- +91 80768 85539
- info@expertvuw.com
- Pan-India service available.
Home / NBFC & Fintech / NBFC Board-Approved Policy Pack
Last updated: 2 October 2026
RBI’s directions require NBFCs to adopt a set of board-approved policies covering customer conduct, KYC, liquidity, outsourcing and technology. Expertvuw drafts and updates these policies for NBFCs, mapping each one to the current RBI direction it comes from and to the NBFC’s layer and business model.
In November 2025 RBI consolidated its NBFC instructions into a set of Master Directions, and in January and July 2026 it issued further directions on the Internal Ombudsman, cybersecurity and technology risk. Policies drafted against older circulars now need to be re-mapped to the current directions.
The core pack for most lending NBFCs includes: the Fair Practices Code and grievance redressal policy under the Responsible Business Conduct Directions, 2025; the KYC and anti-money laundering policy under the KYC Directions, 2025; the liquidity risk management framework under the Asset Liability Management Directions, 2025; the outsourcing policy under the Managing Risks in Outsourcing Directions, 2025; and the IT, information security and cybersecurity policies under the Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026.
Applicability varies. For example, the Internal Ombudsman Directions, 2026 apply only to deposit-taking NBFCs with 10 or more branches and non-deposit-taking NBFCs with assets of ₹5,000 crore or more and a public customer interface. IT requirements are tiered by layer and asset size.
Expertvuw’s role is drafting, mapping and review support. Policies take effect only when adopted by the NBFC’s Board.
Based on the regulations and circulars referred to on this page. Last updated: 28 September 2026.
Board-approved FPC, published on website, with periodic Board review (Responsible Business Conduct Directions, 2025, paras 7, 8, 21).
Board-approved policy with customer acceptance, risk management, identification and monitoring (KYC Directions, 2025, para 6).
Board frames the liquidity risk management framework; ALCO headed by CEO/MD or ED (ALM Directions, 2025, paras 9, 17).
Board-approved policy required; core functions like internal audit and loan sanction cannot be outsourced (Outsourcing Directions, 2025, paras 10, 15).
Deposit-taking NBFCs with 10+ branches and non-deposit NBFCs of ₹5,000 crore+ with customer interface (IO Directions, 2026).
Board-approved IT, information security and cybersecurity policies for all NBFCs, tiered by layer (Cybersecurity Directions, 2026).
RBI inspections and compliance audits frequently find the same policy-level gaps.
Policies still citing repealed circulars rather than the 2025 and 2026 consolidated directions.
Generic documents that do not match the NBFC's products, layer or actual operating process.
Policies adopted at registration and never reviewed by the Board, despite review requirements in several directions.
Related services.
KYC and anti-money laundering compliance support for NBFCs.
Year-round RBI compliance support for registered NBFCs.
Compliance set-up for NBFCs lending through digital channels and partners.
Periodic supervisory returns filed by NBFCs on RBI's CIMS portal.
Identify policies required for the NBFC's category, layer, asset size and customer interface.
Compare existing policies with the current RBI directions and note missing or outdated clauses.
Draft or revise each policy to reflect the NBFC's products, processes and systems.
Walk through drafts with management and compliance and incorporate operational inputs.
Prepare board notes and draft resolutions for adoption of the policies.
Support website publication where required and set review dates for each policy.
Adopting a policy is the start; RBI looks for evidence that it is followed and reviewed.
Place periodic reviews of FPC compliance and grievance redressal functioning before the Board.
Amend policies when RBI updates the underlying directions, which have been revised several times in 2026.
Run periodic KYC updation by risk category as set out in the KYC Directions, 2025.
Keep ALCO minutes, outsourcing reviews and IT committee records ready for inspection.
Share your query and our team will reply during business hours.
Mainly the Master Directions issued on 28 November 2025, such as the Responsible Business Conduct, KYC, Asset Liability Management and Managing Risks in Outsourcing Directions, 2025, plus the Internal Ombudsman Directions and Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions issued in 2026.
No. It applies to deposit-taking NBFCs with 10 or more branches and non-deposit-taking NBFCs with assets of ₹5,000 crore or more that have a public customer interface. HFCs and CICs, among others, are excluded.
No. Core management functions such as internal audit, compliance and decision-making on KYC compliance and loan sanction cannot be outsourced under the Outsourcing Directions, 2025.
Yes. The Cybersecurity Directions, 2026 require a board-approved IT and information security policy for all NBFCs, with lighter requirements for Base Layer NBFCs below ₹500 crore.
Not always. The ALM Directions, 2025 exclude certain categories, such as Base Layer NBFCs without public funds, and the detailed chapter does not apply below ₹100 crore of assets.
ACS – Director, Expertvuw Management Pvt Ltd
Advisory and company secretarial work is handled by Expertvuw’s team. Audits, certifications and representation that the law reserves for Chartered Accountants, advocates or other licensed professionals are provided by independent professionals engaged for your case.