RBI cybersecurity compliance for NBFCs now depends on one thing above all: your layer. This guide explains which rules bind your NBFC, what the core obligations are, and how a lean team can meet them without a large security function.
TL;DR
RBI cybersecurity compliance for NBFCs is tiered by Scale-Based Regulation layer. Every NBFC registered with the RBI is covered, but the chapter that applies depends on your layer and asset size. Base Layer NBFCs below 500 crore and Core Investment Companies get the lightest obligations, Base Layer NBFCs at 500 crore and above get a fuller set, and Middle, Upper, and Top Layer NBFCs face requirements close to a bank.
Across the heavier layers, compliance means board-level governance, an independent Chief Information Security Officer, a VAPT programme, six-hour incident reporting on the DAKSH platform, security monitoring, and data protection. Because the RBI extends bank rules to NBFCs on a delay, even lighter-obligation NBFCs should prepare early.
On this page
What RBI cybersecurity compliance for NBFCs is
RBI cybersecurity compliance for NBFCs is defined by the Reserve Bank of India (NBFC Cybersecurity and Technology Risk) Directions, a consolidated framework that replaced a scattered set of earlier circulars. It applies to all non-banking financial companies registered with the Reserve Bank of India, and it turns cybersecurity into a board-owned, legally binding responsibility rather than a purely technical function. The framework covers board-approved IT and cybersecurity policies, IT governance, risk management, vulnerability assessment and penetration testing, business continuity, disaster recovery, information systems audit, and cyber incident response. In short, NBFC cybersecurity is now a governance obligation the board is accountable for, not a checklist the IT team quietly maintains.
Which rules apply to your NBFC
The single most important thing to understand is that these rules are not one uniform rulebook. The obligations are tiered by your Scale-Based Regulation layer, and the chapters are mutually exclusive, so you need to know exactly which one binds your NBFC before you plan anything.
Chapter III applies to Base Layer NBFCs below 500 crore in asset size, and to Core Investment Companies, whose requirements are the lightest: a board-approved policy, basic controls, and incident-reporting capability. Chapter IV applies to Base Layer NBFCs at 500 crore and above, with a fuller set of obligations. Chapter V applies to Middle, Upper, and Top Layer NBFCs, where the requirements come closest to bank-level expectations. Because the bands are mutually exclusive, two NBFCs on either side of the 500 crore line can sit under materially different rules, so the asset-size test genuinely matters.
The core obligations of RBI cybersecurity compliance for NBFCs
For NBFCs in the Middle Layer and above, and to a large extent for larger Base Layer NBFCs, compliance involves a recognisable core set of security obligations. These formalise what well-run financial entities already do, and make them mandatory and evidenced.
In practice that means board-level governance through an IT Strategy Committee and an Information Security Committee, a Chief Information Security Officer whose role is independent of the head of IT, a vulnerability assessment and penetration testing programme, cyber incident reporting on the DAKSH platform within six hours, security monitoring through a security operations capability for the higher layers, and data protection with business continuity and disaster-recovery testing. If you are unsure where to begin, a structured VAPT programme is usually the fastest way to show real security to an inspection.
The six-hour incident reporting rule
One requirement deserves singling out because it is operationally demanding. Under the framework, cyber incidents must be reported on the DAKSH platform within six hours of detection. That runs alongside the separate CERT-In six-hour clock that already applies to every body corporate, so for many NBFCs it means two reports, to two recipients, on the same deadline. The clock starts at detection, not after investigation, which means an NBFC that learns of an incident from a customer has already missed it. Meeting this is less about paperwork and more about having monitoring good enough to detect and confirm an incident quickly.
The NBFC roadmap: prepare before you are told
There is a strategic point every NBFC should internalise. Even if a specific requirement is not yet mandatory for your layer, the RBI has consistently extended requirements introduced for banks to NBFCs within roughly 12 to 18 months. The bank framework is therefore an effective preview of where these NBFC rules are heading. Elements like continuous monitoring, the CISO independence structure, third-party exit strategies, and DAKSH incident reporting are widely expected to reach more NBFCs over time.
NBFCs that treat the bank framework as their roadmap, and begin building toward it now, will be far better placed than those that wait for the NBFC-specific circular. Getting ahead of these rules turns a future scramble into a controlled, well-evidenced programme. Vendors selling into NBFCs face the same pressure, much like startups preparing for a SOC 2 audit before their first enterprise deal.
The lean-team path to RBI cybersecurity compliance for NBFCs
Meeting these obligations, a VAPT programme, six-hour-ready incident detection, governance evidence, vendor risk, and continuous monitoring, is a heavy lift for a lean NBFC without a dedicated security function. Assembling it from separate tools and consultants is slow and hard to keep audit-ready. The efficient path is a single platform that runs the security work and organises the evidence together.
Meet RBI cybersecurity compliance for NBFCs without a big team.
Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean financial teams. Run the required testing, speed up incident detection, and keep audit-ready evidence, on one platform. No security team required.
Book a Demo →Frequently asked questions
Does RBI cybersecurity compliance for NBFCs apply to every NBFC?
Yes. The framework applies to all non-banking financial companies registered with the RBI. However, the specific obligations depend on your Scale-Based Regulation layer, so which chapter binds you varies by layer and asset size.
Which RBI cybersecurity chapter applies to my NBFC?
Chapter III applies to Base Layer NBFCs below 500 crore and Core Investment Companies, Chapter IV to Base Layer NBFCs at 500 crore and above, and Chapter V to Middle, Upper, and Top Layer NBFCs. The bands are mutually exclusive, so your layer and asset size decide the chapter.
What is the six-hour incident reporting rule?
Cyber incidents must be reported on the DAKSH platform within six hours of detection. It runs alongside the CERT-In six-hour clock, so many NBFCs file two reports on the same deadline, measured from detection, not investigation.
Do small Base Layer NBFCs have to comply?
Yes, though lightly. Even the smallest Base Layer NBFC needs a board-approved cybersecurity policy, basic controls, and incident-reporting capability, plus the CERT-In directions that apply to every body corporate. Small does not mean exempt.
Does an NBFC CISO have to be independent of IT?
For the applicable layers, yes. The framework requires the Chief Information Security Officer to be independent of the head of IT, mirroring the bank rule. It is a structural governance requirement that an inspection will check.
How can a lean NBFC meet these requirements quickly?
The efficient path is one platform that runs VAPT, provides continuous monitoring for fast incident detection, and keeps audit-ready evidence, rather than stitching together separate tools and consultants.
