Legally researched and updated: 6 October 2026

NBFC Not Registered on FINnet 2.0: What Does FIU-IND's 2026 Non-Compliant List Mean and What Should the Entity Do Next?

Create a current NBFC compliance article around FIU-IND's 2026 publication of non-compliant NBFCs that have not fulfilled registration obligations on FINnet 2.0. Explain the difference between being named for registration non-compliance and being accused of money laundering, the immediate governance steps, portal registration, Principal Officer and Designated Director verification, historical reporting review and potential Section 13 exposure.

Legal research and analysis by Advocate Ankit Kumar Singh .

Direct Answer: Being on the FIU-IND List Does Not Mean the NBFC Has Been Found Guilty of Money Laundering

FIU-IND's 2026 publication is specifically described as a:

LIST OF NON-COMPLIANT NBFCs WHICH HAVE NOT FULFILLED THEIR OBLIGATION UNDER THE PML ACT AND RULES RELATING TO REGISTRATION ON FINnet 2.0.

That is a serious compliance issue.

But it must not be inaccurately converted into a statement that:

  • the NBFC has committed money laundering;
  • the NBFC is an accused in an ECIR;
  • its directors have committed a scheduled offence;
  • the Enforcement Directorate has prosecuted it;
  • the company has been convicted under Section 3 PMLA;
  • all its customers are suspicious; or
  • every transaction conducted by the NBFC is unlawful.

The published deficiency is:

REGISTRATION NON-COMPLIANCE.

Any additional allegation requires its own factual and legal basis.

Why Is an NBFC a PMLA Reporting Entity?

Section 2(1)(l) PMLA expressly includes:

A NON-BANKING FINANCIAL COMPANY

within the statutory definition of:

FINANCIAL INSTITUTION.

Section 2(1)(wa) then defines:

REPORTING ENTITY

to include a financial institution.

Therefore the statutory chain is:

NBFC → FINANCIAL INSTITUTION → REPORTING ENTITY → CHAPTER IV PMLA OBLIGATIONS.

This is fundamentally different from sectors such as some designated businesses that first require a specific notification/threshold analysis.

What Exactly Did FIU-IND Publish in 2026?

FIU-IND published updated non-compliant NBFC lists during 2026 including:

  • 28 February 2026;
  • 30 June 2026;
  • 17 August 2026.

The latest publication identified during this update is:

17 AUGUST 2026.

Accordingly, an NBFC should search the latest official publication rather than rely upon an earlier downloaded version.

February 2026 Snapshot

The February publication stated:

  • 8,560 RBI-registered Base Layer NBFCs;
  • 564 Middle Layer NBFCs;
  • 11 Upper Layer NBFCs;
  • 3,910 Base Layer NBFCs not registered on FINnet 2.0; and
  • 102 Middle Layer NBFCs not registered.

June 2026 Snapshot

The 30 June publication used RBI data as of 31 March 2026 and stated:

  • 8,286 Base Layer NBFCs;
  • 536 Middle Layer NBFCs;
  • 12 Upper Layer NBFCs;
  • 3,548 Base Layer NBFCs not registered; and
  • 67 Middle Layer NBFCs not registered.

That represented:

3,615

Base + Middle Layer NBFCs in the June list.

But that number must not be described as the current October 2026 figure because FIU subsequently issued the 17 August 2026 update.

Why Does FIU-IND Call Registration Non-Compliance a Serious AML/CFT Risk?

FIU explains that an unregistered NBFC remains outside the functioning FIU reporting architecture.

That matters because FIU-IND depends upon reporting entities for information concerning prescribed transactions.

FIU's own publication states that non-registration can deprive the financial-intelligence system of transaction data relevant to identifying:

  • suspicious activity;
  • money-laundering risk; and
  • terrorist-financing risk.

The correct interpretation is:

REGISTRATION FAILURE CREATES AML/CFT SYSTEM VULNERABILITY.

It does not establish:

PROVED MONEY LAUNDERING.

FINnet 2.0 Registration Has Three Separate Stages

FIU-IND's own 2026 NBFC publication expressly identifies:

  1. registration of the entity;
  2. registration of the Principal Officer;
  3. registration of the Designated Director.

All three stages must be:

COMPLETED STEP BY STEP.

FIU further states that the reporting entity can start filing reports only:

AFTER COMPLETION OF ALL THREE STAGES.

This Means the Following May Still Be Incomplete

  • entity profile exists but PO is pending;
  • entity and PO exist but DD is pending;
  • PO application was initiated but not approved;
  • DD details are outdated;
  • name/CIN details do not reconcile;
  • earlier user access exists but full enrolment was never completed;
  • portal application remains under validation; or
  • the entity has never completed registration.

Therefore:

“WE HAVE A FINnet LOGIN” IS NOT A COMPLETE LEGAL ANSWER.

Principal Officer: Verify the Real Governance Position

Under the PML framework and RBI's KYC Directions, the Principal Officer is responsible for functions including:

  • AML compliance;
  • transaction monitoring;
  • sharing information;
  • furnishing prescribed reports;
  • internal escalation; and
  • liaison concerning FIU reporting.

Immediately verify:

  • name of Principal Officer;
  • designation;
  • appointment date;
  • Board / management approval;
  • FIU communication date;
  • RBI communication where applicable;
  • FINnet registration status;
  • email/mobile details;
  • portal access;
  • historic change of PO;
  • vacancy periods;
  • actual authority;
  • access to transaction-monitoring information; and
  • responsibility for historical FIU reports.

Do not appoint a person retrospectively and pretend that the appointment existed during an earlier period.

Designated Director: Overall Chapter IV Compliance

The Designated Director is responsible for:

OVERALL COMPLIANCE WITH CHAPTER IV OF THE PMLA.

For a company, the definition under the PML Rules ordinarily refers to a Managing Director or whole-time Director duly authorised by the Board, subject to the applicable legal structure and current Rules.

The NBFC should verify:

  • Board nomination;
  • effective date;
  • correct legal designation;
  • FIU communication;
  • RBI communication;
  • FINnet status;
  • governance reporting;
  • AML risk oversight;
  • policy approval/oversight;
  • remediation supervision; and
  • change history.

Principal Officer Cannot Simply Be Treated as the Designated Director

The RBI KYC framework states:

IN NO CASE SHALL THE PRINCIPAL OFFICER BE NOMINATED AS THE DESIGNATED DIRECTOR.

Therefore a portal correction must match the actual governance structure.

Immediate Action If Your NBFC Is Named on the 2026 List

  1. Confirm the exact latest FIU list. Do not rely on a February or June screenshot when the August list exists.
  2. Search by legal name and CIN. Name changes can create confusion.
  3. Verify RBI CoR status. Confirm whether registration is active, surrendered, cancelled or otherwise changed.
  4. Verify layer. Confirm Base, Middle, Upper or other current RBI classification.
  5. Check FINnet entity enrolment.
  6. Check Principal Officer enrolment.
  7. Check Designated Director enrolment.
  8. Identify the exact incomplete stage.
  9. Escalate internally. Place the matter before the appropriate senior management / Board / committee.
  10. Complete portal remediation.
  11. Preserve every portal acknowledgement.
  12. Open a historical reporting review.
  13. Review historic KYC/AML controls.
  14. Prepare an evidence-based remediation note.

What If the NBFC Is Dormant, Has No Customers or Has Very Little Business?

The registration question and transaction-reporting question are different.

FIU's 2026 publication states:

ALL NBFCs ARE REQUIRED TO COMPLETE REGISTRATION ON FINnet 2.0.

Therefore an entity should not simply state:

“We had no significant business, therefore registration was unnecessary.”

Instead distinguish:

Question 1

Was FINnet registration required?

Question 2

During the relevant period, did any transaction actually require a prescribed FIU report?

It is possible that:

REGISTRATION WAS REQUIRED

while:

NO PARTICULAR REPORTABLE TRANSACTION OCCURRED IN A SPECIFIC PERIOD.

That conclusion must be supported by records.

Historical Reporting Review: Registration Is Only the First Remediation Step

Once registration is completed, conduct a retrospective Rule 3 review.

Create a year-wise or month-wise matrix:

Period Transaction Category Report Required? Due Date Filed? Current Action
_____ CTR Yes / No _____ _____ _____
_____ Connected cash Yes / No _____ _____ _____
_____ NTR Yes / No _____ _____ _____
_____ CBWTR Yes / No _____ _____ _____
_____ STR Yes / No _____ _____ _____

The review should reconcile:

  • loan disbursements;
  • loan repayments;
  • cash receipts;
  • bank statements;
  • ledger;
  • customer master;
  • NPO transactions;
  • international transactions where relevant;
  • alerts;
  • fraud cases;
  • restructured accounts;
  • written-off accounts;
  • third-party payments;
  • high-risk customers;
  • sanctions/PEP results; and
  • existing FIU acknowledgements.

STR Look-Back: Do Not Convert Remediation Into Mechanical Filing

The absence of FINnet registration may mean that historical STR reporting requires review.

But:

DO NOT BULK-FILE STRs WITHOUT APPLYING THE SUSPICIOUS-TRANSACTION TEST.

For each historic alert or potentially suspicious event, analyse:

  • customer profile;
  • beneficial owner;
  • source of funds;
  • loan purpose;
  • repayment source;
  • third-party funding;
  • cash pattern;
  • account behaviour;
  • fraud indicators;
  • identity inconsistencies;
  • linked accounts;
  • mule-account indicators;
  • shell-company concerns;
  • unusual complexity;
  • economic rationale;
  • criminal-proceeds indicators;
  • TF/PF concerns; and
  • attempted suspicious transactions.

Document:

ALERT → FACTS → ANALYSIS → PRINCIPAL OFFICER DECISION → STR OR DOCUMENTED CLOSURE.

Do Not Backdate the Remediation

If the NBFC discovers a genuine historic gap:

FIX IT NOW.

But do not create false historical records.

Do not backdate:

  • FINnet registration;
  • Principal Officer appointment;
  • Designated Director appointment;
  • Board approval;
  • AML/KYC policy;
  • risk assessment;
  • KYC review;
  • transaction-monitoring report;
  • alert review;
  • STR decision;
  • sanctions screening;
  • training;
  • internal audit; or
  • compliance certification.

Instead state:

HISTORICAL POSITION AS IT ACTUALLY EXISTED

and separately:

CURRENT-DATED CORRECTIVE ACTION.

What If the NBFC Believes Its Inclusion in the List Is Outdated or Incorrect?

Do not start with accusation.

Start with reconciliation.

Possible Issues to Check

  • registration completed after the list cutoff;
  • FINnet stage 1 complete but stage 2/3 incomplete;
  • old PO still reflected;
  • DD registration missing;
  • entity name changed;
  • CIN mismatch;
  • RBI CoR surrendered;
  • RBI CoR cancelled;
  • merger/amalgamation;
  • entity converted/restructured;
  • portal validation pending;
  • data-sync timing issue; or
  • genuine FIU registration deficiency.

Prepare an Evidence Pack

  • RBI Certificate of Registration;
  • RBI status communication;
  • MCA master data;
  • CIN;
  • name-change certificate;
  • Board resolution;
  • PO appointment;
  • DD nomination;
  • FINnet screenshots;
  • registration acknowledgement;
  • portal reference;
  • FIU correspondence;
  • support tickets;
  • email trail; and
  • chronology.

Then request status correction / clarification through the proper FIU channel if the evidence supports it.

Section 12A and Section 13: What Can Happen After Registration Non-Compliance?

The public list itself is not a final Section 13 penalty order.

However, registration failure can become relevant to a wider compliance inquiry.

Section 12A

The Director may call for:

  • client/KYC records;
  • transaction records;
  • beneficial-owner information;
  • additional information considered necessary; and
  • other statutory records within the Section 12A framework.

Section 13

The Director can inquire into Chapter IV obligations.

If failure is established, Section 13(2) permits:

  • written warning;
  • specific directions;
  • directions to send periodic remedial reports; or
  • monetary penalty from ₹10,000 to ₹1,00,000 for each failure.

Potential issues in an NBFC case may include:

  • failure to register;
  • failure to register PO;
  • failure to register DD;
  • missed transaction reports;
  • delayed reports;
  • deficient KYC/CDD;
  • deficient beneficial-owner verification;
  • inadequate transaction monitoring;
  • missed STR;
  • inadequate records;
  • poor governance;
  • failure to answer FIU requests; or
  • inaccurate remediation representations.

Do not assume that every one of these exists merely because the NBFC appears on the registration list.

NBFC FINnet 2.0 Remediation Flowchart

An NBFC named for FINnet registration non-compliance should first verify the listing and complete all three registration stages, then separately reconstruct historical reporting and AML-control obligations.

A Practical 15-Point Remediation Pack

  1. Latest FIU list verification sheet.
  2. RBI NBFC status note.
  3. MCA/CIN reconciliation.
  4. Entity-registration evidence.
  5. Principal Officer file.
  6. Designated Director file.
  7. Board escalation / remediation note.
  8. FINnet/FINGate screenshots and acknowledgements.
  9. Historical reporting matrix.
  10. STR look-back methodology.
  11. CDD/beneficial-owner gap analysis.
  12. Transaction-monitoring review.
  13. Current AML/KYC policy and risk assessment.
  14. Corrective-action tracker with owners and dates.
  15. Evidence of testing and open exceptions.

Frequently Asked Questions

1. Does appearing on FIU-IND's non-compliant NBFC list mean the company committed money laundering?

No. The 2026 list expressly concerns failure to fulfil registration obligations on FINnet 2.0. That compliance status is not, by itself, a finding of an offence under Section 3 PMLA.

2. Is an NBFC automatically a PMLA reporting entity?

An NBFC is expressly included within the PMLA definition of financial institution, and a financial institution is a reporting entity under Section 2(1)(wa).

3. What is the latest 2026 FIU non-compliant NBFC list?

The latest official publication identified in this research is dated 17 August 2026.

4. Why were there several lists in 2026?

FIU published updated snapshots on 28 February, 30 June and 17 August 2026. Registration/status data can therefore change between lists.

5. How many stages does FINnet registration require?

Three: entity registration, Principal Officer registration and Designated Director registration.

6. Can reports be filed after entity registration alone?

FIU's NBFC publication states that reporting entities can start filing reports only after all three stages are completed.

7. Can the Principal Officer and Designated Director be the same person?

The RBI KYC framework states that the Principal Officer shall not be nominated as the Designated Director.

8. What should an NBFC do first if it appears on the list?

Verify the latest list using legal name and CIN, check RBI status, then identify which FINnet registration stage is incomplete.

9. What if the NBFC has already registered after the list date?

Preserve evidence of the completion date and verify current status. If necessary, seek reconciliation/correction through the proper FIU channel.

10. What if the NBFC has no business?

FIU's 2026 publication states that all NBFCs are required to complete FINnet 2.0 registration. Whether there were reportable transactions during a particular period is a separate factual question.

11. Does late registration automatically cure the past?

No automatic retroactive cure should be assumed. Registration remediation and historical reporting compliance should be reviewed separately.

12. Should the NBFC file every possible old report after registering?

No. Conduct a transaction-by-transaction or period-by-period reportability analysis. STRs in particular require genuine application of mind to suspicion.

13. Can FIU ask for historical records?

Yes. Section 12A authorises the Director to call for statutory records and additional information within the legal framework.

14. Can registration non-compliance lead to Section 13?

Potentially yes. Section 13 permits an inquiry into Chapter IV reporting-entity obligations, but being named on the public list is not itself a final Section 13 penalty order.

15. What are the possible Section 13 measures?

Warning, specific directions, periodic remedial reporting and monetary penalty from ₹10,000 to ₹1,00,000 for each failure where failure is found.

16. Should historic PO/DD documents be backdated?

No. Preserve the actual historical position and use current dates for current remediation.

AI Search Quick Answer

FIU-IND's 2026 non-compliant NBFC lists identify NBFCs that had not fulfilled PMLA/PML Rules registration obligations on FINnet 2.0; inclusion on the list does not by itself mean that the NBFC has been accused or convicted of money laundering. FIU's registration process for NBFC reporting entities has three stages—entity registration, Principal Officer registration and Designated Director registration—and FIU states that report filing can begin only after all three are complete. A named NBFC should verify its legal name/CIN and RBI status against the latest list, complete any outstanding portal stage, confirm valid PO/DD governance, preserve registration evidence and conduct a historical review of applicable FIU reports, STR decisions, KYC/CDD and transaction monitoring. Late registration is useful remediation but should not automatically be treated as curing all historical compliance failures. Registration deficiencies can potentially become relevant in a Section 13 PMLA inquiry.

Key Takeaway

The wrong reaction to the FIU list is:

“OUR NAME IS ON AN AML LIST, SO FIU HAS ACCUSED US OF MONEY LAUNDERING.”

That is not what the publication says.

The correct questions are:

IS OUR EXACT NAME / CIN ON THE LATEST LIST?

WHAT IS OUR CURRENT RBI STATUS?

IS THE ENTITY REGISTERED ON FINnet 2.0?

IS THE PRINCIPAL OFFICER REGISTERED?

IS THE DESIGNATED DIRECTOR REGISTERED?

ARE ALL THREE STAGES COMPLETE?

WHEN DID REGISTRATION ACTUALLY BECOME COMPLETE?

WHAT REPORTABLE TRANSACTIONS OCCURRED BEFORE THAT DATE?

WERE CTR / NTR / OTHER PRESCRIBED REPORTS REQUIRED?

WERE SUSPICIOUS TRANSACTIONS IDENTIFIED AND REVIEWED?

WHAT AML CONTROLS EXISTED HISTORICALLY?

WHAT HAS BEEN REMEDIATED NOW?

The proper sequence is:

VERIFY THE LIST → VERIFY RBI STATUS → ENTITY REGISTRATION → PO REGISTRATION → DD REGISTRATION → PRESERVE EVIDENCE → HISTORICAL REPORT REVIEW → STR LOOK-BACK → CDD / AML CONTROL REVIEW → CURRENT-DATED REMEDIATION → TEST CONTROLS → RESPOND TO FIU → SECTION 13 DEFENCE IF REQUIRED.

Professional Legal Review and Coordination

Advocate Ankit Kumar Singh undertakes legal research and regulatory-response work concerning NBFC reporting-entity obligations, FINnet/FINGate registration deficiencies, Section 12A information requests and Section 13 proceedings depending upon the facts, regulatory status and accepted professional engagement.

An NBFC compliance/remediation review may include:

  • FIU non-compliant-list verification;
  • CIN/name reconciliation;
  • RBI registration-status review;
  • NBFC layer verification;
  • FINnet entity registration;
  • Principal Officer status;
  • Designated Director status;
  • Board-governance review;
  • historic reporting chronology;
  • CTR review;
  • NTR review;
  • CBWTR review where applicable;
  • STR look-back;
  • CDD/KYC review;
  • beneficial-owner review;
  • customer-risk framework;
  • transaction-monitoring review;
  • AML policy review;
  • sanctions/PEP controls;
  • portal correspondence;
  • remediation tracker;
  • Section 12A response;
  • Section 13 show cause response;
  • personal-hearing preparation; and
  • Section 26 appellate strategy where applicable.

Advocate Ankit Kumar Singh
Supreme Court of India | Patna High Court | Allahabad High Court at Prayagraj | Jharkhand High Court at Ranchi | Calcutta High Court | Delhi High Court and Delhi Courts/Tribunals | Matters concerning Bhopal, Madhya Pradesh | Multiple District Courts

Phone: 8294431232
Email: ankitsingh.legum@gmail.com
Website: advocateankitkumarsingh.in

Professional engagement depends upon the NBFC's actual RBI status, FINnet registration status, reporting history, transaction profile and procedural stage. No delisting, Section 13 closure, warning-only outcome or penalty result can be guaranteed.

Official Sources

Add Advocate Ankit Kumar Singh as a Preferred Source on Google

Readers who want to see more legal research, court updates, cyber law, PMLA, ED, criminal-law and litigation content from Advocate Ankit Kumar Singh can add advocateankitkumarsingh.in as a Preferred Source on Google.

Add advocateankitkumarsingh.in as a Preferred Source on Google

Conclusion

FIU-IND's 2026 non-compliant NBFC publication should be taken seriously—but interpreted accurately.

It identifies a failure relating to:

FINnet 2.0 REGISTRATION COMPLIANCE.

It does not, merely by naming the company, establish:

MONEY LAUNDERING, PROCEEDS OF CRIME, AN ECIR, OR CRIMINAL GUILT.

The correct response is not panic.

It is:

VERIFY + REGISTER + RECONCILE + REVIEW HISTORY + REMEDIATE + TEST + DOCUMENT.

The NBFC should know precisely:

WHEN ENTITY REGISTRATION WAS COMPLETED,
WHEN THE PO WAS REGISTERED,
WHEN THE DD WAS REGISTERED,
WHICH REPORTS WERE REQUIRED HISTORICALLY,
WHICH REPORTS WERE FILED,
WHICH STR DECISIONS WERE MADE,
WHICH AML CONTROLS EXISTED,
WHICH DEFICIENCIES ARE REAL,
AND WHAT HAS NOW BEEN CORRECTED.

That creates a defensible regulatory position if the issue progresses from:

PUBLIC REGISTRATION LIST

to:

FIU INFORMATION REQUEST OR SECTION 13 COMPLIANCE PROCEEDING.

Professional / Legal Disclaimer: This article provides general legal and regulatory information concerning FIU-IND's 2026 publication of NBFCs described as non-compliant in relation to FINnet 2.0 registration. Inclusion in such a publication should not, without additional facts, be described as a finding that the NBFC or its officers committed the offence of money laundering. The entity's current position depends upon its RBI registration, CIN/legal name, latest FIU list, completion of the entity/Principal Officer/Designated Director registration stages, actual transaction history and current PMLA/PML Rules/RBI KYC requirements. Historical reportability must be analysed transaction by transaction. A live FIU or Section 13 matter should be reviewed from the actual notice, portal record and complete compliance history.