Early Warning Signals (EWS) are indicators in a borrower's account or conduct that point to possible wrongdoing. A Red Flagged Account (RFA) is an account where one or more such signals raise a suspicion of fraud, so the bank investigates it more deeply. Under RBI's fraud risk management directions, a bank reports a red-flagged account on the CRILC platform within seven days and should ordinarily decide within 180 days whether it is a fraud.
The rules below come from RBI's Master Directions on Fraud Risk Management of 15 July 2024, which RBI re-issued on 31 July 2026 as entity-wise Fraud Risk Management Directions, 2026.
What EWS and RFA mean
An early warning signal is not proof of fraud. It is a trigger. The directions treat it as a reason to look at a loan account or a transaction more closely and to take remedial action in time. Banks choose their own indicators, both quantitative and qualitative, and the board-level risk committee approves them.
Red flagging is the next stage for credit facilities. When the examination of signals raises a suspicion of fraudulent activity, the account is classified as red-flagged. That classification is a formal status with reporting duties and a clock attached. It ends in one of two ways: the account is classified as fraud, or the red flag is removed.
The concept dates from RBI's 2015 framework for dealing with loan frauds. The 2024 directions moved it out of the credit monitoring function alone and into a framework owned by the board and senior management.
Who must have an EWS system
The requirement is proportionate to the size of the entity.
| Regulated entity | EWS framework required? | Oversight |
|---|---|---|
| Commercial banks | Yes, EWS and red flagging of accounts under the fraud risk management policy | Risk Management Committee of the Board |
| NBFCs, including housing finance companies | Yes, for the Upper Layer and Middle Layer | A board-level committee such as the Risk Management Committee |
| Urban cooperative banks | Yes, for Tier 3 and Tier 4 banks | A board-level committee such as the Risk Management Committee |
Base Layer NBFCs with assets of ₹500 crore and above fall under the fraud risk management directions but are outside the EWS chapter. Other bank categories have their own 2026 directions, so check the text for your entity type on rbi.org.in.
The July 2024 direction for banks gave six months from the date of issue to put the EWS system in place or upgrade the existing one.
What the fraud monitoring system must do
RBI does not prescribe a product. It describes what the EWS framework must achieve. For banks, the 2024 direction expects the framework to provide for:
- System integration. The EWS system is integrated with the core banking solution or other operational systems, so alerts come from live data and not from periodic manual reviews.
- Timely remedial action. Alerts and triggers are acted upon in time. The Risk Management Committee of the Board fixes the turnaround time for examining alerts, which should preferably not exceed 30 days.
- Data analytics. Banks set up a dedicated data analytics and market intelligence unit to collect and process information that helps detect potentially fraudulent activity early.
- Coverage beyond loans. Indicators are also identified for non-credit transactions. Monitoring of such transactions through the system should be in real time, with attention to non-KYC-compliant accounts and money mule accounts, and to unusual patterns on digital platforms.
- Periodic testing. The effectiveness of the system is tested from time to time, and the framework is validated as the risk committee directs.
Senior management is responsible for implementing the framework. The board committee is responsible for seeing that it works.
This is where fraud risk meets credit risk management. Many indicators a credit team already watches, such as repeated irregularities, diversion of funds or disputes over security, are also candidates for the EWS list. The directions ask that they be parameterised, monitored by a system and closed with a recorded decision.
How an account gets red-flagged
Loan fraud detection under the framework follows a sequence:
- Alert. The EWS system or a manual trigger raises one or more signals on a credit facility or borrower account.
- Examination. The bank examines the alert within its approved turnaround time.
- Red flagging. If the examination raises a suspicion of fraud, the account is classified as red-flagged.
- CRILC reporting. The red-flagged status is reported on RBI's Central Repository of Information on Large Credits. The commercial banks direction applies this to accounts with an aggregate exposure of ₹3 crore or more.
- Investigation. The bank uses an external audit or an internal audit, as its board-approved policy provides, to investigate further.
- Natural justice. Before a fraud classification, the bank issues a detailed show-cause notice, allows not less than 21 days for a reply and passes a reasoned order.
- Decision. The account is classified as fraud, or the red-flagged status is removed.
One case skips the first steps. Where a law enforcement agency has started an investigation on its own into a borrower account, the bank must red-flag the account immediately and then follow the normal process.
If the audit stays inconclusive, or is delayed because the borrower does not cooperate, the bank decides the status of the account on the basis of its own records and its own investigation. It still has to follow the principles of natural justice.
Timelines for red-flagged accounts
| Step | Timeline in the directions (commercial banks) |
|---|---|
| Examine an EWS alert | Turnaround time approved by the board risk committee, preferably not more than 30 days |
| Report red-flagged status on CRILC | Within 7 days of classifying the account as red-flagged |
| Classify as fraud or remove the red flag | Ordinarily within 180 days of first reporting the red-flagged status on CRILC |
| Reply to show-cause notice | Not less than 21 days |
| Report to RBI once classified as fraud | Fraud Monitoring Return immediately, and not later than 14 days from the date of classification |
The 180-day limit is tied to the CRILC reporting date, which makes it easy for a supervisor to measure. Contracts with external auditors must state the timeline for completing the audit and submitting the report, so that the audit does not consume the whole window.
The NBFC and urban cooperative bank directions are lighter. They require an indication of fraud from the EWS system to lead to a deeper investigation and timely remedial action, and they do not carry the CRILC red-flagging timelines that apply to banks.
What the board and its committees must review
- Risk Management Committee of the Board: approves the EWS indicators and the alert turnaround time, oversees the effectiveness of the EWS and red-flagging framework, and directs its validation.
- Special Committee of the Board for Monitoring and Follow-up of cases of Frauds (SCBMF): reviews accounts that remain red-flagged beyond 180 days, with the reasons. Such cases are also open to supervisory review by RBI.
- Audit Committee of the Board: receives internal audit findings on the controls for prevention, detection, classification and reporting, including delays.
- Board: reviews the fraud risk management policy, of which the EWS framework is a part, at least once in three years.
Common gaps to check before an inspection
- EWS indicators exist in a policy document but are not parameterised in the system.
- Alerts are closed without a recorded reason or beyond the approved turnaround time.
- The CRILC reporting date is not recorded on the file, so the 180 days cannot be counted.
- Audit engagement letters have no completion date.
- Accounts past 180 days have not been placed before the SCBMF.
- The red flag was removed without a note of who approved it and why.
Figures above are from the directions as published by RBI. Check the current text for your entity type before relying on them.
How RegIntel Nexus helps
RegIntel Nexus is not an EWS or a fraud monitoring system. It does not monitor transactions or flag accounts. It helps you keep track of what the directions require of those systems. It monitors RBI publications and tracks amendments, turns each EWS and red-flagging clause into an obligation with an owner, due date, status and escalation, and maps it to the process and application that must deliver it. When an inspector asks where a requirement comes from and who owns it, the source reference, document version and approvals are on record.
Sources
- Master Directions on Fraud Risk Management in Commercial Banks (including Regional Rural Banks) and All India Financial Institutions (15 July 2024), Reserve Bank of India
- Reserve Bank of India (Commercial Banks – Fraud Risk Management) Directions, 2026, Reserve Bank of India
- Reserve Bank of India (Non-Banking Financial Companies – Fraud Risk Management) Directions, 2026, Reserve Bank of India
- Reserve Bank of India (Urban Co-operative Banks – Fraud Risk Management) Directions, 2026, Reserve Bank of India
- Press release on consolidation of supervisory instructions (31 July 2026), Reserve Bank of India
This article is general information for compliance and risk professionals. It is not legal advice. Regulations are amended often; check the current text published by the regulator before acting.
