A statutory-compliance register connects a legal entity's identity, permissions and obligations with the people responsible for maintaining them. It should answer practical questions: what may this entity do, under which authority, subject to which conditions, and what evidence shows that continuing requirements are met?
Banks and NBFCs can operate within several overlapping frameworks. Corporate records, regulatory registration, activity permissions, local requirements, contractual obligations and listing-related duties may involve different owners. A folder containing certificates does not provide a complete view of those relationships.
An effective register preserves the underlying legal documents while translating relevant conditions into reviewable operational tasks. It also distinguishes a genuine renewal requirement from an ongoing condition or an event-driven obligation. This article describes that operating approach, rather than a comprehensive legal checklist for every lender.
Establish a reliable legal-entity record
Begin with the legal name, registration identifiers, registered office, entity type and relevant group relationships. Record the source and date of important facts. Commercial brand names should not replace the legal identity used for contracts, regulatory permissions and filings.
Changes to these facts may create obligations elsewhere. A name change, office move, acquisition or alteration of business activity can affect records maintained by several authorities or counterparties. The entity record should therefore connect to change and obligation workflows.
Control who can update core facts. An incorrect identifier can propagate into returns, customer documents and agreements. Significant changes should be supported by authoritative evidence and reviewed before they become the default across systems.
Separate registration from permission to conduct an activity
A registration or licence establishes a particular legal status or permission. It should not be interpreted more broadly than its terms and the applicable law allow. A regulated entity may need additional assessment before launching a new activity or changing how an existing activity is conducted.
RBI's NBFC registration and scale-based-regulation directions provide an institution-specific reference for registration, exemptions and the regulatory framework. [3] Banks have their own licensing and activity-related requirements, accessible through the RBI directions directory. [1]
Record permissions at a useful level of detail. Include the issuing authority, relevant entity, scope, conditions and supporting documents. Where an activity relies on an exemption or another legal basis, retain the reasoning and review triggers rather than leaving the permission field blank.
Build a register that captures conditions
Useful fields include the instrument identifier, issue date, scope, conditions, owner, applicable review or expiry date and evidence location. Add linked obligations where the instrument requires reporting, notification, approval or continuing compliance.
Do not invent annual renewal tasks for permissions that do not require them. Distinguish expiry, scheduled review, periodic filing and ongoing conditions. Confusing these concepts can waste effort while leaving the actual obligation unmanaged.
Read the operative document and relevant current rules. A certificate's front page may not contain every condition. Correspondence, annexures or subsequent directions may affect the institution's responsibilities. Keep those relationships visible in the register.
Assign ownership across functions
Legal and company secretarial teams may interpret or maintain certain records, while operations, finance, risk or business teams perform the related actions. Assign one accountable owner for each obligation and identify contributors and approvers.
The central register owner should maintain quality and completeness, but should not automatically become responsible for every underlying task. An employment-related filing and a regulatory activity condition may require different expertise and evidence.
Establish a handover process when owners change. Open applications, unresolved conditions and upcoming deadlines should transfer with their history. A register that depends on a particular employee's memory is vulnerable even if every document is technically stored somewhere.
Connect new business decisions to permission checks
Product development and expansion should include an assessment of legal entity, permitted activity and required approvals or notifications. Perform it early enough to influence design. A late legal review can identify a restriction after commercial commitments have already been made.
Record the assessed proposal and its assumptions. An approval based on one customer group or distribution method may not cover a later change. The business should know which changes require reassessment.
Use clear outcomes: permitted within existing scope, permitted subject to stated conditions, further approval required or not supported by the assessed basis. An ambiguous “legal reviewed” status gives operational teams little guidance about what they may actually do.
A worked example: opening a new service location
Suppose a hypothetical lender plans to open a new location. The project team focuses on premises, staffing and systems. A compliance review then assesses whether the proposed location and activities engage regulatory, corporate, local or contractual requirements.
The register links each applicable obligation to its owner and evidence. Some actions may need completion before operations begin; others may be notifications or ongoing conditions. The exact requirements depend on the entity and circumstances and should not be assumed from another institution's experience.
The final readiness decision should identify any unresolved dependency. A signed lease and a functioning office do not establish that every required permission or condition has been addressed. Conversely, the process should avoid demanding irrelevant approvals merely because they appeared in an old checklist.
Control applications, acknowledgements and approvals
An application submitted to an authority is not the same as an approval received. Keep distinct statuses for preparation, submission, acknowledgement, queries, approval, rejection and withdrawal where relevant. Record the actual evidence supporting each status.
Track authority queries and the institution's responses. Preserve the version submitted and any revised materials. If conditions are imposed, translate them into owned actions rather than leaving them only in the approval letter.
Be precise about what an acknowledgement means. It may confirm receipt without confirming substantive acceptance. The register should not infer permission from silence or a portal receipt unless the applicable framework supports that conclusion.
Manage event-driven legal and statutory obligations
Many obligations arise from events rather than fixed calendar dates. Changes in ownership, key appointments, capital structure, business scope or listing status can trigger assessment. Establish how those events reach the relevant specialists promptly.
Record the event date and the date the institution became aware of it. These may matter to the applicable timing rule. The owner should identify the actual requirement, calculate the deadline on an approved basis and retain the reasoning.
For listed entities or listed instruments, assess relevant SEBI obligations through the current regulations and applicable scope. [2] Do not assume that all listing-related requirements apply identically to equity-listed, debt-listed and unlisted institutions.
Maintain evidence without losing legal context
A useful evidence repository preserves original documents, approved interpretations, submissions and correspondence. Use identifiers that connect them to the relevant entity and obligation. Avoid filenames that reveal little beyond “final” or “latest”.
Restrict sensitive legal material appropriately. Management may need to know that a matter is pending without receiving privileged advice or personal information. Summarise status through controlled reporting while retaining access for authorised reviewers.
Preserve historical versions. A current permission or entity profile may differ from the one applicable when a transaction occurred. The institution should be able to explain the position at that earlier time without reconstructing it from scattered correspondence.
Reconcile records after a legal-entity change
A merger, name change or internal reorganisation can leave different systems referring to different legal identities. Build a change inventory covering regulatory records, contracts, bank accounts, customer documents, reporting profiles and authorised signatories where relevant.
For each item, establish whether an update, notification, consent or approval is required under the applicable terms and law. Do not assume that a corporate filing automatically updates every other relationship. Conversely, do not treat a brand change as proof that the legal entity changed.
Preserve effective dates and evidence of completion. Transactions around the change date may need explanation, especially where operational migration occurs later than legal effectiveness. Staff should know which identity to use during the transition.
A post-change reconciliation can identify missed records. Compare the approved legal position with the names, identifiers and permissions actually used in operational systems. Assign any differences to an owner and confirm their correction. This turns a complex organisational event into a controlled set of verifiable updates.
Review completeness and continuing conditions
Periodically reconcile the register with legal-entity records, business activities, official communications and material organisational changes. Ask whether every significant activity has a supported legal basis and whether every continuing condition has an owner.
Test a sample of obligations end to end. Can the reviewer locate the source, understand applicability, identify the responsible person and verify completion? Missing evidence or unclear scope should create a specific corrective action.
A statutory register is most useful when it serves as a maintained map of authority and responsibility. It connects the institution's legal position with operational decisions, helps teams identify when reassessment is needed and preserves evidence of how obligations were handled over time.
PRIMARY REFERENCES
Sources & further reading
Primary-source references checked on 12 October 2026. Follow the relevant authority’s current text for applicability, amendments and commencement dates. International standards provide context and are not automatically identical to domestic requirements.