BDI Regulatory Watch.

Orientation summaries, not legal advice. Each reflects its official source as at the date shown; always read the source before acting.

1. SEBIIndiaConsultation paper13 Oct 2026

   Observation

   SEBI proposes stronger policing of how listed companies spend issue proceeds

   SEBI is consulting on working group proposals, plus some of its own, under which monitoring agencies would report directly to stock exchanges, with fines and promoter-level action when a listed company does not cooperate. Comments are due by 3 November 2026.

   What changed

   • Monitoring agencies would file their reports directly with stock exchanges and, where a company does not cooperate, report on the best available information with a statement of non-cooperation.
   • Stock exchanges would levy a fine of ₹50,000 for each instance of non-cooperation reported in a period, escalating to notices to promoters and, if the default continues, freezing of promoters' demat accounts.
   • Appointing a monitoring agency would become mandatory for all issues regardless of size (excluding any offer for sale), subject to exemptions that remain under the ICDR Regulations.
   • A company reported for non-cooperation could not terminate or replace its monitoring agency until it cures the default.

   Steps to consider

   • Map how proceeds from recent issues have been deployed against the offer document, and document every variation.
   • Make sure the finance team can give the monitoring agency complete, evidenced information on time each quarter.
   • Brief the audit committee on the proposals and decide whether to respond to SEBI by 3 November 2026.

   Who is affected

   Listed companies raising capital · Monitoring agencies · Promoters · Audit committees

   Reviewed by BDI

   22 Oct 2026

2. CERT-InIndiaAdvisory9 Oct 2026

   Information

   CERT-In and CSIRT-Fin warn of attackers abusing NBFC and fintech payment APIs

   CERT-In and CSIRT-Fin report attackers calling disbursal and fund-transfer APIs from inside compromised NBFC and fintech systems, bypassing KYC, beneficiary and limit checks, and moving money quickly to mule accounts. The advisory recommends limits and checks at the API and payment stage, not only in the application.

   What changed

   • Attackers get in through exposed applications, deprecated or unauthenticated APIs, long-lived tokens hard-coded in source code and plaintext credentials.
   • They call disbursal and transfer APIs from the entity's own whitelisted infrastructure, use dummy loan or transaction references, and push rapid bursts of IMPS and NEFT transfers to mule accounts at several banks.
   • Logs are deleted or truncated and endpoint tools tampered with to hide the trail, and the time between compromise and fraudulent transfer has shortened.
   • Entities are asked to report suspicious activity linked to the campaign to CERT-In with all relevant logs.

   Steps to consider

   • Inventory every payment and disbursal API, decommission unused endpoints and replace long-lived static tokens.
   • Require maker-checker approval and match every payout to an approved record before funds move.
   • Enforce per-transaction and daily limits, beneficiary validation and velocity alerts at the payment layer.
   • Centralise logs, keep them for at least 180 days and protect them from tampering so a forensic review is possible.

   Who is affected

   NBFCs · Digital lending platforms · Fintech firms · Payment service providers · Wallet operators

   Reviewed by BDI

   22 Oct 2026

   Reference

   CICA-2026-3610

   Sectors

   PE, Banking & Financial Services

3. UAEFIUUAEPress release2 Oct 2026

   Information

   UAE FIU and VARA agree to share intelligence on virtual-asset crime

   The UAE Financial Intelligence Unit and Dubai's Virtual Assets Regulatory Authority have signed a memorandum of understanding to exchange financial intelligence and expertise on financial crime involving virtual assets. VARA says the MoU builds on cooperation already in place; the release announces no new obligations for firms.

   What changed

   • The memorandum covers the exchange of relevant expertise and financial intelligence between the two bodies.
   • Its stated focus is financial crime involving virtual assets, within applicable law and confidentiality requirements.
   • The UAE FIU says the partnership will help both agencies understand emerging typologies and risks in virtual assets.

   Steps to consider

   • Identify counterparties, treasury flows and customers that touch virtual-asset providers licensed in Dubai.
   • Check that transaction monitoring and suspicious-transaction reporting cover virtual-asset exposures.
   • Refresh beneficial-ownership checks on UAE counterparties that hold or settle in virtual assets.

   Who is affected

   Virtual asset service providers in Dubai · Banks and payment firms that serve them

   Reviewed by BDI

   22 Oct 2026

   Sectors

   PE, Banking & Financial Services

4. NFRAIndiaStaff publication30 Sept 2026

   Information

   NFRA staff paper lists 35 going-concern questions auditors may expect from audit committees

   The sixth paper in NFRA's auditor and audit committee interaction series lists 35 questions auditors may expect from audit committees on going concern under SA 570 (Revised). It stresses that management prepares the going-concern assessment and that the board's and audit committee's responsibilities do not depend on the auditor's conclusion.

   What changed

   • It sets out the separate going-concern duties of management (Ind AS 1 or AS 1), the board (section 134(5) of the Companies Act, 2013), the audit committee (section 177 and SEBI LODR Regulation 18) and the auditor (SA 570 (Revised)).
   • It notes that the auditor evaluates management's assessment and is not responsible for supplying one that management has not made.
   • It lists 35 questions, grouped by the auditor's possible conclusions, including support from a parent, promoter or other party, group entities and prudential breaches in regulated entities.
   • It is an NFRA staff publication for awareness; NFRA states that it is not a policy, standard or recommendation of the Authority and does not replace any party's legal obligations.

   Steps to consider

   • Put the relevant NFRA questions on the agenda for the next results meeting with the auditor.
   • Ask management for a documented going-concern assessment covering at least twelve months from the end of the reporting period, with its assumptions tested.
   • Where the company relies on a support arrangement, ask what evidence supports the supporting party's financial ability, and take legal advice on whether the arrangement is enforceable.

   Who is affected

   Audit committees · Boards · Chief financial officers · Statutory auditors

   Reviewed by BDI

   22 Oct 2026

   Reference

   Auditor-Audit Committee Interaction Series 6

5. RBIIndiaDraft directions11 Sept 2026

   Observation

   RBI drafts a standard procedure for temporary debit holds on suspected mule transactions

   Following a Supreme Court direction of 4 August 2026, the RBI has proposed a common procedure for temporary debit holds on transactions and accounts linked to money mules and cyber-enabled fraud. Banks would need the systems and the customer process in place by 1 April 2027.

   What changed

   • Transactions of ₹1,000 and above flagged as suspected mule activity, including by AI and machine-learning monitoring, would be put on an immediate temporary debit hold; a hold on a whole account would be a last resort.
   • The customer would be told digitally at once where contact details are on record, otherwise by the end of the next day, and would have 20 days to explain.
   • The bank would decide within 10 days of an explanation, or within 30 days if none arrives, and either release the hold or refer the case to the police through the national cybercrime reporting system. Absent a contrary instruction from a law enforcement agency or a competent authority such as a court, a hold could last no more than 60 days from when it was placed.
   • The draft covers commercial, small finance, payments, regional rural and local area banks and urban co-operative banks, from 1 April 2027 or earlier if a bank chooses. Comments closed on 2 October 2026. Nodal, pool, escrow and other special-purpose accounts would be outside the procedure.

   Steps to consider

   • Test whether transaction monitoring can flag suspected mule activity at the ₹1,000 threshold without swamping genuine customers.
   • Design the customer notice, explanation and decision workflow, with timers for the 20, 10 and 30-day steps.
   • Link the hold process to suspicious-transaction reporting: the draft treats a confirmed mule account with no STR filed as non-compliance.
   • Plan implementation for 1 April 2027 and track the final directions.

   Who is affected

   Banks · Urban co-operative banks · Payment and fintech partners of banks

   Reviewed by BDI

   22 Oct 2026

   Reference

   Press Release 2026-2027/1109

   Sectors

   PE, Banking & Financial Services

6. CDSCOIndiaPublic notice5 Sept 2026

   Information

   CDSCO confirms seized rabies vaccine was misbranded and not made by the brand's maker

   CDSCO reports that rabies vaccine seized from unlicensed premises in Delhi was misbranded and not of standard quality, and had not been made by the brand's manufacturer. The notice records the manufacturer's statement that every batch of the brand is released for sale only after independent testing and batch-release certification by the Central Drugs Laboratory, Kasauli. For brand owners, the case shows the value of being able to confirm or disown a suspect batch quickly.

   What changed

   • As part of continuing surveillance, Delhi Police's Crime Branch and drugs inspectors of the Delhi Government searched unlicensed premises in Delhi on 22 April 2026 and seized rabies vaccine carrying a known brand name and batch number; CDSCO officials drew legal samples.
   • The Central Drugs Laboratory, Kasauli found the product misbranded and not of standard quality; it had not been made by the brand's licensed manufacturer.
   • On 27 August 2026 the Drugs Controller General (India) asked all State Drugs Controllers to watch for the batch and take action as needed under the Drugs and Cosmetics Act, 1940. Delhi Police have arrested four people and investigation is continuing; the notice states that no part of the batch was exported.

   Steps to consider

   • Check that batch-release and serialisation records let you confirm or disown a suspect batch number within hours.
   • Monitor markets and online channels for high-value products, especially injectables offered outside licensed channels, and make test purchases or gather evidence only through counsel, so that every step is lawful and does not interfere with regulatory or police action.
   • Agree in advance how the company will support regulators and police, and who issues any public statement.

   Who is affected

   Vaccine and biologics makers · Pharmaceutical brand owners · Distributors, hospitals and pharmacies

   Reviewed by BDI

   22 Oct 2026

   Sectors

   Pharma, Biotechnology & Life Sciences

7. SEBIIndiaCircular24 Aug 2026

   Observation

   SEBI moves cyber-incident reporting to the FSB's FIRE format, with staged updates

   SEBI has aligned its Cyber Incident Reporting Portal with the Financial Stability Board's FIRE format and requires regulated entities to report cyber incidents through the portal, which supports reporting in stages from first report to closure. The circular cites the existing CSCRF deadlines of six hours by e-mail and 24 hours on the portal.

   What changed

   • SEBI's Incident Reporting Portal is aligned with the FSB's Format for Incident Reporting Exchange (FIRE): common fields, standard definitions and consistent classification of incidents.
   • The portal supports reporting in stages, from an initial report to interim updates and final closure, recognising that early information may be incomplete.
   • Regulated entities must report through SEBI's Cyber Incident Reporting Portal and put systems in place for it, including changes to bye-laws and rules where needed.
   • The circular is addressed to a wide range of SEBI-regulated entities, including stock exchanges, clearing corporations, depositories, brokers, depository participants, mutual funds, AIFs, portfolio managers, investment advisers and research analysts.

   Steps to consider

   • Map the incident-response playbook to the FIRE fields so the six-hour e-mail report and the 24-hour portal report can both be made on time.
   • Assign owners for interim updates and closure reports, and keep the evidence behind each.
   • Run a tabletop exercise that ends with a mock FIRE-format report prepared offline, not a submission on the live portal.

   Who is affected

   Stock brokers · Depository participants · Mutual funds and AMCs · Portfolio managers · Investment advisers and research analysts · Market infrastructure institutions · Other SEBI-regulated entities to which the circular is addressed

   Reviewed by BDI

   22 Oct 2026

   Reference

   HO/(449)2026-ITD-5_DIV1/I/19448/2026

   Sectors

   PE, Banking & Financial ServicesInsurance, Mutual Funds & Others

8. FIU-INDIndiaList17 Aug 2026

   Observation

   FIU-IND lists 3,293 NBFCs it says have not registered on its FINnet 2.0 portal

   FIU-IND has published a list of 3,293 Middle and Base Layer NBFCs that, according to FIU-IND, have not fulfilled their obligation under the PML Act and Rules to register on its FINnet 2.0 portal, as on 17 August 2026. FIU-IND notes that an NBFC can file reports only after completing all three registration stages, and that the list is subject to quarterly review.

   What changed

   • The list, as on 17 August 2026, covers 3,228 Base Layer and 65 Middle Layer NBFCs, against 7,936 Base Layer and 540 Middle Layer NBFCs that FIU-IND says were registered with the RBI as on 30 June 2026. Each entry shows the NBFC's RBI regional office.
   • It supersedes all earlier FIU-IND lists of non-compliant NBFCs as far as FINnet 2.0 registration is concerned.
   • FIU-IND will review the list quarterly; an NBFC that registers after the list is issued may be removed at the next review.

   Steps to consider

   • Check the list for your own entity, group companies and NBFC partners, and confirm the current position directly, as the list is a dated snapshot.
   • If registration is outstanding, complete it on FINnet 2.0 with the principal officer and designated director recorded.
   • Once registered, confirm that cash, suspicious and other prescribed reports are filed on time.
   • Add FINnet 2.0 registration status, confirmed with the entity, to due diligence on NBFC counterparties, co-lending partners and acquisition targets.

   Who is affected

   NBFCs · Lenders and investors in NBFCs · Co-lending and fintech partners

   Reviewed by BDI

   22 Oct 2026

   Sectors

   PE, Banking & Financial Services

9. RBIIndiaMaster Direction31 Jul 2026

   Critical

   RBI reissues NBFC fraud risk rules as new Directions, in force immediately

   On 31 July 2026 the RBI issued Fraud Risk Management Directions for NBFCs, in force immediately, alongside separate Directions for banks, co-operative banks and all-India financial institutions. The NBFC Directions cover Upper and Middle Layer NBFCs, Base Layer NBFCs with assets of ₹500 crore or more, and housing finance companies. They require due process before any fraud classification, early warning systems for larger NBFCs, prompt reporting and staff accountability, and repeal the earlier NBFC instructions.

   What changed

   • Each covered NBFC needs a board-approved fraud risk management policy, reviewed at least once every three years, and a special board committee to monitor fraud cases; Middle and Base Layer NBFCs may use a committee of executives instead.
   • A person or entity must receive a detailed show cause notice and at least 21 days to respond before an account is classified as fraud by a reasoned order.
   • Frauds are reported to the police immediately and to the RBI within 14 days of classification (housing finance companies report to the National Housing Bank); those classified, and associated entities, are barred from raising funds or new credit from RBI-regulated entities for five years after full repayment or settlement.
   • Upper and middle layer NBFCs must run an early warning framework integrated with core systems, and analytics that watch digital transactions, non-KYC accounts and money-mule accounts in near real time.

   Steps to consider

   • Re-map the fraud policy, committee charters and reporting calendar to the new Directions and retire references to repealed circulars.
   • Have counsel review the show cause notice and reasoned-order process, including recent cases, against the due-process requirements of the new Directions.
   • Test early warning signals and red-flag workflows end to end, recording the time taken at each step.
   • Confirm that fraud examinations fix staff accountability and reach the board committee on time.

   Who is affected

   NBFCs in the Upper and Middle Layers · Base Layer NBFCs with assets of ₹500 crore or more · Housing finance companies · Banks, co-operative banks and AIFIs (under parallel Directions)

   Effective

   31 Jul 2026

   Reviewed by BDI

   22 Oct 2026

   Reference

   RBI/DoS/2026-27/463

   Sectors

   PE, Banking & Financial Services

10. SEBIIndiaPress release17 Jul 2026

    Information

    SEBI warns listed companies of 'boss scams' using deepfaked CEOs and hijacked WhatsApp

    Acting on an alert from the Indian Cyber Crime Coordination Centre, SEBI has warned regulated entities and listed companies about fraudsters who impersonate a chief executive to push finance staff into urgent transfers to mule accounts. Some attacks use voice cloning and deepfake video; others hijack WhatsApp Web through a malicious zip file.

    What changed

    • Fraudsters impersonate a CEO or MD by e-mail, WhatsApp, Microsoft Teams or other platforms and instruct staff to transfer funds, sometimes claiming the matter is unpublished price-sensitive information.
    • One method uses deepfake voice and video calls and fake social-media groups; the other sends a zip archive with a malicious executable that hijacks the finance officer's WhatsApp Web session.
    • SEBI advises calling seniors to confirm instructions, never transferring funds on messaging instructions alone, not running unverified executables, logging out of idle WhatsApp Web sessions, and reporting incidents on 1930 or cybercrime.gov.in.

    Steps to consider

    • Require call-back verification, using a number from an independent directory rather than the device's contacts, for any payment instruction received by message, whatever the sender's seniority.
    • Remind finance teams that a request for secrecy is itself a red flag.
    • Block files from messaging apps on finance machines and review active WhatsApp Web sessions.
    • Rehearse the first hour after a fraudulent transfer: bank recall, a 1930 report and evidence preservation.

    Who is affected

    Listed companies · SEBI-regulated entities · Finance and treasury teams

    Reviewed by BDI

    22 Oct 2026

    Reference

    PR No. 40/2026

Summaries are for orientation and are not legal advice. Each summary reflects the source as at the date shown; BDI does not guarantee that it is complete or current. Read the official document, and take advice on your own position, before acting. BDI is independent of the regulators and bodies cited and is not endorsed by them.