Corporate Governance Norms for NBFCs Under Scale Based Regulation

If you are preparing for the CAIIB NBFC elective, you cannot skip the corporate governance norms for NBFCs — they surface in nearly every sitting because RBI has spent the last few years converting what used to be soft guidance into binding RBI Master Direction requirements. The Scale Based Regulation (SBR) framework ties governance obligations directly to the size and risk profile of the company: a base layer NBFC faces light-touch expectations under the Companies Act alone, while an upper layer NBFC must run board committees, a risk officer and a compliance officer that would look familiar inside a mid-sized bank. This article walks through board composition and the fit and proper process, the mandatory board committees and how their applicability changes across layers, the Chief Risk Officer and Chief Compliance Officer mandate, compensation rules including malus and clawback, disclosure and internal audit expectations, and the listing and auditor-rotation requirements that upper layer companies must meet.

🏛️ Board Composition, Independent Directors and Fit and Proper Criteria

Every NBFC board carries baseline obligations under the Companies Act, 2013 — minimum board size, at least one woman director where applicable, and independent directors once the company crosses the thresholds that trigger listed-company-style rules. RBI layers additional expectations on top of this for middle and upper layer entities: a higher proportion of independent directors, a board that is genuinely capable of challenging management on risk and strategy, and a chair whose role is kept distinct from day-to-day executive functions as the company grows larger.

The fit and proper criteria are where this gets exam-relevant. RBI requires every NBFC to frame a board-approved policy for ascertaining the fit and proper status of directors — checking for adverse findings, conflicts of interest, and integrity concerns — both at the time of appointment and every year after that. Directors sign an annual declaration and undertaking confirming they continue to meet the criteria, and separately execute a deed of covenant with the company, a formal document spelling out their duties, responsibilities and the standard of conduct expected of them as an NBFC director. If you want the fuller classification context — which NBFCs this applies to most strictly — the chapter on NBFC types and roles is a useful companion read before you move to the committee structure.

💡 Exam Tip: Do not confuse the fit and proper declaration (signed annually by the director) with the deed of covenant (signed once, on appointment, covering conduct and duties) — examiners like to swap these two in MCQ options.

🛡️ Mandatory Board Committees Across the Scale Based Layers

This is the part of the corporate governance norms for NBFCs that changes the most as a company moves up the SBR ladder. A base layer NBFC generally needs only what the Companies Act already demands — typically an audit committee where the size or listing status of the company requires one. Once an NBFC is classified into the middle layer, RBI expects it to constitute an Audit Committee, a Nomination and Remuneration Committee (NRC) responsible for KMP and senior management appointments and compensation, and a Risk Management Committee (RMC) that owns the risk appetite and monitors the risk register. An Asset Liability Management Committee (ALCO) is also expected wherever the balance sheet profile carries meaningful liquidity or interest-rate risk, which in practice covers most middle and upper layer lenders.

Upper layer NBFCs carry the fullest set: everything required of the middle layer, generally supplemented by an IT Strategy Committee and tighter expectations on how often the RMC and ALCO actually meet and report to the full board. For a working sense of how these obligations are enforced in practice, the chapter on regulatory requirements and compliance pairs well with this section. It is worth remembering that this layered build-up is the same logic that underpins scale based regulation for NBFCs more broadly — governance is simply one more obligation that scales with the layer a company sits in.

🔑 Chief Risk Officer, Chief Compliance Officer and Compensation Rules

Middle and upper layer NBFCs above the specified asset size must appoint a dedicated Chief Risk Officer (CRO). The CRO's role has to be clearly defined, with a direct reporting line to the MD/CEO or to the Board's Risk Management Committee rather than to a business-line head, and removal before the end of a fixed tenure needs the board's approval — a safeguard meant to protect the CRO from being sidelined by management whenever risk views clash with growth targets. Upper layer companies carry a parallel requirement for a Chief Compliance Officer (CCO), independent of business functions, tasked with monitoring regulatory compliance across the organisation and escalating breaches directly to the board rather than routing them through the business it is meant to police.

Compensation governance sits alongside this. RBI's guidelines on compensation for Key Managerial Personnel and senior management in NBFCs require boards to align variable pay with prudent risk-taking, defer a portion of variable compensation for control-function and senior roles, and build in malus and clawback clauses so that already-paid or vested variable pay can be reduced or recovered if losses, misconduct or a material risk-management failure surface later. These are core planks of the corporate governance norms for NBFCs precisely because compensation structure is one of the clearest levers RBI has found for shaping actual risk behaviour, not just paperwork. The chapter on recent RBI initiatives is a good place to track how these expectations have tightened over recent circulars.

⚠️ Common Mistake: Candidates often assume the CRO reports to the Chief Financial Officer. The whole point of the independence requirement is that the CRO does not report into a role with a growth or profitability mandate — the correct answer is always the MD/CEO or the Risk Management Committee.

📈 Disclosure, Listing, Auditor Rotation and Supervisory Action

Disclosure obligations round out the framework. NBFCs in the middle and upper layers must disclose director and KMP remuneration, related-party transactions, and details of penalties or supervisory action in their annual financial statements — the same transparency principle Ind AS-based reporting already pushes for, just made explicit as an RBI requirement. Alongside disclosure, RBI expects a risk-based internal audit function and, for upper layer companies, an Internal Capital Adequacy Assessment Process (ICAAP) that mirrors the Pillar 2 logic used in bank supervision — the board has to satisfy itself that capital is adequate not just for regulatory minimums but for the company's actual risk profile.

Two obligations tend to trip up candidates. First, an NBFC identified as upper layer must get listed on a stock exchange within the period RBI prescribes from that identification — this is treated as a governance obligation, not an optional capital-raising decision, and failure to comply is escalated as a lapse. Second, statutory auditor appointments for NBFCs above the specified size follow rotation and cooling-period principles broadly aligned with RBI's guidelines for statutory auditors of banks and UCBs, replacing the older practice of open-ended, indefinitely renewed audit mandates. Where any of these obligations are breached — governance, disclosure, listing, or audit appointment — RBI's response escalates through monitoring, supervisory letters, formal directions, business restrictions, monetary penalty, and in the most serious cases cancellation of the certificate of registration; a company already under severe financial stress can find itself pulled toward resolution processes similar in spirit to the corporate insolvency resolution process used for corporate borrowers generally.

📌 Remember: The corporate governance norms for NBFCs are not a compliance checkbox — they scale with layer, and a lapse invites a graded supervisory response rather than an automatic penalty.

For candidates preparing the wider prudential picture, it also helps to revisit the related NBFC concentration and exposure norms and the principal business criteria for NBFCs, since governance, exposure limits and classification are usually tested together in the same paper. You can browse every governance and compliance chapter on the NBFC blog tag, and once you have the concepts down, work through timed sets on iibf.store/tests to see how the corporate governance norms for NBFCs actually appear in exam-style questions.

🧠 Practice MCQs: Corporate Governance Norms for NBFCs

Want chapter-wise mock tests with 100+ MCQs? Start practising free →