A Chief Compliance Officer in Indian financial services now sits no more than two levels below the CEO, holds a fixed term of at least three years, and reports directly to the board. For a Middle or Upper Layer NBFC, a bank, or a scaling fintech, this is a mandated appointment drawing on a narrow talent pool. Here is what the role pays and how to hire it well.
What does a Chief Compliance Officer do in a regulated lender?
The CCO owns the independent compliance function: the person accountable to the board for making sure the firm observes every statutory and regulatory requirement that applies to it. The Reserve Bank of India frames compliance as an integral part of governance, sitting alongside internal control and risk management rather than underneath the business.
In practice that means owning the regulatory perimeter (every RBI, SEBI, IRDAI or PMLA obligation the entity carries), running the compliance monitoring and testing programme, clearing new products and processes before launch, managing the regulatory relationship and inspection responses, and escalating to the board when the business wants to do something the rules do not allow. The role is distinct from legal, which advises on contracts and disputes, and from risk, which prices and limits exposure. The CCO's job is conformance: does the firm do what the regulator requires, and can it prove it. A vacant seat here is not a soft cost. The same logic that applies to an open senior risk mandate, set out here, applies to compliance: supervisory findings, delayed approvals and personal liability for the board all accrue while the chair is empty.
Who has to appoint a CCO, and by when?
Most regulated lenders of any scale now do. The RBI's April 2022 circular on the compliance function requires every NBFC in the Upper Layer and the Middle Layer to put in place a board approved compliance policy and appoint a Chief Compliance Officer, with Upper Layer NBFCs required to comply by 1 April 2023 and Middle Layer NBFCs by 1 October 2023 (RBI, 11 April 2022). This flows from the Scale Based Regulation framework that took effect on 1 October 2022, which pulled the largest NBFCs under bank style governance. Banks already operate under a parallel RBI circular from September 2020 that created the same independent CCO role (RBI, 11 September 2020). Base Layer NBFCs sit outside the specific CCO rules but still need a working compliance function under the 2016 Master Directions.
Demand is widening because the regulated population keeps growing. The NBFC sector's assets under management are projected to cross Rs 50 lakh crore by March 2027 on roughly 18 to 19 percent annual growth (Free Press Journal, 2026), which pushes more firms across the threshold into the Middle Layer and the CCO obligation that comes with it. Data protection adds a second front: the Digital Personal Data Protection Rules were notified in November 2025 with a staggered rollout, and significant data fiduciaries, which many lenders will be, face heavier obligations including a data protection officer once the longer transition window closes (Bar and Bench, 2025). SEBI registered intermediaries such as brokers, asset managers and AIFs carry their own compliance officer requirements, and reporting entities under the PMLA must name a principal officer. The net effect is that a credible, independent compliance leader is now a condition of operating, not a luxury.
What rules must a CCO appointment satisfy?
More than most hiring managers expect, which is exactly why these searches run long. The RBI circular sets the terms of the appointment itself, not just the job description. The CCO must be a senior executive positioned no more than two levels below the CEO, and a Middle Layer NBFC may relax this by one further level. The appointment carries a minimum fixed tenure of at least three years, and the CCO cannot be removed or transferred before the term ends except in exceptional circumstances, with the explicit prior approval of the board or its committee.
Independence is built into the structure. The CCO reports directly to the MD and CEO and the board or its audit committee, has no reporting line into any business vertical, and where the CCO reports to the MD and CEO the board must meet the CCO one to one every quarter without senior management in the room. There is to be no dual hatting: the CCO cannot hold a business role or any responsibility that creates a conflict of interest. Selection is made by a board constituted committee, and before an NBFC appoints, transfers or removes a CCO it must give prior intimation to the RBI's Department of Supervision, with a detailed profile and a fit and proper certification signed by the MD and CEO. For a hiring leader, the practical point is that this is a board level appointment with a regulatory notification step attached, so the process cannot be rushed through at the last minute.
What does a Chief Compliance Officer earn in India?
A Head of Compliance or CCO at a bank or large NBFC sits at the top of the market. PeopleCap's compliance and financial crime pay benchmarks put a Director or Head of Compliance at 55 to 120 lakh in fixed pay for someone changing employers, with VP and Senior Manager compliance roles at 26 to 50 lakh and Manager or AVP roles at 14 to 26 lakh. These are fixed pay ranges in rupees, before bonus and long term incentives, and they describe what a candidate moving organisations can expect to command rather than what an internal incumbent is currently paid.
Where a specific CCO lands in that range is driven by three things: the regulatory weight of the entity (a deposit taking bank or Upper Layer NBFC pays more than a small Base Layer lender), direct experience facing the regulator through inspections and enforcement, and the breadth of the perimeter, since a leader covering banking, markets and data compliance at once is scarcer than a single domain specialist. Because independence depends on seniority, firms that try to underpay the role relative to the business heads tend to struggle both to attract credible candidates and to give the CCO the standing the rules assume. If the mandate also spans the wider financial crime team, the KYC and AML operations benchmarks are worth reading alongside the leadership bands.
How should you hire a CCO?
With a specialist search, not a database pull, because the pool of regulator credible compliance leaders is small and the best of them are not applying to adverts. The method that works for a role like this is the same one that works for other scarce control function seats, and it has five parts.
Start with a brief that fixes scope. Settle the entity's layer and regulatory perimeter, the reporting line, what independence has to mean in your structure, and the three or four outcomes the first year has to deliver, before any name is approached. A loose brief produces a long list of people who look right on paper and cannot pass a board.
Then map the market rather than searching a database. The point of a specialist talent acquisition engagement is to identify the fifteen or twenty people who could actually do the job across comparable regulated firms, understand who among them is genuinely movable, and approach them directly, rather than filtering inbound applications.
Assess for judgement, not just knowledge. A CCO who knows the rulebook but cannot say no to a confident business head, and make it hold, is a liability. The interview has to test real situations where the candidate stood firm against revenue, carried the board with them, and managed a regulator through a difficult finding.
Have the honest conversation early. A strong compliance leader will want to know they will get real board access, tenure protection, and the authority the role needs. Setting that out before the offer, rather than discovering a gap after, is what keeps the best candidates in the process.
Run the notice period actively. Senior compliance professionals carry long notice periods and attract counteroffers, and the RBI intimation step adds further lead time. Staying close through the gap, as described in the playbook for the weeks after an offer is accepted, is often the difference between a signed candidate and a restart. The same discipline that protects a CISO hire protects this one.
Frequently asked questions
Is a Chief Compliance Officer mandatory for every NBFC?
No. The RBI's specific CCO requirement applies to NBFCs in the Upper Layer and the Middle Layer, which had to appoint one by 1 April 2023 and 1 October 2023 respectively. Base Layer NBFCs are not covered by those rules but still have to run a compliance function under the 2016 Master Directions, and many appoint a compliance head voluntarily as they prepare to move up a layer.
Can the CCO also run risk, legal or a business line?
No. The rules bar dual hatting: the CCO cannot hold a business role or any responsibility that creates a conflict of interest, and has no reporting relationship with business verticals. In practice the compliance leader is a dedicated appointment, separate from the Chief Risk Officer and from legal, even in a lean organisation.
How long does it take to hire a CCO?
Plan for roughly 12 to 20 weeks end to end. The search itself takes time because the credible pool is small, the board sits on the final decision, and senior compliance candidates serve long notice periods. On top of that, an NBFC must give the RBI prior intimation with a fit and proper certification before the appointment is finalised, a regulatory step that cannot be compressed.
What should a CCO be paid relative to the business heads?
At parity with senior management, not below it. Independence is only real if the CCO has the seniority and standing to challenge revenue leaders, which the pay has to reflect. PeopleCap's compliance and financial crime benchmarks put a Head of Compliance at 55 to 120 lakh in fixed pay for a candidate changing employers, and firms that pitch below that range tend to attract candidates who cannot carry a board or a regulator.