In February 2026, the Financial Intelligence Unit of India published a list identifying 564 NBFCs that had not registered on the FINnet 2.0 portal. By June 30, 2026, FIU-IND published an updated list showing that 340 NBFCs still had not registered. While roughly 224 entities complied in the intervening four months, the pace of registration remains slow. Between December 2025 and May 2026, the Reserve Bank of India revoked the certificates of over 190 NBFCs for regulatory non-compliance. A single sweep in April/May 2026 alone covered 150 entities. These actions reflect a coordinated push by Indian regulators to close long-standing gaps in the country’s anti-money laundering framework.
Every NBFC is a reporting entity under the Prevention of Money Laundering Act, 2002 and must register with FIU-IND through the FINnet 2.0 reporting system to fulfil its statutory reporting obligations. Without registration, an NBFC cannot electronically submit suspicious transaction reports, cash transaction reports or cross-border wire transfer reports through the FIU-IND reporting platform.
This article covers FIU-IND registration requirements across all NBFC layers, ongoing reporting and screening obligations, the penalties regulators now impose and the practical steps every non-compliant NBFC should take today.
| Compliance area | Key requirement | Why it matters |
|---|---|---|
| FIU-IND registration | Register on FINnet 2.0 as a reporting entity | Unregistered NBFCs cannot file mandatory reports and face public identification |
| Transaction reporting | File STR within 7 working days, CTR by the 15th of the following month | Missed filings attract penalties up to ₹1 lakh per failure |
| Sanctions screening | Screen customers frequently enough to capture list updates without delay | Required under RBI KYC Master Directions; daily screening is common industry practice |
| PEP identification | Identify PEPs and apply enhanced due diligence with ongoing monitoring | RBI requires risk-based ongoing monitoring of PEP relationships |
| Principal Officer | Appoint a management-level PO and register on FINnet 2.0 | The PO ensures AML reporting obligations are fulfilled |
| Record retention | Keep KYC and transaction records for at least five years after the business relationship or transaction ends | Subject to audit under PMLA Rules |
| Layer-specific duties | Meet RBI scale-based regulation requirements for your NBFC layer | Higher layers face stricter governance and capital adequacy norms |
Why FIU-IND registration applies to every NBFC layer
Under the Prevention of Money Laundering Act, 2002, every reporting entity must fulfil its obligations through the FIU-IND reporting framework. Specifically, the PMLA defines reporting entities broadly to include banks, NBFCs, housing finance companies, payment system operators and intermediaries. NBFCs register with FIU-IND through FINnet 2.0 to meet these statutory obligations, regardless of size, deposit-taking status or asset class.
The RBI’s scale-based regulation framework classifies NBFCs into four layers. Base Layer NBFCs are non-deposit-taking entities with assets below ₹1,000 crore (Rs. 10 billion) and they account for roughly 96% of all registered NBFCs by number. In contrast, Middle Layer NBFCs include all deposit-taking entities and non-deposit-taking NBFCs with assets above ₹1,000 crore. The RBI identifies Upper Layer NBFCs based on asset size and systemic risk. Meanwhile, the Top Layer remains reserved for any Upper Layer NBFC that the regulator considers an exceptional risk to financial stability.
As a result, FIU-IND registration for NBFCs applies across all four layers. For example, a Base Layer entity with ₹50 crore (Rs. 500 million) in assets carries the same registration obligation as an Upper Layer institution managing tens of thousands of crores. The difference lies in the intensity of ongoing supervision, not in whether registration itself applies.
The Type I and Type II reclassification
From July 1, 2026, the RBI formalized a parallel reclassification of NBFCs into Type I and Type II categories under its revised regulatory framework. Type I entities do not access public funds and have no customer interface. However, Type II entities interact with retail customers or raise public funds and face proportionately higher compliance expectations. Qualifying Type I NBFCs (no public funds, no customer interface, assets below ₹1,000 crore) can apply for deregistration from the RBI by December 31, 2026, which would alter their regulatory standing under Section 45-IA. Until the RBI grants deregistration, both categories must meet FIU-IND registration and reporting obligations for as long as they hold a Certificate of Registration.
The scale of regulatory action in 2026
FIU-IND has taken the unusual step of publicly identifying non-compliant NBFCs. In February 2026, the agency published a list of 564 NBFCs that had not registered on FINnet 2.0. The list included each entity’s name, RBI regional office, Corporate Identification Number and registered address.
In June 2026, FIU-IND published an updated list as of June 30, 2026 showing that 340 NBFCs across the Middle Layer and Base Layer still had not registered. This means roughly 224 entities complied between February and June. However, the fact that 340 NBFCs remain non-compliant after two rounds of public identification shows that a significant portion of the sector has yet to act.
This public identification carries consequences well beyond regulatory embarrassment. Banks and financial institutions that transact with non-compliant NBFCs may reassess the AML risk of those relationships. In addition, non-compliant NBFCs may experience increased onboarding or relationship challenges as counterparties tighten their own compliance controls.
RBI certificate revocations
The RBI’s enforcement record reinforces the seriousness of the situation. Between December 2025 and May 2026, the RBI revoked the certificates of over 190 NBFCs under Section 45-IA(6) of the Reserve Bank of India Act, 1934. A single sweep in April/May 2026 covered 150 entities. The primary statutory grounds for these cancellations included failure to meet Net Owned Fund requirements (transitioning to the ₹10 crore (Rs. 100 million) threshold), operational inactivity and non-submission of periodic financial returns. While AML and KYC gaps did not serve as the principal trigger in every case, entities with parallel compliance failures face heightened scrutiny from both the RBI and FIU-IND.
The direction from regulators is clear. FIU-IND registration for NBFCs is not a formality to defer. It is a baseline requirement and failure to comply now carries real operational consequences for the business.
Reporting obligations after FIU-IND registration
However, registration is only the first step. Once registered, NBFCs must meet ongoing reporting obligations under the PMLA and its associated rules.
Cash Transaction Reports (CTR): NBFCs must file CTRs for all cash transactions exceeding ₹10 lakh. This includes single transactions as well as a series of integrally connected cash transactions in a month that individually fall below ₹10 lakh but aggregate above it. The filing deadline is the 15th of the month following the transaction.
Suspicious Transaction Reports (STR): If a transaction appears inconsistent with a customer’s known profile, source of funds or business activity, the NBFC must file an STR within seven working days of forming the suspicion. Importantly, no monetary threshold applies. Even a small transaction can trigger a filing obligation if the circumstances appear unusual.
Cross-Border Wire Transfer Reports (CBWTR): NBFCs involved in cross-border wire transfers must report these to FIU-IND with originator and beneficiary details as the PML Rules prescribe.
Non-Profit Organisation Transaction Reports (NTR): Similarly, transactions involving non-profit organisations above prescribed limits require separate reporting.
Record retention and filing infrastructure
Beyond filing, NBFCs must retain records of all transactions and customer identification data for a minimum of five years from the date of the transaction or the end of the business relationship, whichever comes later. This requirement continues even after the customer relationship has ended.
NBFCs must file each report electronically through FINnet 2.0. The platform does not accept manual submissions. As a result, NBFCs that lack the technical infrastructure to generate and file these reports need to invest in compliance systems or engage external support before deadlines pass.
Sanctions screening and PEP identification under updated RBI KYC directions
The RBI’s updated KYC Master Direction, most recently amended in August 2025 and supplemented by sector-specific directions issued on November 28, 2025, strengthened the obligations around sanctions screening and PEP identification that many NBFCs have yet to implement.
Sanctions screening: All regulated entities, including NBFCs across every layer, must screen their customer database against the United Nations Security Council (UNSC) Sanctions Lists and the Unlawful Activities Prevention Act (UAPA) sanctions lists that the Ministry of Home Affairs maintains. Regulated entities should ensure screening runs frequently enough to capture list updates without delay. In practice, many institutions run automated daily screens because the UN updates its lists daily.
PEP identification and monitoring: Separately, NBFCs must identify Politically Exposed Persons (PEPs), including family members and close associates and apply enhanced due diligence to these relationships. The RBI requires ongoing monitoring of PEP relationships on a risk-sensitive basis. This obligation is distinct from sanctions screening. It involves a different set of compliance procedures focused on source of wealth, source of funds and transaction patterns.
Ongoing screening beyond onboarding
The screening obligation extends beyond onboarding. NBFCs must screen existing customers on an ongoing basis throughout the relationship lifecycle. If a customer or their beneficial owner appears on a sanctions list, the NBFC must verify the match, follow the applicable UNSC or UAPA procedures and report to FIU-IND without delay.
For smaller Base Layer NBFCs, these requirements present a significant resource challenge. Many lack the compliance technology or dedicated staff to run frequent screens. Outsourcing to a qualified compliance partner or investing in RegTech solutions offers two viable paths forward.
Inadequate screening does not only risk RBI supervisory action. It increases regulatory exposure and may contribute to enforcement proceedings if a sanctioned individual later turns out to have transacted through the entity undetected.
Penalties and enforcement for non-compliant NBFCs
The penalties for FIU-IND non-compliance operate across multiple regulatory channels and they are becoming harder to ignore.
Under Section 13(2)(d) of the PMLA, the Director of FIU-IND can impose monetary penalties of not less than ₹10,000, which may extend to ₹1,00,000 for each failure. If an NBFC repeatedly fails to file STRs or CTRs, each missed filing counts as a separate failure. Consequently, cumulative financial exposure can escalate quickly across hundreds of missed monthly filings.
The RBI exercises its own enforcement powers independently. Under Section 45-IA(6) of the RBI Act, 1934, the RBI can cancel an NBFC’s Certificate of Registration. The over 190 revocations between December 2025 and May 2026 show this is not a theoretical risk. While the primary grounds for those cancellations involved failure to meet NOF thresholds and operational inactivity, entities with AML and KYC gaps face compounded regulatory risk.
Personal exposure and supervisory measures
Beyond monetary penalties and licence actions, senior management faces personal exposure. The PMLA assigns direct responsibility to the Designated Director and Principal Officer. The Principal Officer must ensure AML reporting obligations are fulfilled. The Designated Director carries overall responsibility for the entity’s PMLA compliance. If an NBFC facilitates money laundering through negligent compliance, these individuals may face regulatory or criminal consequences under applicable law.
Regulators may also impose supervisory or enforcement measures depending on the nature of the non-compliance. These can include restrictions on specific business activities or customer onboarding until the entity closes its compliance gaps. For an NBFC that depends on new customer acquisition to sustain its lending business, such measures can prove commercially significant.
The enforcement trend across 2025 and 2026 points in one direction. Indian regulators are moving from warnings to action. The publication of non-compliant NBFC lists, the revocation of registration certificates and the tightening of screening requirements all signal that the window for voluntary compliance is narrowing.
What non-compliant NBFCs should do now
For NBFCs that have not yet completed FIU-IND registration, the priority is straightforward: register on FINnet 2.0 without delay. The process involves three stages.
First, the NBFC must self-enrol as a reporting entity on FINnet 2.0. This requires basic organisational details, the RBI registration number and entity classification information.
Second, the NBFC must appoint and register a Principal Officer. This must be a management-level employee who ensures AML compliance and furnishes reports to FIU-IND. The NBFC must also communicate the PO’s details to the RBI.
Third, the NBFC must appoint a Designated Director at the board or senior management level and notify FIU-IND by letter. The Designated Director carries overall responsibility for PMLA compliance.
Building your AML/CFT compliance framework
Once registered, NBFCs should conduct a gap assessment of their AML/CFT program against current requirements. Key areas to address include transaction monitoring systems that can file STRs, CTRs and CBWTRs electronically through FINnet 2.0. The NBFC should integrate automated sanctions screening against UNSC and UAPA lists with its customer database, running screens frequently enough to capture list updates without delay. It must also establish PEP identification procedures and enhanced due diligence processes separately. Role-based AML training for staff should target specific job functions rather than generic awareness. A customer risk assessment framework supporting ongoing monitoring and periodic KYC updation is also essential. Record retention policies must meet the five-year minimum under PMLA Rules, measured from the end of the business relationship or transaction.
For a detailed walkthrough of the registration process, see our earlier guide on FIU-IND registration applicability and compliance. NBFCs that lack in-house compliance capacity may also benefit from engaging a fractional compliance officer to manage the transition.
Frequently asked questions
Is FIU-IND registration mandatory for Base Layer NBFCs?
Yes. Every NBFC that holds a Certificate of Registration from the RBI qualifies as a reporting entity under the PMLA and must register with FIU-IND through FINnet 2.0, regardless of its position within the scale-based regulation framework.
What is the difference between sanctions screening and PEP monitoring?
Sanctions screening involves checking customers against UNSC and UAPA sanctions lists frequently enough to capture updates without delay. PEP identification is a separate obligation. It requires NBFCs to identify Politically Exposed Persons and apply enhanced due diligence and ongoing monitoring on a risk-sensitive basis.
Can Type I NBFCs avoid FIU-IND registration by deregistering from the RBI?
Under the RBI’s revised framework effective July 1, 2026, qualifying Type I NBFCs can apply for deregistration by December 31, 2026. Until the RBI grants deregistration, these entities remain subject to all PMLA reporting obligations including FIU-IND registration.
What happens if my NBFC appears on the FIU-IND non-compliant list?
Banks and financial institutions may reassess the AML risk of transacting with publicly identified non-compliant entities. This can lead to increased onboarding challenges and relationship difficulties with counterparties. The NBFC also remains exposed to monetary penalties under Section 13 of the PMLA.
FIU-IND registration for NBFCs can no longer sit at the bottom of the compliance to-do list. Regulators are acting and the penalties are real. Public identification as non-compliant can disrupt banking relationships and erode client trust. Every NBFC, from Base Layer to Upper Layer, should treat this as an immediate priority.
If your NBFC needs help with FIU-IND registration, AML program design or ongoing compliance management, book a free consultation with Compliance7. Our CAMS-certified team works with NBFCs across all layers to build compliance programs that meet regulatory expectations and stand up to scrutiny.
This article is for informational purposes only and does not constitute legal or regulatory advice. For guidance specific to your business, consult a qualified compliance professional.
