Concurrent Audit Consultant in Mumbai | NBFC | Marcken

In short: Marcken Consulting LLP is a concurrent audit consultant in Mumbai for NBFCs, housing finance companies and group finance vehicles that want their loan book, their prudential computations and their regulatory returns tested continuously by a firm that is independent of their statutory auditor. Two dates define the current environment for a Mumbai lender. On 28 November 2025, RBI replaced the scattered NBFC rulebook with thirty-five consolidated Directions, so that asset classification, provisioning, credit facilities, governance, conduct and the housing finance framework each now sit in a named instrument. On 31 July 2026, RBI’s Department of Supervision issued a further set of NBFC directions covering statutory audit, the auditor’s report, the internal audit function, the compliance function and cybersecurity, with immediate effect. The statutory audit directions settle a question that used to be argued over: a firm serving as an NBFC’s concurrent auditor may not be appointed its statutory auditor, and a year must separate non-audit work from a statutory appointment. Mumbai matters for this work in a way no other city does, because RBI’s Central Office in Fort is where that rulebook is written and its Mumbai Regional Office is where the city’s NBFCs are supervised. This guide sets out the regulatory map as it stands, what the 2026 directions mean for who can hold the concurrent audit role, what the audit recomputes each cycle under the 2025 prudential directions, the Mumbai-specific scope for capital-market-linked lending, group structures and housing finance, and how Marcken Consulting LLP runs the engagement.

1. What Does a Concurrent Audit Consultant in Mumbai Do?

A concurrent audit consultant in Mumbai gives an NBFC’s Audit Committee something the statutory audit cannot: a view of the book as it stands this month, tested against the Directions that bind the company, with the exceptions already in front of the people who can fix them. In practice the work divides into three streams. The first is prudential recomputation — special mention and NPA classification run as a day-end process, provisioning at the rates in the 2025 IRAC Directions, capital adequacy and the Section 45-IC reserve, each rebuilt from the ledger rather than read off a system report. The second is lending-rule testing — a sample of each cycle’s disbursements checked against the credit policy, the KYC Directions, the Fair Practices Code and Key Facts Statement rules in the Responsible Business Conduct Directions, and the specific restrictions that attach to loans against shares, IPO financing, loans to directors and their relatives, and intra-group exposures. The third is pre-filing review — the supervisory returns, the lender covenant certificates and the figures handed to rating agencies reconciled to the books before they are sent. Marcken Consulting LLP delivers all three on a fixed monthly or quarterly cycle and reports by exception to the Audit Committee.

2. Why Mumbai: The Regulator’s City and the Largest NBFC Balance Sheets

• The rulebook is written here. Reserve Bank of India, Central Office Building, Shahid Bhagat Singh Marg, Fort, Mumbai 400001 is the seat of the Department of Regulation that issued the thirty-five NBFC Directions of 28 November 2025, and of the Department of Supervision that issued the audit, internal audit, compliance and cybersecurity directions of 31 July 2026. RBI’s Mumbai Regional Office, also in Fort, carries the supervisory relationship with the city’s NBFCs.
• The balance sheets are the largest in the country. Mumbai is where India’s Middle and Upper Layer NBFCs, its bank-affiliated finance companies and its housing finance companies are concentrated. Thresholds that are theoretical elsewhere — ₹5,000 crore for the risk-based internal audit framework, ₹15,000 crore for mandatory joint statutory audit — are live questions here.
• Capital-market-linked lending is a Mumbai specialism. Loans against shares, IPO financing, promoter funding and lending to group entities carry restrictions in the NBFC Directions that do not feature in an MSME lender’s audit programme at all; they feature prominently in a Mumbai programme (Section 7).
• SEBI, BSE and NSE are here too. An NBFC on the path to listing debentures or equity, covered in this firm’s IPO consultant in Mumbai guide, will have its loan book examined by merchant bankers and their diligence counsel; a documented concurrent audit record is the shortest route through that examination.

3. The Regulatory Map After 28 November 2025 and 31 July 2026

Until late 2025, an NBFC’s obligations were spread across the Scale Based Regulation Master Direction of 19 October 2023 and dozens of circulars. On 28 November 2025 RBI’s Department of Regulation consolidated them into thirty-five Directions for NBFCs, each covering one subject; the ones a concurrent audit works from are the Registration, Exemptions and Framework for Scale Based Regulation Directions, 2025 (the four-layer structure, amended with effect from 1 July 2026 to create the Type I and Unregistered Type I categories), the Income Recognition, Asset Classification and Provisioning Directions, 2025, the Credit Facilities Directions, 2025 (which now carry the digital lending, gold loan and microfinance chapters for NBFCs), the Responsible Business Conduct Directions, 2025 (Fair Practices Code and Key Facts Statement), the Governance Directions, 2025, the Prudential Norms on Capital Adequacy Directions, 2025, the KYC Directions, 2025, and the category directions for Housing Finance Companies and Core Investment Companies. On 31 July 2026 the Department of Supervision added, with immediate effect, the Statutory Audit Directions, the Auditor’s Report Directions, the Internal Audit Function Directions, the Compliance Function Directions and the Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions for NBFCs.

Across that entire body of text, concurrent audit appears in exactly one place — the Statutory Audit Directions’ rule that a concurrent auditor cannot be the statutory auditor. No NBFC direction prescribes a concurrent audit, its frequency or its format. RBI’s own concurrent audit instruments are addressed to commercial banks (the revised guidelines of 18 September 2019) and, since 2026, to urban co-operative banks. For an NBFC, concurrent audit is therefore a governance decision taken by the board, usually prompted by lenders, rating agencies, investors or the Audit Committee’s own appetite for continuous assurance — and the scope is whatever the board and the auditor agree it should be, which is precisely why it should be anchored to the Directions above rather than borrowed from a bank’s branch-audit manual.

4. The Statutory Audit Directions, 2026: Who May Be Your Concurrent Auditor

The Reserve Bank of India (Non-Banking Financial Companies — Statutory Audit) Directions, 2026 (RBI/DoS/2026-27/465) were issued on 31 July 2026 and came into effect immediately, consolidating the guidelines of 27 April 2021 on the appointment of statutory auditors. Four provisions decide how a Mumbai NBFC structures its audit arrangements:

• Applicability. The Directions apply to all NBFCs, including housing finance companies, in respect of the appointment of statutory auditors; non-deposit-taking NBFCs with an asset size below ₹1,000 crore “have the option to continue with their extant procedure”.
• The concurrent auditor exclusion. “Concurrent auditors of the NBFC should not be considered for appointment as SCAs / SAs of the same NBFC.” A firm cannot hold both roles, and a board planning to move its concurrent auditor into the statutory role must plan the gap.
• The one-year separation. Before appointment or after completion of the statutory audit assignment, “the time gap between any non-audit works (services mentioned at Section 144 of Companies Act, 2013, internal assignments or special assignments) by the SCAs / SAs for the NBFC or any audit / non-audit works for its group entities should be at least one year.”
• Joint audit for the largest NBFCs. NBFCs with an asset size of ₹15,000 crore and above must appoint a minimum of two audit firms for joint statutory audit, without common partners or network affiliations — a threshold that, in practice, is crossed mainly by Mumbai-headquartered companies.

On the same date RBI issued the Reserve Bank of India (Non-Banking Financial Companies — Auditor’s Report) Directions, 2026, replacing the 2016 auditor’s report directions. They require the statutory auditor of an NBFC (other than a housing finance company, which remains under the HFC framework) to report on, among other matters, whether the company holds a Certificate of Registration, meets the Net Owned Fund requirement and continues to satisfy the principal business criteria, with additional reporting for deposit-taking NBFCs on deposit limits, credit rating, capital adequacy, prudential norms and return filings; the auditor files the DNBS10 statutory auditor’s certificate return through RBI’s CIMS portal within five working days of signing the audit report and reports unfavourable or qualified findings to the Regional Office. A concurrent audit that has been recomputing the same figures through the year makes that certificate a confirmation rather than a discovery.

5. Internal Audit, Compliance and Where Concurrent Audit Fits for Larger NBFCs

RBI’s risk-based internal audit framework, introduced on 3 February 2021 for all deposit-taking NBFCs and for non-deposit-taking NBFCs with an asset size of ₹5,000 crore and above, now sits in the Internal Audit Function Directions, 2026 issued on 31 July 2026. The Governance Directions, 2025 require a compliance function headed by a Chief Compliance Officer for Middle Layer NBFCs and above, and RBI has proposed, through draft amendments to those Directions published for comment in 2026, to make risk-based internal audit mandatory for every Middle Layer NBFC from 1 January 2027, leaving it voluntary for the Base Layer. ICAI’s Technical Guide on Risk Based Internal Audit of NBFCs describes the profession’s approach to the framework.

For a Mumbai NBFC above these thresholds, concurrent audit is not a substitute for the RBIA function but one of its inputs: the continuous, transaction-level testing that a risk-based audit plan relies on for the high-risk processes — disbursement, classification, provisioning, treasury and returns — while the RBIA cycle covers the rest of the audit universe over its defined period. For an NBFC below the thresholds, the concurrent audit is usually the only independent assurance the Audit Committee receives between statutory audits, and it should be scoped accordingly. The Companies Act adds its own floor: Section 138 read with Rule 13 of the Companies (Accounts) Rules, 2014 requires an internal auditor once a private company’s borrowings from banks or public financial institutions reach ₹100 crore or its turnover reaches ₹200 crore in the preceding financial year.

6. What the Audit Recomputes Each Cycle: The IRAC Directions, 2025

The Reserve Bank of India (Non-Banking Financial Companies — Income Recognition, Asset Classification and Provisioning) Directions, 2025 of 28 November 2025 repealed the earlier IRACP instructions for NBFCs and carried their substance into one text. The provisions that a concurrent audit rebuilds from the ledger each cycle:

• The 90-day norm for every layer. Middle and Upper Layer NBFCs classify an account overdue for more than 90 days as non-performing; Base Layer NBFCs reached the same point on 31 March 2026 at the end of a glide path that ran through 150 and 120 days.
• Day-end classification. “Classification of borrower accounts as SMA as well as NPA shall be done as part of day-end process for the relevant date and the SMA or NPA classification date shall be the calendar date for which the day end process is run.” The audit tests the engine, the cut-off and the treatment of receipts in transit.
• Upgrade only on full clearance. “Loan accounts classified as NPAs may be upgraded as ‘standard’ asset only if entire arrears of interest and principal are paid by the borrower.” Partial recoveries that move an account below 90 days do not restore it to standard, and the audit looks specifically for accounts upgraded on that basis.

Asset category	Provision under the IRAC Directions, 2025
Standard — Base Layer	0.25% of outstanding
Standard — Middle Layer	0.40% of outstanding (Upper Layer rates vary by asset type)
Sub-standard	10% of total outstanding
Doubtful — secured portion	20% up to one year; 30% one to three years; 50% beyond three years
Doubtful — unsecured portion	100%
Loss	100% (or written off)

Alongside the prudential recomputation, each cycle covers capital adequacy against the 15% minimum CRAR under the Prudential Norms on Capital Adequacy Directions, 2025, the transfer of at least 20% of net profit to the reserve fund under Section 45-IC of the RBI Act, 1934, and a KYC and Fair Practices Code sample under the KYC Directions, 2025 and the Responsible Business Conduct Directions, 2025.

7. Capital-Market-Linked Lending, Group Exposures and Core Investment Companies

This is the part of the programme that distinguishes a Mumbai concurrent audit from one designed for an MSME or microfinance lender. The restrictions below were set in the Scale Based Regulation framework and carried into the consolidated Directions of 28 November 2025:

• IPO financing. “There shall be a ceiling of ₹1 crore per borrower for financing subscription to Initial Public Offer (IPO).” The audit tests every IPO-funding disbursement in the cycle against the ceiling and against the NBFC’s own, possibly lower, policy limit.
• Loans against shares. NBFCs with an asset size of ₹100 crore and above must maintain a loan-to-value ratio of 50% at all times for loans against the collateral of shares; where lending exceeds ₹5 lakh for investment purposes, only Group 1 securities as specified by SEBI qualify as collateral; and any shortfall in the 50% LTV caused by price movement must be made good within seven working days. The audit re-marks the collateral at each cycle date and traces every top-up call.
• Loans to directors, senior officers and their relatives. The NBFC must have a board-approved policy on loans to directors, senior officers and relatives of directors and to entities in which they hold a major shareholding, and disclose the aggregate in its financial statements; the audit reads each such loan against the policy and the approval, and against Section 185 of the Companies Act, 2013 and the related-party approval and disclosure requirements of Section 188.
• Group and captive structures. Where the NBFC is the finance arm of a Mumbai business group or a bank-affiliated company, the audit tests intra-group lending and borrowing against policy, arm’s-length pricing documentation, and the Concentration Risk Management Directions, 2025 limits that apply to the company’s layer.
• Core Investment Companies. Group holding vehicles registered as CICs are governed by the Core Investment Companies Directions, 2025; for those the programme concentrates on the investment-to-group-company tests that define CIC status, leverage, and the related-party trail, and on whether the 2026 Unregistered Type I framework has changed the entity’s registration position at all, a question this firm’s NBFC license consultant in Mumbai guide covers in detail.

8. Housing Finance Companies: What Changes in the Scope

Mumbai hosts a large share of India’s housing finance companies, and since their transfer from the National Housing Bank to RBI’s regulation in 2019 they have been governed by RBI’s HFC directions, now the Reserve Bank of India (Non-Banking Financial Companies — Housing Finance Companies) Directions, 2025. Three features change the concurrent audit programme for an HFC:

• The principal business test. An HFC must keep at least 60% of its total assets in housing finance, and at least 50% of total assets in housing finance to individuals; the audit tracks both ratios at each cycle date so that a drift towards builder or non-housing lending is caught before it becomes a registration problem.
• Loan-size-linked LTV ceilings. Housing loans carry LTV ceilings of 90% for loans up to ₹30 lakh, 80% for loans above ₹30 lakh and up to ₹75 lakh, and 75% for loans above ₹75 lakh; the audit tests the property valuation, the sanctioned amount and the disbursement tranches against the applicable ceiling.
• The auditor’s report route. The 2026 Auditor’s Report Directions for NBFCs carve out HFCs, which remain subject to the reporting requirements in the HFC framework; the concurrent audit programme for an HFC is therefore aligned to that framework’s certificate rather than to the DNBS10 route described in Section 4.

For both NBFCs and HFCs that lend against gold, the Reserve Bank of India (Lending Against Gold and Silver Collateral) Directions, 2025, effective from 1 April 2026, add their own tests; those are covered in this firm’s concurrent audit consultant in Ahmedabad guide, where gold-loan portfolios are a larger part of the picture.

9. How Marcken Consulting LLP Runs the Engagement

1. Independence check before anything else — confirming that neither Marcken Consulting LLP nor any network entity holds, or is in the one-year window around, a statutory audit or non-audit assignment for the NBFC or its group that the 2026 Statutory Audit Directions would treat as a conflict.
2. Appointment and engagement letter — approved by the Audit Committee, fixing the cycle, the sampling basis, the Directions in scope and the reporting format.
3. Direction-by-direction mapping — the company’s layer under the Registration and SBR Directions, its product set, its group structure and its HFC or CIC status mapped to the specific 2025 and 2026 Directions that bind it; the map is the audit programme.
4. Cycle work — prudential recomputation (Section 6), lending-rule testing (Section 7 and, for HFCs, Section 8), and pre-filing review of returns and certificates.
5. Exception reporting — each finding risk-ranked, assigned to a control owner with a remediation date, and re-tested at the next cycle until closed; the open-items register is shared with the statutory auditor at year-end so the two audits do not duplicate each other.
6. Annual close-out — a summary of the year’s findings and remediation for the Audit Committee, timed to precede the statutory audit and the auditor’s report certificate.

Deliverable
Independence confirmation under the Statutory Audit Directions, 2026
Direction-by-direction regulatory map and audit programme
Recomputed SMA/NPA classification and provisioning schedule under the IRAC Directions, 2025, each cycle
Capital-market lending, related-party and intra-group exposure test results
HFC principal-business and LTV monitoring, where applicable
Pre-filing reconciliation of supervisory returns and lender covenant certificates
Exception reports to the Audit Committee and an annual close-out for the statutory auditor

10. Fees and What Drives Them

RBI prescribes no fee for a concurrent audit of an NBFC, and a quoted “market rate” is a guess dressed as a fact. For a Mumbai engagement the fee is driven by the cycle (monthly or quarterly), the size and complexity of the book, whether capital-market, group or HFC testing is in scope, the number of entities in a group engagement, and the volume of returns and certificates reviewed before filing. Marcken Consulting LLP agrees the scope first and quotes a fixed annual fee against it, so that the Audit Committee approves a defined programme rather than an hourly estimate. Where a group wants one firm across its NBFC, its CIC and its HFC, the programme is scoped and priced per entity with a single reporting line.

11. Quick Reference Checklist for Mumbai NBFCs and HFCs

• The company’s current concurrent auditor is also its statutory auditor, or is expected to become it within a year — the 2026 Statutory Audit Directions require this to be unwound
• Asset size is approaching ₹5,000 crore (risk-based internal audit) or ₹15,000 crore (joint statutory audit)
• The company is a Middle Layer NBFC and has not yet aligned its compliance and internal audit functions to the Governance Directions, 2025 and the proposed 2027 changes
• The book includes loans against shares, IPO financing, promoter funding or lending to group entities
• The company is an HFC whose housing-finance ratios or LTV profile have moved since the last statutory audit
• A lender, rating agency or merchant banker has asked for independent assurance on the portfolio ahead of a debt issue, an equity round or a listing
• The last statutory audit raised observations on classification, provisioning or related-party transactions that remain open

12. Why Marcken Consulting LLP Is the Right Concurrent Audit Consultant in Mumbai

Marcken Consulting LLP is led by CA Murli Chandak, an IBBI-Registered Valuer for Securities or Financial Assets, and the firm works with NBFCs at every stage from registration to listing rather than appearing only when an audit is due:

• A practice built around NBFCs: NBFC registration, NBFC due diligence, NBFC takeover and business plan for NBFC are standalone service lines, and the NBFC license consultant in Mumbai guide covers the same consolidated Directions from the registration side.
• Independence that survives the 2026 Directions: the firm takes concurrent audit engagements only where the statutory audit role is held elsewhere, and documents the separation in the engagement letter.
• Recomputation, not confirmation: SMA/NPA ageing, provisioning, CRAR and the Section 45-IC transfer are rebuilt from the ledger each cycle; a figure that cannot be rebuilt is reported as an exception.
• Valuation and transaction experience where Mumbai NBFCs need it: the firm’s business valuation and IBBI-Registered Valuer work means that pledged-share valuations, group restructurings and pre-listing diligence are handled by people who understand both the audit trail and the valuation.
• The rest of the compliance stack in one place: GST, virtual CFO and CA services for Mumbai businesses run through the same firm, so findings with a tax or reporting dimension are closed rather than referred.
• One engagement partner, one reporting line: for a group with an NBFC, a CIC and an HFC, a single programme with a single accountable partner.

This guide is one of three in a series: the concurrent audit consultant in Bangalore guide covers digital lending, the 2026 cybersecurity directions and venture-backed lenders, and the concurrent audit consultant in Ahmedabad guide covers MSME, gold-loan and microfinance portfolios and family-promoted NBFCs.

13. Frequently Asked Questions

Q1. Does RBI require NBFCs in Mumbai to have a concurrent audit?
No. None of the thirty-five NBFC Directions of 28 November 2025 or the supervisory directions of 31 July 2026 prescribes a concurrent audit for NBFCs. RBI’s concurrent audit instruments apply to commercial banks and, from 2026, urban co-operative banks. For an NBFC it is a board-level governance decision, commonly driven by lenders, rating agencies and investors.

Q2. Our statutory auditor has been doing our concurrent audit for years. Is that still allowed?
Not under the Statutory Audit Directions, 2026, which state that concurrent auditors of an NBFC should not be considered for appointment as its statutory auditors and require a one-year gap between non-audit work and a statutory appointment. Non-deposit-taking NBFCs below ₹1,000 crore in assets may continue their existing appointment procedure, but the independence principle is the same.

Q3. What does the auditor’s report certificate have to do with concurrent audit?
The Auditor’s Report Directions, 2026 require the statutory auditor to certify matters such as the Certificate of Registration, Net Owned Fund, principal business criteria and, for deposit-taking NBFCs, prudential compliance, filing the DNBS10 return through CIMS. A concurrent audit that recomputes those figures through the year removes the surprises from that certificate.

Q4. We are a Middle Layer NBFC below ₹5,000 crore. Is risk-based internal audit mandatory for us?
The 2021 framework, now in the Internal Audit Function Directions, 2026, applies to deposit-taking NBFCs and non-deposit-taking NBFCs of ₹5,000 crore and above. RBI has proposed, through draft Governance amendment directions, to extend it to all Middle Layer NBFCs from 1 January 2027; the position should be confirmed against the final text at the time of appointment.

Q5. What is tested on loans against shares?
The 50% loan-to-value ratio that NBFCs of ₹100 crore and above must maintain at all times, the restriction to SEBI Group 1 securities for investment-purpose loans above ₹5 lakh, and the seven-working-day cure period for shortfalls caused by price movement. IPO financing is tested against the ₹1 crore per-borrower ceiling.

Q6. Does the programme change for a housing finance company?
Yes. The 60% housing-finance and 50% individual-housing-finance ratios, the loan-size-linked LTV ceilings of 90%, 80% and 75%, and the HFC framework’s own auditor reporting route are added to the standard NBFC scope.

Q7. Has the 90-day NPA norm reached Base Layer NBFCs?
Yes. The glide path in the IRAC framework ended on 31 March 2026, so an account overdue for more than 90 days is non-performing for every layer, classified at day-end and upgraded only when all arrears are cleared.

Q8. Does Marcken Consulting LLP work only with Mumbai companies?
No. The concurrent audit practice covers NBFCs across India; this guide focuses on Mumbai because the city concentrates the largest NBFCs, the housing finance sector and capital-market-linked lending, and because RBI’s Central Office is here.

---

Speak to Us

Marcken Consulting LLP offers a no-charge 30-minute consultation to discuss your NBFC’s or HFC’s concurrent audit scope, independence position and reporting cycle.

Marcken Consulting LLP | CA Murli Chandak, IBBI-Registered Valuer (Securities or Financial Assets)
Website: marckenconsulting.com
Phone: +91 99980 59923 / +91 99985 39902
Email: crm@marckenconsulting.com

Book a Free Consultation Chat on WhatsApp

Regulatory positions in this guide are as published by the Reserve Bank of India as at October 2026 and are confirmed at the start of each engagement. This guide is general information, not legal, regulatory or investment advice.