Fraud risk in banking is no longer limited to forged loan documents or isolated employee misconduct. Digital transactions, complex borrower structures, mule accounts, manipulation of financial information and weaknesses in internal controls create multiple opportunities for fraudulent activities.
For banks, the real challenge is detecting suspicious activity early, investigating it fairly and responding before the damage becomes more serious.
The Reserve Bank of India (Commercial Banks – Fraud Risk Management) Directions, 2026, issued on 31 July 2026, establish a regulatory framework covering fraud prevention, early detection, governance, investigation and reporting.
The framework reinforces an important principle: fraud risk management must be continuous, accountable and integrated into everyday banking operations.
Here is what banks and risk professionals need to understand.
1. What Are the RBI Fraud Risk Management Directions 2026?
The RBI Directions provide a framework for preventing, identifying, investigating, classifying and reporting fraud in commercial banks.
The Directions came into effect immediately upon issuance on 31 July 2026.
They apply to commercial banks covered by the Directions, including applicable banking companies, corresponding new banks and the State Bank of India.
Important: Small Finance Banks, Payments Banks, Local Area Banks, cooperative banks and NBFCs have separately applicable RBI fraud risk management directions. Institutions should consult the framework relevant to their category.
The Directions address five major areas:
- Board-level fraud risk governance
- Early Warning Signals (EWS) and Red Flagged Accounts (RFA)
- Fraud investigation and classification procedures
- Reporting and staff accountability
- Fraud monitoring, prevention and recovery
2. Board Oversight: Fraud Prevention Begins with Governance
Under the 2026 Directions, commercial banks must maintain a Board-approved Fraud Risk Management Policy.
The policy must clearly establish responsibilities for the Board, relevant committees and senior management.
It must address prevention, early detection, investigation, staff accountability, monitoring, recovery and fraud reporting, together with an EWS/RFA framework.
What should an effective fraud governance framework cover?
| Governance area | Practical responsibility |
| Board | Approve the fraud risk management policy and oversee governance |
| Risk Management Committee of the Board | Oversee the EWS/RFA framework and approve monitoring indicators |
| Senior management | Implement the framework and ensure appropriate action |
| Fraud monitoring and investigation functions | Examine alerts, preserve evidence and support classification decisions |
| Internal audit | Assess control effectiveness and investigate cases where assigned |
| Business and operations teams | Identify anomalies, follow controls and escalate concerns |
The precise organisational responsibilities should be documented in the bank’s approved policy.
Example: A branch notices repeated unusual fund transfers involving a borrower, but the alerts remain unresolved because the operations and credit teams each assume the other is responsible.
The issue is not simply one of technology. It reveals a weakness in accountability and escalation.
3. Early Warning Signals: Detecting Fraud Before It Escalates
An Early Warning Signal is an indicator that may suggest suspicious activity requiring closer examination.
The RBI’s framework expects banks to use both quantitative and qualitative indicators.
These may involve transaction patterns, borrowers’ financial performance, market intelligence and borrower conduct.
Examples of suspicious banking activity
| Possible warning signal | Why it requires examination |
| Repeated unusual transfers to connected entities | May suggest questionable fund movements |
| Financial statements inconsistent with account transactions | May indicate inaccurate or manipulated disclosures |
| Unexplained changes in borrower transaction patterns | May indicate activity inconsistent with the customer’s business profile |
| Suspicious documentation or valuation inconsistencies | May suggest misrepresentation or documentation fraud |
| Unusual transactions in accounts with KYC deficiencies | May expose the bank to financial crime risks |
| Multiple linked accounts moving funds rapidly | May require examination for potential mule-account activity |
These are illustrative indicators, not automatic proof of fraud.
A legitimate commercial explanation may exist. Banks must examine the circumstances and supporting evidence before making conclusions.
How should an EWS system work?
An effective process should move through five stages:
Detect → Examine → Escalate → Investigate → Resolve
For example, if a corporate borrower repeatedly transfers substantial funds to previously undisclosed related parties, the bank should examine the transactions, verify their purpose and evaluate whether the activity warrants further investigation.
The objective is to distinguish genuine business transactions from suspicious activity without making premature allegations.
4. Red Flagged Accounts: When Does an Alert Require Investigation?
A Red Flagged Account (RFA) is an account where one or more EWS indicators create suspicion of fraudulent activity and require deeper investigation.
A bank must distinguish three situations:
- An EWS alert identifies a potential concern requiring examination.
- An RFA classification identifies an account requiring investigation from a potential fraud perspective.
- A fraud classification follows the applicable investigation, assessment, approval and procedural requirements.
An EWS alert does not automatically make an account fraudulent.
Similarly, a loan account can be red-flagged whether it is classified as standard or non-performing.
Key regulatory timelines
| Requirement | RBI provision |
| Examination of EWS alerts | RMCB-prescribed turnaround time, preferably not exceeding 30 days |
| Reporting qualifying RFAs to CRILC | Within 7 days of red-flagging |
| Exposure threshold for specified CRILC RFA return | Aggregate exposure of ₹3 crore and above, including fund-based and non-fund-based facilities |
| Resolution of RFA status | Ordinarily within 180 days of first reporting on CRILC |
| Cases continuing beyond 180 days | Review by the Special Committee of the Board for Monitoring and Follow-up of Cases of Frauds (SCBMF), with reasons; subject to RBI supervisory review |
Important distinction: The 30-day period is expressed as a preferred turnaround time for examination of alerts, not an unconditional deadline for completing every fraud investigation.
The seven-day requirement refers specifically to reporting qualifying red-flagged accounts on CRILC. Other fraud reporting requirements operate separately.
5. Fraud Investigation and the Principles of Natural Justice
A significant procedural element of the Directions is the requirement to observe principles of natural justice before fraud classification.
Banks must not treat suspicion as a final determination.
The policy must provide for a detailed show-cause notice to the relevant persons or entities against whom fraud allegations are being examined.
Affected parties must have an appropriate opportunity to respond, and the decision-making process must follow the prescribed procedural safeguards.
Practical investigation checklist
- Identify and document the suspicious transactions or conduct.
- Preserve relevant records and supporting evidence.
- Conduct an appropriate internal or external investigation.
- Examine the borrower’s explanation and available documentation.
- Follow the applicable show-cause and representation process.
- Obtain a reasoned decision from the competent authority.
- Complete applicable reporting and subsequent actions.
Example: A bank suspects that a borrower submitted inflated collateral valuations.
An independent review may establish whether valuations were inaccurate or misleading. However, inaccurate valuation alone should not be treated as conclusive evidence of intentional fraud without appropriate investigation and procedural safeguards.
A properly documented process protects the institution and supports fair, defensible decisions.
6. Role of Data Analytics in Fraud Prevention
The RBI Directions emphasise the importance of data analytics and market intelligence.
Commercial banks must establish a dedicated Data Analytics and Market Intelligence Unit, considering their size, complexity, business mix and risk profile.
The objective is to analyse information, identify suspicious patterns and improve early detection.
Where analytics can help
Credit monitoring: Identify unusual movement of funds, connected-party transactions and borrower behaviour inconsistent with the sanctioned purpose.
Digital banking: Analyse abnormal transaction velocity, unusual account activity and potential mule-account patterns.
Operational controls: Identify repeated overrides, unusual transaction processing behaviour or other patterns requiring investigation.
Consider a hypothetical account that normally receives ₹2 lakh to ₹3 lakh monthly but suddenly records ₹80 lakh in incoming transfers followed by rapid movement to multiple unrelated accounts.
An analytics system could flag this deviation. The bank would then examine the customer profile, legitimate business explanation and associated transaction information before determining the appropriate response.
Technology improves detection, but human investigation and evidence-based decisions remain essential.
7. Practical Case Study: A Red-Flagged Corporate Loan
Consider a hypothetical manufacturing borrower with total banking exposure of ₹8 crore.
The bank identifies the following developments:
- A sharp increase in transfers to related entities.
- Repeated delays in submitting financial statements.
- Discrepancies between declared receivables and supporting records.
- Unexplained fund movements inconsistent with the stated business purpose.
What should the bank do?
Stage 1 — Alert examination
The credit monitoring team examines the EWS triggers and gathers supporting information.
Stage 2 — Red-flagging decision
Where the examination raises sufficient suspicion, the bank considers RFA classification under its approved framework.
Stage 3 — Regulatory reporting
If the account is red-flagged, its ₹8 crore exposure exceeds the ₹3 crore threshold for the specified CRILC return. The relevant reporting requirement must therefore be followed within seven days.
Stage 4 — Investigation
The bank undertakes the required investigation, using an internal or external audit in accordance with its Board-approved policy.
Stage 5 — Final determination
After following the applicable natural justice requirements, the bank decides whether fraud classification is justified or whether the red-flagged status should be removed.
The RFA process should ordinarily be concluded within 180 days of the first CRILC reporting.
Key lesson: Fraud risk management is not simply identifying suspicious transactions. It requires timely examination, sound evidence, procedural fairness and documented decisions.
8. RBI Fraud Risk Management Compliance Checklist for Banks
Banks can use the following checklist as a starting point for an internal gap assessment.
| No. | Compliance area | Internal review question |
| 1 | Board-approved policy | Is the fraud risk management policy current and comprehensive? |
| 2 | Accountability | Are Board, committee and management responsibilities clearly assigned? |
| 3 | EWS indicators | Are quantitative and qualitative fraud indicators defined and approved? |
| 4 | Alert management | Are alerts examined within the approved turnaround time? |
| 5 | Systems integration | Is EWS integrated with appropriate banking and operational systems? |
| 6 | RFA reporting | Are qualifying RFAs reported to CRILC within the applicable timeline? |
| 7 | Investigation | Are investigation methods, responsibilities and evidence requirements documented? |
| 8 | Natural justice | Are show-cause, representation and decision procedures properly followed? |
| 9 | Analytics | Is the Data Analytics and Market Intelligence capability functioning effectively? |
| 10 | Oversight and review | Are RFA cases, unresolved matters and corrective measures periodically reviewed? |
This checklist is illustrative. Banks should supplement it with a clause-by-clause compliance review covering all applicable reporting, legal, staff accountability and other requirements.
9. Why Employee Training Matters
Banks may have sophisticated fraud monitoring systems, yet their effectiveness depends on employee judgment and consistent procedures.
A branch manager must understand when suspicious conduct needs escalation. A credit officer must recognise potential borrower fraud indicators. An internal auditor must know how to examine evidence without compromising procedural fairness.
Training should therefore cover:
- Fraud typologies and common banking red flags
- EWS monitoring and alert examination
- RFA classification and investigation workflows
- Regulatory reporting responsibilities
- Natural justice and documentation
- Fraud prevention controls and root cause analysis
For corporate training teams, practical case exercises and role-specific assessments can help translate regulatory understanding into day-to-day capability.
Frequently Asked Questions
Q. What are the RBI Fraud Risk Management Guidelines 2026?
They are RBI Directions establishing requirements for fraud risk governance, early detection, investigation, reporting and related controls for covered regulated entities.
Q. What is the difference between EWS and RFA in banking?
EWS identifies potential suspicious activity requiring examination. RFA refers to an account where suspected fraudulent activity warrants deeper investigation.
Q. What is the RBI reporting threshold for red-flagged accounts?
Under the Commercial Banks Directions, a red-flagged account with aggregate exposure of ₹3 crore or above must be reported through the specified CRILC return within seven days of being red-flagged.
Q. Can a standard loan account be classified as red-flagged?
Yes. RFA classification can apply to a standard or non-performing account where the relevant conditions are met.
Q. Is every EWS alert evidence of fraud?
No. An alert is a prompt for examination. Fraud classification requires the appropriate investigation and procedural safeguards.
Q. Are the same 2026 Directions applicable to Small Finance Banks and NBFCs?
No. RBI has issued separately applicable fraud risk management directions for these institution categories.
Conclusion: Move from Fraud Detection to Effective Fraud Governance
The RBI Fraud Risk Management Directions 2026 reinforce the need for banks to develop a structured approach to detecting, investigating and responding to fraud risks.
A strong framework combines Board oversight, effective EWS monitoring, reliable data analytics, timely investigations, documented decisions and trained employees.
The real measure of success is not how many alerts a bank generates, but whether those alerts lead to appropriate, timely and evidence-based action.
Strengthen Fraud Risk Management Skills with RMAI
The Risk Management Association of India (RMAI) offers professional learning programmes through SmartOnlineCourse for banking, risk, compliance, internal audit and operational professionals.
Recommended programme: Fraud Risk Management in Banking — a practical five-hour programme covering fraud typologies, transaction monitoring, investigation techniques, escalation and preventive controls.
Professionals looking for broader enterprise-wide capabilities can explore the 15-hour Fraud Risk Management programme, which includes dual certification through RMAI and BFSI Sector Skill Council of India, subject to the programme’s stated assessment requirements.
For institutional learning programmes, banks can explore customised fraud risk training covering credit, operations, fraud monitoring, audit and compliance teams.
Regulatory reference: Reserve Bank of India (Commercial Banks – Fraud Risk Management) Directions, 2026, dated 31 July 2026.
This article is for educational and professional reference purposes. Institutions should consult the applicable RBI Directions, subsequent amendments and their approved internal policies when determining compliance obligations.
