An audit asks whether your accounts are true and fair. An RBI inspection asks a different question altogether: whether you are safe to keep operating. Very few NBFCs prepare for the second question, because they have spent their whole lives answering the first.
That gap is where findings come from. Not fraud, not incompetence — simply a management team that has never seen the exercise from the supervisor's side of the table.
The inspection begins long before anyone arrives
By the time a team walks into your office, it has already formed a view. It has been reading you for months, from data you filed yourself.
What it has in hand:
- Your regulatory returns, filed quarterly, and the trend across them. Not the latest one — the series.
- Your audited financials, read against those returns.
- Your CRILC reporting, where applicable, and whether your classification of a borrower agrees with how every other lender has classified the same borrower.
- The compliance you submitted against the previous inspection's findings — and whether the thing you said you fixed has stayed fixed.
- Complaints routed through the Ombudsman or received directly, and the pattern in them.
The single most common trigger. Not a bad loan. A contradiction. Your return says one number, your balance sheet says another, and nobody in your organisation can explain which is right. From that moment the team stops sampling and starts digging.
What gets tested on site
1. Asset classification and provisioning
This is where most time goes, and where most findings land. The team will not accept your NPA number. It will rebuild it.
They pull a sample of accounts and re-run the classification themselves — day-end position, overdue ageing, whether the account was upgraded correctly, whether restructuring was recognised as restructuring. Where their number differs from yours, the difference becomes a provisioning shortfall, and a shortfall in provisions reduces your capital immediately.
2. Governance and board oversight
A regulator cannot supervise every loan. So it supervises the people who are meant to. That means reading your board minutes — not for what was decided, but for what was questioned.
Minutes that record only approvals, with no recorded discussion, no dissent and no follow-up on the previous meeting's concerns, tell the reader that the board is not doing its job. So does an audit committee that meets the minimum number of times, a risk management committee that exists on paper, or an internal auditor who reports to the very management he is auditing.
3. KYC, AML and customer conduct
Periodic KYC updation is a common gap, particularly in older accounts opened before current standards. So is the quality — not existence — of your risk categorisation of customers, and whether your system actually generates and closes alerts rather than generating and ignoring them.
On the conduct side: is your interest rate arrived at under a board-approved policy with a documented rationale, or is it whatever the market took? Are penal charges levied as charges, not capitalised as interest? Is your Key Facts Statement given, in a language the borrower reads, before signing?
4. Capital, funding and liquidity
Net Owned Fund, CRAR and leverage are arithmetic — they either hold or they do not. Asset-liability management is the one that surprises people, because a profitable NBFC can be an unsafe one. A large negative gap in the shortest maturity buckets means you are funding long assets with short money, and supervisors have long memories about what that produced in 2018.
5. Outsourcing, technology and digital lending
Where you lend through a partner, an app, or a sourcing agent, the regulator's position is settled: you cannot outsource the obligation. The customer is yours, the compliance is yours, and the conduct of anyone recovering on your behalf is yours. Grievance redressal, data storage, and who is disbursing into whose account are all live areas.
What a finding actually costs
| Severity | Typical consequence |
|---|---|
| Observation | Compliance required, tracked into the next inspection cycle |
| Supervisory concern | Corrective action plan, board-level accountability, closer monitoring |
| Serious | Monetary penalty under the RBI Act, made public by press release |
| Severe | Restriction on specific business lines until remediated |
| Fundamental | Cancellation of the Certificate of Registration |
The item people underestimate is the second column of row three. A monetary penalty on an NBFC is published. Your lenders read it, your rating agency reads it, and your borrowing cost goes up before the penalty is even paid. The fine itself is rarely what costs you the most.
What preparation is not
It is not tidying up files the week before. Inspections look at whether a control operated through the year, and a control that produced no evidence in month four cannot be manufactured in month eleven.
It is not a legal opinion either. The question is never only "what does the Direction say" — it is "what does our data say about us, and what will a supervisor conclude from it."
What good preparation is
- Reconcile every return to the books for the last eight quarters, and be able to explain any movement in one sentence.
- Re-run your own asset classification on a sample, independently of the team that prepared it, using the Directions rather than the practice you inherited.
- Read your last inspection report as the supervisor will — as a list of promises you made.
- Read three board meetings of minutes and ask whether a stranger would conclude the board is challenging management.
- Walk the loan file end to end for five accounts: sourcing, KYC, appraisal, sanction terms, disbursal, KFS, repayment, follow-up.
Why we do this before they do. A mock inspection is not a rehearsal. It is the same exercise, run by people who know what the team will pull and where the data usually contradicts itself — with the crucial difference that findings come to your board instead of to the regulator, and you still have time to fix them.
Time matters more than effort
Almost every serious finding we have seen could have been closed if it had been found twelve months earlier. Provisioning gaps can be funded over quarters. Governance records can only be built prospectively. Return reconciliation is straightforward with time and impossible without it.
The NBFCs that come through inspections cleanly are not the ones with the best lawyers. They are the ones who looked first.