Guidelines on Settlement of Dues of borrowers by ARC
– Team Finserv (finserv@vinodkothari.com)
– Team Finserv (finserv@vinodkothari.com)
Harshita Malik (finserv@vinodkothari.com)
While all issuance of debentures are governed by general laws under Companies Act, 2013 and SEBI (Issue and Listing of Non-Convertible Securities) Regulations, 2021 (for listed debentures), debt issuance (with maturity of more than one year) on a private placement basis, by financial entities are also subject to additional regulatory requirements issued by RBI and NHB for NBFCs and HFCs respectively. Notable, the guidelines for HFCs were stricter and more detailed than those for NBFCs imposing a higher level of regulatory oversight and compliance requirements for HFCs.
The RBI vide its circular dated the 29th of January, 2025, has made a significant modification to the HFC Master Directions stating that the guidelines applicable to NBFCs for issuance of NCDs (with a maturity of more than one year) shall mutatis mutandis apply to debenture issuances by HFCs. Accordingly, additional requirements applicable to HFCs stand deleted. Such change reflects a deliberate effort of the regulator to streamline and simplify the regulatory framework, while simultaneously easing the compliance burden for HFCs in issuing NCDs. This is in line with the overall objective of reducing the compliance burden for debt issuances through private placements, which are primarily targeted at institutional and informed investors.
In any case, NCD issuances will still be governed by other regulatory provisions. Where the existing NCDs are listed, the SEBI principle w.r.t. ‘once listed to be always listed’[1] shall continue to apply, thereby requiring listed HFCs to list every subsequent NCDs and comply with governance norms under SEBI Regulations.
It shall be noted that these guidelines are only applicable to NCDs with a maturity period of more than one year, while short-term NCDs with maturity of less than one year, shall be governed by the Master Direction – Reserve Bank of India (Commercial Paper and Non-Convertible Debentures of Original or Initial Maturity Up to One Year) Directions, 2024.
This circular shall be applicable to all fresh private placements of NCDs (with maturity more than one year) by HFCs from the date of this circular, that is January 29, 2025.
It appears that the RBI has effectively removed such provisions from the HFC Master Directions that were not explicitly mirrored in the SBR Master Directions. The newly inserted Para 56A, drawn verbatim from Para 58 of the SBR Master Directions, retains only such provisions that are common for both .
An analysis of the impact on the applicable provisions of the HFC Master Directions is provided in the table below:
Para No. | Particulars | Applicability | Impact of the change | |
Earlier | Now | |||
57.1 | Use of NCD proceeds for balance sheet funding only | ✅ | ✅ | No change in the purpose of issue |
57.2 | Prohibition on issuing NCDs for group or parent company use | ✅ | ✅ | |
58.1 | Minimum maturity period of 12 months for NCDs | ✅ | X | Removal of restrictions on exercise date, roll-over and tenor of the NCDs. However, as discussed, these guidelines will only be applicable for NCDs with a tenure of more than one year and short-term debentures will be governed by separate guidelines. Further, where the Company has obtained credit rating, quite naturally, the tenor would not exceed the validity period. |
58.2 | Option exercise date must exceed one year from issue date | ✅ | X | |
58.3 | Roll-over of NCDs- not allowed | ✅ | X | |
58.4 | Tenor of NCDs limited to Credit Rating validity period | ✅ | X | |
59.1 | Requirement of Credit Rating from approved agencies for issuing NCDs | ✅ | X | No requirement to obtain credit rating for issuance of NCDs |
59.2 | Minimum credit rating requirement for timely servicing of obligations | ✅ | X | Since no requirement to mandatorily obtain credit rating, this provision would no longer be relevant |
59.3 | Ensure current and valid credit rating at NCD issuance | ✅ | X | No need to ensure current and valid Credit Rating for NCD issuance |
60.1 | Subscriber limit and security requirement for NCDs with maximum subscription of less than ₹1 crore | ✅ | ✅ | No change in maximum number of investors and minimum amount of subscription per investor |
60.2 | No subscriber limit or requirement for security creation for NCDs with maximum subscription of ₹1 crore and above | ✅ | ✅ | |
60.3 | Minimum subscription of ₹20,000 per investor | ✅ | ✅ | |
60.4 | Two categories for private placement of NCDs based on subscription amount | ✅ | ✅ | |
61.1 | Limit on on amount of NCD issuance based on Board approval or credit rating agency guidelines | ✅ | X | Since credit rating is not mandatory, the requirement does not seem relevant. However, if the HFC obtains credit rating, naturally, the amount of issuance under such rating will be limited to the amount stated in the letter. |
61.2 | Completion of NCD issuance within 30 days of opening | ✅ | X | No time limit for completion of the issue. However, the time lines under Companies Act, 2013 and SEBI (Issue and Listing of Non-Convertible Securities) Regulations, 2021 will apply. |
62.1 | Board-approved policy for resource planning and NCD issuance | ✅ | ✅ | No change in the requirement of a Board approved policy |
62.2 | Offer document for private placement of NCDs to be issued within 6 Months of Board resolution | ✅ | X | No timeline is there within which offer document has to be issued from the date of passing of board resolution. |
63.1 | Disclosure requirements in offer document for private placement of NCDs | ✅ | X | The requirement for disclosure in offer documents as per the HFC Directions has been removed. However, the HFCs shall continue to comply with the disclosure requirements as per Section 42 of the Companies Act, 2013 read with Rule 14(1) of Companies (Prospectus and Allotment of Securities) Rules, 2014 and Regulation 28 of the SEBI (Issue and Listing of Non-Convertible Securities) Regulations, 2021 in case of issuance of listed NCDs |
63.2 | Auditor’s certification requirement | ✅ | X | No requirement for obtaining auditor’s certificate |
63.3 | Compliance with Companies Act, SEBI Regulations, and other applicable laws | ✅ | ✅ | While the said provision has not been retained, in any case, any debt issuance will be subjected to provisions of Companies Act, 2013 and Rules framed thereunder shall be applicable, wherever not contradictory, along with other applicable laws. |
63.4 | Issuance of Debenture Certificate in accordance with legal timeframe | ✅ | X | This paragraph becomes redundant, as SEBI (Issue and Listing of Non-Convertible Securities) Regulations, 2021 and Rule 9A and Rule 9B of the Companies (Prospectus and Allotment of Securities) Rules, 2014, stipulate that securities, must be issued in dematerialized form only. |
64.1 | Appointment of Debenture Trustee for each issue | ✅ | X | No need to appoint a Debenture Trustee |
64.2 | Eligibility criteria for Debenture Trustee | ✅ | X | |
64.3 | Submission of information by HFCs, based on information provided by theDebenture Trustee, as required by NHB | ✅ | X | |
65.1 | Requirement for fully secured NCDs | ✅ | X | This would be relevant only where the debentures are secured in nature. This requirement has been deleted, however, applicable provisions under Companies Act and SEBI (Issue and Listing of Non-Convertible Securities) Regulations, 2021/SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 will be applicable in case of security creation for secured debentures. |
65.2 | Escrow arrangement for insufficient security cover | ✅ | X | |
65.3 | Exemption for hybrid or subordinated debt | ✅ | X | |
65.4 | Exemption for NCDs with a maturity of more than one year and having the minimum subscription per investor at ₹1 crore and above | ✅ | X | |
66 | Preference for issuance of NCDs in dematerialized form | ✅ | X | Directions no longer prescribe a preferred mode of issuance, however, SEBI (Issue and Listing of Non-Convertible Securities) Regulations, 2021 and Rule 9A and Rule 9B of the Companies (Prospectus and Allotment of Securities) Rules, 2014, stipulate that securities, must be issued in dematerialized form only. |
67 | Prohibition on loans against own debentures | ✅ | ✅ | Restrictions on extension of loans against security of HFCs’ own debentures continues |
68.1 | Disclosure in the Board’s report requirements on unclaimed or unpaid NCDs | ✅ | X | No requirement of disclosures in the Board’s report. However, disclosure requirements as per applicable laws will continue to apply |
68.2 | Disclosure in the Board’s report requirements on the remaining unclaimed or unpaid NCDs | ✅ | X | |
68A | Exemption for tax-exempt bonds issued by HFCs | ✅ | ✅ | Exemption from applicability of these Directions given to tax exempt bonds continues |
[1] https://www.sebi.gov.in/media/press-releases/jun-2023/sebi-board-meeting_73278.html
Our article on the same can be read here-
-Dayita Kanodia (finserv@vinodkothari.com)
Despite global macroeconomic challenges, including persistent inflation, securitization volumes and ratings across most structured finance asset classes demonstrated remarkable stability in FY 2024. Strong housing markets bolstered credit performance in sectors like U.S. and Australian RMBS, while European housing markets faced concerns of overvaluation.
Overall, the performance of the securitisation market in FY 2024 was considered to be stable with a few exceptions of leveraged lending and collateralized loan obligations (CLOs) which remained in focus for numerous reasons, including their elevated exposures to lower-rated obligors.1
This article delves into the securitization trends observed in FY 2025, analyzing the market’s performance and offering insights into future projections.
As of December 2024, the total US Structured Finance issuance reached USD 770 Billion. In this, the total RMBS issuance accounted for USD 137.9 Billion (17.9% of the total structured finance issuance). It may be noted that total RMBS issuance for FY 2023 amounted to USD 78 Billion, therefore leading to an increase of roughly 76% in the current fiscal year. Securitisation of Credit Card receivables accounted for about USD 20.6 Billion while auto loans accounted for USD 126.4 Billion.2
As per S&P Global, the total credit card ABS issuance will be about $33 billion in 2025 thus leading to a 60% increase from the previous year. It also estimates the total RMBS issuance to reach USD 160 Billion supported by home price appreciation and low unemployment rates.
The below chart shows structured finance issuances by sub-sector:
Traditionally, US data has excluded agency-backed transactions (the data above, therefore, would mostly be non-qualifying residential mortgage loans). SIFMA data shows that agency and non-agency RMBS issuance added to USD 1.592 trillion, registering an increase of 21%. This includes an increase of 119% in non-agency RMBS, and about 19% in agency-RMBS.
Yet another segment which is typically boosted by the benign credit conditions is CMBS. US CMBS volumes touched USD 103 billion [S&P data]. This is over 2.5 X of the volume seen last year.
European securitisation issuance in 2024 reached USD 142 billion, reflecting an over 50% increase compared to 2023.While fewer outstanding transactions in the European securitisation market are anticipated to hit their call dates in 2025, typically a factor that negatively impacts volumes; improvements in underlying credit originations offer a positive outlook3.
A highlight of 2024 was the record-setting bank-originated securitisations, which soared to a 12-year high of over USD 36 billion. Additionally, sustainable-labelled securitisation rebounded strongly, with issuances exceeding USD 5 billion during the year. RMBS volumes in Europe rose by approximately 60% to USD 46 billion, a trend likely to persist into 2025.
The below chart shows the RMBS and ABS issuance over last 3 years in the European market:
In China, new securitization issuances grew by 4.8% year-on-year to USD 200 billion during 1Q-3Q 2024. Issuances of consumer loan ABS and account receivables ABS saw noticeable growth and MSE loan ABS issuances surged by 76%. However, the issuance of certain major asset classes, such as auto loan ABS declined significantly (Auto loan ABS issuance fell 39% in 1Q-3Q 2024 to USD 11.83 billion. The number of transactions issued during the period dropped to 22 from 29 a year earlier).4
A highpoint of the EU securitisation market in 2024 is the consultation by the European Commission to mend the regulatory framework for securitisation. This exercise was prompted by several positive noises about securitisation at a policy-makers’ level. Enrico Letta, former Italian Prime Minister, in his report to the EU, made a strong case for securitisation. He said: “Securitization acts as a unique link between credit and capital markets. In this sense, the securitization market offers significant potential. Increasing its utilization brings two key benefits: i) broadening and diversifying the pool of assets available for investment, and ii) unlocking banks’ balance sheet capacity to facilitate additional financing. Moreover, the adoption of green securitization, whether through securitizing green assets or directing securitization proceeds towards green financing, holds promise as a significant contributor to the transition towards sustainability. Therefore, we advocate for reforms in the European securitization framework to enhance its accessibility and effectiveness”5 In addition, comments by Noyer and those by Mario Draghi favoured changes in securitisation framework. Thus, in October, 2024, the Eurpean Commission began a targeted consultation on several aspects of securitisation market. The responses from the consultation are currently available on the Commission’s website.
One of the notable developments in 2024 was the surge in CLO volumes. US CDO/CLO issuance, as per SIFMA statistics, recorded an issuance volume of USD 85 billion, which is 195% higher than the issuance last year. European CLO volume registered a volume of Euro 46 billion, substantially higher than last year. One report, citing a BofA research, states that the global outstanding CLO volume reached nearly USD 1.2 trillion.
The growth in the CLO market is a direct result of the activity in the leveraged loan market, as the feedstock of CLOs primarily is leveraged loans. Leveraged loans, a term that is rather understood than defined, is mostly low-rated loans to entities that are already carrying significant leverage. The US leveraged loan market adds to upwards of USD 1.2 trillion, and that in Europe stood at about Euro 280 billion. Most of these leveraged loans tend to “syndicated” or downsold in pieces to various participating banks – which may number from a dozen to even 200, and hence, reflecting the extent of lender participation, this market is called “broadly syndicated loan” or BSL market.
While private credit financiers are increasingly making inroads into the space, a lot of capital in the leveraged loan market comes from CLOs.
Another interesting development in the US CLO market has been the growth of CLO ETFs. A report by S&P says that CLO ETFs’ AUM rose from USD 120 million in 2020 to USD 19 billion in Nov., 2024.
UK enacted the Securitisation Regulations, 2024, which replaced the earlier 2017 Regulations. Pursuant to the Regulations, the Financial Conduct Authority has framed the set of rules called Securitisation Sourcebook. The rules lay particular emphasis on the Simple, transparent and standardised (STS criteria) of securitisation transactions, and by way of amendments made later in the year, bar the domiciling of SPVs in certain high risk jurisdictions.
Synthetic securitisation, also sometimes known as synthetic risk transfer or significant risk transfer (SRT) transactions, were mostly limited to Europe and SE Asia jurisdictions, due to lack of clarity on regulatory capital treatment in the USA. In Sept., 2023, the Federal Reserve board clarified that capital relief will be applicable in case of synthetic transactions. Since the clarification, US share in global synthetic securitisations grew to over 30%, from a small fraction earlier. The IMF Global Financial Stability Report of October, 2024 states that globally, more than $1.1 trillion in assets have been synthetically securitized since 2016, of which almost two-thirds were in Europe.
The said IMF report highlights several risks of SRT transactions. First of all, it states, basis anecdotal evidence, that banks are providing funding to credit funds for buying tranches of SRT deals of other banks, thereby implying that the risks are eventually within the banking system. It also states that SRTs may “mask banks’ degree of resilience because they may increase a bank’s regulatory capital ratio while its overall capital level remains unchanged.” Furthermore, overreliance on SRTs exposes banks to business challenges should liquidity from the SRT market dry up. Financial innovation may lead to securitization of riskier asset pools, challenging banks with less sophisticated tools for risk management, because some more complex products make the identity of the ultimate risk holder less clear. Finally, although lower capital charges at a bank level are reasonable, given the risk transfer, cross-sector regulatory arbitrage may reduce capital buffers in the broad financial system while overall risks remain largely unchanged.
The European market saw an issuance exceeding USD 5 Billion during 2024 with first time issuances in solar ABS sectors.
In the U.S., government-sponsored enterprises are purchasing mortgage pools targeting low-carbon buildings and refinancing these assets in the mortgage-backed securities market to finance energy and water efficiency programmes6. For instance, in September 2024, Fannie Mae a GSE came up with a single family green bond framework. Under this framework, loans which conform to the eligibility requirements are acquired from lenders and are securitised into Fannie Mae MBS which are either delivered to the lenders or sold to investors. Here, only projects achieving certain environmental performance standards such as Solar Loans and water efficiency loans are eligible7
Securitisation volumes surged about 27% on-year to Rs 1.78 lakh crore in the first nine months of FY 24-25, supported by large issuances from private sector banks. In the third quarter alone, issuances touched Rs 63,000 crore with private sector banks contributing to 28% of this (HDFC bank alone securitised new car loans by issuing PTCs valued at just over Rs 12,700 crore). However, originations by NBFCs were only up by 5%. The market also saw 15 first time NBFC issuers, bringing the total number of originators to 152, compared with 136 in the last financial year.
Among asset classes, vehicle loans (including commercial vehicles and two-wheelers) accounted for 48% of securitisation volume (vs 40% in the corresponding period last fiscal).
Mortgage-backed loans accounted for about 23% of securitisation volume (vs 20% in the corresponding period last fiscal).
Overall, the Indian Securitisation Market volume is expected to reach Rs 2.4 trillion by the end of FY2025.
On the regulatory front, SEBI, in its board meeting dated December 18, 2024, approved amendments to the framework for the issuance and listing of Securitised Debt Instruments (SDIs). These amendments aim to expand the SDI market and align the regulations with the current securitisation norms prescribed for RBI-regulated entities.
This growth trajectory is expected to persist into FY26, fueled by strong securitization volumes and the expanding involvement of private sector banks. With evolving market dynamics and growing investor confidence, the securitization market is poised for sustained momentum for years to come.
-Anshika Agarwal (finserv@vinodkothari.com)
Core Investment Companies (CIC) and Alternative Investment Funds (AIF) are two very common modes to channelise investments in the Indian market. Both are regulated by different regulators; while CICs are regulated by the RBI, AIFs are regulated by the SEBI. Under their respective regulatory frameworks, both are technically permitted to invest in one another. However, this permissibility introduces an intriguing paradox, especially for a CIC, which is allowed to invest in group companies. It points out that this approach effectively creates two investment pools—one directly under the CICs and another through the AIFs. This dual-pool structure complicates what could otherwise be a straightforward process, introducing unnecessary layers of complexity, thus deviating from the primary purpose of CICs to hold and manage investments efficiently within group companies.
The following article examines the implications of Paragraph 26(a)1 of the Master Direction – Core Investment Companies (Reserve Bank) Directions, 2016 (“CIC Master Directions”), but before delving into the specifics, it may be worthwhile to discuss in brief the concepts of AIF and CIC.
AIFs have gained prominence as a pivotal part of the financial ecosystem, providing investors with access to diverse and innovative investment opportunities. The key features of an AIF are as follows:
CICs are a specialized subset of Non-Banking Financial Companies (NBFCs) established with the primary purpose of holding and managing investments in group companies. CICs do not engage in traditional financial intermediation but play a vital role in maintaining financial stability within the ‘group companies’. CICs are governed under the CIC Master Directions to ensure that their activities align with regulatory standards.
Below given graph explains the regulatory permissibility of the kind of investments a CIC can make:
In addition with the aforesaid, it may further be noted that CICs are permitted to carry out the following financial activities only:
It may be noted that the RBI’s FAQs on Core Investment Companies, particularly Question 92 has clarified about the 10% of Net Asset –
“What items are included in the 10% of Net assets which CIC/CIC’s-ND-SI can hold outside the group?
Ans: These would include real estate or other fixed assets which are required for effective functioning of a company, but should not include other financial investments/loans in non group companies.”
The term “group companies” is defined under Para 3(1)(v) of the CIC Master Directions. It refers to an arrangement involving two or more entities that are related to each other through any of the following relationships:
Subsidiary – Parent (as defined under AS 21), Joint Venture (as defined under AS 27), Associate (as defined under AS 23), Promoter-Promotee (as per the SEBI [Acquisition of Shares and Takeover] Regulations, 1997 for listed companies), Related Party (as defined under AS 18), Entities sharing a Common Brand Name, or Entities with an investment in equity shares of 20% or more |
Para 26A of the CIC Master Directions deals with Investments in AIFs. The language of the provisions suggest that CICs are permitted to invest in AIFs. However, this provision introduces a significant legal contradiction that undermines the regulatory framework governing CICs. According to the Doctrine of Colorable Legislation, a legal principle ensuring legislative consistency, what cannot be achieved directly cannot be permitted indirectly. By allowing CICs to invest in AIFs, Para 26(a) effectively circumvents the explicit restriction on investments outside group companies. This indirect allowance is inconsistent with the foundational objectives of the CIC Master Directions and creates substantial legal and operational confusion.
Under the SEBI (Alternative Investment Funds) Regulations, 2012, the primary objective of an Alternative Investment Fund (AIF) is to pool funds from investors and allocate them across diverse investment opportunities. However, structuring an AIF to invest predominantly or exclusively in entities within the same group raises concerns regarding compliance with SEBI’s regulatory framework, particularly its diversification. SEBI imposes strict investment concentration limits, as outlined in one of its Circular3.
For Category I and II AIFs, no more than 25% of their investable funds can be allocated to a single investee company, while Category III AIFs are restricted to 10%. These regulations inherently prevent AIFs from focusing solely on group entities unless the investment structure strictly adheres to these limits. For CICs intending to invest in AIFs, these restrictions pose significant limitations if the goal is to channel funds primarily into group companies.
Technically, the answer is affirmative—AIFs can be part of a group entity within a group if it satisfies any of the conditions mentioned in the definition. However, if CICs invest in AIFs within the same group structure, it fails to resolve the underlying issue. AIFs often invest outside the group companies, exposing CICs indirectly to entities external to the group. This contradicts the core purpose of CICs, which is to focus investments within their own group companies. Such a structure not only undermines the original intent of CICs but also raises compliance concerns. The RBI adopts a pass-through approach in these cases and is likely to view such practices as non-compliant.
The regulatory paradox of allowing CICs to invest in AIFs under Para 26(a) of the CICs Master Direction raises important questions about the practicality and purpose of this provision. At its core, CICs are meant to simplify and streamline the management of investments within their group companies. However, the inclusion of AIFs creates an unnecessary layer of complexity, dividing investments into dual investment pools and making it harder to track, manage, and maintain transparency.
This arrangement doesn’t just complicate operations, it also moves CICs away from their original purpose. By routing investments through AIFs, CICs are exposed to entities outside their group, which can lead to compliance risks, regulatory confusion, and inefficiencies. Even from a taxation perspective, the setup offers no real benefits, adding financial burdens without meaningful gains. Paragraph 26(a) of the CICs Master Direction has been taken from the SBR Master Direction, which is applicable to NBFCs. However, including it in the CICs Master Direction, which provided regulation specifically for CICs NBFC does not appear to serve any purpose. Even if it were to be amended, its relevance of stating the same for CICs NBFC would still remain questionable.
Securitisation is a cornerstone of modern financial markets, driving liquidity, risk distribution, and innovative funding solutions. This page consolidates all our articles on securitisation, offering insights into regulatory developments, market practices, and evolving structures.
Register here for the Pre-Summit Workshop: https://forms.gle/TGQBkVXgzX8Ho5ts8
Loading…
Register here:
https://forms.gle/kbjwwAmayAWKJwZr5Loading…
– Anshika Agarwal (finserv@vinodkothari.com)
The Reserve Bank of India (RBI) has consistently emphasized the significance of robust internal control systems; where gaps are found by the supervisor, it has penalised regulated entities for non-compliance. Recently, the RBI imposed a penalty on an NBFC for outsourcing one of its core management functions, i.e., internal audit to an external auditor, thereby raising doubts as to whether internal audit for NBFCs can be conducted by external auditors. Does the very fact that internal audit is being conducted not internally but by an external chartered accountancy firm amount to “outsourcing” of core management function? This article examines outsourcing in the context of internal audit function, and the conditions subject to which internal audit may be conducted by external agencies.
Outsourcing is defined under the Basel 2005 document1 as “a regulated entity’s use of a third party (either an affiliated entity within a corporate group or an entity that is external to the corporate group) to perform activities on a continuing basis that would normally be undertaken by the regulated entity, now or in the future.” Similarly, the IOSCO Consultation Paper2 refers to outsourcing as “a business practice in which a regulated entity uses a service provider to perform tasks, functions, processes, or activities that could otherwise be undertaken by the regulated entity itself.”
NBFCs, especially those with asset-light models or limited resources, opt for outsourcing to manage financial as well as non-financial functions. Outsourcing by NBFCs typically involves delegating tasks such as loan application processing, collection of documents, data processing, IT support, customer service, and back-office operations to third-party providers. While outsourcing boosts operational efficiency, they also carry risks, particularly when core management functions are outsourced. Notably, outsourcing is distinct from availing professional services like legal, audit, consulting, or property management, which are ancillary to the NBFC’s core business. In case of outsourcing of financial functions by regulated entities, there are specific guidelines issued by the RBI to regulate the arrangements. Clear regulatory oversight is crucial to strike a balance between leveraging external expertise and maintaining ethical, efficient practices in the financial services sector.
The RBI guidelines are specifically aimed at managing risks related to outsourcing of financial services. Master Direction – Reserve Bank of India (Non-Banking Financial Company – Scale Based Regulation) Directions, 2023 (‘SBR Directions’)3, particularly Annexure 13 on Instructions on Managing Risks and Code of Conduct in Outsourcing of Financial Services by NBFCs (‘Outsourcing Guidelines’), Para 2 lays down stringent conditions for outsourcing to ensure compliance, accountability, and effective risk management. While outsourcing can support operational efficiency, core management functions must remain under the direct control of the regulated entity.
The Outsourcing Guidelines explicitly prohibits NBFCs from outsourcing core management functions vital to governance, decision-making, and risk management. The core management functions are those that are vital and crucial for the existence as well as operations of the entity. These have been defined to include:
These functions are critical for ensuring the organization’s stability and operational integrity. For example, internal audit functions identify risks, ensure regulatory compliance, and assess control effectiveness. Entrusting such functions to external entities could compromise decision-making and erode organizational trust.
While the internal audit function itself is a core management process, the Outsourcing Guidelines in the same lines allows regulated entities to engage internal auditors on a contractual basis. This means external professionals can be brought in to execute internal audits, provided their engagement adheres to regulatory standards, independence is maintained, and the entity retains oversight and control rather than putting all the responsibility on a third party.
For example, an entity may handle several operational tasks related to an audit, such as preparing documentation, organizing records, or conducting initial reviews. However, the ultimate responsibility for decision-making, oversight, and ensuring compliance with regulations rests with the audit committee or the entity’s senior management. This approach ensures that the internal management retains control over key aspects of the audit process, even while delegating specific tasks or availing expertise support. In contrast, the action of outsourcing shifts the entire responsibility for the audit to a third-party. This means the external firm is accountable for managing and executing all aspects of the audit, from operational tasks to final implementation. Such an outsourcing may reduce the internal workload, however, it also transfers control and accountability to an external entity, which may not align entirely with the entity’s internal objectives and strategic priorities.
In other words, what is permitted is to avail the expertise services of a third party for carrying out the internal audit function but not the transfer of the entire responsibility of carrying out internal audit to a third party.
The Institute of Chartered Accountants of India (ICAI) Standards on Internal Audit4 states that “Where the Internal Auditor lacks certain expertise, he shall procure the required skills either though in-house experts or through the services of an outside expert, provided independence is not compromised”.
The aforesaid guidance from the ICAI emphasizes maintaining expertise and independence. While not explicitly addressing outsourcing, these standards recognize that internal auditors may lack certain specialized skills. In such scenarios, they encourage engaging in-house or external experts while safeguarding independence.
The standards indirectly allow for outsourcing when:
By availing the services of experts ensures that internal audit teams possess the necessary skills to perform effective reviews, while the entity retains oversight and accountability.
Section 138 of the Companies Act, 2013 (‘CA 2013’)5, specifies the requirement for internal audits for certain classes of companies. It allows the appointment of internal auditors, which may include chartered accountants, cost accountants, or other professionals, as decided by the Board. Explanation of Rule 13 of the Companies (Accounts) Rules, 2014, states that “the internal auditor may or may not be an employee of the company”.
The aforesaid provision also enables companies to engage external auditors to perform internal audits, even if they are not part of the organization. While the CA 2013 does not explicitly prohibit outsourcing of internal audit functions, it places the ultimate responsibility for conducting and reporting on internal audits with the Board. This also clarifies that companies may utilize external expertise while maintaining oversight and control of the audit process.
In conclusion, the RBI’s recent penalties underscore the importance for regulated entities to maintain strict compliance with outsourcing regulations, particularly regarding core management functions. While the Outsourcing Guidelines as well as the provisions of CA 2013 permit engaging external auditors on a contractual basis to perform operational tasks related to audits, accountability and strategic control such as having audit plan approved by the audit committee, regular reporting to the audit committee, discussion of the board and audit committee on the conduct of audit,implementing remedial measure on the oversight of the audit committee or senior management must remain firmly within the organization. Adherence to these principles will help maintain the fine distinction between outsourcing the internal audit function and appointing external auditors as internal auditors, specifically in the context of internal audits.
Read our other related resources –
In this edition of Shastrath, we address key concerns and considerations for lenders in light of the Draft DPDP Rules published on January 03, 2025, and discuss steps to take in order to ensure readiness and compliance.
Register your interest here: https://docs.google.com/forms/d/e/1FAIpQLSf0uZidJDf8oqK0GfGygo0BmuCKRg9wMo2bXRtwRMIra7Zx5Q/viewform
– Anshika Agarwal (finserv@vinodkothari.com)