Resources Categories
INDUSTRY FACT FILE · NBFCS & LENDING
Market Landscape and the Drivers of Cybersecurity Demand for NBFCs
The business, technology, regulatory, legal and statutory forces that create cybersecurity, audit and assurance work for NBFCs and lenders.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: RBI's 2026 NBFC cybersecurity Directions 5. Other regulatory drivers 6. Legal and statutory drivers 7. How the drivers differ by lender type 8. What this means for buyers and for Codec Networks |
1. Market landscape
The NBFC sector spans very large, often listed lenders and thousands of smaller companies. Growth is increasingly digital and partner-led, and the regulatory framework now scales cybersecurity obligations with each NBFC's layer.
|
17 NBFCs in RBI's 2026-27 Upper Layer list |
₹1,00,000 cr Asset-size threshold for Upper Layer identification |
₹500 cr Threshold splitting Base Layer cyber requirements |
1 Jan 2026 Co-Lending Directions took effect |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Upper Layer NBFCs |
Large, often listed lenders with mature security teams and bank-like expectations |
Red teaming, independent VA/PT, SOC augmentation, third-party and LSP assurance, Board advisory |
|
Middle Layer NBFCs and HFCs |
Growing lenders that must meet Chapter V of the 2026 Directions, often with lean security teams |
Applicability assessments, VA/PT programmes, managed SOC, IS audit support |
|
Base Layer NBFCs (₹500 crore and above) |
Mid-sized lenders needing formal IT governance and annual IS audit |
IS audit, IT policy and governance, BCP/DR reviews |
|
Base Layer NBFCs (below ₹500 crore) |
Smaller lenders needing baseline controls proportionate to size |
Baseline assessments, policy templates, backup and BCP testing |
|
Digital and fintech-led lenders |
App-first origination, LSP partnerships, cloud-native platforms |
Lending app and API testing, cloud security, DPDPA programmes |
|
Microfinance and field-led lenders |
Large field forces using tablets and apps, often offline |
Field device security, agent access monitoring, DLP |
2. Business drivers
These explain why NBFC management allocates money to cybersecurity.
|
Business driver |
Buying trigger |
Relevant services |
|
Funding and partnerships |
Banks, co-lenders, rating agencies and investors examine security before funding |
Partner-ready assurance packs, ISO 27001, IS audit reports |
|
Fraud and credit losses |
Document fraud, dealer collusion and synthetic identities |
Fraud analytics, EWS reviews, forensic audits |
|
Regulatory standing |
New layer-based Directions and supervisory inspections |
Applicability assessments, gap remediation, evidence management |
|
Digital growth |
New apps, LSP partnerships and embedded credit |
Pre-launch testing, API security, LSP assurance |
|
Customer trust and conduct |
Data misuse, rogue apps and collection complaints |
Brand monitoring, privacy programmes, agent access controls |
|
Business continuity |
Branch, disbursement or collection outages |
Resilience and DR testing, ransomware readiness |
|
Listing and Upper Layer obligations |
Upper Layer NBFCs must list within three years of identification |
Board-level cyber governance and disclosure readiness |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Digital lending apps and LSP platforms |
API flaws, data oversharing, fake apps |
Application and API testing, brand monitoring |
|
Cloud-native LOS and LMS |
Misconfiguration, excessive permissions, exposed storage |
Cloud posture reviews, IAM assessments |
|
Account Aggregator and bureau integrations |
Consent abuse, data leakage, credential misuse |
Integration and consent-flow testing |
|
Field and agent mobile apps |
Device loss, offline data, insider misuse |
Mobile app testing, MDM and DLP reviews |
|
AI in underwriting and collections |
Model manipulation, prompt injection, data leakage |
AI/LLM security testing, AI governance |
|
Partner file and data exchange |
Tampering and interception of loan data |
File-integrity and secure-transfer testing |
Figure 3: The four groups of drivers behind cybersecurity spending in NBFCs.
4. Regulatory drivers: RBI's 2026 NBFC cybersecurity Directions
The Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (RBI/DoS/2026-27/461, 31 July 2026) apply to all NBFCs registered under the RBI Act, the Factoring Regulation Act or the NHB Act. They took effect immediately and repealed earlier IT framework and IT governance instructions for NBFCs. Requirements are organised by layer.
|
Applies to |
Key requirements |
|
All NBFCs (Chapters I and II) |
Board approves technology and cybersecurity strategies and policies, reviewed at least annually Cyber incidents reported on RBI's DAKSH platform within six hours of detection (HFCs report to NHB); CERT-In notified proactively |
|
Base Layer below ₹500 crore and CICs (Chapter III) |
Board-approved IT and information security policy; access and maker-checker controls; mobile and social-media safeguards BCP reported to the Board at least annually; data backup with periodic restoration testing |
|
Base Layer ₹500 crore and above (Chapter IV) |
IT Strategy Committee chaired by an independent director, with the CIO/CTO as members, meeting at least once every six months IS audit at least once a year as part of the internal audit system; outsourcing contracts with monitoring, audit rights and RBI access to records |
|
Middle, Upper and Top Layers (Chapter V) |
ITSC of at least three directors, chaired by an independent director with at least seven years of substantial IT experience, meeting at least quarterly; Information Security Committee under ITSC oversight CISO (preferably General Manager level) with no direct reporting to the Head of IT and no business targets, presenting cyber risk reviews at least quarterly VA at least six-monthly and PT at least annually for critical systems and DMZ systems with customer interfaces, including cloud-hosted systems DR drills for critical systems at least half-yearly, running on DR for at least a full working day; BCP tested at least annually and after significant changes IS audit overseen by the Audit Committee with an annually reviewed IS Audit Policy; source code or escrow for critical applications |
5. Other regulatory drivers
|
Instrument |
Applies to |
Key cybersecurity relevance |
|
RBI (Digital Lending) Directions, 2025 (8 May 2025) |
Regulated lenders, their LSPs and DLAs |
LSP oversight, DLA reporting on CIMS, borrower-data collection and storage restrictions, multi-lender transparency |
|
RBI (Co-Lending Arrangements) Directions, 2025 (effective 1 January 2026) |
Banks, AIFIs and NBFCs including HFCs |
Partner due diligence and data exchange for jointly funded loans |
|
RBI Master Directions on Fraud Risk Management in NBFCs (15 July 2024) |
NBFCs; early warning framework for Upper and Middle Layers |
Early warning signals, red-flagging, data analytics and fraud reporting |
|
RBI Managing Risks in Outsourcing Directions, 2025 |
NBFCs and other regulated entities |
Due diligence, contracts, audit and access rights for outsourced services |
|
RBI scale-based regulation |
All NBFCs |
Layer classification that determines which cyber chapter applies |
|
RBI KYC directions (including V-CIP) |
NBFCs |
Secure customer identification and record keeping |
Figure 4: Regulatory timeline for NBFC cybersecurity, as of October 2026.
6. Legal and statutory drivers
|
Law or obligation |
Relevance to NBFCs |
Demand created |
|
Reserve Bank of India Act, 1934 and National Housing Bank Act, 1987 |
Basis for RBI regulation of NBFCs and HFCs, and NHB supervision of HFCs |
Regulatory audits and supervisory responses |
|
IT Act, 2000 and CERT-In Directions (28 April 2022) |
6-hour reporting of specified incidents; ICT logs for 180 days in India; clock synchronisation |
Logging assurance, incident readiness, SOC |
|
Digital Personal Data Protection Act, 2023 and Rules, 2025 |
Most obligations, including security safeguards and breach intimation, from May 2027 |
Borrower data mapping, consent, safeguards, breach workflows |
|
Prevention of Money Laundering Act, 2002 |
Reporting entity obligations and FIU-IND reporting |
Transaction-monitoring reviews, investigations support |
|
Contracts |
Bank lines, co-lending agreements, rating and investor covenants, LSP agreements |
Assurance evidence and partner security reviews |
7. How the drivers differ by lender type
|
Lender type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Housing finance |
Long-tenor trust, document integrity |
Document management, LOS/LMS |
2026 NBFC Directions (NHB reporting), KYC |
|
Vehicle finance |
Dealer channels, collections |
Dealer portals, field apps |
2026 Directions, fraud risk directions |
|
Microfinance |
Field productivity, borrower protection |
Tablets, offline apps |
2026 Directions, microfinance directions, DPDP |
|
Consumer and digital |
Speed, partnerships, brand |
Apps, APIs, cloud, AI |
Digital Lending Directions, 2026 Directions, DPDP |
|
Gold loans |
Branch trust, vault integrity |
Branch IT, digital top-ups |
2026 Directions, gold-lending directions |
|
Infrastructure |
Funding, reputation |
Corporate IT, email |
2026 Directions (often Upper Layer), CERT-In |
8. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“Which requirements apply to our layer?” |
Regulatory applicability assessment |
Annual reassessment as layer or size changes |
|
“We need an annual IS audit.” |
IS audit (Base Layer ≥ ₹500 crore and above) |
Annual audit cycle and closure validation |
|
“We need six-monthly VA and annual PT.” |
VAPT assurance programme |
Scheduled testing calendar with retesting |
|
“Our apps and partners are our biggest risk.” |
Lending platform and partner assurance |
Release-based testing and annual partner reviews |
|
“We must report incidents within six hours.” |
Managed SOC and IR retainer |
24x7 monitoring and on-call response |
|
“We must be ready for DPDP.” |
Privacy and data-protection programme |
Periodic reviews and breach drills |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document summarises regulatory and legal instruments as published up to October 2026. It is not legal advice. Requirements depend on each NBFC's layer, type and activities; confirm obligations against the current official text of each Direction, including amendments.