Corporate governance is one of the most important aspects of running a Non-Banking Financial Company (NBFC) in India. Since NBFCs are involved in lending, investment, financing and other financial activities, their operations directly affect borrowers, investors, lenders and the broader financial system. Weak governance can lead to poor credit decisions, excessive risk-taking, conflicts of interest, financial irregularities and regulatory non-compliance.

The Reserve Bank of India (RBI) has therefore prescribed various corporate governance requirements for NBFCs. These requirements focus on Board oversight, risk management, internal controls, audit, compliance, remuneration, customer protection and transparency. The extent of governance requirements depends on the size, complexity and regulatory classification of the NBFC. Under the Scale Based Regulation approach, NBFCs are classified into different regulatory layers. As the size and systemic importance of an NBFC increase, the governance and risk management expectations also become more complete.

In this article, CA Manish Mishra talks about Corporate Governance Requirements for Indian NBFCs.

What is Corporate Governance for NBFCs?

Corporate governance refers to the system through which an NBFC is directed, managed and supervised. It establishes how important decisions are taken, who is responsible for those decisions, how risks are monitored and how management remains accountable to the Board and other stakeholders. For an NBFC, corporate governance is particularly important because lending decisions involve significant financial risks.

Poor governance can result in weak credit assessment, concentration of exposure, inadequate monitoring of borrowers and ultimately an increase in non-performing assets. A strong governance structure ensures that the Board provides effective oversight, management follows approved policies, risks are identified in advance and compliance responsibilities are clearly assigned. It also promotes transparency and accountability in the organisation.

RBI's Scale-Based Approach to NBFC Governance

RBI follows a Scale Based Regulation approach under which NBFCs are classified according to their size, activities, complexity and systemic importance. The major regulatory layers are the Base Layer, Middle Layer and Upper Layer, with the possibility of a Top Layer for exceptional circumstances. The governance requirements become more detailed as an NBFC moves towards the higher regulatory layers. This approach recognises that a large and complex NBFC can create greater risks for the financial system and therefore requires stronger governance mechanisms.

NBFC Base Layer

The Base Layer generally includes smaller and less complex NBFCs that have a comparatively lower level of systemic risk. However, being placed in the Base Layer does not mean that an NBFC is exempt from governance responsibilities. Base Layer NBFCs are expected to maintain appropriate Board oversight, risk management systems and internal controls. They should ensure that directors understand the business and that important financial and operational risks are appropriately monitored. The Board should regularly review the company's financial position, business activities and compliance status and ensure that management follows applicable RBI requirements.

NBFC Middle Layer

The Middle Layer contains NBFCs that have a greater size, complexity or risk profile. As a result, these entities are subject to enhanced corporate governance requirements. Applicable NBFCs in this layer are required to establish appropriate Board committees, including an Audit Committee, Nomination and Remuneration Committee and Risk Management Committee, as prescribed.

These committees provide specialised oversight over financial reporting, risk management, internal audit, appointments, remuneration and other important areas. The objective is to ensure that important decisions receive appropriate independent review instead of being concentrated entirely with executive management.

NBFC Upper Layer

The Upper Layer consists of NBFCs identified by RBI for enhanced regulatory supervision based on factors such as size, complexity, interconnectedness and systemic importance. Such NBFCs are subject to stronger governance expectations because weaknesses in their operations may have a greater impact on the financial system.

These entities are expected to maintain robust Board structures, specialised committees, comprehensive risk management systems and enhanced disclosure practices. Their governance arrangements should be capable of handling complex financial and operational risks.

Role of the Board of Directors

Board Oversight

The Board of Directors has the primary responsibility for providing strategic direction and effective oversight of an NBFC. The Board should understand the company's business model, financial position, major risks and regulatory obligations. Board oversight involves reviewing important matters such as asset quality, capital position, liquidity, credit concentration, risk exposure, regulatory compliance and customer-related concerns.

The Board should not simply approve proposals placed before it by management. Directors should critically evaluate significant decisions, ask relevant questions and ensure that adequate information is available before taking decisions.

Relevant Experience of Directors

An NBFC requires directors who understand the financial services sector and can effectively evaluate issues relating to lending, credit risk, compliance and financial management. RBI has prescribed requirements relating to relevant experience for directors of applicable NBFCs.

Having directors with appropriate banking or NBFC experience helps the Board understand the specific risks associated with financial services. The expertise of directors becomes particularly important when an NBFC operates in specialised areas such as digital lending, housing finance, infrastructure finance or complex investment activities.

Fit and Proper Criteria for Directors

RBI places importance on ensuring that individuals appointed to the Board of an NBFC are suitable to hold such positions. The fit and proper assessment generally considers factors such as integrity, reputation, competence, experience and overall suitability.

An NBFC should have a Board-approved policy for assessing the fit and proper status of directors. The assessment should be properly documented and carried out in accordance with applicable regulatory requirements. The purpose is to ensure that individuals responsible for directing an NBFC possess the required competence and integrity and do not create additional governance or reputational risks for the organisation.

Audit Committee of the Board

The Audit Committee is an important component of corporate governance for applicable NBFCs. It provides oversight over financial reporting, internal audit, internal controls and other audit-related matters. The committee reviews significant audit observations and ensures that management takes appropriate corrective action.

It can also examine whether financial information presented by the company is accurate and whether internal controls are operating effectively. The Audit Committee therefore acts as an important link between the Board, management, internal auditors and other assurance functions.

Nomination and Remuneration Committee

The Nomination and Remuneration Committee focuses on leadership, appointments and remuneration-related matters. Its purpose is to ensure that directors and senior management are selected through an appropriate and transparent process.

The committee may evaluate the qualifications, experience and suitability of candidates for senior positions and consider succession planning requirements. It also plays an important role in ensuring that remuneration practices do not encourage excessive risk-taking. Compensation should be appropriately linked with long-term performance, responsibilities and the risk profile of the NBFC.

Risk Management Committee

Risk management is central to the functioning of an NBFC because its business involves several types of financial and operational risks. The Risk Management Committee provides oversight over the identification, assessment and management of significant risks.

Depending on the nature of the NBFC's business, these may include credit risk, liquidity risk, market risk, operational risk, technology risk and cybersecurity risk. The committee should regularly review the company's risk profile and ensure that appropriate controls and mitigation measures are implemented.

Chief Risk Officer

Certain NBFCs are required to appoint a Chief Risk Officer (CRO) based on their regulatory category and applicable asset-size. The CRO provides specialised oversight of risk management and helps ensure that major risks are independently identified, assessed and reported to senior management and the Board.

The CRO's role becomes particularly important for larger NBFCs with complex lending portfolios or significant exposure to multiple sectors. The CRO should be able to raise material risk concerns without inappropriate interference from business functions.

Board-Approved Policies

An NBFC should maintain appropriate policies governing its business operations and risk management activities. These policies establish the principles and procedures that management is expected to follow. Depending on the nature and scale of operations, an NBFC may maintain policies relating to credit, investment, risk management, KYC and AML, outsourcing, cybersecurity, customer grievance handling, remuneration and other regulatory matters.

Board approval provides formal governance oversight over these policies. However, approval alone is not sufficient. Management must ensure that policies are implemented effectively and reviewed periodically when business or regulatory requirements change.

Loans to Directors and Senior Officers

Loans or financial facilities involving directors, their relatives or senior officers can create potential conflicts of interest. RBI therefore requires applicable NBFCs to maintain appropriate policies and controls governing such transactions.

The objective is to ensure that connected persons do not receive preferential treatment and that lending decisions are made through transparent and appropriate approval processes. Such transactions should be properly documented and handled in accordance with applicable regulatory requirements and the NBFC's internal policy.

Compensation of Key Management Personnel

Remuneration policies can influence how senior management and employees make business decisions. If compensation is heavily linked to short-term growth, employees may have incentives to take excessive risks to meet business targets.

Therefore, applicable NBFCs should maintain appropriate remuneration policies for Key Management Personnel and senior management. The remuneration structure should take into account long-term performance, risk management and the overall financial health of the NBFC. A well-designed remuneration policy helps align management incentives with sustainable business growth.

Corporate Governance Guidelines and Disclosures

Applicable NBFCs are required to maintain appropriate internal corporate governance guidelines and make prescribed disclosures. These guidelines help stakeholders understand how the NBFC is governed and how responsibilities are distributed. Governance disclosures can provide information regarding the Board, committees, risk management arrangements and other important governance matters. Transparency in governance strengthens stakeholder confidence and demonstrates that the NBFC is committed to responsible management.

Internal Audit and Internal Controls

Internal controls are essential for preventing errors, fraud, unauthorised transactions and regulatory violations. An NBFC should establish appropriate controls over its financial, operational and compliance processes. Internal audit independently evaluates whether these controls are functioning effectively. It can identify weaknesses in loan processing, financial reporting, regulatory compliance, technology systems and other business activities. The Board and relevant committees should ensure that significant audit observations are not merely recorded but are followed by appropriate corrective action.

Compliance Function

The compliance function plays a key role in ensuring that an NBFC follows applicable RBI directions, statutory requirements and internal policies. A strong compliance function should monitor regulatory developments, track filing deadlines, review compliance requirements and report significant deviations to senior management and the Board.

Compliance should be integrated into business operations rather than being treated as a last-minute activity before regulatory inspections. Continuous monitoring allows an NBFC to identify and correct compliance gaps at an early stage.

Risk Management and Corporate Governance

Corporate governance and risk management are closely connected. The Board cannot exercise effective oversight without understanding the major risks associated with the NBFC's business.

For example, rapid loan growth without adequate credit assessment may increase NPAs, while excessive dependence on short-term funding may create liquidity pressure. The Board should therefore regularly review key risk indicators and ensure that business growth remains within the organisation's financial and risk-bearing capacity.

Customer Protection and Corporate Governance

Corporate governance also includes protecting customers and ensuring fair treatment. NBFCs should have appropriate systems for communicating loan terms, interest rates, charges and repayment conditions clearly to borrowers.

Customer complaints should be properly recorded, investigated and resolved through an effective grievance redressal mechanism. The Board and senior management should review recurring customer complaints because they may indicate weaknesses in business processes or customer service practices.

Outsourcing and Vendor Governance

NBFCs often rely on external service providers for activities such as technology services, customer support, collections and other operational functions. However, outsourcing an activity does not eliminate the NBFC's responsibility for appropriate oversight.

The NBFC should conduct suitable due diligence before engaging important service providers and should establish clear contractual responsibilities, confidentiality requirements, security controls and monitoring mechanisms. Management should periodically evaluate whether outsourced service providers continue to meet the required operational and security standards.

Information Technology and Cybersecurity Governance

Technology has become an integral part of NBFC operations, particularly with the growth of digital lending and online financial services. This has also increased exposure to cybersecurity risks. The Board and senior management should understand the organisation's major technology risks and ensure that appropriate cybersecurity controls are in place.

Governance oversight should cover areas such as access management, data security, cyber incident response, backup systems, disaster recovery, system availability and third-party technology risks.

Related-Party Transactions and Conflict of Interest

Related-party transactions require careful oversight because they can create situations where personal or business relationships influence financial decisions. NBFCs should have appropriate mechanisms to identify related-party transactions and potential conflicts of interest.

Transactions involving directors, senior management or connected entities should be handled through prescribed approval and disclosure mechanisms. The objective is to ensure that decisions are taken in the best interests of the NBFC and are not influenced by personal interests.

Board Meetings and Documentation

Effective Board governance requires regular meetings supported by complete and accurate information. Directors should receive sufficient information before meetings so that they can properly evaluate proposals and risks.

Board and committee minutes should accurately record important discussions, decisions and follow-up actions. Proper documentation provides evidence that the Board has actively exercised its oversight responsibilities. It can also become important during statutory audits, regulatory inspections and internal reviews.

Regulatory Reporting and Disclosures

Accurate regulatory reporting is an essential part of corporate governance. NBFCs are required to submit various returns, statements and disclosures depending on their regulatory category and business activities. Management should establish appropriate review mechanisms before regulatory submissions are made. Information reported to RBI should be consistent with the NBFC's accounting records and internal data. Any material error or discrepancy should be investigated and corrected promptly.

Common Corporate Governance Challenges for NBFCs

NBFCs may face governance challenges when business expansion happens faster than the development of internal controls and risk management systems. Rapid loan growth, inadequate Board oversight, weak internal audit, concentration of decision-making authority, conflicts of interest and poor regulatory monitoring can all weaken governance.

Digital NBFCs may face additional challenges relating to cybersecurity, customer data protection, outsourcing and technology-dependent operations.  A strong governance culture requires continuous involvement from the Board, senior management, risk, compliance, audit and operational teams.

Best Practices for Strong Corporate Governance

NBFCs should regularly evaluate whether their governance structure remains appropriate for the size and complexity of their business. The Board should receive timely and accurate information regarding financial performance, risks, compliance and customer-related matters. Committees should function effectively rather than merely existing as a formal requirement. Their meetings should involve meaningful discussions and proper follow-up of issues.

NBFCs should also conduct regular internal audits, review policies, strengthen employee training and ensure that regulatory observations are addressed promptly. Most importantly, employees should be encouraged to report potential compliance or risk concerns without fear of inappropriate retaliation. This helps create a culture where problems are identified before they become serious.

RBI Inspection and Corporate Governance

Corporate governance is an important area during RBI supervision. RBI may examine whether the Board and senior management have effectively discharged their responsibilities. During an inspection, the regulator may review Board and committee minutes, internal audit reports, compliance reports, risk management records, policy documents and corrective actions.

If governance deficiencies are identified, the NBFC may be required to take corrective measures. Therefore, maintaining proper documentation and demonstrating active Board oversight are important aspects of inspection readiness.

Practical Corporate Governance Checklist for NBFCs

An NBFC should periodically assess whether its Board composition satisfies applicable requirements and whether directors continue to meet fit and proper criteria. It should also ensure that required committees are properly constituted and functioning according to their responsibilities.

The NBFC should review whether Board-approved policies remain current and whether risk, compliance and audit reports are regularly presented to the appropriate committees. The company should also verify that Board minutes, committee records, regulatory filings, internal audit reports and corrective action records are complete and properly maintained. Regular governance reviews can help identify weaknesses before they result in regulatory observations.

Conclusion

Corporate governance is fundamental to the safe and sustainable functioning of an NBFC. It provides the structure through which the Board and management can supervise business operations, manage risks, ensure compliance and protect stakeholder interests. RBI's Scale Based Regulation approach recognises that larger and more complex NBFCs require stronger governance systems. Accordingly, NBFCs must ensure that their governance practices are appropriate to their regulatory classification, size, business model and risk profile.

Effective Board oversight, properly functioning committees, strong internal controls, independent audit and risk functions, transparent disclosures, appropriate remuneration policies and continuous compliance monitoring can significantly strengthen an NBFC's governance environment. Corporate governance should therefore not be treated as a documentation exercise. It should form part of the NBFC's everyday decision-making and risk management culture.

Frequently Asked Questions (FAQs)

Q1. What is corporate governance in an NBFC?

Ans. Corporate governance refers to the policies, processes and controls through which an NBFC is directed, managed and supervised. It establishes clear responsibilities for the Board, senior management and various committees while ensuring transparency, accountability, risk management and regulatory compliance.

Q2. Why is corporate governance important for NBFCs?

Ans. Corporate governance is important because NBFCs deal with lending, investments and other financial activities that involve significant risks. Effective governance helps prevent excessive risk-taking, conflicts of interest, financial irregularities and compliance failures while protecting the interests of customers and other stakeholders.

Q3. What are the regulatory layers for NBFCs?

Ans. Under RBI's Scale Based Regulation, NBFCs are broadly classified into the Base Layer, Middle Layer and Upper Layer, with a Top Layer envisaged for exceptional circumstances. The governance and risk management requirements become more comprehensive as the regulatory significance and complexity of the NBFC increases.

Q4. What is the role of the Board of Directors in an NBFC?

Ans. The Board of Directors is responsible for providing strategic direction and effective oversight of the NBFC. It should regularly review financial performance, asset quality, risk exposure, regulatory compliance, internal controls and significant business decisions and ensure that appropriate corrective measures are taken where required.

Q5. What are fit and proper criteria for NBFC directors?

Ans. Fit and proper criteria are used to assess whether a person is suitable to serve as a director of an NBFC. The assessment generally considers factors such as integrity, reputation, competence, experience and suitability. The NBFC should follow applicable RBI requirements and maintain proper documentation.

Q6. Is an Audit Committee required for NBFCs?

Ans. The requirement for an Audit Committee depends on the NBFC's regulatory category and applicable requirements. NBFCs falling under categories for which an Audit Committee is prescribed must constitute and maintain the committee to oversee matters relating to financial reporting, internal audit, internal controls and related areas.

Q7. What is the role of the Risk Management Committee?

Ans. The Risk Management Committee oversees the identification, assessment and management of significant risks faced by an NBFC. It helps the organisation monitor risks such as credit risk, liquidity risk, market risk, operational risk, technology risk and cybersecurity risk, depending on the nature of its business.

Q8. Is a Chief Risk Officer mandatory for every NBFC?

Ans. No. The requirement to appoint a Chief Risk Officer depends on the NBFC's regulatory category and applicable criteria. Certain larger NBFCs are required to have a CRO to provide specialised and appropriately independent oversight of risk management.

Q9. What is the role of the Nomination and Remuneration Committee?

Ans. The Nomination and Remuneration Committee deals with matters relating to the appointment, suitability and remuneration of directors and senior management for applicable NBFCs. It also supports succession planning and helps ensure that remuneration practices are aligned with responsible and sustainable business performance.

Q10. What Board-approved policies should an NBFC maintain?

Ans. An NBFC should maintain policies appropriate to its business and regulatory requirements. These may include policies relating to credit, investment, risk management, KYC and AML, outsourcing, cybersecurity, customer grievance handling, remuneration, conflicts of interest and lending to directors or senior officers.