RBI fraud risk management directions for banks and NBFCs

RBI's fraud risk management directions require every bank and larger NBFC to run a board-approved fraud risk management policy, follow the principles of natural justice before calling anyone a fraud, watch for early warning signals, and report each fraud to RBI within 14 days of classifying it. The framework was issued as three Master Directions on 15 July 2024 and re-issued, entity by entity, on 31 July 2026.

This explainer sets out what the directions ask for, in the order a compliance or risk team usually has to implement them.

Which directions apply today

On 15 July 2024 RBI issued three revised Master Directions on fraud risk management: one for commercial banks (including regional rural banks) and All India Financial Institutions, one for cooperative banks, and one for NBFCs including housing finance companies. They replaced the 2016 directions on classification and reporting of frauds and withdrew a long list of older circulars.

On 31 July 2026 RBI's Department of Supervision consolidated its instructions into 64 directions organised by type of regulated entity and repealed 628 earlier circulars and directions. Fraud risk management now sits in entity-wise texts, for example:

• Reserve Bank of India (Commercial Banks – Fraud Risk Management) Directions, 2026
• Reserve Bank of India (Urban Co-operative Banks – Fraud Risk Management) Directions, 2026
• Reserve Bank of India (Non-Banking Financial Companies – Fraud Risk Management) Directions, 2026

RBI has said the consolidation was done on an "as is" basis, so the substance of the 2024 framework continues. Paragraph numbers have changed, and small finance banks, payments banks, local area banks, regional rural banks, rural cooperative banks and AIFIs have their own texts. Cite the 2026 direction for your entity type in policies and audit papers. Action already taken under the 2024 directions continues to be governed by them.

The NBFC direction applies to NBFCs in the Upper Layer and Middle Layer, and to Base Layer NBFCs with an asset size of ₹500 crore and above. It covers housing finance companies as well.

Board-approved policy and governance

Fraud risk management starts with the board. The directions require:

• A board-approved fraud risk management policy that sets out the roles of the board, its committees and senior management. The board must review it at least once in three years, or more often if it decides so.
• A Special Committee of the Board for Monitoring and Follow-up of cases of Frauds (SCBMF). In a commercial bank it has at least three board members, including one whole-time director and at least two independent or non-executive directors, and is headed by an independent or non-executive director.
• Proportionate options for smaller entities. Middle Layer and Base Layer NBFCs, and Tier 1 and Tier 2 urban cooperative banks, may set up a Committee of Executives instead of the board committee.
• A whistle-blower mechanism so that complaints pointing to possible fraud are examined and concluded properly.
• A senior official responsible for monitoring and reporting fraud cases.

The Audit Committee of the Board keeps its own role: internal audit must cover the controls for fraud prevention, detection, classification, reporting and closure, and cases involving very senior executives go to the audit committee.

Principles of natural justice before classification

This is the biggest change from the older framework. It follows the Supreme Court's judgment of 27 March 2023 in State Bank of India v. Rajesh Agarwal, which held that a borrower must be heard before an account is classified as fraud.

The directions now require the policy to provide for:

1. A detailed show-cause notice to the persons and entities against whom the allegation is being examined, including promoters and whole-time or executive directors. The notice must give the transactions, actions or events on which the fraud allegation rests.
2. Not less than 21 days to respond.
3. A reasoned order that deals with the facts relied on, the reply received and the reasons for the decision to classify, or not to classify, the account as fraud.

Fraud investigation in banks therefore needs a documented trail: notice, reply, examination, order and the approval of the competent authority. The "date of classification" is the date on which that approval is obtained and the reasoned order is passed, and the reporting clock starts from there.

Early warning signals and red-flagged accounts

Bank fraud prevention under the directions depends on early detection. Commercial banks must have a framework for Early Warning Signals (EWS) and red flagging of accounts under the fraud risk management policy, overseen by the Risk Management Committee of the Board. The 2024 direction for banks expected:

• an EWS system integrated with the core banking solution or other operational systems;
• a dedicated data analytics and market intelligence unit;
• examination of EWS alerts within a turnaround time that should preferably not exceed 30 days;
• monitoring of non-credit transactions, including digital channels, with attention to non-KYC-compliant and money mule accounts;
• periodic testing of how well the EWS system works.

For NBFC fraud prevention, the EWS requirement applies to Upper Layer and Middle Layer NBFCs. Among urban cooperative banks it applies to Tier 3 and Tier 4 banks. In both cases a board-level committee oversees the framework.

When a bank red-flags a borrower account it reports the status on RBI's CRILC platform within seven days, uses an external or internal audit to investigate, and should ordinarily decide within 180 days whether to classify the account as fraud or remove the red flag. Accounts that stay red-flagged beyond 180 days go to the SCBMF for review.

Reporting fraud to RBI and law enforcement

Reporting has been simplified but the timelines are firm.

For commercial banks the direction names the agency by amount involved:

• Private sector and foreign banks: below ₹1 crore to the State or Union Territory police; ₹1 crore and above to the police and also to the Serious Fraud Investigation Office.
• Public sector banks: below ₹6 crore to the State or Union Territory police; ₹6 crore and above to the CBI.

NBFCs and urban cooperative banks report to the appropriate law enforcement agency, such as the State police. Later developments in a case are filed as updates to the Fraud Monitoring Return. Delay in reporting is itself a finding: the directions ask the entity to examine it and fix staff accountability.

Penal measures and staff accountability

Persons and entities classified and reported as fraud, and entities associated with them, are debarred from raising funds or seeking additional credit from RBI-regulated financial entities for five years from the date of full repayment of the defrauded amount or of the amount agreed under a settlement. After that period, lending is at the discretion of each lender.

The debarment does not continue against a borrower entity after a resolution plan under the Insolvency and Bankruptcy Code or RBI's resolution framework is implemented, but it continues against the erstwhile promoters and directors.

Staff accountability must be examined and completed in a time-bound manner under the entity's internal policy. Public sector banks follow the Central Vigilance Commission's guidelines and refer cases of ₹3 crore and above to the Advisory Board for Banking and Financial Frauds.

Role of auditors and other controls

• Statutory and other auditors: an auditor who comes across transactions or documents that point to possible fraud must bring it to the notice of senior management immediately and, if necessary, to the Audit Committee of the Board.
• External auditors for red-flagged accounts: the entity needs a policy on engaging them, and the contract must set timelines for completing the audit and submitting the report.
• Legal audit of title documents: periodic legal audit and re-verification until the loan is repaid, for credit facilities of ₹5 crore and above in commercial banks and ₹1 crore and above in NBFCs and urban cooperative banks.
• Third-party service providers: banks may hold advocates, valuers, chartered accountants and similar professionals accountable where wilful negligence or malpractice contributed to a fraud.

How RegIntel Nexus helps

RegIntel Nexus does not detect fraud or monitor transactions. It helps your team keep track of what the directions require. It monitors RBI publications, classifies new directions and tracks amendments, so a change such as the July 2026 re-issue reaches the right people. It turns each clause into an obligation with an owner, a due date, a status and an escalation path, and maps it to the processes and applications it affects. Its research assistant answers questions with the document, clause and page cited. Source references, document versions and approvals are kept as audit evidence.

This article is general information for compliance and risk professionals. It is not legal advice. Regulations are amended often; check the current text published by the regulator before acting.