NBFC Stability is About Models and Culture, Not Just Money

Financing vulnerabilities in India’s non-bank financial company sector have been under intense spotlight in recent months. Commentaries, media reports, and regulatory data releases have all pointed to rising funding pressures. While this concern is legitimate, it also raises a more fundamental question: are financing constraints the problem itself, or symptom of some other set of issues?

Until about a decade ago, Indian NBFCs operated at relatively modest scale. That has changed rapidly. The sector’s balance sheet has expanded to over ₹55 trillion, increasing its share of total lending from about 12% to 16% in just seven years. This increase in scale alone makes a compelling case for examining the sector’s resilience with far greater seriousness than before.

Much of the recent debate has centred on NBFCs’ dependence on bank funding. This critique is not without merit. Over the past seven years, borrowings from banks by NBFCs have grown nearly fourfold, while funding through debt issuance has only doubled. Even so, the narrative is often overstated. At present, bank finance and market debt each account for about one quarter of NBFC liabilities. The sector is not funded disproportionately by banks alone. Funding composition matters—but it is not the whole story.

Some time ago, I presented a study to a group of bank regulators on the reasons behind the failure of several Indian NBFCs over the past decade. The usual explanations were on the table: were these failures simply the by-product of rapid growth? Did they stem from lax risk discipline? Were they driven by fraud or malfeasance, as popular conjecture sometimes suggests? Or was there a more systemic explanation?

To answer these questions, the study made use of analysis grounded in Basel techniques. The Basel Pillar-2 or ICAAP-based analyses are powerful review tools, based on the state-of-art risk management advancements.

The findings pinned the vulnerability of individual NBFCs to two factors: their business model, and their risk management culture.

One, the business models were skewed at least on one side of the balance sheet. For instance, interest rate and liquidity risks generated by short duration of liabilities over significantly longer duration for assets. Enhanced credit risks from fundamental nature of assets. Sector exposure concentrations not factored in, leading to lack of building fundamental business hedges such as diversifications without significantly altering the target market.

Second, there was a clear dilution of risk management discipline in the run-up to crisis. In one institution examined, the primary cause of failure was the gradual abandonment of a core organisational risk objective related to asset–liability mismatches and liquidity risk. Over a ten-year period, the objective remained firmly in place on paper—but the underlying business model evolved in ways that rendered it meaningless. The priority survived in documentation, even as reality moved on. Similar patterns were evident across other risk dimensions, such as for credit risk, in several institutions.

Risk management culture varies widely across NBFCs, shaped largely by top management’s commitment, and senior leadership’s technical risk management skill and mindset. It must begin with the top management appreciating that compliance and risk management are not tick-in-the-box exercises and that these are essential to a lending institution’s health and longevity. All non-interest expenditure decisions are driven by commercial considerations such as near-term growth in topline and profitability. However, some investment decisions cannot be measured by such yardstick alone. While taking and managing credit risk is the core business of NBFCs, what tends to be underappreciated is that returns on capital depend as much on avoiding losses as on generating income—and loss avoidance requires sustained investment in risk management.

Just as business model choices deserve the highest level of attention, so too do risk and compliance priorities. Yet this alignment is not always present. Consider an interaction I had with an NBFC a few months ago. The institution had entered the RBI’s middle layer a couple of years earlier. To meet basic regulatory risk requirements, it had combined in-house systems with external solutions—largely driven by expectations of regulatory scrutiny. However, when it came to more complex and core risk areas requiring deeper expertise and stronger frameworks, management felt it was already on solid ground. The chief risk officer rated the institution’s risk management maturity at “8 out of 10.” Ironically, while resources were being devoted to baseline controls, genuinely core risks were accorded lower priority. The institution also relied more heavily on bank funding than its peers. The false sense of security this created was unsettling.

Contrast this with another institution I encountered around the same time—roughly three times larger in size. Its leader was focused on understanding where the institution truly stood and how its two most significant risks could be addressed. He emphasised problem definition, delegation, review, and capability-building in core areas. That approach reflected an organisation shaped by strong risk leadership. Crucially, it was backed by the Board and the CEO. Meaningful change, after all, must come from the top.

Across more than fifty company and financial institution failures that I have reviewed or audited first-hand, none involved mala fide intent. Instead, the consistent causes were flawed business models and/or failures in risk management.

Basel’s regulatory philosophy aligns with this conclusion. Banking regulation globally, including in India, is built on Basel guidance, which emphasises the definition, continuous evaluation, and internal consistency of business models. Where business model limitations give rise to specific risks, institutions are expected to recognise and mitigate them. Many small and mid-sized European lenders follow this approach in spirit, devoting considerable effort to explaining to regulators and stakeholders how they counterbalance inherent weaknesses. Where business model changes are not feasible, the answer lies in robust risk management.

India’s NBFCs would do well to absorb this spirit, not merely its form. This means, first, ruthless clarity about business models. Second, rebuilding risk culture as a strategic priority—not as a department, but as a mindset. Finally, it means recognising what funding pressures really signal.

If India wishes to see the 16% NBFC share to grow more and power the economy, Indian NBFCs should follow this approach.

If India wishes to see the NBFC sector continue powering the economy and raise its 16% share of lending, then this is the approach Indian NBFCs must adopt. Funding pressures will then be recognised for what they often are: signals of deeper structural issues, not their root cause.