCs irrespective of their layer classification are required to file mandatory returns including on the RBI’s CIMS portal.5 Non-filing of such returns can be a precursor to CoR cancellation.6 The RBI’s Department of Non-Banking Supervision (“DNBS”) tracks such non-filers systematically and repeated default could ultimately lead to deregistration.
Secondly, use of CoRs as shelters for illegal digital lending can be a reason. The RBI has been previously aware of the practice wherein dormant Base Layer NBFCs rented their CoRs to predatory digital lending applications. This enabled the latter to disburse loans while evading direct regulatory scrutiny. The RBI’s Guidelines on Digital Lending explicitly mandated that the regulated entity must retain control over loan origination, underwriting, and disbursement.7 Violations of these guidelines could constitute grounds for cancellation.
Thirdly, failure to meet Net Owned Fund (“NOF”) requirements. All NBFCs are required to have a NOF as prescribed by the RBI to commence or carry on their business. Currently, different categories of NBFCs have different requirements, such as Rs. 300 crores for an NBFC-IFC and Rs. 10 crores for an NBFC-ICC, as given under the RBI (Non-Banking Financial Companies – Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025 (“RBI SBR Directions, 2025”). This serves as a shock absorber to ensure financial stability for the NBFCs and falling below the prescribed NOF can lead to cancellation of the CoR by the RBI.
Fourthly, concerns relating to digital lending and regulatory arbitrage cannot be ruled out. RBI guidance has consistently emphasised that regulated entities must retain substantive control over lending operations. Structures that effectively outsource core regulatory responsibilities may attract heightened scrutiny.
Other reasons for cancellation of CoR could be failure to comply with Know Your Customer, Anti-Money Laundering, or Prevention of Money Laundering Act requirements; and where NBFCs are considered detrimental to depositors, creditors, customers, or the broader financial system.
The IL&FS Legacy and RBI’s Evolving Philosophy
The roots of the RBI’s current supervisory approach can arguably be traced back to the lessons learned from earlier episodes of financial sector stress, including the collapse of Infrastructure Leasing & Financial Services (IL&FS). That episode demonstrated that governance failures, inadequate risk management and weak supervisory visibility within non-bank financial institutions can create systemic consequences.
In the years that followed, the RBI expanded its regulatory toolkit considerably. Enhanced governance norms, digital lending regulations, IT governance requirements, outsourcing controls and the Scale Based Regulation framework collectively reflect a regulator that is increasingly focused on resilience, transparency and accountability.
The May 2026 cancellations should therefore be viewed as another step in the RBI’s broader effort to strengthen confidence in the non-bank financial sector.
RBI’s Signalling Towards Proper NBFC Governance and Compliance:
This mass cancellation of 150 NBFCs is a signal by RBI that governance and compliance cannot be reduced to box-ticking exercises. The RBI has been progressively hardening this position by introducing various compliance related provisions for NBFCs. The Master Direction – Reserve Bank of India (Non-Banking Financial Company – Scale Based Regulation) Directions, 2023 (now withdrawn and replaced by RBI SBR Directions, 2025)first overhauled the entire governance architecture for Middle Layer and Upper Layer NBFCs by mandating additional financial disclosures and prescribing restrictions on independent directors and Key Managerial Personnel.8 Then, the RBI (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023 extended this framework to technology governance by requiring the NBFCs to establish Board-level IT Strategy Committees and robust cybersecurity infrastructure.9
A pattern of crackdown by the RBI can now also be observed. In October 2024, the RBI barred four NBFCs from sanctioning and disbursing loans on grounds of usurious pricing, deviations from Income Recognition and Asset Classification norms, and outsourcing of core financial services in violation of guidelines. December 2025 also saw the cancellation of 35 additional NBFCs for non-compliance. Now, this May 14, 2026 action escalates the crackdown, marking a definitive shift from reactive enforcement to proactive systemic cleansing by the RBI.
Moreover, the RBI reiterated this in the context of the present cancellations that holding a registration certificate is subject to continuous compliance. Regulatory relief obtained through appellate or judicial processes does not dilute an NBFC’s obligation to adhere to the law in both letter and spirit. This is a deliberate narrowing of the safe harbour that NBFC entities had historically exploited.
Consequences of the Cancellation for Stakeholders:
The consequences of this CoR cancellations will radiate across multiple stakeholders. For the deregistered entities, the legal effect under Section 45-IA(6) is immediate and comprehensive. They are prohibited from carrying on the business of a non-banking financial institution as defined under Section 45-I(a) of the RBI Act.10 Any continuation of lending, deposit-taking, or financial intermediation activities following cancellation constitutes a criminal offence under Section 58B(4A) of the RBI Act, exposing directors and officers to prosecution.11
For the existing borrowers and customers, the position is more nuanced. The deregistered NBFCs can no longer disburse fresh loans, but their existing loan agreements will remain legally enforceable. So, the borrowers are still obligated to repay their dues. Moreover, such deregistered entities will retain their right of recovery under applicable laws for the secured assets. However, borrowers can face significant difficulties as there is no centralised grievance redressal mechanism for customers of deregistered entities and the NBFCs’ internal complaint infrastructure could disintegrate on deregistration.
For the broader NBFC sector, the message is more or less clear. The RBI is not merely cleaning the NBFC registry, instead it is restructuring the entire NBFC ecosystem. NBFCs now operating within the SBR framework must treat compliance as a continuous operational obligation and not just a registration formality. The RBI’s public advisory to verify the regulatory status of financial entities before any transaction, embedded in its press communications, simultaneously shifts due diligence responsibilities onto consumers and further marginalises non-compliant players.
Questions Every NBFC Board Should Ask
In light of the RBI’s recent actions, boards should consider the following questions:
Are all supervisory returns and regulatory filings being submitted accurately and on time? Does the board receive meaningful compliance and risk reports? Are outsourcing arrangements compliant with RBI expectations? Does the organisation continue to satisfy prudential and capital requirements? Have digital lending arrangements been reviewed from a regulatory perspective? Is the IT governance framework functioning effectively? Are customer grievance mechanisms operating as intended? Is there any prolonged business inactivity that could attract supervisory concerns?
Boards that cannot answer these questions with confidence may face elevated regulatory risk.
Conclusion:
The cancellation of 150 NBFC registrations on May 14, 2026, is not merely an administrative action but a regulatory statement about the RBI’s evolving conception of financial sector’s compliance and integrity. This points to the direction that the era of using NBFCs as a passive vehicle for dubious activities might be decisively over. Further, the lesson is unambiguous that an NBFC’s CoR is not a perpetual licence. It is just a conditional grant that needs to be continuously earned through governance reliability and regulatory compliance. Boards of NBFCs, thus, must internalise this and must treat compliance architecture as a critical subject which is not peripheral in importance.
|
