Resources Categories
INDUSTRY FACT FILE · NBFCS & LENDING
Industry Overview: NBFCs and Lending in India
The types of non-bank lenders and industry players, how they are owned and regulated, who buys cybersecurity inside them, and why each needs a distinct approach.
|
In this document 1. Why NBFC cybersecurity matters now 2. The NBFC ecosystem at a glance 3. Scale-based regulation and NBFC layers 4. Categories of NBFCs and industry players 5. Government, public-sector and private ownership 6. Who buys cybersecurity inside an NBFC 7. Why each lender type needs a different approach 8. How Codec Networks works with NBFCs |
|
Sector scope Sector: NBFCs and lending — housing finance, vehicle finance, microfinance, consumer finance and infrastructure lenders. Primary service proposition: regulatory applicability assessments, IT audits, lending platform security, privacy and SOC. |
1. Why NBFC cybersecurity matters now
Non-banking financial companies (NBFCs) finance homes, vehicles, small businesses, gold-backed needs, infrastructure and millions of first-time borrowers. Many reach customers through branches, field agents, dealers, partners and digital lending apps at the same time. Every one of those channels carries borrower data and money—and every one is an attack path.
|
4 layers Base, Middle, Upper and Top under scale-based regulation |
17 NBFCs in RBI's 2026-27 Upper Layer list |
6 hours To report cyber incidents to RBI (NHB for HFCs) |
31 Jul 2026 RBI's new cybersecurity Directions for NBFCs |
On 31 July 2026 RBI issued the Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (RBI/DoS/2026-27/461). They apply to all NBFCs, took effect immediately and repealed earlier IT framework and IT governance instructions for NBFCs. Requirements are tiered by layer, so the first question for every NBFC is which chapter applies to it.
|
Key takeaway For NBFCs, cybersecurity is now a layer-specific regulatory obligation, a condition of bank and investor partnerships, and a direct driver of fraud and credit losses. |
2. The NBFC ecosystem at a glance
NBFCs operate across many lending segments and depend on banks, partners, data infrastructure and technology providers.
Figure 1: The NBFC and lending ecosystem — lender types, channels, partners and oversight.
3. Scale-based regulation and NBFC layers
RBI's scale-based regulation framework, issued in October 2021 and in force from October 2022, places NBFCs in four layers—Base, Middle, Upper and Top—based on size, activity and perceived risk. Upper Layer NBFCs are identified by RBI; the 2026-27 list announced in August 2026 contains 17 entities, identified on an asset-size threshold of ₹1,00,000 crore and above.
|
Layer |
Typical NBFCs |
Cybersecurity chapter under the 2026 Directions |
|
Base Layer (asset size below ₹500 crore) and Core Investment Companies |
Smaller non-deposit-taking NBFCs and CICs |
Chapter III: baseline IT and information security policy, access and maker-checker controls, BCP and data backup with periodic testing |
|
Base Layer (asset size ₹500 crore and above) |
Larger Base Layer NBFCs |
Chapter IV: IT governance with an ITSC meeting at least six-monthly, IT policy, information and cyber security, IS audit at least annually, BCP/DR, outsourcing |
|
Middle Layer |
Deposit-taking NBFCs, larger non-deposit-taking NBFCs, HFCs and other specified categories |
Chapter V: full governance (ITSC, CISO), VA at least six-monthly and PT at least annually, DR drills at least half-yearly, IS audit under the Audit Committee |
|
Upper Layer |
Largest NBFCs identified by RBI (17 in the 2026-27 list) |
Chapter V, plus the enhanced regulatory norms applicable to Upper Layer NBFCs |
|
Top Layer |
Reserved for NBFCs RBI considers to pose extreme risk; ideally empty |
Chapter V and any additional supervisory measures |
|
Who receives incident reports Cyber incidents are reported on RBI's DAKSH platform within six hours of detection. Housing finance companies report to the National Housing Bank instead of RBI. CERT-In must be notified separately. |
4. Categories of NBFCs and industry players
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Housing finance companies |
Home loans, loans against property and construction finance |
Bank-promoted, corporate-group and standalone HFCs; some government-owned |
RBI regulation (NHB Act / RBI Act); NHB supervision; 2026 NBFC Directions |
|
Vehicle and equipment finance |
Cars, two-wheelers, commercial vehicles, tractors and construction equipment |
Corporate groups, auto-OEM captives, listed NBFCs |
Scale-based regulation; 2026 NBFC Directions |
|
NBFC-MFIs |
Collateral-free microfinance loans to low-income households, often through joint-liability groups |
Private and impact-investor-backed companies |
RBI microfinance directions; 2026 NBFC Directions |
|
Consumer and personal finance |
Personal loans, consumer-durable loans, credit lines and BNPL-style products |
Listed NBFCs, group companies, fintech-led NBFCs |
Digital Lending Directions 2025; 2026 NBFC Directions |
|
Gold loan companies |
Loans secured by gold jewellery, through large branch networks |
Family-promoted and listed companies |
RBI directions on lending against gold; 2026 NBFC Directions |
|
Infrastructure finance companies |
Long-term finance for power, roads, railways and urban infrastructure |
Government-owned and private companies |
Scale-based regulation; 2026 NBFC Directions |
|
Investment and credit companies |
Diversified lenders across retail, SME and wholesale segments |
Corporate groups and listed NBFCs |
Scale-based regulation; 2026 NBFC Directions |
|
Lending service providers and partners |
DSAs, dealers, LSPs, digital lending apps and lending technology firms working for NBFCs |
Private companies |
Not licensed as lenders; governed through Digital Lending Directions and the NBFC's outsourcing oversight |
|
Related fact files Account Aggregators, P2P lending platforms and lending technology firms are covered in the Fintech fact file; banks are covered in the Banking fact file. NBFCs frequently partner with both—through co-lending with banks and through technology partners—so their security posture extends across those relationships. |
5. Government, public-sector and private ownership
- Government-owned NBFCs include large infrastructure and power-sector lenders and housing finance institutions; several now appear in RBI's Upper Layer list.
- Bank-promoted NBFCs and HFCs are subsidiaries of public and private sector banks, often sharing technology and brand with the parent.
- Corporate-group NBFCs belong to diversified business groups and auto manufacturers, with group-level security functions.
- Listed and investor-backed NBFCs face disclosure, rating-agency and investor scrutiny of cyber risk.
- Development finance institutions such as the National Housing Bank are All India Financial Institutions with their own 2026 cybersecurity Direction.
6. Who buys cybersecurity inside an NBFC
For Middle Layer and above, RBI's 2026 Directions require an IT Strategy Committee of at least three directors, chaired by an independent director with at least seven years of substantial IT experience, meeting at least quarterly; and a CISO—preferably at General Manager level—who does not report directly to the Head of IT, holds no business targets and presents cyber risk reviews at least quarterly.
|
Stakeholder |
What they care about |
What they buy |
|
Board and IT Strategy Committee |
Regulatory standing, cyber and technology risk, resilience |
Board advisory, risk dashboards, crisis exercises |
|
CISO / Information Security Committee |
Control effectiveness, monitoring, vulnerability closure |
VAPT, SOC, threat hunting |
|
CTO / Digital lending head |
App and platform availability, secure releases |
Application and API testing, DevSecOps, cloud reviews |
|
Chief Risk Officer and fraud control |
Credit and fraud losses, early warning signals |
Fraud analytics, EWS reviews, forensic audits |
|
Compliance head and Principal Officer |
RBI, NHB, CERT-In and FIU-IND obligations |
Applicability assessments, IS audit support |
|
Data protection lead |
Borrower data handling, DPDP readiness |
Privacy programme, DLP, data-flow mapping |
|
Partnerships and vendor management |
LSP, DSA, dealer and co-lending risk |
Third-party assessments, contract reviews |
7. Why each lender type needs a different approach
|
Lender type |
Highest-consequence risk |
Starting point for assurance |
|
Housing finance company |
Document fraud, data leakage, ransomware across branches |
Applicability assessment, LOS/LMS testing, NHB reporting readiness |
|
Vehicle finance |
Dealer collusion and fictitious buyers, field-app data exposure |
Dealer and DSA controls review, fraud analytics, field app testing |
|
NBFC-MFI |
Field-agent misuse, device loss, collection fraud |
Mobile app and device management review, agent access monitoring |
|
Consumer and digital lender |
Fake apps, API exposure, LSP data misuse |
Lending app and API testing, brand monitoring, LSP assurance |
|
Gold loan company |
Branch-network ransomware, insider misuse, valuation fraud |
Branch infrastructure assessment, privileged-access review |
|
Infrastructure lender |
Targeted phishing, BEC and data theft |
Email security, executive impersonation testing, SOC |
8. How Codec Networks works with NBFCs
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For NBFCs we combine:
- Regulatory applicability assessments that map each NBFC to the right chapter of RBI's 2026 Directions and related digital lending, co-lending, fraud and outsourcing rules.
- IT and IS audits for Base Layer NBFCs of ₹500 crore and above and for Middle Layer and above.
- Lending platform security: testing of lending apps, LOS, LMS and partner APIs, plus six-monthly VA and annual PT where required.
- Privacy and SOC: DPDPA readiness, DLP for field channels and a managed SOC that correlates security and fraud signals.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026, including RBI, NHB, CERT-In and MeitY publications. Requirements depend on each NBFC's layer, type and activities; confirm obligations against the current official Directions before making compliance decisions.