NFRA's New Criminal Powers Under the 2026 Amendment Bill: What CAs Must Know
The Corporate Laws (Amendment) Bill 2026 proposes criminal penalties, mandatory auditor registration, and binding directions for NFRA — on top of intensifying inspections under current Section 132(4). Here's what audit partners and audit committees need to track before the provisions become law.
CA Harun Raaj
Chartered Accountant · Harun Raaj & Associates
Legal basis: Section 132(4), Companies Act 2013 — Effective: ongoing. Source: MCA/CBDT/RBI circular. Last reviewed by CA Harun Raaj: September 2026.
India's audit regulator, the National Financial Reporting Authority (NFRA), is about to become significantly more powerful. The Corporate Laws (Amendment) Bill, 2026 — whose Joint Parliamentary Committee (JPC) report was submitted in August 2026 — proposes criminal penalties, binding directions, and mandatory auditor registration. Alongside this, NFRA has published new Audit Quality Inspection Guidelines (June 2026) and its first Staff Series paper on technology in audit.
If you are an audit partner signing a listed company report, or an audit committee member overseeing a statutory audit, this is the development to track closely.
Note: The proposed provisions under the Corporate Laws (Amendment) Bill, 2026 are NOT yet in force. They await Presidential assent and a Central Government notification of the effective date. This article separates current law from proposed changes throughout.
Key point: NFRA's existing enforcement powers under Section 132(4) are already active and being used, while the Bill's criminal penalties, mandatory registration, and binding-direction powers remain proposals pending notification.
NFRA's current powers — Section 132(4), Companies Act 2013
NFRA's enforcement jurisdiction covers auditors of listed companies, public companies with paid-up capital of ₹500 crore or more or turnover of ₹1,000 crore or more, and other prescribed classes.
Current enforcement options:
- Fines on individuals: ₹1 lakh to ₹5 lakh, or 3x audit fees, whichever is higher.
- Fines on firms: ₹5 lakh to ₹10 lakh, or 3x audit fees, whichever is higher.
- Debarment of individuals: 6 months to 10 years.
- Debarment of firms: 1 year to 10 years.
- Referral to ICAI or the Central Government.
NFRA has actively used these powers. The ₹10 crore penalty on BSR & Associates LLP remains the most prominent example. Inspection reports on Deloitte Haskins & Sells, Walker Chandiok & Co LLP, and mid-tier firms have repeatedly flagged independence documentation gaps, weak SA 315(R) risk assessment, and inadequate SA 550 related-party procedures.
What the Corporate Laws (Amendment) Bill 2026 proposes
Status: JPC report submitted, NOT yet law.
Proposed Section 132(4A) — criminal non-compliance penalty
The most significant proposed change makes NFRA orders as enforceable as court orders:
- Individuals who fail to comply with an NFRA order within 90 days: imprisonment up to 6 months, OR fine ₹1 lakh to ₹5 lakh.
- Audit firms that fail to comply within 90 days: fine up to ₹25 lakh.
The trigger is non-compliance with an order, not audit failure itself. But the effect is structural: NFRA could pursue criminal prosecution if its monetary penalties are ignored.
Proposed Section 132A — mandatory auditor registration
Auditors and firms for NFRA-covered entities would need to register directly with NFRA. Currently, NFRA's oversight is triggered by company-level filings, not auditor registration. Mandatory registration would close this gap and allow proactive tracking of auditor-entity relationships.
Proposed Section 132C — binding directions in public interest
NFRA would gain the power to issue binding directions to audit firms, auditors, or companies. Non-compliance: fine up to ₹50 lakh. This mirrors SEBI's suo motu direction power and represents a shift from NFRA's current advisory-or-enforce binary.
Current law versus proposed Bill: a side-by-side view
NFRA inspection activity 2025-26: what they are finding
Even under current powers, NFRA inspections have intensified. The new Audit Quality Inspection Guidelines (June 2026) provide a public framework:
- Top 6 firms face formal inspections in FY26/FY27: Deloitte Haskins & Sells, SRBC & Co LLP, PW&A Network, BSR Affiliates Network, MSKA & Associates LLP, Walker Chandiok & Co LLP.
- Post-inspection: remediation plan submitted within 3 months; full implementation within 6 months.
Case study: NFRA Inspection Report No. 132.2-2024-07 (M/s Umamaheswara Rao & Co.)
NFRA's published inspection report on this mid-tier firm details exactly what inspectors look for.
Firm-level (SQC 1) observations:
- Independence: inadequate documentation of independence verification for audit team members.
- Client acceptance: no formal acceptance procedures; no assessment of management integrity.
- Time reporting: absence of time recording systems; no way to verify audit effort.
- Internal monitoring: no internal quality review mechanisms.
Engagement-level observations:
- Revenue recognition: not assessed as a significant risk under SA 315(R) despite industry-specific complexities.
- Related parties: reliance on management representations without independent corroboration — insufficient under SA 550.
- Going concern: not assessed per SA 570 despite multiple indicators present in the audit client.
- Materiality: not documented at planning stage or revised during audit execution.
- External confirmations: bank balance confirmations not sent; assertions not independently tested.
The pattern across NFRA inspection reports is consistent: SQC 1 weaknesses at the firm level compound into engagement-level gaps. A firm with no time recording will consistently show engagement teams with insufficient documented effort.
NFRA technology-in-audit guidance (Staff Series Paper 1, July 23, 2026)
NFRA's General Principles for Technology Adoption in Audit sets out the regulatory position on AI and automation in audit:
- Data analytics, automated tools, generative AI, and agentic AI are permissible in audit — but they assist; they do not replace professional scepticism.
- SA 200 (Overall Objectives of the Independent Auditor) requires professional scepticism from the auditor, not the tool.
- SA 315(R) risk assessment must reflect independent auditor judgment — automated risk scoring does not discharge this obligation.
- NFRA will assess, in future inspections, whether technology was used appropriately and whether the auditor understood the tool's limitations.
This matters practically: an auditor using AI to analyse journal entries must still be able to explain the AI's methodology and verify its completeness under SA 330 (Auditor's Responses to Assessed Risks). The professional judgment stays with the signing auditor at every step.
What audit committees should ask their statutory auditors now
Under Section 177 of the Companies Act, every listed company's audit committee must review auditor performance and independence. Given NFRA's tightening framework, audit committees should add these questions to the annual review:
- Has your firm received any NFRA inspection observation, show-cause notice, or enquiry in the last 3 years?
- Who is the Engagement Quality Control Reviewer (EQCR) for our audit under SQC 1?
- How does your firm document independence verification for all audit team members?
- What is your approach to SA 315(R) risk assessment — specifically for revenue recognition and related-party transactions?
- Has this engagement used any AI or automated tools? How is professional scepticism maintained?
- When the proposed Section 132A registration requirement comes into force, what is your firm's registration status with NFRA?
Illustrative example
ABC Infrastructure Limited is listed with turnover of ₹900 crore — squarely within NFRA's jurisdiction. Its audit committee has scheduled the statutory auditor's attendance at the October 2026 audit committee meeting.
Under current law, the audit committee should ask for the EQCR confirmation and independence documentation summary.
If the proposed Section 132A is enacted, the audit firm will need to be registered with NFRA as a precondition for acting as auditor for NFRA-covered entities. The audit committee should factor this into the next auditor appointment or re-appointment decision.
Under the proposed Section 132C, if NFRA issues a binding direction on disclosure of specific audit procedures, non-compliance by either the company or the auditor could attract fines of up to ₹50 lakh.
Disclaimer: This article is for general information only. The proposed provisions of the Corporate Laws (Amendment) Bill 2026 discussed here are not yet law. Statutory references: Section 132, Companies Act 2013; SA 200, SA 315(R), SA 550, SA 570, SA 330 (ICAI auditing standards).
I'm CA Harun Raaj, Visakhapatnam. If your firm or audit committee is preparing for NFRA's tightened inspection regime, reach out and we'll walk through where your documentation stands today.
---
See Also
Frequently Asked Questions
Are the criminal penalties under the Corporate Laws (Amendment) Bill 2026 already in force?
No. As at September 2026, the Bill has not received Presidential assent and the proposed Sections 132(4A), 132A, and 132C are not yet law. The JPC report was submitted in August 2026; watch for the gazette notification announcing the effective date.
Does NFRA cover auditors of private limited companies?
Currently, NFRA covers auditors of listed companies and public companies with paid-up capital of ₹500 crore or more or turnover of ₹1,000 crore or more, plus other prescribed classes. Private companies below this threshold are generally outside NFRA's direct jurisdiction unless specifically prescribed by the Central Government.
What penalty does a signing partner face under NFRA's existing powers?
Under current Section 132(4), individual auditors face fines of ₹1 lakh to ₹5 lakh, or 3x audit fees, whichever is higher, plus debarment of 6 months to 10 years. There are no criminal penalties under current law — that is what the proposed Section 132(4A) in the 2026 Bill would add for non-compliance with an NFRA order.
What does the proposed Section 132A auditor registration requirement change?
Currently, NFRA's oversight is triggered by company-level filings, not by auditor registration. The proposed Section 132A would require auditors and firms of NFRA-covered entities to register directly with NFRA, closing this gap and enabling proactive tracking of auditor-entity relationships.
How is ICAI's peer review different from an NFRA inspection?
ICAI's Quality Review Board (QRB) conducts peer reviews under the CA Act, while NFRA operates under Section 132 of the Companies Act and focuses on audits of public-interest entities such as listed and large public companies. The two are complementary processes with separate mandates and separate enforcement consequences.
What should a firm document to prepare for NFRA inspections under the current framework?
Based on NFRA Inspection Report No. 132.2-2024-07, the recurring focus areas are SQC 1 items: independence verification records, formal client acceptance with management integrity assessment, EQCR documentation, SA 315(R) risk assessment at planning stage, and SA 330 completion checklists for revenue recognition, related parties, going concern, and materiality.
Can an auditor rely on AI tools for risk assessment under SA 315(R)?
NFRA's Staff Series Paper 1 (July 23, 2026) permits data analytics and AI tools in audit but states they assist rather than replace professional scepticism under SA 200. SA 315(R) risk assessment must still reflect independent auditor judgment, and NFRA will assess in future inspections whether the auditor understood the tool's limitations.
What fine could apply under the proposed binding-direction power in Section 132C?
Under the proposed Section 132C, NFRA could issue binding directions to audit firms, auditors, or companies in the public interest, with non-compliance attracting a fine of up to ₹50 lakh. This provision is not yet in force and awaits notification under the Corporate Laws (Amendment) Bill 2026.
Need help with this?
Our team handles the paperwork. You focus on your business.