Scale Based Regulation for NBFCs: What Each Layer Changes
Scale-Based Regulation for NBFCs: What Upper and Middle Layer Lenders Must Change in Their Systems
Last reviewed: November 2026
Scale based regulation for NBFCs is the RBI framework that sorts non-bank lenders into Base, Middle, Upper and Top layers and raises the rules as size and risk grow. The layer you sit in decides your provisioning, governance, technology and disclosure duties.
This guide is for CEOs, CROs and Chief Compliance Officers at Middle Layer NBFCs and those nearing the Upper Layer. It sets out the 2026 position and turns each layer rule into a system change you can plan and budget.
Key Takeaways
- Layer rules now sit in the NBFC Registration, Exemptions and Framework for SBR Directions, 2025, with duties spread across other consolidated directions.
- Since 24 June 2026, the Upper Layer test is simple: assets of ₹1,00,000 crore or more on the latest audited balance sheet.
- The RBI's 2026-27 Upper Layer list named 17 NBFCs, plus two retained from earlier lists.
- Middle Layer status brings a 90-day NPA test, 0.40% standard asset provisioning and tighter governance and technology rules.
How Does SBR Classify NBFCs in 2026?
Classification depends on deposits, asset size and activity. The thresholds below come from the consolidated SBR Directions, updated as on 1 July 2026.
| Layer | Who Is In It | Key Threshold |
|---|---|---|
| Base | Non-deposit-taking NBFCs, P2P platforms, account aggregators, NOFHCs and NBFCs without public funds or customer interface | Assets below ₹1,000 crore, or by type regardless of size |
| Middle | All deposit-taking NBFCs, plus HFCs, IFCs, CICs, SPDs and IDF-NBFCs | Assets of ₹1,000 crore or more, or by activity |
| Upper | NBFCs identified annually by the RBI | Assets of ₹1,00,000 crore or more |
| Top | Upper Layer NBFCs whose systemic risk rises sharply | Expected to stay empty |
The rules themselves were consolidated on 28 November 2025. Governance duties sit in the NBFC Governance Directions, provisioning in the IRACP Directions and technology in the 2026 cybersecurity directions.
What Data Decides Your Layer?
Your layer is a calculated status, so treat it like any other regulated data point. The inputs should come from systems, not a year-end spreadsheet.
- Asset size from the latest audited balance sheet, tracked quarterly against each threshold.
- Group assets for categories where the RBI consolidates group entities for the ₹1,000 crore test.
- Deposit status, since any deposit-taking NBFC sits in the Middle Layer or above.
- Activity type, because HFCs, IFCs and some others enter the Middle Layer by activity alone.
- Public funds and customer interface, which decide Type I treatment at the bottom of the framework.
A single layer flag, set from these inputs, should drive every downstream rule. That avoids the common gap where finance knows the layer has changed but the loan system does not.
What Changed for the Upper Layer in 2026?
The RBI replaced its scoring method with a single asset test. It finalised the change on 24 June 2026 after an April draft.
- One threshold. The earlier mix of top-ten-by-size and parametric scoring gave way to ₹1,00,000 crore of assets.
- Ownership neutral. Eligible government-owned NBFCs can now be placed in the Upper Layer, though they are exempt from mandatory listing.
- Periodic review. The RBI identifies Upper Layer NBFCs annually and reviews the threshold every three years.
- New list. The 2026-27 list, published on 6 August 2026, named 17 NBFCs, while PNB Housing Finance and Sammaan Capital stay in under the five-year rule.
No list was issued for 2025-26 while the criteria were under review. The Tata Sons entry is shown without prejudice to its pending de-registration application.
What Must Middle Layer Lenders Change in Their Systems?
Most Middle Layer rules are parameters that your systems must apply by layer. The table maps each rule to the change it needs.
| Requirement | What the Rule Says | System Change |
|---|---|---|
| NPA recognition | 90 days overdue, sub-standard for 12 months | Layer-specific DPD and ageing parameters in the asset classification engine |
| Standard asset provisioning | 0.40%, against 0.25% for Base Layer | Provisioning engine driven by a layer flag |
| Governance | Chief Compliance Officer, board committees, fit and proper checks | Board and committee records linked to policy reviews |
| Chief Risk Officer | Required above ₹5,000 crore of assets | Risk dashboards owned by an independent CRO |
| Technology risk | Chapter V of the 2026 cybersecurity directions | Committees, DR drills, VAPT cycles and IS audit tracked as controls |
| Pre-payment charges | No charges on floating-rate business loans up to ₹50 lakh to individuals and MSEs, sanctioned from 1 January 2026 | Charge rules keyed to layer, borrower type and loan size |
| Core financial services solution | ML and UL NBFCs with 10 or more service points had a 30 September 2025 deadline under a 2022 circular | Centralised loan and accounting platform across branches |
Confirm how the 2022 CFSS requirement now applies to newly classified entities, as its location in the consolidated framework should be checked against current RBI text.
Reporting load also rises. A regulatory return automation agent can assemble layer-specific returns from the same data that drives provisioning.
Could your loan system switch provisioning and NPA rules by layer tomorrow?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build lending platforms with configurable regulatory rules.
What Extra Does the Upper Layer Demand?
The Upper Layer adds capital, concentration and listing duties on top of Middle Layer rules. Each needs data your systems may not yet hold.
- Capital. A minimum Common Equity Tier 1 ratio of 9% of risk-weighted assets.
- Large exposures. Group-level exposure limits that need a clean map of connected counterparties.
- Differential provisioning. Standard asset rates from 0.25% for individual housing and small enterprise loans to 1% for commercial real estate.
- Listing. Listing within three years of identification, with listed-company style disclosures before then.
- Board competence. A board with expertise matched to the businesses the NBFC runs.
The 24-month transition is shorter than it sounds once procurement and testing are counted. Most roadmaps need four parallel workstreams.
- Data. Connected-counterparty maps, exposure aggregation and segment tags for differential provisioning.
- Capital. CET1 computation and capital planning linked to the growth plan.
- Governance. Board composition, committee charters and disclosure policies ahead of listing.
- Technology. Controls under the Middle and Upper Layer chapter of the 2026 cybersecurity directions.
Stress testing becomes a board conversation, not just a risk report. A credit portfolio stress testing agent can model how growth plans affect capital and exposure limits.
How Does a Layer Change Play Out?
Layer moves are predictable if you track the numbers. Two illustrative cases show the arithmetic.
Case 1: Base to Middle. An NBFC-BL with ₹850 crore of assets grows 25% in a year, reaching ₹850 crore × 1.25 = ₹1,062.5 crore.
It crosses ₹1,000 crore and enters the Middle Layer. If ₹1,040 crore of its book is standard assets, provisioning rises from 0.25% (₹2.6 crore) to 0.40% (₹4.16 crore), an extra ₹1.56 crore.
Case 2: Approaching the Upper Layer. An NBFC with ₹88,000 crore of assets plans 15% growth, giving ₹88,000 crore × 1.15 = ₹1,01,200 crore.
Once that figure appears on an audited balance sheet, Upper Layer identification is likely. The NBFC then has three months for a board-approved plan and 24 months to comply.
The lesson for leadership: model layer transitions in the annual plan. The cost lands in provisioning, people and systems at the same time.
Which SBR Mistakes Do NBFCs Make?
Most errors come from treating the layer as a compliance label rather than a system parameter.
- Hard-coded rules. NPA days and provisioning rates written into code make layer changes slow and risky.
- Ignoring group data. Some categories consolidate group assets for the ₹1,000 crore test, which catches lenders by surprise.
- Late governance hires. CCO and CRO roles take months to fill, so start before the threshold is crossed.
- Missing the technology tier. Moving layers also moves you into a stricter chapter of the cybersecurity directions, with no glide path in the text.
What Is Changing Next?
The framework keeps moving at the edges. From 1 July 2026, certain Type I NBFCs, with no public funds and no customer interface, can operate without registration subject to conditions.
The June 2026 amendment also added a separate section for NBFCs that are group entities of scheduled commercial banks. Bank-owned NBFCs should check which Upper Layer provisions now reach them through their parent's directions.
The RBI will review the Upper Layer threshold every three years, and lists will follow each audited year. A regulatory change tracking agent can flag amendments as they land, and our guide to AI agents for NBFCs shows where automation fits across operations.
Planning for your next layer before the regulator tells you?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build lending platforms and AI agents for growing NBFCs.
