Key takeaways
- An NBFC follows one obligation chapter, III, IV or V, set by its layer and asset size.
- The ₹500 crore asset line separates Chapter III from Chapter IV for Base Layer NBFCs. The Middle Layer and above follow Chapter V.
- Reporting to RBI on DAKSH within six hours of detection applies under Chapters IV and V.
- The record of layer and asset size is the first thing to put on file, because it decides the rest.
On 31 July 2026 the Reserve Bank of India issued the Non-Banking Financial Companies Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026. They came into force with immediate effect. They apply to NBFCs registered under the RBI Act, 1934, the Factoring Regulation Act, 2011 or the National Housing Bank Act, 1987, unless stated otherwise.
Unlike a single bank text, the NBFC Directions do not hand every entity the same set of controls. Each NBFC follows one of three obligation chapters, chosen by its layer and asset size. The first task is to find yours.
Which chapter applies to my NBFC?
The layers and Core Investment Companies (CICs) are defined in the Scale Based Regulation Directions, 2025, which the Directions refer to. The only asset threshold in the Directions is ₹500 crore (paragraph 3).
| NBFC category | Chapter | Where the weight falls |
|---|---|---|
| Base Layer, assets below ₹500 crore, and Core Investment Companies | III | Basic IT systems, a Board-approved IT/IS policy, business continuity, tested backups |
| Base Layer, assets of ₹500 crore and above | IV | IT governance, information security, IS audit, BCP, outsourcing |
| Middle, Upper and Top Layer, excluding Core Investment Companies | V | Governance structures, a CISO, risk management, testing, DR drills, IS audit policy |
Two questions in the NBFC chapter finder give a first reading. The chapters are alternatives. A Middle Layer NBFC follows Chapter V, not Chapters III and IV as well. Chapter II (the Board's role) applies to every NBFC.
Watch for. Record the layer, CIC status and asset size on file, with the date. A change in layer or asset size changes the chapter, and a reviewer will ask how you decided.
What does the Board have to do?
Chapter II applies to every NBFC. The Board approves the technology and cybersecurity strategies and policies and reviews them at least annually (paragraph 6).
The rest depends on the chapter:
- Chapter III: the Board approves the IT/IS policy and a business continuity policy, and receives periodic reports on continuity at least once a year (paragraph 8)
- Chapter IV: the Board approves the IT policy, the information security policy and the cybersecurity policy (paragraphs 18, 20 and 22). The annual IT risk assessment is brought to the CRO, CIO and the Board (paragraph 32). The Audit Committee of the Board approves the IS audit framework (paragraph 49)
- Chapter V: the Board approves the IT, information asset, business continuity, information security and cybersecurity strategies and policies, reviewed at least annually (paragraphs 68 and 69)
What are the governance structures?
For a Base Layer NBFC of ₹500 crore and above, the IT Strategy Committee is chaired by an independent director, has the CIO and CTO as members, and meets with no more than six months between meetings. Its deliberations go to the Board (paragraph 15).
Chapter V is more demanding:
- An IT Strategy Committee of at least three directors. The chair is an independent director with at least seven years of experience managing information systems or leading technology or cybersecurity initiatives. It meets at least quarterly (paragraphs 71 and 72)
- An IT Steering Committee with senior management from IT and business, meeting quarterly (paragraphs 75 and 76)
- An Information Security Committee under the IT Strategy Committee, headed by someone from the risk management vertical (paragraph 77)
- A CISO, preferably at General Manager level or equivalent, with no direct reporting to the Head of IT and no business targets, reporting to the Executive Director or equivalent overseeing risk. The CISO presents a review of cyber risks and preparedness to the Board, the Risk Management Committee of the Board or the IT Strategy Committee at least quarterly (paragraphs 81 and 82)
What does each chapter ask for?
| Chapter | What is asked | Evidence a reviewer will want |
|---|---|---|
| III | Basic IT systems that digitise and secure core databases. A Board-approved IT/IS policy covering physical and logical access controls, a password policy, defined user roles, maker-checker controls and information security and cybersecurity controls. A Board-approved business continuity policy. Data backups with periodic testing (paragraphs 7 to 9) | Approved policy, access and role records, maker-checker configuration, backup test results, the Board’s annual continuity report |
| IV | An annual IT risk assessment (paragraph 32). IS audit at least once a year, preferably before the statutory audit (paragraph 56). BCP tested at least annually and after significant changes, using worst-case scenarios (paragraph 59). An ongoing information security training programme with a record of training status (paragraphs 35 and 36). Outsourcing with risk assessment before the arrangement, and written contracts covering monitoring, audit rights and RBI access (paragraphs 60 to 64) | Risk assessment report, IS audit report, BCP test records, training repository, vendor assessments and contracts |
| V | VA of critical systems and customer-facing DMZ systems at least every six months, PT at least every 12 months, by independent experts, with time-bound remediation (paragraphs 121 to 125). DR drills for critical systems at least half-yearly, with the DR site used as primary for at least one full working day (paragraphs 129 to 131). Audit trails on systems that touch critical or sensitive information, monitored regularly (paragraphs 109 to 111). A vendor risk process for IT and cyber third-party arrangements outside the outsourcing Directions (paragraph 117). An IS Audit Policy approved by the Audit Committee and reviewed at least annually (paragraph 150) | VA and PT reports with a closure tracker, DR drill reports, log and audit trail configuration, third-party assessments, the IS Audit Policy and its review record |
How fast must a cyber incident be reported?
Within six hours of detection, on the DAKSH platform. This is stated in paragraph 28 for Chapter IV and in paragraph 141 for Chapter V. Under Chapter V, CERT-In is also notified proactively. Housing finance companies continue to report to the National Housing Bank, not to RBI, under the note to paragraph 141.
The Directions do not prescribe a record format. A record that supports a six-hour claim shows the detection time, who decided it was reportable, when and where it was submitted, and the follow-up actions. Our guide to CERT-IN 6-hour incident reporting sets this out in more detail.
Tip. Disaster recovery drills that fail are not the end of the matter. Chapter V asks that major issues from a failed drill are resolved and retested before the next cycle (paragraph 130), so keep the retest as part of the drill record.
What evidence will a supervisor ask for?
Reviewers start with the chapter that applies and then look for proof that each requirement operated. In practice that means:
- 1The basis for the chapter: layer, CIC status, asset size and the date of the assessment
- 2Board approval of policies, and the annual review of them
- 3Committee constitution and minutes, at the frequency the chapter sets
- 4Test and drill reports with remediation tracked to closure
- 5An incident register with detection times and the submissions made
- 6Outsourcing and third-party files, with audit and RBI access clauses in contracts. See our vendor assessment checklist
- 7IS audit reports and the follow-up on their findings
A checklist to start from
Tick what you already have.
Where the work usually gets stuck
The reading is rarely the hard part. Committees drift beyond their meeting interval. Policies are approved once and not reviewed on the annual date. Test findings stay open. The chapter was chosen on assumption, with no note of why. And evidence sits in email and shared folders when someone asks for it.
How this is run as owned work in Netra
Give every requirement an owner and a due date, and let the evidence build as the work is done. The RBI CTRRAF 2026 for NBFCs page describes how the Direction is loaded in Netra as requirements, tasks and policies for the chapter that applies. Evidence is attached once and shown against every requirement it supports, and status is derived from completed work and evidence, not typed in. Annual, half-yearly and quarterly obligations reopen on their own, and the Audit Centre holds IS audit findings with their corrective actions. The NBFC still decides its chapter and remains responsible for implementation. For related reading, see the compliance audit readiness checklist.
This article is a summary for general information. It is not legal advice. Confirm how the Directions apply to your company with your compliance and legal teams, and read the Directions themselves.
Frequently asked questions
Which chapter applies to a Middle Layer NBFC?
Chapter V, together with Chapter II on the Board. Chapter V covers the Middle, Upper and Top Layers, and excludes Core Investment Companies.
Where does a Base Layer NBFC with assets of ₹500 crore or more fall?
Chapter IV. A Base Layer NBFC with assets below ₹500 crore follows Chapter III instead, as do Core Investment Companies.
How quickly must an NBFC report a cyber incident?
Within six hours of detection, on the DAKSH platform, under Chapters IV and V. Under Chapter V, CERT-In is notified proactively too, and housing finance companies continue to report to the National Housing Bank.
Do all NBFCs run vulnerability assessments every six months?
No. The six-monthly vulnerability assessment, annual penetration test and half-yearly disaster recovery drill for critical systems are Chapter V requirements.
Sources
The NBFC Directions, loaded as owned work
Requirements, tasks and policies scoped to your chapter, with status derived from evidence.
See it in Netra
A demo on the frameworks that matter to you.
