Reserve Bank of India (Small Finance Banks - Compliance Function) Directions, 2026

Search the Website

( 968 kb ) Reserve Bank of India (Small Finance Banks - Compliance Function) Directions, 2026 RBI/DoS/2026-27/417 DoS.CO.PPG.11/11.01.005/2026-27

July 31, 2026

Reserve Bank of India (Small Finance Banks - Compliance Function) Directions, 2026

Introduction

Compliance function is a key element of a bank’s corporate governance framework and an integral part of assurance, alongside internal audit and risk management processes. The principles governing the Compliance function are aligned with the Basel Committee on Banking Supervision framework, adapted to the Indian operating environment, and extend to bank-led Financial Conglomerates for managing group-wide compliance risk. While minimum standards are prescribed, the bank shall organise its Compliance function and prioritise compliance risk management in a manner commensurate with its size, complexity, risk profile, and organisational structure.

In exercise of the powers conferred by Section 35-A of the Banking Regulation Act, 1949, and all other provisions / laws enabling the Reserve Bank of India (‘RBI’) in this regard, RBI being satisfied that it is necessary and expedient in the public interest so to do, hereby, issues Directions hereinafter specified.

Chapter I - Preliminary

A. Short Title and Commencement

1. These Directions shall be called the Reserve Bank of India (Small Finance Banks - Compliance Function) Directions, 2026.

2. These Directions shall come into effect immediately upon issuance.

B. Applicability

3. These Directions shall be applicable to Small Finance Banks (hereinafter collectively referred to as 'banks' and individually as 'bank').

C. Definitions

4. In these Directions, unless the context states otherwise, the terms herein shall bear the meaning assigned to them below:

(1) ‘Compliance Risk’ shall mean the risk of legal or regulatory sanctions, material financial loss, or loss to reputation a bank may suffer as a result of its failure to comply with laws, regulations, rules, related self-regulatory organisation standards, and codes of conduct applicable to its banking activities (together, ‘compliance laws, rules, and standards’).

5. All other expressions unless defined herein shall have the same meaning as have been assigned to them under the Reserve Bank of India Act, 1934, the Banking Regulation Act, 1949, the Companies Act, 2013, or any statutory modification or re-enactment thereto or other regulations issued by RBI or the Glossary of Terms published by RBI or as used in commercial parlance, as the case may be.

Chapter II - Governance and Oversight

A. Role of the Board

6. The Board shall have an overall responsibility for the effective oversight and management of the bank’s Compliance function and compliance risk.

7. The Board shall ensure that the bank has an appropriate Compliance Policy in place and shall oversee its effective implementation. The Board shall review the policy at least annually.

8. The Board shall ensure that compliance issues are resolved effectively and expeditiously by senior management with the assistance of compliance staff. If necessary, the Board may delegate these tasks to the Audit Committee of the Board (ACB).

9. The Board or ACB shall review the Compliance function on a quarterly basis. A detailed annual review should also be placed before the Board / ACB. The Chief Compliance Officer (CCO) should be an invitee to such meetings.

10. The Board shall ensure that the Compliance function and the Internal Audit function of the bank are kept separate.

B. Role of the Senior Management

11. The Managing Director and Chief Executive Officer (MD & CEO) shall ensure the presence of an independent Compliance function and adherence to the compliance policy of the bank.

12. The senior management shall establish a written Compliance policy which should contain the basic principles to be followed by the management and staff and explain the process by which compliance risk shall be identified and managed through all levels of the bank.

13. The senior management shall ensure that appropriate remedial or disciplinary action is taken if breaches are identified.

14. Senior management shall, with the assistance of the Compliance Function:

(1) identify and assess, at least annually, the main compliance risks facing the bank and formulate the plans to manage them;

(2) submit to the Board / ACB, as the case may be, quarterly and annual reviews as prescribed at paragraph 9, in such a manner as to assist the Board members to make an informed judgment on whether the bank is managing its compliance risk effectively; and

(3) report promptly any material compliance failure (e.g., failure that may attract a significant risk of legal or regulatory sanctions, material financial loss, or loss to reputation) to the Board / ACB and take appropriate remedial measures.

C. Compliance Policy

15. The Board-approved Compliance policy of the bank should clearly spell out its compliance philosophy, expectations on compliance culture covering tone from the top, accountability, incentive structure, effective communication and challenges thereof, structure and role of the Compliance function, authority, and role of the CCO, processes for identifying, assessing, monitoring, managing, and reporting on compliance risk throughout the bank.

16. The Compliance policy shall, inter alia, adequately consider the size, complexity, and compliance risk profile of the bank, expectations on ensuring compliance to all applicable statutory provisions, rules, and regulations, various codes of conduct (including the voluntary ones) and the bank’s own internal rules, policies and procedures, and a disincentive structure for compliance breaches. The policy should emphasise building up compliance culture, vetting of the quality of reports provided to RBI by the bank.

17. The policy should cover the following aspects:

(1) Establishment of an independent Compliance Department at the Head Office headed by the CCO with adequate support staff and its role and responsibilities specified.

(2) Compliance units in controlling offices and branches specifying the role and responsibility of each functionary within such compliance units.

(3) Measures to ensure independence of the Compliance function.

(4) Focus of the Compliance function on ensuring compliance with regulatory and statutory requirements, fair practice codes, and other codes prescribed / suggested by self-regulatory organisations, government policies, bank's internal policies, and requirements relating to the prevention of money laundering and funding of illegal activities.

(5) Monitoring mechanism for the compliance testing procedure.

(6) Reporting requirements including inter alia reporting of monitoring results, compliance risk assessment, and change in the compliance risk profile, by the Compliance function to the senior management and the Board / ACB, as the case may be.

(7) Right of the Compliance function to have access to information necessary to carry out its responsibilities and for pointing out / looking into possible breaches of Compliance policy.

(8) Relationship between CCO and heads of other functional departments.

(9) Independence of the Compliance function from Internal Audit function and clarity on their respective roles.

(10) Mechanism for dissemination of information on regulatory directions and guidelines among operational staff and periodic updating of operational manuals to incorporate changes in regulatory, legal and other applicable requirements.

(11) Approval process for all new processes and products by the Compliance Department prior to their introduction.

(12) Right of the Compliance function to freely disclose its findings and views to senior management, Board / ACB, as the case may be.

Chapter III - Scope, Structure and Responsibilities

A. Scope

18. The Compliance function shall ensure adherence with applicable statutory and regulatory requirements as well as applicable codes, of Self-Regulatory Organisations.

B. Group-wide Compliance

19. A group or enterprise-wide compliance programme shall assist senior management and the Board in understanding the concentration, level, and evolution of legal and reputational risks and in identifying control processes requiring enhancement. The Compliance function shall ensure that controls and procedures capture the appropriate information to allow senior management and the Board to better perform their Risk Management functions on a group-wide basis.

Explanation: A Group is defined as parent and its subsidiaries (as defined in AS-21). However, the bank is also encouraged to promote a similar compliance culture across its associates and joint ventures (as defined in AS-23 and AS-27 respectively).

C. Structure

20. Depending on its branch network, size and complexity of the business operations, and sophistication of products and services offered, the bank shall decide on the organisational structure and composition of its Compliance unit. The bank may, however, lay down the structure within the overall framework of these Directions and should avoid all potential conflicts of interest. Regardless of how the Compliance function is organized within the bank, it should be independent and sufficiently resourced, its responsibilities should be clearly specified, and its activities should be subject to periodic and independent review.

21. The bank shall set up a Compliance Department at the Head Office of the bank. The CCO shall head the Compliance Department, with the overall responsibility of coordinating the identification and management of the bank's compliance risk and supervising the activities of other Compliance function staff.

22. In case of large banks, Compliance function staff may be located within operating business lines.

23. Each Department in the Head Office, controlling offices, the branches, and / or Strategic Business Units shall have distinct Compliance function, and the functions should be undertaken by specifically identified / designated compliance official/s who would report to the CCO.

24. The staff in the Compliance Department at the Head Office, controlling offices, and branches / Strategic Business Units shall primarily focus on compliance functions. However, in small sized banks with limited branch network, the compliance staff may be assigned other duties while ensuring that there is no conflict of interest. Under no circumstances, the compliance staff should be assigned audit / inspection duty to avoid conflict of interest in view of the fact that all products and processes are expected to be cleared by the Compliance Department, and its audit needs to be carried out independently by a separate set of staff.

25. Depending on the business model, size, structure of the bank, entire compliance responsibilities may not be carried out by the Compliance Department and may be vested in different departments. For Compliance function staff in independent support units (e.g., legal, financial control, risk management), a separate reporting line from staff in these units to the CCO may not be necessary. However, these units / departments shall co-operate closely with the CCO and there should invariably be an appropriate mechanism for co-ordination among these departments to enable the CCO to perform the assigned responsibilities effectively.

26. Compliance function staff in operating business units or in local subsidiaries may have a reporting line to operating business unit management or local management, but they should also have a reporting line through to the CCO for their compliance responsibilities.

27. The remuneration of the Compliance functionaries shall not be related to the business line for which they exercise Compliance responsibilities though it could generally be related to the financial performance of the bank as a whole.

D. Staffing

28. The bank shall provide adequate staff to the Compliance Department to ensure that the compliance units discharge their functions without human resource constraints. The bank shall put in place appropriate succession planning to ensure that the post of compliance officer(s) does not remain vacant.

29. Apart from the basic qualifications, the compliance staff should preferably have fair knowledge of law, accountancy, and information technology and also adequate practical experience in various business lines and audit / inspection functions to enable them to carry out their duties effectively. In order to keep the compliance staff up-to-date with developments in the areas of banking laws, rules, and standards, regular and systematic education and training in new products and services introduced in the banking industry as well as in the areas of corporate governance, risk management, and supervisory practices may be considered.

E. Roles and Responsibilities

30. The Compliance Department at the Head Office shall play the central role in identifying the level of compliance risk in each business line, product, and process, issue instructions to operational functionaries and formulate proposals for mitigation of such risk. It shall periodically circulate the instances of compliance failures among staff along with preventive instructions.

31. The responsibilities of the Compliance function shall be carried out under a Compliance programme that sets out its planned activities. The Compliance programme shall be risk-based and subject to oversight by the CCO to ensure appropriate coverage across businesses and co-ordination among Risk Management functions. The bank shall implement a comprehensive Compliance plan replete with Compliance testing and review structures.

32. Inspection / audit findings should serve as a feedback mechanism for the Compliance Department for assessing the areas of compliance breaches / failures. A checklist on the compliance aspect may be made part of the inspection report for the inspectors / concurrent auditors to verify the level of compliance.

33. Compliance function shall vet the guidelines / circulars issued by the bank, for compliance with regulatory guidelines before these are disseminated amongst the operational units. It shall also incorporate a robust mechanism to ensure that regulatory guidelines / instructions are promptly issued / disseminated within the bank and also monitor compliance with them.

34. The Compliance Department shall serve as a reference point for the bank's staff from operational departments for seeking clarifications / interpretations of various regulatory and statutory guidelines.

35. The Compliance function shall on a pro-active basis identify, document, assess the compliance risks associated with the bank's business activities and products. The compliance risks in all new products and processes should be thoroughly analysed and appropriate risk mitigants by way of necessary checks and balances should be put in place before launching. The bank shall subject all new products to intensive monitoring for the first six months of introduction to ensure that the indicative parameters of compliance risk are adequately monitored.

36. The bank shall develop function-wise compliance manuals duly approved by the CCO if their operating manuals do not already contain specific sections or chapters on compliance and provide these to the staff associated with the respective functions.

37. The Compliance Department shall, at frequent intervals, interact with Legal Department, Operational Risk Management Department, Taxation Department, and Audit / Inspection Department of the bank to take stock of the latest developments. The bank should provide Compliance officers with access to all information they require and the right to conduct investigation and report the findings to the CCO.

38. There should be close co-ordination and partnership between Compliance and Business Operations functions. The interaction may be formalised by making the CCO a member of the various inter-departmental committees in the bank.

39. The Compliance function shall monitor and test compliance by performing sufficient and representative compliance testing, and the results of such compliance testing shall be placed before the Board / ACB / MD & CEO.

40. The Compliance function shall also consider ways to measure compliance risk (e.g., by using performance indicators) and use such measurements to enhance compliance risk assessment.

41. The Compliance function shall empower the Compliance staff to conduct compliance reviews / investigations, whenever required. The authority to use external experts for the purpose of investigation, if required, should be left to the discretion of the CCO.

42. The bank shall ensure that the Compliance function is free to report to senior management on any irregularities without fear of disfavour from management or other staff members. The Compliance function should also have the right of direct access to the Board or the ACB, as the case may be, bypassing normal reporting lines.

43. Non-compliance with any regulatory guidelines and administrative actions initiated against the bank and / or corrective steps taken to avoid recurrence of the lapses should be disclosed in the annual report of the bank.

44. The code of conduct for employees should envisage working towards earning the trust of the society by dealing with customers in a fair manner and conducting business operations consistent with rules and regulations. Due weightage may be given to record of compliance during performance appraisal of staff at various levels. The bank shall examine the staff accountability for all compliance failures.

45. Compliance function shall ensure full compliance with all specified guidelines enlisted in the templates oriented towards Compliance assessment under the Risk-Based Supervision (RBS) framework. Since the regulatory guidelines forming part of such template are neither exhaustive nor static and are expected to be updated on an annual basis, the bank shall, therefore, strive to put in place an exhaustive Compliance framework encompassing all guidelines emanating from RBI, identify potential breaches and remedy them up-front.

46. Compliance units shall specifically devise a time-bound strategy to ensure that compliance with Monitorable Action Plan (MAP) / Risk Mitigation Plan (RMP) prescribed pursuant to the Annual Financial Inspection / Risk Based Supervision process is achieved within the time frame. The bank shall comply with all MAP / RMP points well before the commencement of the subsequent supervisory cycle and / or within the periods prescribed for fulfilling the requirements of MAP / RMP.

47. The Compliance function may have specific statutory responsibilities (e.g., fulfilling the role of anti-money laundering officer). The bank shall carry out an annual compliance risk assessment in order to identify and assess major compliance risks faced by it and prepare a plan to manage the risks. The Annual Review shall cover the following aspects:

(1) Compliance failures, if any, during the preceding year and consequential losses and regulatory action as also steps taken to avoid recurrence of the same.

(2) List of all major regulatory guidelines issued during the preceding year, and steps taken by the bank to ensure compliance.

(3) Independence of Compliance function.

(4) Scope of compliance procedures and processes.

(5) System of internal control to minimise compliance risk.

(6) Compliance with fair practices codes and adherence to standards set by self-regulatory organisations and accounting standards.

(7) Progress in rectification of significant deficiencies pointed out by the Internal audit, Statutory audit, and RBI inspection reports and position of implementation of recommendations made therein.

(8) Strategy for the next year including restructuring of Compliance Department, if necessary, and posting / transfer / training of staff.

48. Apart from the exhaustive annual review, a monthly report on the position of compliance risk may be put up to the senior management / MD & CEO.

49. The Compliance function shall advise and assist the senior management on compliance laws, rules, and standards, including keeping them informed on developments by establishing written guidance to staff on the appropriate implementation of compliance laws, rules, and standards through policies and procedures and other documents such as compliance manuals, internal codes of conduct, and practice guidelines.

50. The Compliance function shall also attend to the compliance of directions from other regulators (including Insurance Regulatory & Development Authority of India, and Securities and Exchange Board of India) in those cases where the activities of the bank are not limited to the banking sector. For example, a bank which is acting as a corporate agent for distribution of other companies’ insurance products may receive direction from Insurance Regulatory & Development Authority of India, which should be a part of the Compliance function. The Compliance function shall bring to the notice of RBI, any discomfort conveyed to the bank on any issue by other regulators.

51. A bank with business across various jurisdictions shall ensure that it complies with applicable laws and regulations in all such jurisdictions and that the bank, its Compliance function structure, and its responsibilities are consistent with local legal and regulatory requirements. It is for local business units to ensure that compliance responsibilities specific to each jurisdiction are carried out by the individuals with appropriate local knowledge and expertise, with oversight from the CCO in co-operation with the bank’s other risk management functions.

F. Compliance Culture

52. For the Compliance function to be effective, it must be supported by a healthy Compliance culture within the bank. It is important that the need to comply with instructions meticulously is periodically re-iterated to all the staff in the bank through continuous and mandatory training on compliance aspects, and appropriate disciplinary measures through staff accountability framework / policies for non-compliance. Compliance should not be viewed as a responsibility of the Compliance Department alone but as a culture that should pervade across the bank.

G. Quality Assurance and Internal Audit

53. The bank shall develop and maintain a quality assurance and improvement program covering all aspects of the Compliance function. The quality assurance and improvement program shall be subject to independent external review periodically (at least once in three years).

54. The Compliance function shall be subject to Internal Audit. The Internal audit function should keep the CCO informed of audit findings related to Compliance. Compliance risk shall be included in the risk assessment methodology of the Internal Audit function, and the audit programme shall cover the adequacy and effectiveness of the bank's Compliance function including testing of controls commensurate with the perceived level of risk.

Chapter IV - Chief Compliance Officer

55. The Compliance function in the bank shall be adequately enabled and made sufficiently independent. Such an independent Compliance function shall be headed by a designated CCO who may also be recruited from outside the bank.

A. Appointment

56. The candidate for the post of the CCO shall be selected on the basis of a well-defined selection process with an appropriate ‘fit and proper’ evaluation / selection criteria (‘Fit and Proper’ criteria may be examined and reported from the perspectives of competency, integrity and conflict of interest, among others) and recommendations made by the senior executive level selection committee constituted by the Board for the purpose. The selection committee shall recommend the names of candidates suitable for the post of the CCO in order of merit and Board shall take final decision in the appointment of CCO.

57. There should be no vigilance case or adverse observation from RBI pending against the candidate identified for appointment as the CCO.

58. The CCO shall not be more than 55 years of age at the time of appointment.

Provided that if a person identified as CCO is above the age of 55 years, but had continuous association with the Compliance function either as CCO or otherwise, the age limit of 55 years may be taken as the date from when the continuous association with the Compliance function started for the identified CCO. Illustratively, if a person identified for CCO role is more than 55 years old but has been continuously associated with the Compliance function prior to completing the age of 55 years, she/ he would be eligible for such appointment.

59. The CCO shall have an overall experience of at least 15 years in the banking or financial services, out of which minimum five years shall be in the Audit / Finance / Compliance / Legal / Risk Management functions.

Provided that Risk Management functions shall also include control functions within the business lines. Therefore, if a regional / zonal / business head had the requisite responsibility / experience in the control functions of the business lines for five years or more, they shall be eligible for the post of CCO under this condition.

60. The CCO shall have good understanding of industry and risk management, knowledge of regulations, legal framework, and sensitivity to supervisors’ expectations.

B. Authority, Stature, and Independence

61. The CCO shall be appointed for a minimum fixed tenure of not less than three years. The ACB / MD & CEO shall factor this requirement while appointing CCO.

62. The CCO may be transferred / removed before completion of the tenure only in exceptional circumstances with the explicit prior approval of the Board after following a well-defined and transparent internal administrative procedure.

63. The CCO shall be a senior executive of the bank, preferably in the rank of a General Manager or an equivalent position (not below two levels from the MD & CEO).

64. The CCO shall have the ability to independently exercise judgement. They should have the freedom and sufficient authority to interact with regulators / supervisors directly and ensure compliance.

65. The CCO shall have direct reporting lines to the MD & CEO and / or Board / ACB of the bank. In case, the CCO reports to the MD & CEO, ACB shall meet the CCO quarterly on one-to-one basis, without the presence of the senior management including MD & CEO.

66. The CCO shall not have any reporting relationship with the business verticals of the bank and shall not be given any business targets. Further, the performance appraisal of the CCO shall be reviewed by the Board / ACB.

67. The bank shall ensure that there is no ‘dual hatting’ i.e. the CCO shall not be given any responsibility which brings elements of conflict of interest, especially the role relating to business. Roles which do not attract direct conflict of interest like role of anti-money laundering officer can be performed by the CCO in those banks where principle of proportionality in terms of bank’s size, complexity, risk management strategy, and structures justify that.

68. The CCO shall not be member of any committee which brings their role in conflict with responsibility as member of the committee, including any committee dealing with purchases / sanctions. In case the CCO is member of a committee, they may have only advisory role.

69. The CCO shall have the authority to communicate with any staff member and have access to all records or files that are necessary to enable them to carry out entrusted responsibilities in respect of compliance issues.

C. Reporting Requirements

70. The bank shall provide prior intimation to the Senior Supervisory Manager of the RBI, before appointment, premature transfer / removal of the CCO. Such information should be supported by a detailed profile of the candidate along with the fit and proper certification by the MD & CEO of the bank, confirming that the person meets the prescribed supervisory requirements, and detailed rationale for changes, if any.

D. Roles and Responsibilities

71. The CCO shall assist the senior management in effectively managing the compliance risks faced by the bank. Typical core elements of the mandate of CCO must include the design and maintenance of compliance framework, training on the regulatory and conduct risks, and effective communication of compliance expectations. These shall, inter alia, include following activities:

(1) To apprise the Board and senior management on regulations, rules and standards and any further developments.

(2) To provide clarification on any compliance related issues.

(3) To conduct assessment of the compliance risk (at least once a year) and to develop a risk-oriented activity plan for compliance assessment. The activity plan shall be submitted to the ACB for approval and be made available to the Internal Audit function.

(4) To report promptly to the Board / ACB / MD & CEO about any major changes / observations relating to the compliance risk.

(5) To periodically report on compliance failures / breaches to the Board / ACB and circulating to the concerned functional heads.

72. The CCO should be a member of the 'new product' committee/s to ensure that the new products / processes have clearance from all perspectives including compliance.

73. The CCO shall ensure compliance of supervisory observations made by RBI and / or any other directions in both letter and spirit in a time bound and sustainable manner. They should be the nodal point of contact between the bank and the RBI. The CCO shall necessarily be a participant in the quarterly informal discussions held with RBI. In case no quarterly meeting is held, they shall meet the Chief General Manager, Department of Supervision, in charge of the concerned bank at Central Office of RBI, once in every quarter of the year, to discuss compliance issues. In case compliance to RBI inspection reports is communicated through the Inspection & Audit Department of banks to RBI, a copy of the same needs to be endorsed to the CCO for information.

Chapter V - Use of Technology for Monitoring

74. The bank shall implement comprehensive, integrated, enterprise-wide and workflow-based solutions / tools to enhance the effectiveness of Compliance function. Such a solution / tool shall, inter alia:

(1) provide for effective communication and collaboration among all the stakeholders (by bringing business, compliance, and Information Technology teams, and senior management on one platform);

(2) have processes for identifying, assessing, monitoring and managing compliance requirements;

(3) escalate issues of non-compliance, if any;

(4) require recording approval of competent authority for deviations / delay in compliance submission; and

(5) have a unified dashboard view to senior management on compliance position of the bank as a whole.

75. The bank, based on the size and complexity of its operations, may decide on the tools / mechanism it would prefer to deploy for monitoring of compliance and development of the unified dashboard.

Chapter VI - Repeal and Other Provisions

A. Repeal and Saving

76. With the issue of these Directions, the existing directions, instructions, and guidelines relating to Compliance function as applicable to Small Finance Banks stand repealed, as communicated vide circular no.DoS.CO.PPG.66/11.01.005/2026-27 dated July 31, 2026 . The Directions, instructions, and guidelines repealed prior to the issuance of these Directions shall continue to remain repealed.

77. Notwithstanding such repeal, any action taken or purported to have been taken, or initiated under the repealed Directions, instructions, or guidelines shall continue to be governed by the provisions thereof. All approvals or acknowledgments granted under these repealed lists shall be deemed as governed by these Directions. Further, the repeal of these directions, instructions, or guidelines shall not in any way prejudicially affect:

(1) any right, obligation or liability acquired, accrued, or incurred thereunder;

(2) any penalty, forfeiture, or punishment incurred in respect of any contravention committed thereunder;

(3) any investigation, legal proceeding, or remedy in respect of any such right, privilege, obligation, liability, penalty, forfeiture, or punishment as aforesaid; and any such investigation, legal proceedings or remedy may be instituted, continued, or enforced and any such penalty, forfeiture or punishment may be imposed as if those directions, instructions, or guidelines had not been repealed.

B. Application of Other Laws Not barred

78. The provisions of these Directions shall be in addition to, and not in derogation of the provisions of any other laws, rules, regulations, or directions, for the time being in force.

C. Interpretations

79. For the purposes of giving effect to the provisions of these Directions or for removing any difficulties in their application or interpretation, RBI may, if it deems necessary, issue such clarifications as it considers appropriate in respect of any matter covered herein. The interpretation of any provision of these Directions by RBI shall be final and binding on all concerned entities.

(Tarun Singh) Chief General Manager

Top

Back to previous page