Before Scale Based Regulation, every NBFC was broadly regulated alike. Now the rulebook that applies to you depends on which layer you sit in — and you can move up a layer by simply growing, without any decision being taken and without anyone telling you.
That is the part that catches people. There is no letter. Your balance sheet crosses a number, and a new set of obligations attaches from that point.
The four layers
| Layer | Who is in it |
|---|---|
| Base | Non-deposit-taking NBFCs with assets below ₹1,000 crore that do not access public funds and have no customer interface. P2P platforms, Account Aggregators and NOFHCs sit here regardless of size. |
| Middle | All deposit-taking NBFCs regardless of size, plus non-deposit-taking NBFCs with assets of ₹1,000 crore and above. Also includes Standalone Primary Dealers, Infrastructure Finance and Debt Funds, CICs and HFCs. |
| Upper | NBFCs identified by the RBI as warranting enhanced regulation. The framework now works off an asset-size threshold of ₹1 lakh crore, reviewed periodically, in place of the earlier parametric scoring. |
| Top | Deliberately kept empty. Populated only if the RBI considers systemic risk from specific Upper Layer NBFCs has increased materially. |
For most Indian NBFCs the only line that matters in practice is the first one: ₹1,000 crore. That is the boundary between Base and Middle, and crossing it is a genuine change in how you must run the company.
What attaches when you reach the Middle Layer
A compliance function that is actually independent
A board-approved compliance policy and a Chief Compliance Officer with a defined tenure, defined reporting line to the board or a board committee, and protection from being removed at management's convenience. In practice this is the single hardest cultural change for an owner-run NBFC: it means creating a role whose job is to disagree with you.
Internal capital adequacy assessment
Not just holding regulatory capital, but documenting your own assessment of whether that capital is adequate for the risks you actually run — concentration, interest rate, operational — including under stress. The document matters less than being able to defend it.
Board composition and experience
At least one director with relevant experience of having worked in a bank or NBFC. A functioning risk management committee. Limits on concurrent directorships.
Exposure limits that are actually enforced
Concentration limits on single borrower and single group exposures, computed on Tier 1 capital. Restrictions on lending to directors, their relatives and entities in which they are interested, with sanction escalated to the board.
Disclosures that make everything visible
Expanded annual financial statement disclosures — sectoral exposure, related party transactions, top twenty borrowers, movement in NPAs, breaches of limits, and customer complaints.
The three traps
Trap 1: assuming the layer is reviewed annually
Classification follows your position. If your audited balance sheet crosses ₹1,000 crore, you are Middle Layer from that point — not from the date someone reclassifies you. Every obligation above applies for the period, and an inspection a year later will test them for the period, not from the date you woke up.
Trap 2: growing through a subsidiary and assuming the group does not count
Where a group runs several NBFCs, the framework looks at them together for layer purposes. Splitting the book across two registrations does not keep you in the Base Layer.
Trap 3: treating Base Layer as unregulated
It is not. Base Layer NBFCs still carry the NOF requirement, the 90-day NPA classification norm, IT framework requirements, KYC obligations, a grievance redressal machinery and disclosure requirements. The difference is degree, not kind — and the most common Base Layer finding is a company that read "Base" as "minimal."
A useful test. Take your asset growth rate for the last three years and project the balance sheet forward. If ₹1,000 crore arrives within eight quarters, you should be building the Middle Layer systems now — because a compliance officer, a risk committee and an internal capital assessment cannot be created retrospectively.
What this framework is really asking of you
Read together, Scale Based Regulation is a single proposition: as an NBFC becomes large enough that its failure would hurt people other than its owners, the owners lose the right to run it informally.
Every obligation above is a version of that. An independent compliance officer, a board that challenges, disclosed related party lending, documented capital assessment — none of it improves your margin. All of it makes sure the company can survive without you.
NBFCs that see this as a burden do the minimum, and it shows in inspection. The ones that use it — a real risk committee, honest sectoral disclosure, a capital assessment they actually believe — find it changes their cost of funds, because lenders and rating agencies are reading exactly these signals.
Where to start if you are unsure of your position
- Fix your layer in writing, with the balance sheet number that puts you there and the date it first applied.
- List every obligation attaching to that layer and mark each: in place with evidence / in place without evidence / absent.
- Treat "in place without evidence" as absent, because a supervisor will.
- Close the gaps in order of how long they take to build, not how serious they look. A policy takes a week. A track record of a functioning risk committee takes a year.