A Non-Banking Financial Company (NBFC) is a type of financial institution that provides financial services and products similar to traditional banks, but without holding a banking license. NBFCs play a crucial role in the financial system by catering to the diverse financial needs of individuals and businesses. Here are some key characteristics of NBFCs:

Financial Services: NBFCs offer a wide range of financial services such as loans, advances, investments, asset financing, acquisition of shares and stocks, leasing, hire-purchase, insurance business, chit fund activities, and more. They engage in financial activities similar to banks, except for accepting demand deposits.

Regulation: NBFCs are regulated by the regulatory authority of the country, such as the Reserve Bank of India (RBI) in India. The regulatory framework ensures that NBFCs adhere to specific guidelines, capital adequacy requirements, risk management practices, and customer protection norms.

Non-Deposit Taking or Deposit Taking: NBFCs can be categorized into non-deposit taking and deposit taking entities. Non-deposit taking NBFCs do not accept deposits from the public, while deposit taking NBFCs can accept deposits from individuals and businesses, subject to certain regulatory conditions and limitations.

Diverse Operations: NBFCs can specialize in various financial activities and cater to specific sectors or markets. Some examples of specialized NBFCs include microfinance institutions, housing finance companies, infrastructure finance companies, equipment leasing companies, and factoring companies.

Complementary Role: NBFCs often complement the services provided by banks and other financial institutions. They bridge the gaps in the financial ecosystem by extending credit to underserved sectors, providing flexible financing options, supporting small and medium-sized enterprises (SMEs), and facilitating financial inclusion.

Risk Management: NBFCs are required to have robust risk management frameworks to assess and mitigate various risks associated with their financial activities. This includes credit risk, liquidity risk, market risk, operational risk, and compliance risk.

Customer Base: NBFCs serve a diverse customer base, including individuals, businesses, self-employed professionals, and organizations across different sectors. They offer customized financial solutions tailored to the specific needs of their customers.

NBFCs contribute significantly to the overall financial stability and economic growth of a country. They provide an alternative source of funding, promote entrepreneurship, facilitate capital formation, and enhance access to financial services for a wide range of stakeholders.

The Reserve Bank of India (RBI) has provided guidelines for the Policy for Information System Audit (IS Audit) to ensure the effective management of IT infrastructure in Non-Banking Financial Companies (NBFCs). These guidelines aim to enhance the security, confidentiality, integrity, and availability of information systems within NBFCs. Key aspects of RBI's NBFC guideline for IS Audit policy include:

Objective: The objective of the IS Audit is to assess the effectiveness of controls in place to safeguard the organization's IT infrastructure and ensure the confidentiality, integrity, and availability of information.

Internal Audit Integration: IS Audit should be an integral part of the internal audit system of NBFCs. The framework should align with the guidance issued by professional bodies such as ISACA, IIA, and ICAI. ICAI has published the "Standard on Internal Audit (SIA) 14: Internal Audit in an Information Technology Environment" that provides relevant standards and practices.

Coverage: The IS Audit should cover various areas, including the policy and oversight of IT systems, adequacy of processes and internal controls, business continuity planning, disaster recovery, and compliance with legal and statutory requirements.

Personnel: NBFCs can conduct the IS Audit using their internal team. In cases where internal expertise is insufficient, external agencies with IT/IS audit expertise may be appointed. The auditors should possess the required skills and understanding of legal and regulatory requirements. Independence and accountability should be ensured, especially when engaging external professional service providers.

Periodicity: The frequency of IS Audit should ideally be based on the size and operations of the NBFC. However, it should be conducted at least once a year, preferably before the statutory audit, ensuring timely availability of IS audit reports.

Reporting: The framework should clearly define the reporting structure, specifying whether it is to be reported to the Board or a Committee of the Board, such as the Audit Committee of the Board (ACB).

Compliance: NBFC management is responsible for taking appropriate actions in response to reported observations and recommendations from the IS Audit. The framework should outline responsibilities for compliance, reporting lines, timelines for submission of compliance, and authority for accepting compliance. It may also provide audit-mode access for auditors, inspectors, or regulatory authorities.

Computer-Assisted Audit Techniques (CAATs): NBFCs should adopt a suitable combination of manual techniques and CAATs for conducting the IS Audit. CAATs can be particularly useful in critical areas, enabling effective detection of control weaknesses, revenue leakage, monitoring customer transactions, and assessing areas with significant financial, regulatory, or legal implications.

RBI's NBFC guideline for IS Audit policy emphasizes the importance of robust IT infrastructure controls, risk mitigation, compliance, and maintaining the confidentiality, integrity, and availability of information systems within NBFCs.

Non-Banking Financial Companies (NBFCs) and banks perform similar financial functions, there are several key differences between the two. Here are some of the main distinctions:

Legal Structure and Regulation: Banks are authorized and regulated under banking laws, such as the Banking Regulation Act, while NBFCs are governed by specific regulations applicable to non-banking financial institutions. Banks are typically incorporated as banking corporations, whereas NBFCs can be registered as companies under the Companies Act.

Deposit Acceptance: Banks have the ability to accept demand deposits from the public, which are withdrawable on demand by the depositor. NBFCs, on the other hand, are categorized as deposit-taking or non-deposit taking. Non-deposit taking NBFCs do not accept public deposits, while deposit-taking NBFCs can accept deposits subject to regulatory conditions and limitations.

Lending and Credit Activities: Both banks and NBFCs engage in lending and credit activities. However, banks have the advantage of access to low-cost funds through deposit mobilization, allowing them to lend from a stable source of funds. NBFCs, on the other hand, rely on sources such as borrowings, debentures, and market borrowings for their lending activities.

Payment and Settlement Systems: Banks have the capability to issue checks, drafts, and other negotiable instruments that facilitate payment and settlement transactions. NBFCs, as non-banking entities, do not have the same authority to issue such instruments.

Regulation and Prudential Norms: Banks are subject to comprehensive prudential norms, capital adequacy requirements, and liquidity regulations prescribed by the regulatory authorities. These norms ensure the stability and solvency of banks and protect the interests of depositors. NBFCs also have regulatory guidelines and requirements, but they may not be as stringent as those applicable to banks.

Access to Central Bank Facilities: Banks have access to central bank facilities, such as liquidity support and refinancing options, which provide additional stability during financial stress. NBFCs do not have direct access to these facilities and rely on their own sources of funding and liquidity management.

Public Perception and Trust: Banks generally enjoy a higher level of public trust and confidence due to their extensive regulation, deposit guarantee schemes, and longstanding presence in the financial system. NBFCs may face challenges in gaining the same level of public perception and trust, particularly for non-deposit taking entities.

It is important to note that while NBFCs and banks have these differences, they both contribute to the overall financial system by fulfilling diverse financial needs, providing credit, and supporting economic growth. The specific roles and functions of banks and NBFCs may vary across jurisdictions based on local regulations and market conditions.

Systemically important NBFCs refer to Non-Banking Finance Companies whose asset size, as indicated in their last audited balance sheet, amounts to ₹500 crore or more. The classification of these NBFCs as systemically important stems from the recognition that their operations and activities can significantly impact the financial stability of the broader economy.