Financial servicesIndia

RBI CTRRAF 2026 - Non-Banking Financial Companies

Build an NBFC compliance programme around your actual scope

Connect applicable technology-risk work with owners, evidence and audit follow-up across your organisation.

Full title
Reserve Bank of India (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026
Issued by
Reserve Bank of India, Department of Supervision
Issued and in force
31 July 2026, with immediate effect
Applies to
All NBFCs registered under the RBI Act, the Factoring Regulation Act or the NHB Act, with requirements set by layer and asset size
Nature
Binding regulatory Directions, reviewed through RBI supervision and the NBFC’s own information systems audit
Structure
Six chapters and 158 paragraphs. Chapters III, IV and V are alternatives: each NBFC follows one of them

Overview

What the Directions require

The Directions set out how a non-banking financial company must govern technology, manage IT and cyber risk, protect its systems, respond to incidents and prove that its controls work. They were issued by the Reserve Bank of India’s Department of Supervision on 31 July 2026, took effect immediately and replace the earlier directions on IT framework and IT governance for NBFCs, with a saving clause for actions already taken under them.

Unlike the bank Directions, the NBFC text does not apply one set of controls to every entity. Its three obligation chapters are written for different categories under scale-based regulation, and an NBFC follows the one that matches its layer and asset size: a short baseline for smaller Base Layer NBFCs and Core Investment Companies, an IT governance chapter for Base Layer NBFCs of ₹500 crore and above, and a full framework for the Middle, Upper and Top Layers.

At the top of that range, the requirements are close to those for commercial banks: an IT Strategy Committee meeting quarterly, an independent CISO, six-monthly vulnerability assessments, half-yearly disaster recovery drills and reporting of cyber incidents to RBI on DAKSH within six hours of detection. Smaller NBFCs carry lighter, more general duties, but still need a Board-approved IT and information security policy, a business continuity plan and tested backups.

For most NBFCs the hard part is running it: confirming the chapter that applies, giving every requirement an owner, keeping evidence current between inspections and showing the Board where the company stands.

Who it applies to

The Directions apply to all NBFCs registered under the RBI Act, 1934, the Factoring Regulation Act, 2011 or the National Housing Bank Act, 1987, unless stated otherwise. Chapters I, II and VI apply to all. The obligation chapter depends on the category, as defined in the scale-based regulation Directions, 2025:

  • Chapter III: NBFC-Base Layer with asset size below ₹500 crore, and Core Investment Companies
  • Chapter IV: NBFC-Base Layer with asset size of ₹500 crore and above
  • Chapter V: NBFC-Middle Layer, NBFC-Upper Layer and NBFC-Top Layer, excluding Core Investment Companies
  • The chapters are alternatives, not a ladder. A Middle Layer NBFC follows Chapter V, not Chapters III to V.
  • Housing finance companies are within scope. Under Chapter V, their cyber incidents continue to be reported to the National Housing Bank rather than RBI.
  • The text sets no separate exclusion for NBFCs without a customer interface and no phased compliance timeline.

Here CIC means Core Investment Company. Credit Information Companies have their own Credit Information Companies Directions. Banks and other entities also have separate Directions: Commercial Banks, Small Finance Banks, Payments Banks, Urban Co-operative Banks and All India Financial Institutions.

Structure

How the Directions are organised

Six chapters. Chapters I, II and VI apply to every NBFC. Each NBFC then follows one of Chapters III, IV or V, according to its layer and asset size.

Chapter I

Preliminary

Short title and commencement, applicability by category, and definitions, most adapted from the FSB Cyber Lexicon.

Chapter II

Role of the Board

Applies to all NBFCs.

Board-approved policies
The Board approves the strategies and policies for the technology and cybersecurity frameworks and reviews them at least annually.
Chapter III

Base Layer below ₹500 crore, and Core Investment Companies

A short baseline focused on getting core systems digitised and secure.

Basic IT systems
Prioritise basic IT systems that digitise and secure core business databases, and scale them up as operations grow.
Board-approved IT/IS policy
Covering physical and logical access controls, a password policy, defined user roles, maker-checker controls and robust information security and cybersecurity controls.
Specific safeguards
Requirements on digital signature certificates, mobile financial services and social media, cross-referred from Chapter IV.
Reporting capability
System-generated reports for senior management, and the ability to file regulatory returns with RBI.
Continuity and backup
A Board-approved business continuity plan, with periodic reports to the Board at least once a year, and data backups tested periodically.
Chapter IV

Base Layer of ₹500 crore and above

IT governance, information security and assurance at a level proportionate to a mid-sized NBFC.

IT governance and IT Strategy Committee
IT governance built into corporate governance, with documented roles. An IT Strategy Committee chaired by an independent director, with the CIO and CTO as members, meeting at least once every six months and placing its deliberations before the Board.
IT policy
An IT organisation suited to the business, a senior executive designated as CIO or in charge of IT operations, periodic assessment of training needs, and public-facing infrastructure able to handle IPv6.
Information security and cybersecurity
A Board-approved information security policy covering asset classification, segregation of duties, role-based access, background checks for privileged staff, maker-checker, incident management, audit trails and PKI. A separate Board-approved cybersecurity policy with vulnerability management.
Preparedness and crisis management
Cybersecurity preparedness indicators tested through independent checks and audits, and a Cyber Crisis Management Plan covering detection, response, recovery and containment.
Incident reporting
Cyber incidents reported to RBI on the DAKSH platform within six hours of detection.
Risk assessment and training
A comprehensive IT risk assessment at least annually, reported to the CRO, CIO and Board. Ongoing information security training with a record of each user’s training status.
IT operations and MIS
Controls over acquisition, development and change of information systems, and IT-enabled management information.
IS audit
An IS audit framework approved by the Audit Committee of the Board, with independent auditors, IS audit at least once a year, preferably before the statutory audit, and use of computer-assisted audit techniques.
BCP/DR and IT outsourcing
A Board-approved BCP tested at least annually and after significant changes. IT outsourcing contracts with monitoring, audit rights and access for RBI, with the Board ultimately responsible.
Chapter V

Middle Layer and above: governance and risk

The full framework for NBFC-ML, NBFC-UL and NBFC-TL, excluding Core Investment Companies.

Board role
The Board approves IT, information asset, business continuity, information security and cybersecurity strategies and policies, and reviews them at least annually.
IT Strategy Committee
At least three directors. The Chair is an independent director with at least seven years of IT experience. Meets at least quarterly and reviews BCP/DR at least annually.
IT Steering Committee and Information Security Committee
An IT Steering Committee of senior management from IT and business meeting quarterly. An Information Security Committee under the ITSC, headed by an official from the risk management vertical.
Head of IT and CISO
A senior Head of IT as first line of defence. A CISO, preferably at General Manager level, who must not report directly to the Head of IT, has no business targets, reports to the Executive Director overseeing risk and reviews cyber risk before the Board, RMCB or ITSC at least quarterly.
Policies, projects and services
A separate information security policy, cybersecurity policy and Cyber Crisis Management Plan. Formal project management, an IT service management framework, asset classification and a refresh plan that replaces technology before end of support.
IT and information security risk
IT and cyber risks reviewed by the Risk Management Committee with the ITSC at least annually, a risk management framework, asset-level risk assessment and annual review of security infrastructure and policies.
Chapter V

Middle Layer and above: baseline controls and IS audit

Data and physical controls
Data migration controls, an enterprise data dictionary, and data centre and DR sites that are geographically well separated.
Application security and capacity
Vendor maintenance, source code or escrow for critical applications, and capacity assessed annually or more often.
Audit trails, change and access
Audit trails detailed enough for forensics and regularly monitored, controlled change and patching, review of elevated access, and MFA for privileged users of critical systems based on risk.
Teleworking, third parties and cryptography
Secure remote access with MFA for critical systems. Proportionate risk assessment of third-party arrangements outside the outsourcing Directions, 2025. Strong, non-deprecated cryptography and straight through processing.
Vulnerability assessment and penetration testing
VA at least every six months and PT at least every 12 months for critical systems and DMZ systems with customer interfaces, by independent experts, with time-bound remediation.
Business continuity and disaster recovery
Good practice such as ISO 22301. DR drills for critical systems at least half-yearly, running the DR site as primary for a full working day. Minimal RTO approved by the ITSC, near-zero RPO for critical systems, and identical configurations at both sites.
Cyber incident response and recovery
A policy covering classification, communication and containment. Incidents reported to RBI on DAKSH within six hours of detection, with CERT-IN notified. Housing finance companies report to NHB.
Metrics and IS audit
Recovery and performance metrics for critical systems. An IS Audit Policy approved by the Audit Committee and reviewed at least annually, an IS audit function within internal audit and risk-based audit planning.
Chapter VI

Repeal and other provisions

Earlier directions on IT framework and IT governance for NBFCs are repealed, with a saving clause. Other laws continue to apply, and RBI’s interpretations are final.

Implementation roadmap

How to implement it, step by step

A practical sequence for an NBFC putting the Directions into operation and keeping them there.

  1. 1

    Confirm the chapter that applies

    Record the NBFC’s layer under scale-based regulation, whether it is a Core Investment Company and its asset size, and map it to Chapter III, IV or V. Keep the basis on file, because a change in layer or asset size changes the chapter.

    OutputsApplicability noteChapter mapping
  2. 2

    Put Board-level governance in place

    Have the Board approve the technology and cybersecurity strategies and policies and fix an annual review. Constitute the IT Strategy Committee where Chapter IV or V applies, and the CISO and other committees under Chapter V.

    OutputsApproved policiesCommittee charters
  3. 3

    Assess gaps requirement by requirement

    Map current practice against every paragraph of the applicable chapter. Record each gap with an owner, a target date and a risk rating.

    OutputsGap registerOwners and dates
  4. 4

    Remediate the controls

    Close gaps in order of risk. Under Chapter V, build in six-monthly VA, annual PT and half-yearly DR drills for critical systems. Under Chapters III and IV, focus on access, maker-checker, backups and BCP testing.

    OutputsRemediation planTesting schedule
  5. 5

    Prepare for incidents

    Approve the Cyber Crisis Management Plan where required and rehearse the six-hour report to RBI on DAKSH, or to NHB for housing finance companies under Chapter V, with notification to CERT-IN.

    OutputsCCMPIncident procedure
  6. 6

    Bring vendors into scope

    Review IT outsourcing and other third-party arrangements, with audit rights and access for RBI written into contracts.

    OutputsVendor assessmentsUpdated contracts
  7. 7

    Establish IS audit and reporting

    Approve the IS audit framework or policy through the Audit Committee, plan audits on a risk basis and report results and open findings to the Board and committees.

    OutputsIS audit policyBoard and committee packs
  8. 8

    Keep it running and inspection-ready

    Run the annual reviews, training and tests, re-check the applicable chapter when the NBFC’s layer or assets change, and keep evidence current for supervisory review.

    OutputsEvidence libraryAnnual review records

Audit and evidence guide

What auditors look for, and the evidence to keep

Compliance is reviewed through RBI’s supervision of the NBFC, or NHB’s for housing finance companies where the Directions provide, and through the NBFC’s own IS audit under the Audit Committee of the Board. Reviewers start with the chapter that applies and then look for proof that each requirement operates.

What reviewers look for

  • The basis for the applicable chapter: layer, Core Investment Company status and asset size
  • Board approval and annual review of technology and cybersecurity policies
  • IT Strategy Committee composition and meeting frequency for the applicable chapter
  • Under Chapter V, the CISO’s level, independence from the Head of IT and quarterly reporting
  • Maker-checker, role-based access and privileged access controls
  • VA/PT reports and remediation for critical and customer-facing DMZ systems (Chapter V)
  • BCP tests and, under Chapter V, half-yearly DR drills running the DR site as primary for a full day
  • Incident records showing detection time and reporting on DAKSH within six hours, and to CERT-IN
  • IT outsourcing and third-party contracts with audit and RBI access rights
  • IS audit coverage, independence and follow-up of findings

Recurring obligations and timelines

Board review of technology and cybersecurity policiesAt least annually
Board report on BCP (Chapter III)At least once a year
IT Strategy Committee meetings (Chapter IV)At most 6 months apart
IT risk assessment (Chapter IV)At least annually
IS audit (Chapter IV)At least once a year
BCP testing (Chapter IV)At least annually
IT Strategy Committee meetings (Chapter V)At least quarterly
IT Steering Committee meetings (Chapter V)Quarterly
CISO review of cyber risk before Board, RMCB or ITSC (Chapter V)At least quarterly
VA of critical and DMZ systems (Chapter V)At least every 6 months
PT of the same systems (Chapter V)At least every 12 months
DR drills for critical systems (Chapter V)At least half-yearly
IS Audit Policy review (Chapter V)At least annually
Cyber incident reporting on DAKSH (Chapters IV, V)Within 6 hours of detection

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Applicability

  • Layer and asset size record
  • Chapter mapping approved by management

Governance

  • Board and committee minutes
  • Approved policies with review history
  • ITSC constitution
  • CIO or CISO appointment

Access and operations

  • Role and access matrix
  • Maker-checker configuration
  • Privileged access reviews
  • Change records

Testing and resilience

  • VA/PT reports and closure tracker
  • BCP test results
  • DR drill reports
  • Backup restoration tests

Incidents

  • Incident register with detection times
  • DAKSH or NHB submissions
  • CERT-IN notifications
  • Cyber Crisis Management Plan

Third parties

  • Outsourcing risk assessments
  • Contracts with audit and RBI access clauses
  • Ongoing provider assurance

IS audit

  • IS audit framework or policy
  • Audit reports
  • Action tracking to closure

Areas that often need attention

  • Chapter chosen on assumption, with no record of layer and asset size
  • Controls carried over from the old IT framework without checking the new chapter
  • Policies approved once and not reviewed annually
  • ITSC meetings drifting beyond the required interval
  • BCP or DR never tested against a worst-case scenario
  • Incident detection times not recorded, so six-hour reporting cannot be shown
  • Outsourcing contracts without audit rights or RBI access
  • IS audit findings with no tracked closure

How Netra helps

Where each part of the work lives in Netra

Netra loads the NBFC Direction as requirements, tasks and policies, scoped to the chapter that applies to the company. Each part of the work then lives in the module built for it, on one record.

Only the chapter that applies

Compliance Centre

Status for each requirement is derived from completed tasks and evidence, never typed in, so every figure traces back to the work.

Every requirement owned and tracked

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks cover quarterly, half-yearly and annual obligations so that evidence stays current.

Board-approved IT, security and cyber policies

Policy Hub

A policy library generated at onboarding, with review dates and a policy score that rises as the work behind each policy is done.

Annual IT risk assessment

Risk Manager

A risk register with inherent and residual heatmaps, with risks reduced as the linked tasks are completed.

IT outsourcing and third parties

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

IS audit and supervisory reviews

Audit Centre

Run internal and regulatory audits end to end, with findings and corrective actions, using evidence held in a tamper-evident vault.

Reporting to the Board and ITSC

Dashboard & Reports

A live Posture Score and a one-click board report for the Direction.

Drafting procedures and finding missing evidence

Netra AI

Works from the NBFC’s own records to suggest missing evidence and draft SOPs. It never changes status on its own.

Netra organises the work, evidence and reviews. It does not determine the NBFC’s layer or legal classification, is not a SIEM or SOC, is not a reporting channel to RBI, NHB or CERT-IN, and does not by itself establish compliance. The NBFC remains responsible for implementation and regulatory interpretation.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Financial services

RBI CTRRAF 2026 - Credit Information Companies

Make credit-information security work traceable

Financial services

RBI CTRRAF 2026 - Commercial Banks

Connect bank-wide cyber governance with reviewable evidence

Financial services

FTC Safeguard Rule

Keep your information-security programme accountable

See RBI CTRRAF 2026 - Non-Banking Financial Companies in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.