The RBI 2026 Directions are seven instruments.

Seven instruments, one date

Each set of Directions carries its own reference number, its own chapters and its own tiering. A bank's Directions do not bind an NBFC and a co-operative bank's levels are not an NBFC's layers. The table shows each instrument as it stands in AuditSahi's rulebook. Verified means we read the instrument in RBI's own publication. Unverified means we could not reach a primary page that quotes its title and reference, and the entry is shown that way in the product until we can.

Instrument	Applies to	Reference	Status in our rulebook
Commercial banks	Scheduled commercial banks	RBI/DoS/2026-27/410	verified
NBFCs	All NBFCs, by scale-based regulation layer and asset size	Master Direction of 31 July 2026	verified
Urban co-operative banks	Primary co-operative banks, tiered by the digital services offered	RBI/DoS/2026-27/437	verified
Small finance banks	Small finance banks	RBI/DoS/2026-27/419	unverified
Payments banks	Payments banks	RBI/DoS/2026-27/428	unverified
All-India financial institutions	AIFIs	Title reported in search results only	unverified
Credit information companies	CICs	Existence inferred from references to the seven	unverified

Across the instruments we have read, the structure is the same: governance, policies, risk management, resilience, incident reporting and assurance, with the clauses applied by tier. The NBFC Directions are the ones most of our users meet, so the rest of this article follows them.

How the NBFC Directions tier

The NBFC Directions took effect on the day they were issued, 31 July 2026, with no transition period stated. Which chapters apply depends on the entity's layer under RBI's scale-based regulation and, within the Base Layer, on asset size.

Layer	Who
Base Layer, below Rs 500 crore	Non-deposit taking NBFCs with assets under Rs 500 crore on the latest audited balance sheet
Base Layer, Rs 500 crore and above	Non-deposit taking NBFCs with assets of Rs 500 crore or more
Middle Layer	Deposit taking NBFCs irrespective of size, and non-deposit taking NBFCs of Rs 1,000 crore and above
Upper Layer	The top ten NBFCs by asset size, and others RBI places there by its scoring methodology
Top Layer	Reserved by RBI

What a Base Layer NBFC of Rs 500 crore and above must do

AuditSahi's rulebook holds 90 obligations under the NBFC Directions. These are the ones a Board hears about first.

The six-hour report to RBI sits beside the six-hour report to CERT-In under the 2022 Directions. One incident, two regulators, two clocks starting at about the same time.

What the smaller Base Layer NBFC must do

Below Rs 500 crore the Directions ask for less, but not for nothing. A Board-approved IT and information security policy covering access controls, passwords, user roles, maker-checker, digital signatures, mobile and social media use, management information for senior management and readiness for RBI returns, and a Board-approved business continuity plan with the Board seeing a report on it at least once a year.

Directions 2026, para 8 and para 8(8).

Why the distinction matters in an audit

An auditor reading the NBFC Directions against a policy written from a bank template will find clauses that do not apply and miss clauses that do. The instrument, the layer and the asset-size band decide the list, and the list decides the evidence. AuditSahi asks the three questions that place you, then shows the clause that put you there, so the document set you build is the one your own Directions ask for.