RBI compliance for an NBFC lending platform comes down to four things the system has to do without being asked. Classify assets correctly every single day. Send credit information to the bureaus on the RBI’s reporting calendar. Produce the borrower disclosures the Digital Lending Directions require before a loan contract is executed. Split and settle co-lent loans the way the Co-Lending Directions prescribe.
If any of those four depend on somebody remembering to run a process at month end, the NBFC is carrying a risk the software was bought to remove.
What has changed over the last three years is not the volume of regulation. It is the frequency. The RBI has moved from asking lenders for periodic returns to asking for continuous, timestamped, borrower-level data. That single shift is why compliance has quietly turned into a software procurement question rather than a compliance team question.
The four frameworks that set system requirements
|
Framework
|
Status
|
What it demands of the system
|
|
Scale Based Regulation
|
Master Direction of 19 October 2023. The Base Layer glide path to the 90 day NPA norm completed on 31 March 2026.
|
Daily, borrower-level asset classification and layer-appropriate provisioning
|
|
Credit Information Reporting Directions, 2025
|
Master Direction of 6 January 2025. Fortnightly reporting from 1 January 2025, weekly reporting from 1 July 2026.
|
Four clean incremental extracts a month, plus a full month file and a rejection handling loop
|
|
Digital Lending Directions, 2025
|
Issued 8 May 2025, consolidating the 2022 digital lending guidelines, the 2023 DLG guidelines and the 2022 KFS circular.
|
Accurate APR, a Key Facts Statement before execution, controlled disbursal and a DLG ledger
|
|
Co-Lending Arrangements Directions, 2025
|
RBI/DOR/2025-26/139, issued 6 August 2025, in force from 1 January 2026.
|
Transaction-level splitting, escrow settlement and asset classification aligned across both partners
|
Each of these translates into something specific your platform either does or does not do. Taking them in turn.
What does Scale Based Regulation require your system to do?
Scale Based Regulation sorts every NBFC into one of four layers, Base, Middle, Upper and Top, by size, activity and systemic risk. The practical consequence for software is that asset classification and provisioning have to be computed by the system itself, daily, at borrower level, with the rules for your layer applied automatically.
Two changes matter more than the layer structure.
Classification is borrower-wise, not account-wise
If a borrower holds four loans with you and one of them crosses the overdue threshold, every one of that borrower’s accounts is affected. A system that tracks delinquency account by account will quietly understate your non-performing book. This is not a reporting error that shows up at audit. It is a daily miscalculation that compounds for as long as it runs.
The 90 day norm now applies across the sector
Base Layer NBFCs were given a phased path to the 90 day overdue standard, stepping down through 150 days and then 120 days, with full convergence by 31 March 2026. Middle and Upper Layer NBFCs were already there. That glide path has now closed, which means a Base Layer lender still running 120 day logic in its loan management system is recognising stress later than the regulation allows.
There is also the upgrade rule, which catches more lenders than any other provision in this area. An account that has slipped into non-performing status cannot be moved back to standard on a part payment. The entire arrears have to be cleared. Systems that upgrade an account the moment a payment lands will produce an asset classification the regulator does not recognise.
What to check in your own platform
- Does days past due recalculate every day automatically, or does somebody run a job
- Does classification aggregate at borrower level across all products and branches
- Is the layer-specific provisioning matrix configured, and does it pass entries to the general ledger without a manual journal
- Does the upgrade rule enforce full clearance of arrears
Why is weekly credit bureau reporting the hardest requirement right now?
Because it is the only RBI requirement that asks your system to produce a clean, complete data extract four times a month, every month, with no room to tidy it up by hand first.
The history is worth following, because it shows the direction clearly. Until the end of 2024 lenders reported to credit information companies once a month. From 1 January 2025 that became fortnightly, on the 15th and the last day. The RBI then issued amendment directions in December 2025 moving reporting to a weekly cycle, deferring the start from 1 April 2026 to 1 July 2026 after industry feedback. Since July 2026, credit institutions submit incremental data on the 9th, the 16th, the 23rd and the last day of each month, alongside a full monthly file.
Reporting that runs monthly can survive a manual step. Somebody exports a file, checks it, fixes the obvious problems and uploads it. Reporting that runs four times a month cannot survive that, because the manual step has to happen forty eight times a year and it will eventually be missed.
Three things break at this frequency.
Data quality has to be fixed at the point of capture
Credit information is submitted in the Uniform Credit Reporting Format, with separate formats for consumer, commercial and microfinance segments. Every mandatory field has to be populated correctly at origination, because there is no longer a comfortable window in which to clean it afterwards. A missing identifier captured during onboarding becomes a rejected record a few days later.
Rejections need a closed loop
Records rejected by a bureau have to be corrected and resubmitted inside the prescribed window. If your process for handling rejections is an email to the operations team, that loop will not close reliably at weekly cadence. The handling has to sit inside the system, with rejected records queued, assigned and tracked to resolution.
Asset classification and bureau reporting have to agree
The classification you report to the bureau has to match the classification in your books on the same date. When the two are produced by different systems or different extracts, they drift, and the drift is visible to the regulator because the bureau holds a timestamped record.
The RBI has signalled that it wants to move further toward near real-time reporting. Lenders choosing a platform now should assume the cadence tightens again rather than assume it settles here.
What do the Digital Lending Directions, 2025 require?
The Digital Lending Directions, 2025, issued on 8 May 2025, pulled three earlier frameworks into one rulebook: the September 2022 digital lending guidelines, the 2023 Default Loss Guarantee guidelines and the April 2024 Key Facts Statement circular. For software, the obligations fall into four groups.
The Key Facts Statement and the APR
A borrower must receive a standardised Key Facts Statement, showing the all-inclusive Annual Percentage Rate, before the loan contract is executed. Not at disbursal, before execution. Any fee that does not appear in the KFS cannot be charged later without explicit consent.
This makes the APR calculation a compliance artefact rather than a marketing number. The system has to compute it correctly for every product including every fee, generate the KFS, get it digitally signed, deliver it to the borrower and retain proof of delivery. Where an application shows offers from more than one lender, each offer has to carry its own disclosure.
Disbursal and repayment controls
Disbursements must go directly into the borrower’s bank account, with limited exceptions, and repayments must flow directly back to the regulated entity. Pass-through accounts controlled by a lending service provider are not permitted. If your origination system can be configured to disburse elsewhere, that configuration is a liability.
Default Loss Guarantee
DLG cover is capped at five per cent of the disbursed amount of the relevant loan portfolio, must be invocable within 120 days of a loan being classified as in default, and can only be provided by an entity incorporated as a company. Once invoked and revoked, the DLG amount cannot be reinstated.
Every one of those is a system requirement. The platform has to track DLG exposure at portfolio level continuously, not reconcile it quarterly, and it has to enforce the invocation window rather than rely on someone watching a calendar.
Disclosure and reporting of lending apps
Regulated entities must publish details of their digital lending products and their lending service providers, and report their digital lending apps to the RBI’s CIMS portal. Consent for every category of borrower data has to be specific, recorded and auditable, and the data has to be stored in India.
The point the RBI has made repeatedly here is that outsourcing the journey does not outsource the obligation. When a lending service provider mishandles consent or charges a borrower a fee outside the KFS, the NBFC answers for it. That makes visibility into partner activity a system requirement rather than a contractual comfort.
What changed for co-lending, and what does it mean operationally?
The Co-Lending Arrangements Directions, 2025, notified as RBI/DOR/2025-26/139 on 6 August 2025 and in force from 1 January 2026, replaced the 2020 priority sector co-lending circular. Three changes have direct system consequences.
Co-lending is no longer limited to priority sector lending
The framework now covers arrangements between regulated entities across lending activity generally. More of your book can be co-lent, which means the splitting logic has to work for every product rather than one segment.
Each partner retains a minimum of ten per cent of every individual loan
The retention floor came down from twenty per cent, and it applies loan by loan rather than at portfolio level. Your system has to hold and prove the retained share on each individual exposure.
The borrower sees one blended rate, and the bank can no longer cherry-pick
The earlier model that let a partner bank select which sourced loans to take has been removed. Selective purchase of exposures now falls under separate transfer of loan exposure rules instead.
Operationally, the hard part was never origination. It is what happens to every rupee afterwards. Each collection has to be split in the agreed proportion, settled through the escrow arrangement, and reconciled with the partner at transaction level rather than summarised monthly and argued over. Asset classification has to stay aligned on both sets of books, because a loan cannot be standard for one co-lender and non-performing for the other.
If you are evaluating a platform for co-lending, ask the vendor to run a live split and settlement on sample data in front of you. Most will describe it. Fewer can show it.
The compliance layer that sits underneath all of it
Four capabilities decide whether a lending platform can carry regulatory weight, and none of them appear on a feature list.
The first is an immutable audit trail. Every action recorded with a user, a timestamp and a reason, with no ability to edit history after the fact. This is what turns an inspection into an afternoon rather than a fortnight.
The second is role-based access with maker-checker on anything that changes money or classification. Waivers, write-offs, rate changes and manual classification overrides all need a second pair of eyes enforced by the system.
The third is data residency. Credit information and borrower data must be stored in India, and accountability stays with the regulated entity even where processing touches a foreign server.
The fourth is configurability of the rules themselves. Thresholds and reporting dates have changed three times in three years. A platform where a classification threshold is a configuration setting adapts in a day. A platform where it is written into the code adapts when the vendor schedules the work.
How to test whether your platform is actually compliance-ready
Generic assurances are worthless here. These questions produce evidence.
- Show me today’s asset classification run, and show me the borrower-level aggregation behind one classified account
- Generate this fortnight’s incremental bureau file in front of me, and show me the rejection queue from the last cycle
- Produce a Key Facts Statement for a live application, including the APR calculation, and show me the delivery and signature record
- Show me the current DLG exposure as a percentage of the relevant portfolio, calculated now rather than as of last month
- Take one co-lent loan, apply a collection, and show me the split, the settlement entry and the partner reconciliation
- Change a classification threshold in front of me. If that needs a development ticket, note how long the last one took
- Show me the audit trail for a waiver approved last week, including who approved it and on what basis
Where lenders usually fail
The failures are rarely dramatic. They look like this:
- Classification logic still running account-wise because the system was configured before the rule changed
- Bureau files prepared by exporting to a spreadsheet, which worked monthly and does not work weekly
- APR computed on the website and separately in the loan system, with the two disagreeing
- DLG tracked by the partner rather than by the lender, which leaves the regulated entity unable to answer a question about its own exposure
- Co-lending reconciliation done in a shared spreadsheet between two institutions
- Compliance reports built from a separate data warehouse that was last refreshed before the correction
Every one of those is a system gap being covered by a person. That arrangement holds until volume rises or the person leaves.
Frequently asked questions
What is RBI compliance for an NBFC lending platform?
It is the set of obligations a lending system must meet on its own: daily borrower-level asset classification under Scale Based Regulation, credit information reporting to bureaus on the RBI’s weekly calendar, borrower disclosures required by the Digital Lending Directions, 2025, and transaction-level splitting and settlement under the Co-Lending Arrangements Directions, 2025.
What is the NPA classification norm for NBFCs?
An account is classified as non-performing when principal or interest is overdue for more than 90 days. Classification is applied borrower-wise rather than account-wise. Base Layer NBFCs completed their phased move to the 90 day standard by 31 March 2026, so the norm now applies uniformly across all layers.
How often must NBFCs report to credit bureaus?
Weekly since 1 July 2026. Incremental credit information is submitted on the 9th, 16th, 23rd and last day of each month, with a full monthly file alongside it. This replaced the fortnightly cycle that had applied since 1 January 2025.
What is the Key Facts Statement requirement?
Borrowers must receive a standardised Key Facts Statement showing the all-inclusive Annual Percentage Rate before the loan contract is executed. Charges not disclosed in the KFS cannot be levied later without the borrower’s explicit consent.
What is the DLG cap under the Digital Lending Directions, 2025?
Default Loss Guarantee cover is capped at five per cent of the disbursed amount of the relevant loan portfolio. It must be invocable within 120 days of default classification, and can only be provided by an entity incorporated as a company under the Companies Act, 2013.
What is the minimum retention under the Co-Lending Directions, 2025?
Each regulated entity must retain at least ten per cent of every individual loan under a co-lending arrangement on its own books. The earlier framework required twenty per cent.
Does using a fintech partner reduce the NBFC’s compliance obligation?
No. The regulated entity remains accountable for the conduct of its lending service providers, including consent handling, fee disclosure and data protection.
Where this leaves you
The regulator has been consistent about direction even while changing the detail. Reporting gets more frequent. Classification gets stricter and more granular. Accountability stays with the regulated entity regardless of who runs the journey. A platform chosen on today’s rules alone will be behind within a year.
The question worth asking of any NBFC software you are evaluating is not whether it is compliant today. It is how quickly it was compliant the last three times the rules moved, and whether that took a configuration change or a release.
AllCloud builds lending software for NBFCs covering origination, loan management, collections and co-lending on one platform. If you want to see any of the checks above run against your own portfolio rather than a demo dataset, that is the conversation worth having.
Sources:
- Master Direction on Scale Based Regulation for NBFCs, 19 October 2023, and the Base Layer asset classification glide path concluding 31 March 2026
- Master Direction, Reserve Bank of India (Credit Information Reporting) Directions, 2025, 6 January 2025, and the December 2025 amendment directions effective 1 July 2026
- Reserve Bank of India (Digital Lending) Directions, 2025, 8 May 2025
- Key Facts Statement circular DOR.STR.REC.13/13.03.00/2024-25, 15 April 2024
- Reserve Bank of India (Co-Lending Arrangements) Directions, 2025, RBI/DOR/2025-26/139, 6 August 2025, effective 1 January 2026
.png)
.svg){kind=small}
