RBI penalises two NBFCs over KYC and governance compliance lapses

The Enforcement Action

The Reserve Bank of India (RBI) on 21 August 2026 imposed monetary penalties on two non-banking financial companies for deficiencies in regulatory compliance identified during its supervision. Per the RBI press releases dated that day, the regulator imposed a penalty of Rs 8.10 lakh on Shri Ram Finance Corporation Private Limited (press release 2026-2027/943) and a separate penalty of Rs 2.70 lakh on Progfin Private Limited (press release 2026-2027/944). Both penalties were imposed under Section 58G(1)(b) read with Section 58B(5)(aa) of the Reserve Bank of India Act, 1934.

RBI stated that the action in each case followed its statutory inspection of the company with reference to its financial position as on 31 March 2025. According to the releases, the penalties relate to the companies' failure to comply with certain RBI directions on customer identification and, in the case of Shri Ram Finance Corporation, on governance. RBI recorded that a notice was issued to each company asking it to show cause as to why a penalty should not be imposed for the identified non-compliance.

In both cases RBI added the standard qualification that its action was "based on deficiencies in regulatory compliance" and was "not intended to pronounce upon the validity of any transaction or agreement" entered into with customers. The regulator further noted that the penalty is without prejudice to any other action it may initiate against the company. Neither company is recorded in the releases as having contested the findings beyond the show-cause process, and no public response from either lender was on record at the time of writing.

How the Scheme Worked

These penalties do not stem from any finding of customer wrongdoing. They follow RBI's routine supervisory examination, and the releases describe specific compliance gaps rather than any misappropriation of money. According to the release concerning Shri Ram Finance Corporation Private Limited, RBI found three shortcomings. To begin with, the company appointed a director without obtaining the prior written permission of RBI, in a situation where the change in management exceeded 30 per cent of its directors, excluding independent directors. Second, it had not put in place a system to categorise its customers into low, medium and high risk. Third, it failed to upload the KYC records of certain customers to the Central KYC Records Registry within the prescribed timeline.

In the case of Progfin Private Limited, RBI found a narrower lapse. Per the release, the company had not put in place "a system of periodic review of risk categorisation of accounts", which is required at least once every six months. Risk categorisation is the process by which a regulated lender ranks each customer by risk and applies proportionate due diligence; leaving that ranking un-reviewed weakens the early-warning value of the exercise.

The procedural history in each matter followed RBI's standard supervisory route. The examination fixed the companies' financial position as on 31 March 2025, after which RBI issued a show-cause notice setting out the contraventions it had identified. In the Shri Ram Finance Corporation matter, the release records that the company submitted a written reply, made additional submissions, and was heard in person before RBI took its decision. After considering the submissions, RBI concluded that the non-compliance was substantiated and warranted a monetary penalty. RBI did not, in either release, attribute any customer loss to the lapses; the action turns on the adequacy of each company's compliance systems, not on any harm to a borrower or depositor.

The Law Invoked

Both penalties were imposed under Section 58G(1)(b) read with Section 58B(5)(aa) of the Reserve Bank of India Act, 1934. Section 58B(5)(aa) addresses the failure by a non-banking financial company to comply with directions issued by RBI, and Section 58G empowers the regulator to impose a monetary penalty for such a default through an adjudicating officer, up to the ceiling the Act prescribes. These provisions sit in Chapter IIIB of the Act, which governs RBI's oversight of NBFCs.

The underlying obligations flow from RBI's directions rather than from the Act alone. The customer-identification failures were assessed against the Reserve Bank of India (Know Your Customer (KYC)) Directions, which require regulated entities to classify customers by risk, to review that classification periodically, and to file KYC records with the Central KYC Records Registry within set timelines. The director-appointment finding against Shri Ram Finance Corporation was assessed against RBI's requirement that an NBFC seek the regulator's prior approval before a substantial change in its management. The releases describe these as directions issued by RBI; they are administrative requirements, and a breach is a compliance default addressed through a monetary penalty rather than any other proceeding.

What Happens Next

A monetary penalty of this kind is a completed regulatory action, not an interim step in a continuing matter. The two NBFCs are required to pay the penalties imposed on them. RBI has recorded that the action is without prejudice to any other step it may take, which leaves open further supervisory measures if the deficiencies are not corrected, though the releases announce none.

A regulated entity that disputes a penalty imposed by an adjudicating officer under the RBI Act has recourse to the appellate mechanism the Act provides, and ultimately to the courts by way of writ. Neither company is recorded as having announced an appeal. In practice, the more consequential response is remedial: lenders penalised for KYC or governance gaps are expected to close them, and RBI's follow-up inspections test whether that has happened.

The releases do not restrict either company's lending or deposit activities; the penalties are financial and reputational, not a suspension of business. For customers, nothing in the orders changes the standing of loans, deposits or agreements they already hold with either lender, a point RBI made expressly when it noted that the penalties do not pronounce upon the validity of any customer transaction.

What It Means

For an ordinary borrower or depositor, the value of an action like this is the window it opens onto how a lender is run. KYC risk categorisation and timely filing to the Central KYC Records Registry are not paperwork for its own sake; they are the controls that keep a finance company's books clean of illicit-funds risk and ensure a customer's verified identity is recorded once and reused across the system. When RBI penalises a company for gaps here, it is signalling that the lender's back-office discipline fell short of the standard expected, even where no customer was harmed.

The practical takeaway is verification. Anyone dealing with a finance company can check that it is a registered NBFC on RBI's list of NBFCs, available on the RBI website, and can look up whether an entity is authorised to accept deposits at all, since most NBFCs are not permitted to. A lender that asks for full KYC, explains its risk-based due diligence and files your records properly is following the very directions these penalties enforce. Treat reluctance to complete KYC, or pressure to skip it, as a warning sign rather than a convenience.

None of this is cause for alarm about the two companies named. A penalty for compliance deficiencies is a corrective tool used routinely across the sector, and RBI has expressly separated it from the validity of customer dealings. The lesson for the reader is the general one: the strength of a lender's compliance is a fair proxy for how carefully it will handle your money and your data.

FAQ

What exactly did RBI order?

RBI imposed a monetary penalty of Rs 8.10 lakh on Shri Ram Finance Corporation Private Limited and Rs 2.70 lakh on Progfin Private Limited on 21 August 2026, for non-compliance with its directions on KYC and, in the Shri Ram Finance Corporation matter, on prior approval for a change in management. The penalties were imposed under Section 58G(1)(b) read with Section 58B(5)(aa) of the RBI Act, 1934.

Does the penalty mean my loan or deposit is invalid?

No. RBI stated that its action is "based on deficiencies in regulatory compliance" and is "not intended to pronounce upon the validity of any transaction or agreement" entered into with customers. Existing agreements stand; the penalty concerns the company's compliance systems, not individual customer dealings.

Why does KYC risk categorisation matter?

Risk categorisation ranks each customer by risk so that the lender applies proportionate checks and reviews higher-risk accounts more closely. RBI requires this to be reviewed at least once every six months. Leaving it un-reviewed, as RBI found in Progfin's case, weakens the system's ability to flag unusual activity early.

Can the companies challenge the penalty?

Yes. A penalty imposed under the RBI Act can be contested through the appellate route the Act provides and, ultimately, before the courts. Neither company is on record as having announced an appeal. Paying the penalty does not by itself amount to any admission beyond the compliance findings RBI recorded.

How can I check if a finance company is regulated?

RBI publishes a list of registered NBFCs and a separate list of those authorised to accept public deposits on its website, rbi.org.in. Verifying a lender's registration, and checking whether it may take deposits at all, is the simplest protection before you borrow from or place money with any finance company.

Where can I read the official orders?

The penalties are set out in RBI's press releases dated 21 August 2026 on rbi.org.in: release 2026-2027/943 for Shri Ram Finance Corporation Private Limited and release 2026-2027/944 for Progfin Private Limited.

This report is based on the official Reserve Bank of India press releases dated 21 August 2026 imposing penalties on Shri Ram Finance Corporation Private Limited and Progfin Private Limited. It was surfaced via coverage in The Economic Times.