What the RBI's Scale-Based Framework Actually Changes for Mid-Tier NBFCs

When the scale-based regulation framework was first announced, most of the commentary went straight to the upper layer: the systemically important names everyone already knows. That was understandable but a little misleading. The largest NBFCs already ran bank-like compliance functions. For them, the framework mostly formalised what they were doing anyway.

The middle layer is where the real operational change lands. These are lenders with enough scale to be visible to the regulator but not enough to have built out the compliance machinery the framework now expects. In our implementation work with Finpage clients over the past year, this segment has consistently been the one scrambling.

Three things that quietly got harder

Board-level risk oversight. It is no longer enough to have a risk policy document. The framework expects evidence that the board is actually reviewing portfolio risk metrics on a cadence, which means someone has to produce those metrics reliably. If your loan management system cannot generate a clean PAR ageing and concentration view without a week of Excel work, that is now a compliance gap, not just an inconvenience.

Internal audit independence. Several mid-tier lenders had internal audit reporting into the CFO or COO. The framework pushes this toward a direct board or audit committee line. Structurally simple, politically not.

Data granularity for regulatory returns. The returns themselves have not changed dramatically, but the expectation that the numbers in them reconcile to the general ledger and the loan book at a transaction level has tightened. This is where lenders running LOS and LMS as separate, loosely connected systems feel it most.

What this means for staffing

The honest answer is that a mid-tier NBFC probably needs one more person in the compliance-and-reporting function than it planned for, and that person needs to be comfortable with data, not just regulation. The lenders coping best are the ones who treated this as a systems problem first and a policy problem second.

Compliance is increasingly a question of whether your data can answer the regulator's question in an afternoon, or whether it takes a project.

At Twinline we have been building reporting and reconciliation views into Finpage specifically because of this shift. But the tooling only helps if the underlying operating discipline is there. A system cannot reconcile data that was never captured properly in the first place.

A practical checklist

• Can you produce a board-ready portfolio risk pack from your core system in under a day? If not, that is your first project.
• Does your internal audit function report to the board or audit committee? If not, plan the change now rather than when the inspection letter arrives.
• Pick one regulatory return and trace every number back to the loan book. Where the trail breaks is where your systems gap is.

None of this is glamorous. But the mid-tier lenders that get through the next two years cleanly will be the ones that treated the framework as an operations upgrade rather than a paperwork exercise.