TL;DR
NBFCs in the Upper and Middle Layers of the RBI's scale-based regulation must have an independent compliance function headed by a Chief Compliance Officer. The framework, set out in the RBI's circular on the compliance function and role of the Chief Compliance Officer in NBFCs, applied from 1 April 2023 for Upper Layer entities and 1 October 2023 for Middle Layer.
Like the Chief Risk Officer mandate, it fixes the terms of the appointment rather than merely requiring one. A minimum tenure of three years, a position no lower than two levels below the CEO, direct reporting to the MD and CEO or the board, quarterly board sessions without senior management present, and a flat prohibition on dual-hatting.
Key points
- Applies to NBFC Upper and Middle Layers. Base Layer entities remain under earlier guidance.
- Minimum fixed tenure of three years, which the board may shorten by one year only in exceptional circumstances with a succession plan.
- The CCO sits no more than two levels below the CEO, relaxable by one further level for Middle Layer entities.
- No dual-hatting. The CCO cannot hold business responsibilities that create a conflict.
- The MLRO function under anti-money-laundering rules is related but distinct, and whether to combine them is a real decision.
What the framework requires
| Requirement | Consequence for hiring |
|---|---|
| Applies to NBFC-UL and NBFC-ML | The trigger is your layer under scale-based regulation, not your revenue |
| Minimum fixed tenure of three years | A three-year commitment from both sides, which changes the negotiation |
| Not below two levels from the CEO, relaxable by one for ML | Fixes the grade. A compliance manager cannot be elevated in title alone |
| Direct reporting to MD and CEO and/or the board or a board committee | Determines who interviews and who the candidate's stakeholder really is |
| Quarterly one-to-one with the board, excluding senior management | Independence will be tested, and candidates assess whether it is genuine |
| Good industry understanding, regulatory knowledge, clean record, independent judgement | The eligibility bar is principles-based rather than a checklist of years |
| No dual-hatting where a conflict arises | Rules out combining with legal, operations or product in most structures |
The framework is deliberately principles-based on qualifications and prescriptive on structure. That is the reverse of most hiring assumptions, where companies are flexible on structure and rigid on years of experience. Briefs written the usual way tend to fail this one.
What the role owns
Regulatory interpretation and the compliance programme. Translating circulars into controls the business can actually run, then evidencing that they run. Indian fintech regulation changes frequently enough that this is continuous work rather than an annual exercise.
Digital lending guidelines. For any lending business, this is the dominant workload: disbursement and repayment flows directly between borrower and regulated entity, disclosure of the lending service provider relationship, cooling-off periods, data collection limits and grievance handling.
Payment aggregator and cross-border obligations where the company holds those authorisations, each with its own conditions and reporting.
Outsourcing and partnership governance. Most fintechs operate through partners, and the regulated entity remains accountable for what the partner does. Someone has to own that accountability in practice.
Regulatory reporting and inspection. Periodic returns, and being the person in the room when the RBI inspects.
Grievance redressal and conduct. Increasingly scrutinised, particularly around collections practice.
The systems that produce the evidence for most of this are covered in KYC, AML and compliance engineering.
CCO and MLRO: related, not identical
The Money Laundering Reporting Officer is a separate designation under India's anti-money-laundering framework, responsible for monitoring, filing suspicious transaction reports and acting as the point of contact with the Financial Intelligence Unit.
Many Indian fintechs combine the two in one person. That is workable at moderate scale and becomes a problem at volume, for a practical reason rather than a legal one: the MLRO role is operational and high-frequency, involving alert review and reporting deadlines, while the CCO role is governance-led and strategic. Combining them usually means the operational work crowds out the governance work, because alerts have deadlines and policy reviews do not.
The signal that they need splitting is usually a backlog in alert review or a regulator asking why transaction monitoring thresholds have not been revisited.
When briefing, be explicit about which role you are hiring and whether the other is included, because the candidate pools differ. The strongest MLROs come from financial crime backgrounds in banks and payments; the strongest CCOs more often come from regulatory and legal backgrounds with operating experience.
Which backgrounds transfer
| Background | Transfers | Watch for |
|---|---|---|
| Compliance leadership at an NBFC or fintech | Strongly | Small pool, almost entirely passive |
| Bank compliance at senior level | Well, with a caveat | May expect resources and committee structures a fintech does not have |
| Payments or PA-licensed entity compliance | Strongly for payment businesses | Lending regulation is a different body of rules |
| Legal and regulatory practice | Partially | Strong on interpretation, often untested on operating a control environment |
| Financial crime and AML specialist | Strongly for MLRO, partially for CCO | Depth in monitoring, less exposure to the full regulatory perimeter |
| Big four risk and regulatory consulting | Partially | Knows the frameworks, has usually not been accountable during an inspection |
The decisive question is not knowledge of the rules. It is whether the person has operated a control environment while a business was growing fast and wanted to move faster. That is learned in post, not in advisory work.
How to assess
Ask what they would stop. A compliance leader who cannot name something they would refuse to allow is describing a documentation function. The best candidates are specific, and often cite something commercially painful.
Ask about an inspection. What the regulator asked for, what was missing, what changed afterwards. Candidates who have been through one describe the texture of it. Those who have not describe the process in the abstract.
Test the translation skill. Give them a recent regulatory change and ask what it would mean operationally for your business. This separates people who read circulars from people who implement them.
Probe independence structurally. Ask what reporting line they would require and what they would do if overruled. The framework gives them a board channel; a serious candidate knows that and will want to confirm it is real.
The search reality
The three-year tenure changes the conversation on both sides. Candidates evaluate the board and the governance culture more carefully than in an ordinary role, because leaving early is visible and the framework expects stability. Companies should expect to be assessed, and to answer questions about why the previous holder left.
Seniority is fixed by the framework, not by the budget. Two levels from the CEO means the offer has to match that level. Attempting to fill the role below grade is the most common way these searches fail late, after a candidate has engaged.
Demand is concentrated and rising. The scale-based regulation deadlines pulled a large number of NBFCs into scope within a short window, and the pool of people who have held the role under the current framework is correspondingly thin. This is one of the clearest supply constraints in Indian fintech leadership hiring.
Do not run it as a legal hire. Compliance and legal are adjacent and distinct. A general counsel is not automatically a CCO candidate, and treating the search as a legal search surfaces the wrong shortlist.
The other mandated appointments are the Chief Risk Officer and the CISO. For brokers and investment advisers the equivalent obligations sit under SEBI rather than the RBI, covered in hiring a Compliance Officer or Principal Officer under SEBI.
Common questions
Which NBFCs must appoint a Chief Compliance Officer?
Those in the Upper Layer and Middle Layer under the RBI's scale-based regulation. The requirement applied from 1 April 2023 for Upper Layer entities and 1 October 2023 for Middle Layer. Base Layer NBFCs continue under the earlier guidance, though a growing Base Layer entity should plan for the transition rather than be surprised by it.
Can the CCO also be the company secretary, general counsel or head of legal?
Only where no conflict of interest arises, and in most fintech structures a conflict does arise. The framework prohibits dual-hatting on that basis. Legal advises the business on what it may do; compliance assures the board that what the business does is within the rules. Combining them puts one person on both sides.
Should the CCO and MLRO be the same person?
At moderate scale, frequently yes, and it is common practice. The pressure point is that MLRO work is operational with hard deadlines while CCO work is governance-led, so at volume the operational side crowds out the strategic side. Backlogged alert queues or stale monitoring thresholds are the usual signal that the roles need separating.
What qualifications does the RBI require?
The framework is principles-based rather than prescriptive: a good understanding of the industry and of risk management practices, knowledge of regulations and legal requirements, a clean track record and unquestionable integrity, and the ability to exercise independent judgement. It does not specify a minimum age or number of years, which gives boards more latitude on the person and less on the structure.
Can the three-year tenure be shortened?
The board may reduce it by one year in exceptional circumstances, with appropriate succession planning. It is not a term to be negotiated down casually at offer stage, and a candidate asked to accept a shorter commitment will reasonably ask what the company expects to go wrong.