Acquiring an existing Non-Banking Financial Company (NBFC) can help investors, fintech companies and financial groups enter the regulated lending market through an already established entity. Such an acquisition may provide access to an existing RBI registration, operational systems, employees, customers and loan portfolio. However, an NBFC takeover is more complex than an ordinary company acquisition because NBFCs operate under strict RBI regulations and continuous compliance requirements.

The buyer acquires not only the shares of the NBFC but also its past regulatory record, financial obligations, loan documentation, tax exposures, customer liabilities and contractual commitments. Any previous non-compliance, defective lending practices, pending disputes or undisclosed liabilities may continue after the takeover and create significant financial consequences. Therefore, buyers should conduct comprehensive legal, regulatory, financial, tax, operational and technology due diligence before finalising the transaction and ensure that appropriate contractual protections are included in the acquisition documents.

In this article, CA Manish Mishra talks about Common Legal Risks in an NBFC Takeover Transaction.

Regulatory Context Governing an NBFC Takeover

NBFCs are primarily regulated by the Reserve Bank of India under the Reserve Bank of India Act, 1934 and the regulatory directions issued by RBI from time to time. The principal regulatory framework includes the RBI's Scale Based Regulation framework, KYC requirements, prudential regulations, fair lending requirements and category-specific directions.

RBI's current regulatory handbook confirms that prior approval is required for a takeover or acquisition of control of an NBFC, whether or not it results in a change in management. Prior approval is also required for acquisition or transfer of 26% or more of the shareholding of an NBFC. Accordingly, an NBFC acquisition must be structured not only under the Companies Act, 2013 and contractual principles but also around the conditions and approvals prescribed by RBI.

Completing the Takeover Without Prior RBI Approval

One of the most serious legal risks is completing a share acquisition or transferring effective control before obtaining RBI's prior approval. RBI requires prior written permission in cases involving any takeover or acquisition of control of an NBFC, whether or not there is a change in management. Approval is also required where a change in shareholding results in acquisition or transfer of 26% or more of the paid-up equity capital. A change in management resulting in a change of more than 30% of directors, excluding independent directors, has also historically been covered by the prior-approval.

Therefore, the parties should avoid drafting an acquisition agreement under which ownership or effective control passes automatically on signing. RBI approval should ordinarily be treated as an important condition precedent to closing. Any premature exercise of shareholder rights, management control, board nomination rights or operational control may create regulatory concerns if it effectively transfers control before the required approval is obtained.

Incorrect Assessment of What Constitutes “Control”

A purchaser may assume that RBI approval is required only when more than 26% of the shares are purchased. This can be dangerous because the regulatory test separately covers takeover or acquisition of control, regardless of whether a specific shareholding percentage is crossed. Control may arise through voting arrangements, shareholder agreements, rights to appoint directors, affirmative voting rights or contractual arrangements that enable an investor to influence important management or policy decisions.

Accordingly, even where an investor proposes to acquire a minority shareholding, the transaction documents should be examined carefully to determine whether the rights granted to the investor amount to control. This issue becomes particularly important in structured transactions where an investor acquires less than 26% initially but receives extensive management or governance rights.

Risk Relating to the Incoming Promoters and Source of Funds

RBI scrutiny is not limited to the target NBFC. The credentials of the incoming shareholders and directors are also relevant. The RBI takeover framework requires information concerning proposed shareholders and directors, source of acquisition funds, declarations regarding specified regulatory and criminal matters, and bankers' reports concerning incoming shareholders and directors.

Therefore, an acquisition can face delays or regulatory difficulties where the buyer cannot satisfactorily demonstrate the legitimate source of funds or where the proposed promoters or directors have adverse regulatory, financial or legal histories. Before signing the transaction, the purchaser should verify the funding structure, ultimate beneficial ownership, financial capacity and regulatory background of all significant incoming shareholders.

Inadequate Regulatory Due Diligence

Many NBFC acquisitions fail to properly distinguish financial due diligence from regulatory due diligence. A company may have profitable financial statements but still carry significant RBI compliance risks. The purchaser should therefore verify the NBFC's regulatory history separately. The review should cover the validity of its CoR, exact classification, applicable regulatory layer, RBI returns, correspondence with RBI, supervisory observations, inspection findings, penalties, show-cause notices and any commitments previously given by the company to the regulator.

The purchaser should also determine whether the NBFC has complied with all conditions attached to its registration or any specific approval granted by RBI. A regulatory violation that occurred before the takeover does not automatically disappear merely because the shareholders have changed.

Risk of Incorrect NBFC Classification

Not all NBFCs operate under identical regulatory requirements. Under RBI's Scale Based Regulation framework, NBFCs are placed within different regulatory layers depending on their category, size, activity and systemic importance. Higher layers are subject to progressively enhanced regulatory requirements. RBI's framework also contains category-specific requirements for specialised NBFCs.

A buyer should therefore verify whether the target is an NBFC-ICC, NBFC-MFI, NBFC-Factor, Core Investment Company, NBFC-P2P, Account Aggregator, Housing Finance Company or another regulated category. If the acquirer's intended business model differs substantially from the target's existing classification, additional regulatory approvals or restructuring may be necessary. Acquiring an NBFC registered for one business model with the intention of immediately carrying on a substantially different regulated activity without analysing the applicable RBI requirements can create serious compliance problems.

Net Owned Fund and Capital Adequacy Risk

An NBFC's regulatory capital position is one of the most important matters in an acquisition. The buyer should not rely solely on the share capital appearing in the balance sheet. It should calculate the company's Net Owned Fund (“NOF”) in accordance with the applicable RBI rules and verify whether the target satisfies the minimum capital requirement applicable to its category.

Adjustments may be required for accumulated losses, intangible assets, deferred revenue expenditure and other items while assessing regulatory capital. The purchaser should also examine applicable capital adequacy requirements, leverage ratios and other prudential requirements. A company may appear adequately capitalised for Companies Act purposes while still failing RBI's regulatory capital requirements. Any capital shortfall should be identified before completion and reflected in the transaction valuation and capital infusion plan.

Hidden Problems in the Loan Portfolio

A major portion of the value of an operating NBFC may lie in its loan book. At the same time, the loan portfolio can be one of the biggest sources of legal and financial risk. The buyer should examine whether loans were properly sanctioned, documented and disbursed. Security documents, guarantees, mortgages, hypothecation agreements, promissory notes and other collateral documentation should be reviewed.

The purchaser should also verify whether the company correctly classified overdue accounts, non-performing assets and stressed accounts and made appropriate provisions. A loan shown as recoverable in the financial statements may have little economic value if security has not been properly created, documentation is defective, limitation periods have expired, borrower disputes exist or enforcement rights are weak. Accordingly, a sample-based legal audit of major loan accounts is often necessary in addition to financial due diligence.

Incorrect NPA Classification and Provisioning

Understatement of non-performing assets can materially distort the valuation of an NBFC. The target may have historically classified stressed borrowers incorrectly, capitalised unpaid interest, granted repeated restructuring arrangements or otherwise presented the portfolio more favourably than justified under applicable regulations. If such problems are identified after completion, the purchaser may need to make substantial additional provisions, causing an immediate reduction in net worth and profitability.

NPA classification should therefore be tested independently using loan-level repayment data rather than relying only on management representations or audited financial statements. The purchaser should also review write-offs, settlements, restructuring, evergreening indicators and recovery practices.

KYC and Anti-Money Laundering Non-Compliance

NBFCs are regulated entities for purposes of KYC and anti-money laundering requirements. RBI's KYC operates alongside the Prevention of Money Laundering Act, 2002 and related rules. RBI further amended its KYC Directions in June 2025, reinforcing customer protection and due-diligence requirements.

The buyer should verify whether proper Customer Due Diligence was conducted, beneficial owners were identified, records were maintained and appropriate monitoring processes were followed. Deficiencies in KYC records can be particularly serious where the NBFC has a large retail customer base or operates through digital channels. Post-acquisition remediation of thousands of incomplete customer files can involve considerable expense and operational disruption.

Digital Lending and Fintech Compliance Risk

Where the target conducts digital lending, the due-diligence exercise should examine its entire digital lending ecosystem. RBI confirmed that the Reserve Bank of India (Digital Lending) Directions, 2025 consolidated requirements for digital lending, including customer-centric requirements concerning loan offers and relationships involving Lending Service Providers. The purchaser should examine all arrangements with Lending Service Providers (“LSPs”), Digital Lending Apps (“DLAs”), technology vendors, collection agencies and fintech partners.

Particular attention should be given to customer consent, data collection, disclosure of loan terms, Key Facts Statements, Annual Percentage Rate disclosures, disbursement and repayment flows, grievance redressal mechanisms and outsourcing practices. Where the business depends heavily upon third-party lending apps or fintech platforms, legal deficiencies in those arrangements may directly affect the commercial value of the NBFC.

Customer Protection and Fair Lending Risk

Historical customer practices should also be reviewed. The buyer should examine interest-rate disclosures, processing charges, penal charges, recovery practices, loan agreements, Key Facts Statements, grievance records and complaints received from borrowers. RBI has increasingly emphasised customer protection, transparency and fair lending. Its 2024-25 regulatory programme included implementation of Key Facts Statement requirements for retail and MSME loans and continued focus on consumer protection.

Aggressive recovery practices, undisclosed charges or unclear loan terms may result in customer disputes, regulatory action and reputational damage after the acquisition. The buyer should therefore analyse not merely whether the loans are profitable but whether the underlying lending practices are legally sustainable.

Fraud and Employee Misconduct Risk

Historical fraud is another important takeover risk. An NBFC may have suffered employee fraud, forged loan documents, fictitious borrowers, unauthorised disbursements, diversion of funds or manipulation of accounts. RBI issued comprehensive Fraud Risk Management Directions for NBFCs in 2024, reflecting the regulatory emphasis placed on fraud governance and detection.

Due diligence should therefore include examination of internal audit reports, fraud registers, whistle-blower complaints, suspicious transactions, employee disciplinary records and regulatory fraud reporting. A purchaser should be particularly cautious where rapid historical loan growth is not supported by corresponding improvements in underwriting and internal controls.

Related-Party Transactions and Promoter Exposure

Closely held NBFCs may have significant transactions with promoters, directors or related entities. The purchaser should review loans, guarantees, investments, service arrangements, leases and other transactions involving promoter-group entities. Such transactions can create several risks. They may be inadequately documented, conducted on non-commercial terms, inconsistent with regulatory exposure norms or used to divert funds from the NBFC.

The transaction documents should therefore clearly identify related-party exposures that must be repaid, unwound or regularised before closing. Where recovery from promoter-related borrowers is doubtful, appropriate adjustments should be made to the purchase price.

Non-Compliance with the Companies Act, 2013

An NBFC remains a company under the Companies Act, 2013 in addition to being regulated by RBI. The buyer should therefore conduct a complete corporate-secretarial review covering incorporation records, Memorandum and Articles of Association, statutory registers, annual filings, board meetings, shareholder meetings, share issuances, transfers, charges and related-party transactions.

The ownership structure should be reconciled with the register of members, share certificates and MCA filings. Particular attention should be given to disclosures of beneficial interest under Sections 89 and 90 of the Companies Act and the Significant Beneficial Ownership Rules. Under the SBO framework, certain indirect holdings, voting rights or significant influence can create reporting obligations. Where applicable, the parties should also verify compliance with requirements relating to holding and transferring securities in dematerialised form.

Defective Title to Shares

Before paying acquisition consideration, the purchaser must verify that the selling shareholders actually hold valid and transferable title to the shares. Shares may be subject to pledges, liens, contractual restrictions, shareholder agreements, court orders or other encumbrances. The company's Articles of Association may contain rights of first refusal, pre-emption rights or board approval requirements.

The purchaser should inspect the register of members, share certificates or demat records, historical allotments and transfers and any pledge documentation. Any break in the chain of title can delay or invalidate the proposed transfer and may also create disputes with previous shareholders.

Existing Lender and Change-of-Control Restrictions

An NBFC may have significant borrowing arrangements with banks, financial institutions, debenture holders or other lenders. Financing documents commonly contain restrictions on changes in shareholding, promoter status, management or control. Therefore, RBI approval alone may not be sufficient to complete the acquisition.

The purchaser should examine all material financing agreements to determine whether lender consent or prior notification is required. Failure to obtain necessary consent could constitute an event of default, allowing lenders to accelerate repayment or enforce security. This can create a serious liquidity problem immediately after takeover.

Contractual Change-of-Control Clauses

Similar restrictions may exist in commercial contracts. Technology agreements, fintech partnerships, co-lending arrangements, service agreements, leases, insurance policies and major vendor contracts may contain termination or consent provisions triggered by a change in control.

The purchaser should identify all material contracts and determine whether the proposed transaction permits the counterparty to terminate, renegotiate or suspend services. This issue is particularly important where the NBFC depends on one or two technology platforms for loan origination, underwriting or collections.

Litigation and Regulatory Proceedings

A target NBFC may be involved in litigation as claimant or defendant. The purchaser should examine proceedings before civil courts, consumer forums, High Courts, the Supreme Court, Debt Recovery Tribunals, NCLT, tax authorities, RBI and other regulatory bodies. Borrower litigation deserves particular attention because a large portfolio of small disputes may collectively become material.

The buyer should also investigate threatened claims rather than relying solely on cases appearing in public databases. Notices issued by regulators, tax departments, customers or former employees may represent future liabilities even where formal proceedings have not yet commenced.

Tax Exposure

An NBFC takeover through a share acquisition results in the same corporate entity continuing after closing. Consequently, historical tax liabilities generally remain within the target. Due diligence should therefore cover income tax, TDS, GST and other applicable fiscal liabilities.

The purchaser should verify assessments, notices, disputed demands, pending refunds, withholding-tax compliance and positions adopted in earlier returns. Tax treatment of bad debts, provisioning, interest income and related-party transactions should also be reviewed. The acquisition itself may create separate tax and stamp-duty consequences for the seller, purchaser or company depending upon the transaction structure. Appropriate tax representations and indemnities should therefore be included in the acquisition documents.

Foreign Investment and FEMA Risks

Additional complexity arises where the purchaser or incoming investor is a person resident outside India. Foreign investment in regulated financial services is generally permitted up to 100% under the automatic route, subject to the activities being regulated by a recognised financial-sector regulator and compliance with sector-specific conditions.

However, the transaction must also comply with the Foreign Exchange Management Act, 1999, the Foreign Exchange Management (Non-Debt Instruments) Rules, 2019, pricing requirements, reporting obligations and any applicable Government approval requirements. The NDI Rules have also been amended from time to time, including amendments issued in 2024 dealing with matters such as control and transfer arrangements. Therefore, where a foreign purchaser is involved, RBI takeover approval and FEMA compliance must be examined separately. Compliance with one regulatory framework does not automatically satisfy the other.

Data Privacy and Cybersecurity Risk

Modern NBFCs hold significant quantities of customer information, including identity documents, financial information, bank details, credit records and contact information. A purchaser should determine where customer data is stored, who can access it, whether third parties process it and whether historical data breaches or cybersecurity incidents have occurred.

Technology due diligence should cover access controls, encryption, backup systems, incident-response procedures, cloud arrangements and cybersecurity audits. Weak information-security systems can require major investment after acquisition and may expose the NBFC to regulatory, contractual and reputational liability. Digital NBFC acquisitions should therefore include specialist technology and cybersecurity due diligence rather than limiting the review to legal documents.

Employment and Management Risks

An acquisition frequently involves replacement of promoters, directors or senior management. The buyer should identify key employees and understand employment contracts, remuneration arrangements, incentives, notice periods, employee disputes and confidentiality obligations. The purchaser should also determine whether the target has personnel with adequate financial-sector and compliance experience.

For Middle Layer and Upper Layer NBFCs, RBI has prescribed requirements concerning an independent compliance function and Chief Compliance Officer. Replacing the entire existing management immediately after takeover without a transition plan may therefore create operational and regulatory difficulties.

Public Notice Requirement

Even after obtaining RBI approval, the parties must pay attention to the prescribed public-notice process. Under the RBI takeover framework, a public notice of at least 30 days is required before effecting the sale or transfer of ownership or control. The notice is given after obtaining RBI's prior permission and contains prescribed information concerning the transaction.

The transaction agreement should therefore provide sufficient time between RBI approval and final closing. Ignoring this step or transferring shares immediately upon receipt of RBI approval may result in procedural non-compliance.

Inadequate Representations and Warranties

Due diligence can reduce risk but cannot uncover every historical problem. A well-drafted Share Purchase Agreement should therefore contain detailed representations and warranties from the sellers covering regulatory compliance, accounts, loan assets, taxes, litigation, employees, ownership, contracts and information provided during due diligence.

The agreement should specifically address the validity of the RBI CoR, compliance with applicable RBI directions, accuracy of regulatory returns and absence of undisclosed regulatory correspondence. Generic corporate representations are rarely sufficient for an NBFC transaction because the target operates within a specialised regulatory.

Weak Indemnity Protection

Representations are meaningful only if the purchaser has an effective remedy when they prove incorrect. The acquisition agreement should contain appropriate indemnification for identified and unidentified historical liabilities. Specific indemnities may be appropriate for existing tax proceedings, regulatory violations, defective loan accounts, litigation or related-party transactions identified during due diligence.

The purchaser should also evaluate the financial capacity of the sellers to honour indemnity claims after receiving the purchase consideration. Depending upon negotiations and applicable law, parties may consider mechanisms such as escrow, holdback of consideration or deferred payments to provide practical protection against post-closing claims.

Paying the Full Purchase Price Before Regulatory Conditions Are Satisfied

Another transactional risk arises when the buyer pays substantial consideration before RBI approval and other conditions precedent are completed. If approval is delayed or refused, recovering the funds may become difficult.

The transaction agreement should clearly separate signing from closing and specify how consideration will be handled during the interim period. The agreement should also provide for termination where regulatory approval is not received within an agreed period and state what happens to deposits or advance consideration.

Failure to Control the Business Between Signing and Closing

There may be a significant gap between execution of the transaction agreement and completion of the takeover. During this period, the existing promoters remain in control of the NBFC. The purchaser therefore faces the risk that the sellers may issue new loans, incur debt, dispose of assets, enter related-party transactions, alter employee arrangements or otherwise change the business.

The Share Purchase Agreement should contain appropriate interim operating covenants requiring the NBFC to operate in the ordinary course of business while respecting the regulatory limitation that the purchaser should not prematurely exercise control before approval.

Post-Takeover Compliance Failures

Closing the share acquisition is not the final compliance step. After completion, the company may need to update its board, statutory registers, beneficial ownership records, authorised signatories, banking mandates and regulatory records. Applicable filings under the Companies Act, FEMA and RBI framework should be completed within the prescribed timelines.

The new management should also review the NBFC's policies, internal controls, risk framework, compliance calendar and regulatory reporting system immediately after takeover. A structured 100-day post-acquisition compliance programme can help identify and correct inherited deficiencies before they develop into larger regulatory problems.

How Buyers Can Reduce Legal Risk

The most effective method of reducing takeover risk is to begin detailed due diligence before agreeing on the final valuation. Regulatory, legal, financial, tax, technology and operational teams should work together because many NBFC risks overlap. For example, defective loan documentation may create a legal risk, reduce the recoverable value of assets and also affect provisioning and regulatory capital.

The buyer should obtain complete RBI correspondence, verify the CoR independently, analyse the loan portfolio, review regulatory returns, test KYC records and reconcile the company's financial statements with regulatory reporting. Material problems identified during diligence can then be addressed through valuation adjustments, pre-closing remediation, specific conditions precedent or indemnities.

Key Documents to Review Before an NBFC Takeover

A comprehensive due-diligence exercise should ordinarily examine corporate records, RBI registration and correspondence, audited financial statements, regulatory returns, loan files, borrowing agreements, tax records, employee documents, material contracts, litigation records and technology arrangements.

The purchaser should also obtain details of customer complaints, fraud incidents, inspection observations, regulatory penalties, related-party transactions and all pending or threatened proceedings. Merely reviewing the Certificate of Registration and financial statements is not sufficient to establish that an NBFC is legally clean.

Importance of the Share Purchase Agreement

A carefully structured Share Purchase Agreement is central to protecting both parties in an NBFC transaction. The agreement should clearly identify the number of shares being transferred, purchase consideration, regulatory approvals, conditions precedent, interim conduct of business, representations and warranties, indemnities, closing mechanics and post-closing obligations.

RBI approval, public notice requirements and any lender or contractual consent should be appropriately integrated into the closing structure. Where due diligence identifies specific liabilities, the SPA should allocate responsibility for those liabilities rather than leaving them subject to general representations.

Conclusion

An NBFC takeover involves significant legal, financial and regulatory risks because the buyer acquires not only the shares of the company but also its historical liabilities, compliance record, loan portfolio, contractual obligations and tax exposures. Major risks may arise from inadequate RBI approvals, hidden NPAs, KYC and AML deficiencies, weak loan documentation, pending litigation, capital shortfalls, lender restrictions and previous regulatory violations. Therefore, the acquisition should be assessed much more carefully than an ordinary share purchase transaction.

Before finalising the purchase price, the buyer should conduct comprehensive legal, financial, tax, regulatory and technology due diligence of the target NBFC. Identified risks should be addressed through appropriate valuation adjustments, conditions precedent, seller representations, warranties, indemnities and post-closing compliance measures. A cheaper NBFC may ultimately become costly if serious historical issues exist. Therefore, successful takeover depends on acquiring a financially sound, compliant and operationally suitable NBFC.

Frequently Asked Questions (FAQs)

Q1. Why is legal due diligence important before an NBFC takeover?

Ans. Legal due diligence helps identify hidden regulatory, contractual, litigation, tax and corporate risks before acquisition. It allows the buyer to verify RBI compliance, ownership of shares, loan documentation, pending disputes and contractual obligations. Identified risks can then be addressed through price adjustments, conditions precedent, warranties or indemnities.

Q2. Is RBI approval mandatory for an NBFC takeover?

Ans. RBI prior approval is generally required for any takeover or acquisition of control of an NBFC and for specified significant changes in shareholding or management. The parties should structure the transaction so that transfer of ownership or control takes place only after obtaining the necessary regulatory approval.

Q3. What is the risk of acquiring control without RBI approval?

Ans. Acquiring effective control before obtaining required RBI approval can result in regulatory non-compliance and may affect the validity or implementation of the transaction. Buyers should avoid exercising premature management or governance rights and should make RBI approval a clear condition precedent before completing the acquisition and transferring control.

Q4. What are legacy liabilities in an NBFC takeover?

Ans. Legacy liabilities are obligations or risks arising from activities conducted before the acquisition. They may include tax demands, regulatory violations, borrower disputes, bad loans, defective KYC records, employee claims, litigation and contractual defaults. Since the same company continues after takeover, these liabilities may remain with the acquired NBFC.

Q5. How can hidden NPAs affect an NBFC takeover?

Ans. Hidden or incorrectly classified NPAs can significantly reduce the actual value of an NBFC’s loan portfolio. They may require additional provisioning, reduce profitability and weaken regulatory capital after acquisition. Buyers should independently verify repayment histories, restructuring, overdue accounts and asset classification rather than relying solely on audited financial statements.

Q6. What KYC and AML risks should buyers examine?

Ans. Buyers should verify whether the NBFC properly completed customer due diligence, identified beneficial owners, maintained required records and monitored suspicious transactions. Incomplete KYC or AML compliance can result in regulatory action and expensive remediation. Large-scale deficiencies may also disrupt lending operations and create reputational and customer-related risks.

Q7. Can the buyer inherit tax liabilities of the target NBFC?

Ans. Yes. In a share acquisition, the legal identity of the NBFC generally remains unchanged. Historical income-tax, GST, TDS and other tax liabilities therefore remain with the company. Buyers should review pending assessments, notices, disputed demands, tax returns and potential exposures and obtain appropriate tax warranties and indemnities.

Q8. Why should the buyer review the NBFC’s loan documentation?

Ans. Defective loan agreements, security documents, guarantees or charge documentation can make recovery difficult even when loans appear valuable in the accounts. Buyers should review major loan files to confirm enforceability, proper execution, security creation and limitation periods. Weak documentation may substantially reduce the recoverable value of the loan portfolio.

Q9. What is the importance of checking Net Owned Fund before takeover?

Ans. The buyer should verify whether the target satisfies the applicable Net Owned Fund and other capital requirements. Share capital shown in financial statements may not equal regulatory NOF. Any capital shortfall may require immediate or future infusion and should therefore be considered while negotiating the purchase price and transaction structure.

Q10. Can lender consent be required for an NBFC takeover?

Ans. Yes. Loan agreements and borrowing arrangements may contain change-of-control or promoter-related restrictions. A takeover without required lender consent could result in contractual default or accelerated repayment obligations. Buyers should carefully review financing documents and obtain necessary consents or waivers before completing the transaction whenever applicable.