Concurrent Audit Consultant in Bangalore | NBFC | Marcken

In short: Marcken Consulting LLP is a concurrent audit consultant in Bangalore for NBFCs that need an independent, continuous check on their loan book, their digital lending arrangements and their regulatory filings between one statutory audit and the next. The practice is a Chartered Accountancy and IBBI-Registered Valuer firm whose core work includes concurrent audit, valuation and GST, and it brings that combination to Karnataka lenders whose books now carry more technology risk than collateral risk. Bangalore’s case for a specialist concurrent auditor is specific: RBI’s own Bengaluru Regional Office on Nrupathunga Road supervises every NBFC registered in Karnataka, the city is India’s largest hub for fintech and digital-lending companies, and the two instruments that now matter most to a technology-led lender are both recent — the Reserve Bank of India (Digital Lending) Directions, 2025 of 8 May 2025 and the NBFC Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions, 2026 of 31 July 2026. One point this guide makes early, because most competing pages get it wrong: RBI has never issued a direction that makes concurrent audit compulsory for NBFCs. Concurrent audit is a bank requirement that NBFC boards, lenders and investors have adopted because it works, and understanding that distinction is what allows the scope to be designed around the risks a Bangalore lender actually carries rather than a bank-style template. This guide sets out what RBI does require, what a well-scoped concurrent audit of a Bangalore NBFC tests, how the 2025 digital lending and 2026 cybersecurity directions reshape that scope, and how Marcken Consulting LLP runs the engagement.

1. What Does a Concurrent Audit Consultant in Bangalore Do?

A concurrent audit consultant in Bangalore examines an NBFC’s transactions and controls while the financial year is still running, rather than after it has closed. The statutory auditor forms an opinion on the annual financial statements once a year; the concurrent auditor tests a sample of the month’s or quarter’s disbursements, collections, classifications and filings as they happen, and reports the exceptions to the Audit Committee while there is still time to correct them before a regulatory return, a lender’s covenant certificate or the year-end audit picks them up. Marcken Consulting LLP’s role covers four pieces of work:

• Scope design around the actual book — mapping the NBFC’s products, origination channels, Lending Service Provider (LSP) relationships, Default Loss Guarantee (DLG) arrangements and Scale-Based Regulation layer to the specific RBI directions that apply to each, so that the audit programme tests what the regulator will ask about (Sections 3, 5, 6 and 7).
• Transaction and control testing on a fixed cycle — sampling disbursements, repayments, overdue classification, provisioning and KYC on a monthly or quarterly rhythm, with the sample sized to the portfolio rather than a token file count.
• Regulatory return and certificate review before filing — reconciling the numbers that go into RBI returns, lender covenant certificates and rating-agency submissions to the underlying ledgers before they leave the building.
• Audit Committee reporting that leads to action — a report structured by exception, risk-ranked, with the control owner and the remediation date against each finding, followed up at the next cycle.

2. Why Bangalore NBFCs Need a Technology-Led Concurrent Audit Scope

A concurrent audit built for a branch-based, collateral-backed lender tests the wrong things in Bangalore. The city’s NBFC population is weighted towards companies that originate through mobile applications, partner with LSPs for sourcing and servicing, price on data rather than security, and run their entire loan lifecycle on cloud infrastructure. Three facts shape the scope:

• RBI’s Bengaluru Regional Office supervises Karnataka’s NBFCs. Reserve Bank of India, Bengaluru Regional Office, Nrupathunga Road, Bengaluru — the office whose jurisdiction covers the whole of Karnataka and through which a Karnataka-registered NBFC’s supervisory relationship with RBI runs. Findings that a concurrent auditor surfaces and the board remediates are findings the supervisory team does not have to surface for the company.
• The digital lending rulebook is now consolidated and specific. The Reserve Bank of India (Digital Lending) Directions, 2025, issued on 8 May 2025 and now also carried as the digital lending chapter of the Credit Facilities Directions, 2025 for NBFCs, replaced the 2022 digital lending guidelines and the 2023 DLG guidelines with a single set of obligations covering every NBFC, including housing finance companies. For a Bangalore lender, almost every one of those obligations is a testable control (Section 6).
• Technology risk is now regulated by NBFC layer and asset size. The NBFC Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions, 2026, issued and effective on 31 July 2026, apply in three tiers — Base Layer NBFCs below ₹500 crore and Core Investment Companies, Base Layer NBFCs of ₹500 crore and above, and Middle Layer and above — and replaced the earlier IT framework instructions for NBFCs (Section 7). A concurrent audit that does not test the controls in the tier that applies to the company is incomplete.

Karnataka also hosts proven, non-fintech NBFC models that a concurrent audit has to serve equally well — Bengaluru-headquartered Vistaar Finance, an MSME lender that has scaled to an AUM of over ₹4,500 crore, is the clearest example — which is why Section 8 covers MSME and supply-chain credit alongside venture-backed lending.

3. What RBI Actually Requires of an NBFC

The honest starting point is that concurrent audit, as a named regulatory requirement, belongs to banking. RBI’s Concurrent Audit System in Commercial Banks — Revision of RBI’s Guidelines of 18 September 2019 prescribes the system for commercial banks, and in 2026 RBI issued separate concurrent audit directions for urban co-operative banks. For NBFCs there is no equivalent. The consolidated NBFC rulebook — thirty-five subject-wise Directions issued by RBI’s Department of Regulation on 28 November 2025, led by the Registration, Exemptions and Framework for Scale Based Regulation Directions, 2025 — and the supervisory directions of 31 July 2026 do not prescribe a concurrent audit, and the Scale Based Regulation Master Direction of 2023 that preceded them did not use the term either. What RBI does require, and what a concurrent audit is built to support, is the following:

• Risk-Based Internal Audit for larger NBFCs. RBI’s framework of 3 February 2021 made a risk-based internal audit function mandatory for all deposit-taking NBFCs and for non-deposit-taking NBFCs with an asset size of ₹5,000 crore and above, to be implemented by 31 March 2022, and now consolidated in the Internal Audit Function Directions, 2026 of 31 July 2026; ICAI’s Technical Guide on Risk Based Internal Audit of NBFCs sets out how the profession implements it. Concurrent audit is one of the assurance tools an RBIA function relies on; for NBFCs below the threshold, it is frequently the only independent, continuous assurance the board has.
• A statutory internal audit under the Companies Act. Section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014 requires an internal auditor for, among others, a private company whose turnover reached ₹200 crore or whose outstanding borrowings from banks or public financial institutions reached ₹100 crore at any point in the preceding financial year — thresholds a growing Bangalore lender crosses early, usually on borrowings.
• Independence rules that decide who can be the concurrent auditor. The Reserve Bank of India (Non-Banking Financial Companies — Statutory Audit) Directions, 2026 (RBI/DoS/2026-27/465), issued on 31 July 2026 and effective immediately, state that “concurrent auditors of the NBFC should not be considered for appointment as SCAs / SAs of the same NBFC”, and require a gap of at least one year between any non-audit work for the NBFC and appointment as its statutory auditor. Non-deposit-taking NBFCs below ₹1,000 crore may continue their existing appointment procedure. The practical consequence is that the concurrent auditor and the statutory auditor must be two different firms, which is how Marcken Consulting LLP structures every engagement.
• The substantive norms the concurrent audit tests. Asset classification, provisioning, the Fair Practices Code, KYC, the board-approved policy on loans to directors and their relatives, the statutory reserve under Section 45-IC of the RBI Act, 1934, and the minimum 15% Capital to Risk-Weighted Assets Ratio now sit in the Income Recognition, Asset Classification and Provisioning Directions, 2025, the Responsible Business Conduct Directions, 2025, the KYC Directions, 2025, the Governance Directions, 2025 and the Prudential Norms on Capital Adequacy Directions, 2025, all of 28 November 2025. These are covered in Section 5.

Outside the regulatory text, two further sources of demand are routine: lenders to NBFCs commonly ask for independent assurance on the portfolio they are funding, and investors in venture-backed lenders expect it as part of governance. Neither replaces the regulatory analysis above; both are reasons a Bangalore board rarely waits for the ₹5,000 crore threshold before appointing a concurrent auditor.

4. Concurrent, Internal and Statutory Audit Compared

Dimension	Concurrent audit	Internal audit / RBIA	Statutory audit
Legal basis for an NBFC	Board decision, lender or investor requirement; not an RBI mandate	Companies Act s.138 (by threshold); RBI risk-based internal audit framework for NBFC-D and NBFCs of ₹5,000 crore and above, now in the Internal Audit Function Directions, 2026	Companies Act; RBI Statutory Audit Directions, 2026
Timing	Continuous — monthly or quarterly, on live transactions	Periodic, risk-prioritised across the audit universe	Annual, after year-end
Reports to	Audit Committee and management; not filed with RBI	Audit Committee	Shareholders; report and certificates also used by RBI
Who performs it	An independent CA firm that is not the statutory auditor	In-house function or outsourced firm	Statutory auditor appointed under the 2026 Directions
Output	Exception report with owners and dates; pre-filing reconciliations	Audit plan, process audits, risk ratings	Audit opinion on the financial statements

The three are complementary. The practical design question for a Bangalore NBFC is which risks need continuous testing (the concurrent scope) and which can wait for a periodic process audit.

5. What a Concurrent Audit of a Bangalore NBFC Tests

Every item below is tied to a direction RBI has actually issued, which is the only basis on which a finding can be defended to an Audit Committee:

• Overdue classification on the day it happens. RBI’s clarification of 12 November 2021, now carried into the Income Recognition, Asset Classification and Provisioning Directions, 2025, requires that “classification of borrower accounts as SMA as well as NPA shall be done as part of day-end process for the relevant date”, and that an NPA may be upgraded to standard only when the entire arrears of interest and principal are paid. For an app-based lender whose collections post through payment gateways and partner wallets, the concurrent auditor tests that the day-end classification engine reflects actual receipts, not scheduled ones.
• The 90-day norm, now universal. Under the IRAC Directions, 2025, Base Layer NBFCs moved to the 90-day NPA norm through a glide path that ended on 31 March 2026, so every NBFC now classifies an account overdue for more than 90 days as non-performing. The audit tests the cut-off and the ageing logic each cycle.
• Provisioning at the prescribed rates. The same Directions prescribe standard-asset provisioning of 0.25% for the Base Layer and 0.40% for the Middle Layer; a 10% provision on sub-standard assets; 20%, 30% and 50% on the secured portion of doubtful assets by period and 100% on the unsecured portion; and 100% on loss assets. The concurrent audit recomputes the provision from the ageing report rather than accepting the system figure.
• KYC and the Fair Practices Code. Sample files are tested against the KYC Directions, 2025 and the Fair Practices Code and Key Facts Statement rules in the Responsible Business Conduct Directions, 2025, with particular attention to the disclosure of rate, fees and recovery practices in app-originated loans.
• Loans to directors, senior officers and their relatives. RBI’s NBFC Directions require a board-approved policy on such loans and disclosure of the aggregate in the annual financial statements; the audit traces each such advance to the policy and the approval.
• Reserve fund and capital. Transfer to the statutory reserve under Section 45-IC of the RBI Act, 1934 and the 15% minimum CRAR are checked against the ledger and the latest computation, not the last return.
• Returns and covenant certificates. Figures in RBI returns and lender certificates are reconciled to the books before submission; a mismatch found here costs an afternoon, while the same mismatch found by a supervisor or a lender costs considerably more.

6. The Digital Lending Directions, 2025 as a Concurrent Audit Checklist

For a Bangalore lender, the Digital Lending Directions, 2025 are the single most important document in the concurrent audit programme, because nearly every obligation in them is observable in a sample of loans. Marcken Consulting LLP tests, on each cycle:

• Direct disbursal and repayment. Loan proceeds must be disbursed directly into the borrower’s bank account and repayments collected into the regulated entity’s account, without a pass-through of an LSP or a third party. The audit traces a sample from the lending system to the bank statement.
• Key Fact Statement and Annual Percentage Rate. Every digital loan must carry a Key Fact Statement with the APR and all charges disclosed before the borrower signs; where an LSP displays offers from more than one lender, each offer must show the lender’s name, loan amount, tenor, APR and repayment terms, a requirement that took effect on 1 November 2025.
• Cooling-off period. The Directions require a cooling-off period of at least one day during which the borrower can exit by repaying principal and proportionate APR; the audit confirms the period is configured and that exit requests are honoured.
• Data consent and storage in India. Borrower data must be collected with explicit consent and stored on servers located in India; the audit reviews consent logs and the hosting arrangements of the Digital Lending App and the LSP.
• Default Loss Guarantee limits. DLG cover on any portfolio is capped at 5% of the amount disbursed under that portfolio and must be backed by an enforceable contract; the audit recomputes the cap on live portfolios and confirms that DLG arrangements have not been used to defer NPA recognition.
• Reporting of Digital Lending Apps. Regulated entities had to report their DLAs on RBI’s CIMS portal by 15 June 2025; the audit confirms the register is complete and current as apps and LSP relationships change.

7. Cybersecurity and Technology Risk: The 31 July 2026 NBFC Directions

RBI’s NBFC Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions, 2026 (RBI/DoS/2026-27/461) replaced the earlier IT framework instructions for NBFCs on 31 July 2026 and apply with effect from the same date. They are organised in three chapters by NBFC size and layer: one for Base Layer NBFCs with assets below ₹500 crore and for Core Investment Companies, one for Base Layer NBFCs of ₹500 crore and above, and one for Middle Layer and above. The obligations are alternatives, so the first task is to identify which chapter binds the company. For the cycle-by-cycle concurrent audit, the testable items are the ones that leave evidence: user access reviews and maker-checker controls in the loan management system, change management records for releases to the lending app, backup and restoration tests, incident logs and the related reporting, and the due diligence files for cloud, LSP and other technology vendors. Marcken Consulting LLP tests these as part of the regular programme and reports them in the same exception format as credit findings, so the Audit Committee sees technology risk alongside portfolio risk rather than in a separate silo.

8. Sector Focus: Venture-Backed Lenders, Supply-Chain Finance and Karnataka MSME Credit

Venture-backed and start-up-facing lenders. Bangalore NBFCs that lend to funded start-ups often secure themselves on guarantees, pledges of shares and assignment of receivables rather than physical collateral. The concurrent audit tests covenant monitoring (financial covenants, reporting undertakings and events of default actually tracked, not merely drafted), the valuation basis for pledged shares, and the classification of restructured or rescheduled facilities under the asset classification norms rather than as fresh loans.

Supply-chain and invoice finance. For NBFC-Factors and for NBFC-ICCs that discount invoices, the audit tests invoice authenticity against GST records, confirmation of the receivable with the buyer, concentration of exposure to single buyers, and the reconciliation of collections to specific invoices rather than to a borrower-level balance.

Karnataka MSME credit. For lenders in the Vistaar Finance mould, the audit concentrates on the fundamentals: income assessment documentation, security creation and charge registration, insurance on financed assets, the day-end overdue process at branch and field level, and the reconciliation of field collections to the general ledger. A Karnataka-wide branch network also brings the branch-visit element that app-based lenders do not need.

9. How Marcken Consulting LLP Runs a Concurrent Audit Engagement

1. Appointment by the Audit Committee — engagement letter setting out scope, cycle, sampling basis, reporting format and the independence confirmation that the firm is not, and will not within the periods prescribed by the 2026 Statutory Audit Directions become, the NBFC’s statutory auditor.
2. Regulatory mapping — identifying the NBFC’s layer, the chapter of the 2026 cybersecurity directions that applies, the digital lending arrangements in place, and the specific directions each product attracts; this becomes the audit programme.
3. Baseline review — a first-cycle review of policies (credit, KYC, Fair Practices Code, loans to directors, outsourcing, IT) against the current directions, so that later cycles test compliance with policies that are themselves compliant.
4. Cycle testing — monthly or quarterly sampling and recomputation across the items in Sections 5 to 7, with system data pulled directly from the loan management system and reconciled to the ledger and bank statements.
5. Pre-filing reconciliation — review of RBI returns and lender certificates before submission on each cycle.
6. Audit Committee report and follow-up — exception report with risk ranking, control owner and remediation date; open items carried forward and re-tested at the next cycle until closed.

Deliverable
Regulatory map and audit programme specific to the NBFC’s products, layer and digital lending arrangements
Cycle exception reports to the Audit Committee with owners, dates and follow-up status
Recomputed NPA ageing and provisioning schedule each cycle
Digital Lending Directions compliance checklist with sample evidence (KFS, cooling-off, disbursal trail, DLG cap, CIMS register)
Technology control test results under the applicable chapter of the 2026 cybersecurity directions
Pre-filing reconciliation notes on RBI returns and lender covenant certificates
Annual summary of findings and remediation for the statutory auditor and the board

10. What a Concurrent Audit Costs

There is no prescribed fee for a concurrent audit of an NBFC, and any page quoting a standard figure is guessing. The fee is a function of four variables: the frequency of the cycle (monthly costs more than quarterly), the number of products and origination channels in scope, whether the programme includes the technology controls under the 2026 cybersecurity directions and the digital lending checks in Section 6, and whether branch or field visits are needed. Marcken Consulting LLP scopes the programme first and quotes a fixed fee for the year against that scope, so the Audit Committee can see what is being tested, how often, and what it costs before the engagement letter is signed. The comparison that matters is not between fee levels but between the cost of a finding surfaced by the concurrent auditor and remediated in-cycle and the cost of the same finding surfaced later by a lender, a rating agency or RBI’s supervisory team.

11. Quick Reference Checklist: When a Bangalore NBFC Should Appoint a Concurrent Auditor

• The company originates or services loans through a Digital Lending App or an LSP, or carries any DLG arrangement
• Borrowings from banks or public financial institutions have reached ₹100 crore, or turnover ₹200 crore, bringing the company within Section 138 of the Companies Act, 2013
• A lender, rating agency or investor has asked for independent assurance on the portfolio
• Asset size is approaching ₹500 crore, which moves a Base Layer NBFC into the next chapter of the 2026 cybersecurity directions
• The statutory auditor has raised observations on NPA classification, provisioning or KYC that recur year on year
• The company is preparing for a fundraise, a change of control or the IPO route, where diligence will test the portfolio in detail
• Asset size is approaching ₹5,000 crore, where the RBIA framework becomes mandatory and the concurrent audit needs to be integrated with it

12. Why Marcken Consulting LLP Is the Right Concurrent Audit Consultant in Bangalore

Marcken Consulting LLP is led by CA Murli Chandak, an IBBI-Registered Valuer for Securities or Financial Assets, and concurrent audit sits inside a practice that works with NBFCs across their lifecycle rather than as a standalone audit shop:

• An NBFC practice end to end: the firm runs standalone NBFC registration, NBFC due diligence, NBFC takeover and business plan for NBFC service lines, and its NBFC license consultant in Bangalore guide covers the registration side of the same regulatory framework this guide applies to the audit.
• Scope built from the directions, not a template: the audit programme is written against the consolidated NBFC Directions of 28 November 2025, the Digital Lending Directions, 2025 and the 2026 cybersecurity directions as they apply to the specific company, which is why the findings hold up in front of an Audit Committee.
• Independence structured correctly from day one: the engagement is designed so that the firm’s role as concurrent auditor is compatible with the 2026 Statutory Audit Directions, with the separation from the statutory auditor documented in the engagement letter.
• Valuation and transaction depth when the portfolio is tested by outsiders: the same firm’s business valuation and IBBI-Registered Valuer work for Bengaluru companies means that when a fundraise, an equity round or a change of control puts the loan book under diligence, the concurrent audit record and the valuation work speak the same language.
• Compliance across the company, not only the loan book: GST, ESOP and virtual CFO support sit in the same practice, so related findings do not fall between advisers.
• One accountable firm: scope, testing, Audit Committee reporting and follow-up run through Marcken Consulting LLP, with a single engagement partner answerable for the programme.

This guide is part of a city series: the concurrent audit consultant in Mumbai guide covers large and Middle Layer NBFCs, housing finance companies and group structures, and the concurrent audit consultant in Ahmedabad guide covers MSME, gold-loan and microfinance portfolios and family-promoted NBFCs.

13. Frequently Asked Questions

Q1. Is concurrent audit mandatory for an NBFC in Bangalore?
No RBI direction makes concurrent audit compulsory for NBFCs; neither the consolidated NBFC Directions of 28 November 2025 nor the supervisory directions of 31 July 2026 prescribe one. RBI mandates a risk-based internal audit function for deposit-taking NBFCs and non-deposit-taking NBFCs of ₹5,000 crore and above, and the Companies Act requires an internal auditor once a company crosses the Section 138 thresholds. Concurrent audit is the continuous assurance tool boards, lenders and investors adopt within that framework.

Q2. Can our statutory auditor also do the concurrent audit?
No. The Statutory Audit Directions, 2026 state that concurrent auditors of an NBFC should not be considered for appointment as its statutory auditors, and require a one-year gap between non-audit work and a statutory audit appointment. The two roles need two firms.

Q3. Does the concurrent audit report go to RBI?
No. It is addressed to the Audit Committee and management. RBI’s supervisory team may ask to see it during an inspection, which is one reason the report should be exception-based, risk-ranked and show remediation status.

Q4. How often should the concurrent audit run?
Monthly for lenders with high transaction volumes or digital origination; quarterly can be sufficient for smaller, slower-moving books. The cycle is fixed in the engagement letter and matched to the NBFC’s return and covenant calendar.

Q5. Which digital lending obligations are tested?
Direct disbursal to the borrower’s account, the Key Fact Statement and APR disclosure, the minimum one-day cooling-off period, consent-based data collection with storage in India, the 5% cap on Default Loss Guarantee cover, the CIMS register of Digital Lending Apps, and the multi-lender offer disclosures in force since 1 November 2025.

Q6. Which chapter of the 2026 cybersecurity directions applies to us?
It depends on layer and asset size: one chapter for Base Layer NBFCs below ₹500 crore and Core Investment Companies, one for Base Layer NBFCs of ₹500 crore and above, and one for Middle Layer and above. The regulatory mapping at the start of the engagement settles this.

Q7. Has the 90-day NPA norm reached every NBFC?
Yes. The glide path for Base Layer NBFCs ended on 31 March 2026, so an account overdue for more than 90 days is now non-performing for every NBFC, classified in the day-end process and upgraded only when all arrears are cleared.

Q8. Does Marcken Consulting LLP only work with Bangalore NBFCs?
No. The firm’s concurrent audit practice covers NBFCs across India; this guide focuses on Bangalore because the city’s lenders carry a distinctive mix of digital lending and technology risk that shapes the scope.

---

Speak to Us

Marcken Consulting LLP offers a no-charge 30-minute consultation to discuss your NBFC’s concurrent audit scope, independence position and reporting cycle.

Marcken Consulting LLP | CA Murli Chandak, IBBI-Registered Valuer (Securities or Financial Assets)
Website: marckenconsulting.com
Phone: +91 99980 59923 / +91 99985 39902
Email: crm@marckenconsulting.com

Book a Free Consultation Chat on WhatsApp

Regulatory positions in this guide are as published by the Reserve Bank of India as at October 2026 and are confirmed at the start of each engagement. This guide is general information, not legal, regulatory or investment advice.