RBI Penalises Progfin Private Limited ₹2.70 Lakh Over KYC Risk-Review Lapse

The Reserve Bank of India has imposed a monetary penalty of ₹2.70 lakh on Progfin Private Limited for non-compliance with provisions of the RBI's Know Your Customer Directions. The enforcement release was published on 21 August 2026, while the underlying RBI order imposing the penalty is dated 19 August 2026.

What RBI found

According to the central bank, the action followed a statutory inspection of the company with reference to its financial position as on 31 March 2025. RBI said the company had failed to put in place a system for periodic review of the risk categorisation of customer accounts. The regulator specifically noted that such review was required to be carried out at least once every six months.

The finding is important because KYC compliance is not limited to customer onboarding. Regulated entities are expected to maintain continuing controls that keep customer risk classifications current and ensure that review cycles are actually embedded in their systems and processes.

How the enforcement process unfolded

RBI said a notice was issued to the company asking why a penalty should not be imposed for failure to comply with the relevant directions. After considering the company's reply and oral submissions made during a personal hearing, the regulator concluded that the charge was sustained and warranted monetary penalty.

The penalty was imposed under section 58G(1)(b) read with section 58B(5)(aa) of the Reserve Bank of India Act, 1934.

What compliance teams should take from the order

For NBFCs and other RBI-regulated entities, the order is a useful reminder that a written KYC policy is not sufficient by itself. The control environment should demonstrate that customer risk categorisation is reviewed at the prescribed frequency, that responsibility for the review is assigned, and that the institution can evidence completion of those reviews during inspection.

Internal audit and compliance teams may therefore want to test whether risk-review triggers, periodicity, exception reporting and audit trails are functioning as designed rather than relying only on policy documents.

Penalty does not invalidate customer transactions

RBI clarified that the action is based on deficiencies in regulatory compliance and is not intended to pronounce on the validity of any transaction or agreement entered into by the company with its customers. The central bank also said the monetary penalty is without prejudice to any other action that it may initiate against the company.

Useful official links

RBI imposes monetary penalty on Progfin Private Limited

Key takeaway

The Progfin order turns a relatively specific KYC obligation into a practical control lesson: regulated entities should be able to demonstrate a functioning system for periodic customer-risk review, not merely a policy requiring one. For finance, compliance and internal-audit teams, the six-month review expectation highlighted by RBI is the central operational point to test.