CARO 2020 Clause 3(xvi) is often reduced to a single question: does the company have an RBI registration certificate? That is incomplete. The clause has four distinct reporting limbs covering registration under section 45-IA of the Reserve Bank of India Act, unregistered Non-Banking Financial or Housing Finance activity, Core Investment Company status, and the number of CICs in the group. ICAI’s Guidance Note on CARO 2020 (Revised 2022) sets out these four limbs and the related audit procedures.
What Clause 3(xvi) asks the auditor to report
- Clause 3(xvi)(a): whether the company is required to be registered under section 45-IA of the RBI Act and, if so, whether registration has been obtained.
- Clause 3(xvi)(b): whether the company has conducted any Non-Banking Financial or Housing Finance activity without a valid Certificate of Registration from RBI.
- Clause 3(xvi)(c): whether the company is a Core Investment Company under RBI regulations and, if so, whether it continues to satisfy the CIC criteria; this also covers exempted or unregistered CICs.
- Clause 3(xvi)(d): whether the group has more than one CIC and, if yes, the number of CICs in the group.
The practical implication is important: a clean answer to one limb does not automatically answer the others. An auditor should document each limb separately.
Step 1: Understand the company’s real financial activity
Start with the business model, not the legal name or objects clause. Review the latest financial statements, trial balance, loan and investment schedules, interest and finance income, borrowing profile, board papers, product descriptions and significant contracts. ICAI’s guidance says the auditor should obtain sufficient knowledge of the company’s business and the nature of its revenues and assets to determine whether it is conducting non-banking financial or housing finance activities.
A company may hold investments, make an occasional group loan or earn interest without automatically reaching the same regulatory conclusion as a company whose principal business is financial activity. The audit file should therefore contain the factual basis for the regulatory assessment rather than a bare management representation.
Step 2: Test whether RBI registration is required and whether the CoR exists
For Clause 3(xvi)(a), document why section 45-IA registration is or is not required. Where registration is required, obtain and inspect the RBI Certificate of Registration and reconcile the legal name and entity details to the company being audited. If management states that registration is not required, retain the computation, business analysis and regulatory basis supporting that conclusion.
Clause 3(xvi)(b) is a separate check. Even if the registration analysis under sub-clause (a) has been performed, the auditor still needs to consider whether the company actually conducted Non-Banking Financial or Housing Finance activities without a valid CoR during the period. ICAI expressly describes this sub-clause as an extension of 3(xvi)(a).
Step 3: Perform a separate CIC test
The RBI Core Investment Companies Directions, 2016, updated on the RBI page as of 1 August 2025, set out the portfolio conditions used for CIC analysis. Among other conditions, the company must hold at least 90% of its net assets in specified investments, debt or loans in group companies, and qualifying equity exposure in group companies plus permitted sponsor holdings in InvIT units must constitute at least 60% of net assets. The Directions also restrict trading in group-company investments and limit other financial activity to specified categories.
Do not confuse CIC characteristics with registration requirement. The current RBI Directions state that CICs with asset size below ₹100 crore are not required to register irrespective of access to public funds. They also state that CICs with asset size of ₹100 crore or more that do not access public funds are not required to register; these are termed Unregistered CICs. An unregistered CIC with asset size above ₹100 crore that accesses public funds without obtaining a CoR would violate the Directions.
This distinction matters under CARO because Clause 3(xvi)(c) specifically asks about exempted or unregistered CICs as well. The auditor should therefore test whether the entity continues to satisfy the criteria relevant to its status rather than stopping merely because no RBI certificate is expected.
Worked illustration: why “no CoR” does not end the analysis
Assume a holding company has total assets below ₹100 crore and its portfolio otherwise satisfies the applicable CIC investment conditions. The RBI Directions say a CIC below the ₹100 crore asset-size threshold need not register, irrespective of public-fund access. The correct audit approach is not to conclude that “the company is not a CIC because it has no CoR.” Instead, the auditor should separately document the CIC criteria, the basis for non-registration, and the reporting conclusion under Clause 3(xvi)(c).
Now assume the asset size is ₹100 crore or more. The registration analysis must also consider whether the company accesses public funds within the RBI definition. The RBI Directions define public funds broadly to include, among other sources, public deposits, inter-corporate deposits, bank finance, commercial paper and debentures, subject to the stated exclusions. This is why the borrowing schedule and funding agreements belong in the CARO workpaper.
Step 4: Build a group-wide CIC matrix
Clause 3(xvi)(d) is a group-level question. ICAI’s guidance says the auditor should obtain the list of companies in the group, obtain management representation about CICs in the group including exempt and unregistered CICs, and corroborate the information to the extent possible. If there is more than one CIC, the auditor reports the number of CICs in the group.
A practical matrix can contain the entity name, relationship to the group, total assets, relevant group-company investments and loans, qualifying equity exposure, public-fund status, RBI registration status and the conclusion on CIC classification. The purpose is not to replace regulatory analysis with a spreadsheet; it is to make the population complete and the reasoning reviewable.
Audit evidence checklist for Clause 3(xvi)
- Business and revenue analysis: financial statements, trial balance, revenue streams and operating model.
- Loan and investment schedules: counterparty, group relationship, instrument type and carrying amount.
- Borrowing and funding records: bank facilities, debentures, inter-corporate deposits, commercial paper and other relevant funding.
- RBI evidence: CoR where applicable, filings, correspondence and any registration application or regulatory communication.
- Group structure: entity chart, related-party information and management’s list of CICs across the group.
- CIC computation: net-asset composition, 90% test, 60% test and other conditions in the current RBI Directions.
- Management representation: use it as supporting evidence, not as a substitute for corroboration and the auditor’s own analysis.
Common mistakes to avoid
- Checking only whether an RBI CoR is physically available and ignoring the underlying registration requirement.
- Treating 3(xvi)(a) and 3(xvi)(b) as the same test.
- Assuming that an entity without a CoR cannot be a CIC.
- Applying the ₹100 crore figure without separately considering public-fund access where the threshold is relevant.
- Testing only the audited company and missing the group-wide CIC count required by 3(xvi)(d).
- Using a generic “investment company” label instead of testing the current RBI definition and conditions.
Practical takeaway
A robust CARO 2020 Clause 3(xvi) file should answer four questions in sequence: is RBI registration required, was any NBFC or HFC activity carried on without a valid CoR, does the company satisfy the CIC criteria including any unregistered-CIC conditions, and how many CICs exist in the group. Using separate workpapers for registration, activity, CIC classification and group mapping makes the conclusion easier to support and review.
