The Reserve Bank of India’s decision to conduct compliance audits on the 9,500-odd registered non-banking finance companies (NBFCs) is a necessary move to ensure water-tight regulation of the sector. While the exercise may precipitate a shakeout, this may not be such a bad thing, as the proliferation of non-banking entities exposes both retail borrowers and the financial system to risks. The immediate provocation for this audit seems to be rising customer complaints about digital lending apps openly flouting RBI norms.

RBI has decreed that digital apps cannot undertake any lending on their own balance sheets and must have either a bank or a registered NBFC at their back-end to underwrite risk. But investigations have shown that 600 of the 1,100 lending apps are illegal, with many digital players piggybacking on licenses of dormant NBFCs. Compliance audits will also help ensure that registered NBFCs are adhering to the specific lines of business that they were authorised for. After the IL&FS and DHFL failures exposed the high degree of inter-connectedness between NBFCs, banks and the rest of the financial system, RBI has been trying to reduce systemic risks by raising the regulatory bar on large NBFCs. In October 2021, it introduced a scale-based regulatory structure, where all NBFCs, including base-layer ones, are expected to transition to 90-day NPA recognition, granular disclosures on loan exposures et al. It may like to check if the new rules are being complied with. While RBI has so far been cancelling licences of individual NBFCs for violations, an audit can help rid the sector of bad actors and shell companies, in one go.

That said, there could be challenges in implementation. To start with, there is the question as to whether there are enough experienced audit firms to take up assignments. India is home to just about 2,000-odd audit firms, but RBI’s eligibility criteria may reduce it further. Presently, RBI specifies that statutory auditors for NBFCs must be rotated every three years, should not be reappointed for six years and must not have any other commercial relationship with the NBFC. Relaxing these norms for compliance audits may compromise the quality of the exercise. Small-sized NBFCs may be loathe to shell out the audit fees demanded by good quality firms for what is a mandatory exercise. Two, while checking whether non-bank entities are operational at their registered premises may be easy, scrutinising their books to assess net worth, loan exposures and recovery practices may require a deeper and longer engagement.

Given these challenges, RBI can perhaps supplement this audit exercise with efforts to get direct feedback from stakeholders on the functioning of NBFCs. Opening up a direct grievance redressal window at its own site where NBFC customers can escalate their complaints to the regulator, and whistle-blower mechanisms for reporting on doubtful NBFC lending practices, may give RBI more leads on rogue entities.