Compliance that scales with
your lending business

Lending partners, digital channels and regulators all ask for proof of security. Netra holds the RBI Direction for NBFCs as owned tasks and keeps the evidence where you can find it.

All solutions
NBFC Direction
RBI CTRRAF 2026 for NBFCs, loaded as controls
Level or layer
Requirements matched to where your entity sits
Vendor-aware
Technology and collection partners on the same record
Audit-ready
Evidence from daily work, not from a request list

What you are asked for

What regulators, lenders and partners ask an NBFC for

A small compliance team often answers all of them, from the same few people.

Compliance with the Direction

A clear status for each control, with an owner and evidence.

Bank and investor due diligence

Proof of security from the entity that funds or invests.

Partner and vendor oversight

How lending service providers and technology partners were assessed.

IS audit and internal audit

Evidence for the audit period, and closure of earlier observations.

Customer data protection

Policies and controls that show how personal data is handled.

Board reporting

A concise view of exposure and progress for directors.

The difference

One small team, several demands

The work is the same each time. Netra stops the evidence being rebuilt for each audience.

The usual way

  • Separate trackers for regulator, lender and auditor
  • Policies in documents nobody scores
  • Partner assessments held in email
  • Status depends on who updated it last

In Netra

  • One task and its evidence serve every audience
  • Policies generated, scored and kept with the controls they support
  • Vendor and partner decisions on the vendor record
  • Status derived from completed work

From the NBFC Direction to a standing record

A short path from the requirement to something you can show.

  1. 1

    Enable the Direction

    RBI CTRRAF 2026 for NBFCs, with its requirements as controls.

  2. 2

    Add what you also hold

    ISO 27001, ISO 27701 or others, sharing the same work.

  3. 3

    Assign owners

    Tasks with owners, plans and due dates.

  4. 4

    Attach evidence

    Held once, counted wherever it applies.

  5. 5

    Report

    Posture score and reports for management and the board.

Quiet audits. Loud confidence.

When audit comes, the evidence is already attached to the controls, so the first conversation is about findings and not about gathering files.

See the Audit Centre

Frameworks

The frameworks this sector works to

The Direction for NBFCs, with the standards lenders and partners most often ask for.

RBI CTRRAF 2026: NBFCs

The Direction for Non-Banking Financial Companies.

CERT-IN Guidelines

Obligations for Indian organisations.

ISO 27001:2022

A common ask from partners and funders.

ISO 27701:2019

Privacy information management, alongside security.

PCI DSS v4.0.1

Where card data is in scope.

SOC 2

Where international partners ask for it.

Who uses it

One system, the people who answer for it

Compliance Lead

One place to track, evidence and report across every framework.

CISO or Head of Security

Tasks and risk in the same view, with posture over time.

Head of IT

Clear assignments and evidence in the storage the team already uses.

Chief Risk Officer

A register that reflects treatment work, not just the annual review.

Internal Audit

Audits planned and findings tracked to closure.

Board

Reports a director can read in minutes.

In the platform

The modules behind this page

Every module works on the same record, so a task done once is counted wherever it applies.

Compliance Centre

Status for every framework, derived from the work.

Task Engine

Every requirement as an owned task with evidence.

Policy Hub

Policies generated, scored and kept current.

Third-Party Risk

Vendors discovered, assessed and reported to the board.

Audit Centre

Internal, external, certification and regulatory audits end to end.

Dashboard and Reports

A live posture score and one-click board reports.

The detail: reporting, third parties and what to prepare

Questions we are asked

Does Netra hold the RBI Direction for NBFCs?

Yes. RBI CTRRAF 2026 for Non-Banking Financial Companies is one of the frameworks in the library.

We have a very small compliance team. Is this too heavy?

Netra is built so one team can run many frameworks from one record. Evidence counted once serves each framework it applies to.

Can we track our lending partners and technology vendors?

Yes. Third-Party Risk covers discovery, assessment, dependencies and board reporting.

Can we add ISO 27001 later?

Yes. Work already done for the Direction is credited to ISO 27001 where the controls overlap, so the second framework starts ahead.

Can our auditors work in Netra?

Yes. The Audit Centre lets internal and external auditors be invited with their own access to the audit.

See the NBFC Direction in Netra

We will set up the demo around your layer and the frameworks your partners ask for.