Common Observations Made by Statutory Auditors During NBFC Audits
Your books are closed. Your loan system shows healthy numbers. Your board has approved the accounts. But here is the real question: would your NBFC pass if an RBI inspector or the National Financial Reporting Authority (NFRA) looked at the same numbers tomorrow?
Is Your NBFC Really Ready for Its Next Audit?
Are all overdue and restructured loans correctly tagged as NPAs? Is your Expected Credit Loss (ECL) provision strong enough for the risk you actually carry? When did you last review every customer's KYC risk category, and can you prove it with a date?
These questions are no longer theoretical. Between 10 and 15 July 2026, RBI issued six penalty orders against NBFCs in just ten days, including one on Muthoot Finance, one of India's largest gold loan companies. In FY25-26, RBI took 32 enforcement actions against NBFCs. And NFRA has fined auditors of Reliance Home Finance, Reliance Capital, DHFL and Religare Finvest, with penalties running into crores and bans of up to ten years.
The message is clear. The statutory audit of an NBFC is no longer a year-end formality. It is the first line of defence for the company, its lenders, its investors and its borrowers. This guide explains the most common observations auditors make during NBFC audits, why they matter, real cases from 2024 to 2026, and a practical plan to fix them before your next audit.
Why NBFC Audits Matter More Than Ever
India has 8,561 NBFCs registered with RBI (June 2026). They lend to small businesses, gold loan borrowers, vehicle buyers, microfinance groups and first-time digital borrowers who are often outside the reach of banks. When an NBFC's numbers are wrong, the damage spreads quickly: to banks that lend to it, to mutual funds that hold its bonds, and to customers who depend on it.
Three trends have raised the stakes for every NBFC and its auditor:
- Tougher RBI supervision: RBI's scale-based regulation places NBFCs in Base, Middle, Upper and Top layers, with stricter rules as they grow. RBI cancelled the registrations of 150 NBFCs in a single release in May 2026, and of 13 more in October 2026.
- NFRA as an active enforcer: NFRA has penalised auditors of several large finance companies, and the Corporate Laws (Amendment) Bill, 2026 proposes even stronger powers, including fines for non-compliance with NFRA directions of up to ₹1 crore for audit firms.
- More complex accounting: Ind AS 109, Expected Credit Loss models, digital lending partnerships and co-lending arrangements all require deeper judgment and better documentation than ever before.
What Must an NBFC Auditor Report On?
An NBFC audit is wider than a normal company audit. Beyond the true and fair view of the accounts, the auditor has specific reporting duties:
| Reporting area | What the auditor checks | Why it matters |
|---|---|---|
| Companies Act, 2013 and Standards on Auditing | True and fair view, internal financial controls, going concern | Basis of the audit opinion |
| CARO 2020 | Including whether the company needs RBI registration and holds it | Reported in the audit report |
| RBI Auditor's Report Directions | Registration, Net Owned Fund, public deposits, prudential norms | Exceptions must be reported to RBI |
| Ind AS 109 | Expected Credit Loss, effective interest rate, classification | Drives provisions and profit |
| Section 143(12) | Reporting fraud by officers or employees to the Central Government | Strict timelines; NFRA has penalised delays |
| RBI rules on auditor appointment (2021) | For NBFCs with assets of ₹1,000 crore or more: three-year term and independence rules | Applies to the NBFC's board when appointing auditors |
12 Common Observations Made by Statutory Auditors
Across RBI orders, NFRA findings and audit practice, the same issues appear again and again. Here are the twelve that matter most.
1. Asset classification and NPA tagging
This is the single most common finding. Loans that are more than 90 days overdue, or restructured accounts that should be downgraded, are left in the "standard" category. Auditors also find NPAs upgraded before all overdue amounts are fully repaid, and classification done at the loan level instead of the borrower level. In July 2026, RBI penalised Satya MicroCapital and Dhani Loans and Services for exactly this.
2. Weak Expected Credit Loss (ECL) provisioning
Under Ind AS 109, NBFCs must provide for expected losses, not just losses that have already happened. Common gaps include outdated default rates, no testing of the model against actual results, unexplained management adjustments, and provisions lower than RBI's prudential norms without the required adjustment. The most striking example: NFRA found that Reliance Home Finance had lent about ₹27,850 crore to weak borrowers but provided only ₹173 crore as ECL.
3. KYC and anti-money laundering gaps
Policies exist on paper, but customer risk categories are not reviewed every six months, and alert software does not flag suspicious transactions properly. Muthoot Finance was fined ₹5.80 lakh in July 2026 for both issues, proving that size does not guarantee compliance.
4. Exposure and concentration limits
Lending to a single borrower or a group of connected borrowers above RBI limits is a recurring observation. Auditors often find that the company relies only on its own reports instead of recalculating exposure at group level. Avail Financial Services and PAN Emami Cosmed were both penalised in July 2026 for exposure breaches.
5. Governance and board oversight
Directors holding positions in other NBFCs beyond what is allowed, board committees that meet irregularly, and missing Chief Risk Officer or Chief Compliance Officer roles in Middle and Upper Layer NBFCs are frequent findings.
6. Interest rates, penal charges and fair practices
RBI requires penal charges to be reasonable and not added to the interest rate, and interest to be charged only from the actual date of disbursement. Auditors frequently find old practices continuing, such as charging interest for the full month or adding penal interest to the loan balance.
7. Related-party transactions
Loans and investments in group companies without proper board approval, arm's length pricing or disclosure remain a major risk area. NFRA has repeatedly flagged weak testing of related-party transactions by auditors.
8. Outsourcing, digital lending and co-lending
Loan money passing through a partner's account, weak oversight of Lending Service Providers, and loss guarantees above the 5% limit are now common observations. RBI cancelled the registration of N.Y. Leasing for outsourcing almost all core lending functions to a service provider.
9. IT systems and data integrity
The loan management system and the general ledger often do not match. Manual changes to overdue days, weak user access controls and missing audit trails make it hard to trust the numbers. Under the Companies Act, accounting software must also maintain an audit trail that cannot be switched off.
10. Errors in RBI returns and capital calculations
Mistakes in calculating Net Owned Fund, capital adequacy (CRAR) and risk weights, and differences between RBI returns and audited accounts, are frequent findings. The minimum CRAR for NBFCs is 15%.
11. Late fraud reporting
Frauds must be reported to RBI and, where applicable, by the auditor under Section 143(12) within strict timelines. NFRA fined the auditor of Religare Finvest ₹5 lakh and barred him for five years for not reporting a loan fraud in time.
12. Liquidity and asset-liability mismatches
Funding long-term loans with short-term borrowings creates hidden risk. Auditors check whether the NBFC tracks maturity gaps correctly and reports them accurately to its board and to RBI.
Observation, Risk and Fix at a Glance
| Observation | What auditors typically find | Risk if ignored | How to fix it |
|---|---|---|---|
| NPA tagging | Restructured accounts kept as standard | RBI penalty, profit overstated | Monthly borrower-level system check |
| ECL | Old default rates, no back-testing | Qualified audit opinion | Annual model validation, documented overlays |
| KYC | No six-monthly risk review | RBI penalty, money-laundering risk | Dated review logs, tested alert rules |
| Exposure limits | Group exposure not added up | Concentration losses | Independent group-level recalculation |
| Interest and charges | Penal interest added to principal | Customer complaints, RBI action | Review loan terms against RBI rules |
| Fund flows | Partner accounts used for loans | Registration at risk | Direct lender-to-borrower flows only |
| IT and data | System and ledger do not match | Unreliable numbers | Monthly reconciliation, access controls |
Real Cases: What Went Wrong
July 2026: six RBI orders in ten days
| NBFC | Penalty | What went wrong |
|---|---|---|
| Avail Financial Services | ₹6.20 lakh | MD on boards of two other Middle Layer NBFCs; single-party exposure limit breached |
| Muthoot Finance | ₹5.80 lakh | Customer risk categories not reviewed every six months; weak suspicious-transaction software |
| Satya MicroCapital | ₹3.10 lakh | Some restructured accounts not classified as NPAs |
| PAN Emami Cosmed | ₹3.10 lakh | Exposure to a single group of parties above the limit |
| Muthoot Vehicle & Asset Finance | ₹2.70 lakh | Six-monthly KYC risk review not carried out |
| Dhani Loans and Services | ₹2.70 lakh | Certain accounts not classified as NPAs |
Source: RBI orders dated 10-15 July 2026, based on inspections of financial positions as of 31 March 2025 (TaxGuru).
Reliance Home Finance: when ECL fails
In April 2024, NFRA fined the audit firm of Reliance Home Finance ₹1 crore, its engagement partner ₹50 lakh with a five-year ban, and its quality reviewer ₹10 lakh with a three-year ban. NFRA found the auditors had not properly checked ECL on about ₹27,850 crore of loans to weak borrowers, and had issued a qualified opinion where a disclaimer or adverse opinion was needed.
DHFL: documentation matters
In September 2023, NFRA penalised 18 branch auditors of DHFL for FY 2017-18, finding inadequate documentation and no audit evidence in their working papers. Each faced a penalty and a ban of six months to one year.
The lesson from every case
Big or small, listed or private, no NBFC is outside the reach of RBI or NFRA. Upper Layer NBFCs accounted for only 12% of RBI actions in FY25-26 but about 45% of the penalty amount. The cost of a weak audit is not just a fine. It is reputation, funding access and, in serious cases, the registration itself.
What RBI Enforcement Data Tells Us
RBI's actions against NBFCs fell from 48 in FY24-25 to 32 in FY25-26, but the focus has sharpened. About 85% of NBFC penalties were under ₹5 lakh, which shows that RBI is using penalties as a warning signal. Repeated or serious lapses lead to much stronger action, including business restrictions and cancellation of registration.
Things to Consider Before Your Next Audit
- Your layer decides your rules: Base, Middle and Upper Layer NBFCs have different requirements for capital, governance and disclosures.
- Policies are not enough: RBI and auditors now ask for dated evidence that each policy was actually followed.
- Your partners are your responsibility: fintech partners, collection agents and IT vendors all fall within your audit and compliance scope.
- Data must tell one story: the loan system, general ledger, RBI returns and board reports must match.
- Documentation protects everyone: a decision not written down is, for an auditor or inspector, a decision not made.
The 8-Step NBFC Audit Readiness Plan
NBFCs that follow these steps through the year, not just in March, finish audits faster, receive fewer observations and build stronger confidence with lenders, rating agencies and investors.
Latest Trends Shaping NBFC Audits
- Stronger NFRA powers: the Corporate Laws (Amendment) Bill, 2026 proposes a wider enforcement toolkit and penalties for not following NFRA directions.
- Model risk management: RBI's 2026 draft guidance on model risk covers NBFCs and AI-based models, making ECL and credit scoring models a key audit focus.
- Data governance and privacy: RBI's draft data governance guidance and the DPDP Rules, 2025 are pushing NBFCs to review partner contracts and data controls.
- Technology-driven audits: data analytics on full loan books is replacing sample testing, so errors are harder to hide.
- Registration clean-up: RBI continues to cancel the registrations of inactive and non-compliant NBFCs in large batches.
The Major Crux
In one line: Most NBFC audit observations come from a small set of recurring gaps: NPA tagging, ECL, KYC, exposure limits, governance and documentation. NBFCs that fix these through the year, keep dated evidence and make their systems match their books will face fewer observations, fewer penalties and stronger trust from lenders and regulators.
Summary: Key Takeaways
- RBI took 32 enforcement actions against NBFCs in FY25-26, and six in just ten days in July 2026.
- NPA classification, ECL, KYC and exposure limits are the most frequent audit observations.
- Large names such as Muthoot Finance were penalised, so size is no protection.
- NFRA has fined and banned auditors of Reliance Home Finance, Reliance Capital, DHFL and Religare Finvest.
- Dated evidence, system-to-ledger reconciliation and strong board oversight prevent most observations.
- Audit readiness is a year-round discipline, not a March exercise.
How Panchal S K & Associates Can Help
At Panchal S K & Associates (PSK), we work with NBFCs of all sizes on audit, assurance and RBI compliance. Our team understands both the auditor's expectations and the regulator's concerns, and helps you close gaps before they become observations.
| Service | How PSK supports you |
|---|---|
| Pre-audit health check | Independent review of NPA tagging, ECL, KYC and exposure limits before the statutory audit |
| Statutory and internal audit | Risk-focused audits aligned with RBI directions, Ind AS and Standards on Auditing |
| ECL and Ind AS 109 support | Model review, back-testing and documentation of management judgments |
| RBI compliance and returns | NOF and CRAR computation, RBI returns, policies and board reporting |
| KYC and AML review | Risk categorisation, alert testing and periodic review frameworks |
| IS and IT controls audit | System-to-ledger reconciliation, access controls and audit trail checks |
| RBI inspection readiness | Mock inspections, gap closure and response to RBI observations |
Is your NBFC audit-ready?
Talk to CA Swati Panchal and the PSK team. We will help you identify gaps, fix them before your auditor or RBI finds them, and build an NBFC that is compliant, credible and ready to grow.
Frequently Asked Questions
What are the most common audit observations in NBFCs?
Incorrect NPA classification, weak ECL provisioning, KYC and anti-money laundering gaps, breaches of exposure limits, governance lapses, related-party issues, and differences between the loan system and the books.
Does an NBFC auditor report to RBI?
Yes. Under RBI's directions on the auditor's report for NBFCs, the auditor must report on matters such as registration, Net Owned Fund and compliance with prudential norms, and report certain exceptions to RBI.
Who regulates the auditors of NBFCs?
ICAI regulates Chartered Accountants generally. NFRA oversees audits of listed companies and certain large unlisted companies, including many large NBFCs, and can impose penalties and bans.
When can an NPA be upgraded to standard?
Only when the entire overdue amount, including interest and principal, has been fully repaid by the borrower.
How often should KYC risk categories be reviewed?
RBI expects periodic review of customer risk categorisation. In 2026, RBI penalised NBFCs that did not carry out the review at least once every six months.
How can an NBFC reduce audit observations?
Reconcile the loan system with the ledger monthly, test NPA tagging and ECL regularly, keep dated evidence of every policy review, and conduct an independent pre-audit health check.
Disclaimer: This article is for general information and educational purposes only and does not constitute legal, tax or audit advice. Regulations change frequently; please check the latest RBI directions and professional standards before acting.