RBI NBFC Concentration Risk Management Directions 2026: Exposure Limits and Compliance

The Reserve Bank of India has amended its Directions on Concentration of Credit for Non-Banking Financial Companies (NBFCs) for 2026, establishing stricter exposure limits and a comprehensive framework for managing concentration risk. These amended directions apply to all registered NBFCs and require careful monitoring of exposure to single borrowers, related parties, groups, and sectors. The RBI's focus on concentration risk reflects the banking regulator's concern that excessive exposure to a single borrower or sector can threaten the financial stability of NBFCs and, by extension, the broader financial system. Understanding and complying with these directions is essential for NBFC boards, risk management committees, and compliance officers.

Single Borrower Exposure Limits

The 2026 directions establish that exposure to a single borrower cannot exceed 20 percent of the NBFC's net owned funds (capital and reserves minus losses). This exposure includes direct loans, advances, guarantees, investments in securities issued by the borrower, and any off-balance-sheet exposure. For large value transactions exceeding Rs. 500 crores, the limit is further restricted to 15 percent. These limits apply on an ongoing basis and must be monitored monthly. Exposure includes both performing and non-performing advances. An NBFC must establish robust systems to aggregate all forms of exposure to a borrower across multiple branches and business units. Exposure must be measured at the individual borrower level, not at group or corporate structure level, to prevent circumvention through legal entity fragmentation.

Group Exposure and Related Party Restrictions

Beyond individual borrower limits, the directions define 'group' to include all companies holding more than 20 percent stake in a common company, or where more than 50 percent stake is held by the same person or entity. The aggregate exposure to a group cannot exceed 40 percent of net owned funds. Related party exposure adds another layer of restriction. A 'related party' includes directors, major shareholders, entities with common directors, and entities in which directors hold significant interests. Exposure to related parties is capped at 10 percent of net owned funds in aggregate and requires board-level approval. Transactions with related parties above certain thresholds must also comply with the RBI's regulations on related party lending. These provisions prevent insiders from obtaining favorable financing terms and protect the NBFC from concentrated risk to interconnected entities.

Sector Concentration Framework

The 2026 directions introduce explicit sector concentration limits. Exposure to any single sector cannot exceed 40 percent of net owned funds. Sectors are classified according to the RBI's methodology (e.g., real estate, wholesale trade, retail trade, manufacturing, services, etc.). An NBFC's portfolio concentration must be actively monitored and periodic sector-wise exposure reports must be submitted to the board. If exposure to a sector approaches the limit, the NBFC must slow disbursements in that sector and rebalance its portfolio. This requirement is designed to prevent NBFCs from becoming dependent on cyclical sectors or from experiencing simultaneous defaults across related industries. Stress testing of sector concentration is also mandated as part of the NBFC's risk management framework.

Large Exposure Framework

The directions define 'large exposures' as advances to any single entity exceeding 10 percent of net owned funds. For each large exposure, the NBFC must maintain detailed documentation including facility agreements, security details, valuation of collateral, and stress scenarios. Large exposures must be subject to enhanced due diligence including credit analysis, industry outlook assessment, and borrower financial statements. The NBFC must maintain a large exposure register tracking exposure levels, covenant compliance, and any deterioration in borrower credit quality. The board must review large exposures quarterly or upon any material change. These requirements ensure that significant credit risks receive appropriate board-level oversight and documented governance.

Connected Lending and Cross-Guarantees

The directions restrict 'connected lending', meaning lending by an NBFC to entities connected to the borrower. If an NBFC lends to Entity A and Entity B guarantees the loan or shares significant common management, the aggregate exposure must still comply with concentration limits. Similarly, cross-guarantees between entities must be treated as creating aggregate exposure for concentration purposes. The directions require NBFCs to maintain systems that identify connected entities and aggregate their exposures. An NBFC must ensure that its credit policies explicitly address connected lending restrictions and that credit committees are trained to identify connections. These requirements prevent circumvention of concentration limits through related party transactions or disguised exposures.

Monitoring, Reporting, and Governance

Compliance with concentration limits must be monitored on a continuous basis, with exposure levels reported to the board monthly. Any breach of limits must be immediately disclosed to the board and a remedial action plan developed to bring exposure below limits within a specified period. The RBI retains the power to tighten limits or impose stricter requirements if an NBFC's concentration risk is excessive. Violations of concentration limits can result in penalties up to Rs. 1 crore per violation and can lead to cancellation of the NBFC's registration if breaches are systematic or willful. NBFCs must ensure their internal audit and compliance functions have sufficient resources and independence to monitor concentration risk effectively. The Audit Committee must receive quarterly reports on concentration risk and any violations.

Applicability to All NBFC Categories

The concentration risk directions apply to all registered NBFCs, including deposit-taking NBFCs, systemically important non-deposit-taking NBFCs, and smaller NBFCs. While certain calibrations may apply based on NBFC category, the fundamental exposure limits and concentration framework are uniform. This inclusive approach reflects the RBI's view that concentration risk is a systemic concern regardless of an NBFC's size or funding model. Smaller NBFCs should ensure that their compliance and monitoring systems, though less complex than those of larger institutions, still adequately track and manage concentration across single borrowers, groups, sectors, and related parties.

Conclusion: Risk Management as Competitive Advantage

The RBI's 2026 concentration risk directions are not merely compliance burdens but represent best practices in risk management. NBFCs that maintain diversified portfolios across borrowers, groups, and sectors are inherently more resilient to economic cycles and individual borrower defaults. Robust monitoring systems that prevent concentration risk create confidence among depositors, investors, and regulators. NBFC boards and management must ensure that credit policies, loan approval processes, and portfolio reviews explicitly address concentration limits. Regular training of credit committees, loan officers, and risk teams on concentration risk identification and management is essential. By internalizing these directives as core risk management practices rather than regulatory compliance checklists, NBFCs can build sustainable, resilient businesses that weather market downturns and maintain stakeholder trust.