Introduction
On July 31, 2026, the Department of Supervision (DoS) of the Reserve Bank of India issued the Reserve Bank of India (Non-Banking Financial Companies – Statutory Audit) Directions, 2026, vide RBI/DoS/2026-27/465, DoS.CO.ARG.59/08.91.001/2026-27 dated July 31, 2026 consolidating the framework governing appointment and reappointment of Statutory Auditors (SAs) and Statutory Central Auditors (SCAs) for NBFCs. The Directions supersede the earlier framework contained principally in RBI’s April 27, 2021 guidelines on appointment of SCAs/SAs of Commercial Banks, UCBs and NBFCs, insofar as those guidelines applied to NBFCs.
The Directions form part of a wider consolidation exercise by the Department of Supervision covering statutory audit, internal audit, fraud risk management, cybersecurity, compliance function and supervisory returns — issued simultaneously for Commercial Banks, Small Finance Banks and NBFCs. Substantively, most of the core requirements were already present in the 2021 framework; the change lies chiefly in bringing them into a single, structured document. That consolidation, however, is itself useful — eligibility, independence, tenure, rotation, auditor strength and appointment procedure can now be assessed against one reference point rather than a scattered set of circulars and clarifications.
This article examines the principal provisions from the perspective of an NBFC’s management, Audit Committee and statutory auditor, and flags the points that deserve particular attention this appointment season.
1. Applicability
Paragraph 3 applies the Directions to all NBFCs, including Housing Finance Companies, for appointment/reappointment of SCAs/SAs — with one qualification: a non-deposit taking NBFC with asset size below ₹1,000 crore may continue with its extant appointment procedure. This is an option to continue as before, not a blanket exemption from RBI oversight of statutory audit.
The threshold is asset-size based, not turnover-based — a distinction lending NBFCs should note carefully, since a modest-turnover NBFC-ICC can still carry a loan book comfortably above ₹1,000 crore. Deposit-taking NBFCs get no such option regardless of size. For a qualifying smaller NBFC, the Board should take a conscious, recorded decision on whether to retain the existing procedure or voluntarily migrate to the new framework.
2. Board and Audit Committee responsibilities
The NBFC must have a Board-approved policy on appointment of SCAs/SAs, factoring in asset size, transaction complexity, computerisation and financial-reporting risk — consistent with RBI’s broader risk-based approach elsewhere in the 2025–26 consolidation. This policy must be hosted in the public domain, a point compliance functions should track as part of the annual governance calendar.
Where an ACB exists, it monitors auditor independence and conflict of interest, escalating concerns to the Board and to RBI’s Department of Supervision; where it doesn’t, this falls to the Board directly. The Board/ACB must also review SCA/SA performance annually, and report serious lapses or conduct issues to DoS within two months of completion of the annual audit — an obligation carried forward unchanged from the 2021 circular and one that should sit on the compliance calendar independently of the audit-closure timeline.
3. Number of auditors and branch coverage
NBFCs with asset size of ₹15,000 crore and above must have their statutory audit conducted under joint audit by at least two firms; all others may continue with a single firm. A slab-based ceiling on maximum auditors (four firms up to ₹5,00,000 crore, rising to twelve beyond ₹20,00,000 crore) applies but is realistically relevant only to the largest NBFCs.
More operationally relevant for most entities is the branch-coverage requirement: SCAs/SAs must audit at least the top 20 branches (or top 20% for NBFCs with under 100 branches), selected by outstanding advances, covering a minimum of 15% of gross advances — over and above the Section 143(8) Companies Act obligation. NBFCs with concentrated large-ticket exposures versus wide retail networks will feel this very differently, and the branch-selection basis should be documented clearly.
4. Eligibility criteria
Paragraph 14 sets eligibility across three asset-size bands (up to ₹1,000 crore; ₹1,000–15,000 crore; above ₹15,000 crore), escalating on full-time partner strength, FCA partners, CISA/ISA-qualified personnel, audit experience and professional staff. Audit experience is specifically defined as experience auditing Commercial Banks, Small Finance Banks, Payment Banks, Local Area Banks, AIFIs, UCBs or NBFCs — general statutory-audit experience elsewhere doesn’t automatically qualify. Professional staff excludes typists, stenographers, computer operators, secretaries and subordinate staff, so firms should verify strength against this specific definition rather than a broad headcount.
The provision meriting closest attention is the “exclusive association” test for NBFCs above ₹1,000 crore (Note 1): a full-time partner cannot hold partnership elsewhere, cannot be employed elsewhere full- or part-time, cannot practise independently, and the Board/ACB must be satisfied the partner’s firm income reflects genuine full-time engagement. This is a materially higher bar than mere listing on the constitution certificate, and audit firms should verify it against partners’ actual professional positions — not the firm’s paperwork — before certifying Form B.
Other eligibility conditions carry forward largely unchanged: Section 141 Companies Act qualification, no debarment by NFRA/ICAI/RBI/other regulators, and a bar on firms where a partner sits as director of the NBFC or a group entity.
5. Independence
Concurrent auditors cannot be appointed SCA/SA of the same NBFC. A one-year cooling-off applies between non-audit assignments (Section 144 services, internal/special assignments) and statutory-auditor appointment, with tax audit, interim-financial audit, statutory certifications and segment reporting carved out as not normally conflicting.
A point worth flagging for groups with related lending entities: where the audit firm also audits an entity with “Large Exposure” to the NBFC in the same year, that relationship must be explicitly factored into the independence assessment — not prohibited, but documented as considered by the Board/ACB.
6. Tenure, rotation and concurrent mandates
A continuous three-year tenure applies, subject to annual eligibility compliance; firms already mid-term when the Directions took effect complete only their balance tenure. Early removal before three years requires intimation to the concerned Regional Office/SSM with reasons, within a month.
The cooling-off on reappointment is six years (two tenures) after completion of a full or partial term — importantly, an early exit does not shorten this clock, it only shortens how long the firm actually served before it starts running. Firms may hold a maximum of eight concurrent NBFC statutory-audit mandates across the RBI-regulated universe (with separate caps for banks, UCBs and cooperative banks) — a ceiling firms should track as a live register, since a firm eligible on size-linked criteria can still be disqualified by having already reached this limit.
7. Appointment procedure, fees, and effective date
No fee scale is prescribed; fees must be reasonable and commensurate with audit scope and complexity. NBFCs continue to operate on a post-facto intimation basis (no prior RBI approval, unlike Commercial Banks) — a minimum of two firms must be shortlisted per vacancy, a signed Form B eligibility certificate obtained, and the appointment intimated via Form A within a month (to DoS Central Office for Mumbai-region NBFCs, otherwise the concerned Regional Office).
The Directions repeal the earlier NBFC statutory-audit framework with effect from issuance, with standard savings for rights and liabilities accrued earlier. There is no notified transition period — NBFCs mid-cycle in an appointment process need to assess compliance against the new framework without any breathing room.
Practical takeaways
For NBFCs
- Confirm applicability by actual asset size (not turnover) as at the preceding year-end.
- Where crossing ₹1,000 crore, revisit the incumbent auditor’s partner-deployment structure against the exclusive-association test.
- Build the two-month post-audit lapse-reporting obligation into the compliance calendar independently of the audit-closure cycle.
- Treat eligibility as a continuing requirement — don’t assume Form B remains valid for the entire tenure without periodic verification.
For audit firms
- Check eligibility, tenure history, cooling-off status and concurrent-mandate count together before pitching for any NBFC mandate.
- A firm eligible on size-linked partner/staff criteria can still be disqualified by a prior engagement’s cooling-off bar or by having already reached its concurrent-NBFC ceiling.
Conclusion
The 2026 Directions are best understood as a consolidation and restatement of the existing NBFC statutory-audit framework rather than a substantive rewrite — the joint-audit trigger, eligibility bands, tenure/cooling-off norms and concurrent-mandate ceiling are all carried forward from 2021 in substantially the same form. The practical value lies in having a single reference point: eligibility should be established before appointment, independence assessed at the group level, and compliance monitored throughout tenure — a discipline the consolidated Direction now makes considerably easier to demonstrate.
******
Disclaimer: This article is for general informational purposes and reflects the author’s understanding of the Reserve Bank of India (Non-Banking Financial Companies – Statutory Audit) Directions, 2026 as on the date of writing. It is not a substitute for the text of the Directions or for professional advice based on the specific facts of an NBFC. Readers should refer to the original RBI notification and applicable laws before acting on any matter discussed here.
