RBI/DOR/2026-27/__
DOR.GOV.REC.No.__/18.10.006/2026-27 June xx, 2026 Reserve Bank of India (Asset Reconstruction Companies) Second Amendment Directions, 2026 The Reserve Bank had issued Reserve Bank of India (Asset Reconstruction Companies) Directions, 2025 on November 28, 2025. 2. In line with the Reserve Bank’s ongoing efforts to strengthen governance framework of regulated entities and align it with the evolving best practices, it has been decided to issue directions related to Compliance Function and Internal Audit Function for Asset Reconstruction Companies (ARCs). 3. Accordingly, in exercise of the powers conferred by Sections 3, 9, 10, 12 and 12A of the Securitisation and Reconstruction of Financial Assets and Enforcement of Security Interest Act, 2002 (54 of 2002), and all other provisions / laws enabling the Reserve Bank of India in this regard, the Reserve Bank being satisfied that it is necessary and expedient in the public interest so to do, hereby issues the Directions hereinafter specified. (1) These Directions shall be called the Reserve Bank of India (Asset Reconstruction Companies) Second Amendment Directions, 2026. (2) These Directions shall come into effect on April 1, 2027. (3) These Directions shall modify the Reserve Bank of India (Asset Reconstruction Companies) Directions, 2025 (hereinafter called as ‘the said Directions’) in the manner as specified hereinafter. (i) After sub-paragraph (1) of paragraph 4 of the said Directions, the following shall be inserted, namely: “(1a) ‘Assurance’ means those activities which provide independent confirmation and confidence to the Board of Directors or its committees on the compliance of business functions with the internal control environment, as well as the applicable laws, rules and regulations.” (ii) After sub-paragraph (3) of paragraph 4 of the said Directions, the following shall be inserted, namely: “(3a) ‘Compliance’ means the state of being in accordance with the applicable laws, regulations, rules, directions issued by the Reserve Bank, self-regulatory organisation standards, codes of conduct applicable to an ARC’s activities and with the internal control systems laid down to comply with the foregoing. (3b) ‘Compliance Culture’ means the set of values, attitudes, and behaviours that are promoted and demonstrated throughout the organisation, ensuring that adherence to laws, regulations, internal standards, and ethical norms is routinely prioritised and embedded throughout the organisation’s operations and decision-making. (3c) ‘Compliance Function’ means policies, processes, procedures, systems, and personnel dedicated for compliance. (3d) ‘Compliance Risk’ means the risk of legal or regulatory sanctions, material financial loss, or loss to reputation an ARC may suffer as a result of its failure to comply with laws of the land, regulations, rules, directions given by Reserve Bank, related self-regulatory organization standards, and codes of conduct applicable to its activities. (3e) ‘Control Functions’ means those functions that have a responsibility independent from business functions to provide objective assessment, reporting and/or assurance. This includes Risk Management Function, Compliance Function and Internal Audit Function.” (iii) After sub-paragraph (7) of paragraph 4 of the said Directions, the following shall be inserted, namely: “(7a) ‘Internal Audit Function’ means an activity that provides independent assurance to the Board or its committees on the quality and effectiveness of an ARC’s internal control, risk management and governance systems and processes. (7b) ‘Internal Audit Plan’ means the document that defines the scope, coverage, areas, frequency, etc. of internal audit. (7c) ‘Internal Controls’ means a set of rules and controls governing an ARC’s organisational / operational structure, including reporting processes and functions.” (iv) After paragraph 131 of the said Directions, the following shall be inserted, namely: “D. Control Functions: Compliance and Internal Audit D.1 General 131A. An ARC shall establish Compliance and Internal Audit Functions, commensurate with its size, complexity and business profile, headed by a Chief Compliance Officer (CCO) and a Head of Internal Audit (HIA), respectively. 131B. An ARC shall have policies for each of the control functions, viz. Compliance and Internal Audit, clearly articulating the objectives, roles and responsibilities of each function. These policies shall be approved by the Board and reviewed periodically. 131C. The above functions shall - (1) have the necessary authority and autonomy to discharge their responsibilities effectively. (2) be independent of the business lines, free from conflicts of interest and business targets. Accordingly, they shall neither be involved in revenue generation nor have the remuneration of their staff linked to the business area being overseen. (3) have unrestricted access to all business areas and records. (4) not be outsourced, being core activities. However, external experts may be engaged under the oversight of CCO / HIA for specialised tasks without diluting the accountability of the functions. 131D. As part of the overall corporate governance framework, the Board is responsible for overseeing the control functions. The Board must set the ‘tone at the top’ and ensure that these functions are adequately resourced and maintain their independence. Further, the Board / ACB shall review control functions on an ongoing basis to ensure their continued relevance and effectiveness. 131E. The Compliance Function shall be subject to regular internal audit. D.2 Appointment of CCO and HIA 131F. An ARC shall adhere to the following terms for appointment of CCO and HIA: (1) Appointing authority and rank: An ARC shall appoint / designate suitably senior employees, not more than three levels below the MD & CEO, as CCO and HIA, with the approval of the Board. (2) Knowledge / Experience: CCO and HIA shall possess adequate domain knowledge and relevant experience in the respective fields, commensurate with the size, complexity and risk profile of the ARC. (3) Age: The age limits for CCO and HIA to hold office shall be prescribed by the ARC as a part of its internal policy. (4) Tenure: CCO and HIA shall ordinarily be appointed for a fixed tenure of not less than three years. (5) Premature transfer / removal: Any transfer or removal of CCO and HIA prior to the completion of the stipulated tenure shall be subject to the approval of the Board. (6) External Hiring: If considered necessary, suitably experienced and competent external candidates may be hired as CCO or HIA. However, consultants, advisors, part time auditors or individuals who are neither on the rolls of the ARC nor have a contractual employer-employee relationship with the ARC shall not be appointed / designated as CCO or HIA. D.3 Independence of CCO and HIA 131G. CCO and HIA shall function with independence, objectivity and free from conflict of interest. In particular, CCO and HIA shall – (1) functionally report to the Board or ACB and administratively report to MD & CEO. (2) not be assigned business targets or have their remuneration linked to the performance of any business line. (3) meet the Board or ACB at least once in a quarter, without the presence of the Senior Management (including the MD / CEO / WTD). Even otherwise, they shall have direct and unrestricted access to the Board or ACB to enable them to communicate concerns without management interference. (4) have their final performance review carried out by the Board or ACB. D.4 Compliance Function 131H. The Board shall ensure an effective oversight over ARC’s compliance risk. 131I. The Senior Management shall be responsible for effective management of an ARC’s compliance risk, including communication of the compliance policy throughout the ARC and ensuring that it is observed in letter and spirit. Further, Senior Management shall also be responsible for embedding compliance in the business strategy while ensuring that risks of non-compliance are identified and mitigated, and for promoting compliance culture. Reviews and reporting should be regular and meaningful, with frequency based on the risk profile of the ARC. 131J. An ARC shall maintain a compliance programme supported by an annual compliance risk assessment placed before the Board or ACB, as applicable. The Compliance Function shall monitor and test compliance by inter-alia performing sufficient and representative compliance testing. 131K. The Compliance Function shall – (1) ensure adherence to statutory and regulatory requirements, fair customer treatment, and sound market conduct. The CCO shall be the nodal point of contact between the ARC and the RBI. (2) proactively identify, assess, and manage compliance risks, and provide independent assurance to the Board or ACB on the effectiveness of compliance policies, controls, and remediation of breaches, to be in state of compliance and for the improvement in compliance culture. (3) vet internal policies and communications, act as a reference point for regulatory interpretation, and coordinate with other control / assurance functions such as Risk Management and Internal Audit, as applicable, while maintaining its independence. D.5 Internal Audit Function 131L. The Board shall have an effective internal audit framework, proportionate to the ARC’s risk profile with adequate resources and independence. Staff posted to the Internal Audit Function should ordinarily have a tenure of at least three years. 131M. The Senior Management shall be responsible for ensuring effectiveness of the Internal Audit Function. It must facilitate the independence of audit, provide full access and act promptly on audit findings. The Senior Management shall ensure that internal auditors have sufficient knowledge and training appropriate to the entity’s risks. 131N. The Internal Audit Function shall provide independent evaluation of governance, risk management, compliance, internal controls, business lines, support functions, outsourced activities, etc., ensuring assurance across the entire organisation. All significant activities shall be audited over a defined cycle (ordinarily not exceeding three years), with high-risk areas reviewed more frequently. 131O. The Internal Audit Function shall – (1) follow systematic methodologies aligned with professional standards, using tools such as data analytics, thematic reviews, and automated monitoring, with proper documentation. (2) coordinate with risk management, compliance, and external auditors while retaining independent judgment, ensuring clear distinction of responsibilities. 131P. An ARC may voluntarily adopt Risk-Based Internal Audit (RBIA) approach focusing on areas of higher risk, materiality, systemic relevance, and supervisory concerns as given in Annex V-A. D.6 Intimation to the Reserve Bank 131Q. Any appointment (including re-appointment and interim appointment), premature transfer, removal, exit, or change in tenure of CCO or HIA in an ARC shall be reported to Department of Supervision, RBI within five working days. Reporting of appointment including interim appointment and re-appointment shall be accompanied with a profile of the CCO / HIA.” (v) The paragraph 155 of the said Directions (along with the heading “A. Internal Audit”) shall be deleted. (Scenta Joy)
Chief General Manager |