RBI Fraud Risk Management Directions 2026 - Commercial Banks

What Happened?

On July 31, 2026, the Reserve Bank of India (RBI) issued the Reserve Bank of India (Commercial Banks – Fraud Risk Management) Directions, 2026. This is a comprehensive regulatory framework that applies to all commercial banks in India (excluding Small Finance Banks, Payments Banks, and Local Area Banks). These directions replace all previous fraud risk management guidelines and come into effect immediately. The framework focuses on prevention, early detection, investigation, and timely reporting of fraud incidents to both Law Enforcement Agencies (LEAs) and RBI.

Background & Legal Context

Regulatory Authority: These directions are issued by RBI under Section 21 and Section 35-A of the Banking Regulation Act, 1949, which empower RBI to issue directions in the public interest.

Applicability: The directions apply to:

• All Scheduled Commercial Banks (domestic and foreign banks)
• The State Bank of India (SBI)
• New banks
• Does NOT apply to Small Finance Banks, Payments Banks, or Local Area Banks

Key Legal Principles Embedded: The framework specifically incorporates principles of natural justice, as mandated by the Supreme Court judgment dated March 27, 2023 in State Bank of India & Others vs. Rajesh Agarwal & Others. This means banks must:

• Issue a detailed Show Cause Notice (SCN) to persons/entities accused of fraud
• Allow minimum 21 days to respond to the SCN
• Pass a reasoned order containing facts, circumstances, and reasons for fraud classification
• Follow this process before any fraud declaration with civil consequences

What Does This Mean for You?

For Borrowers and Loan Account Holders:

If your account is suspected of fraudulent activity, the bank must follow strict procedural safeguards. You have at least 21 days to respond to any fraud allegations before the bank can classify your account as fraudulent. This is a significant protection because:

• You get advance notice (Show Cause Notice) with detailed allegations
• You have reasonable time to submit your defense
• The bank must issue a reasoned order explaining why it classified you as fraudulent
• Once classified as fraud, you cannot raise fresh credit or additional funds from any RBI-regulated entity for 5 years from the date of full repayment/settlement

For Businesses with Multiple Group Companies:

If one group company is identified as fraudulent and one or more promoters/whole-time directors are common across group companies, other group companies' borrowal accounts must also be examined for fraud. This is significant because the definition of "associated entities" includes:

• Subsidiary companies
• Joint ventures
• Associate companies (as per Companies Act 2013)
• Entities where a person is a promoter, director, or responsible for management

For Banks and Financial Institutions:

Banks now have clearer timelines and governance requirements:

• 7 days: Report red-flagged accounts with exposure ≥ ₹3 crore on RBI's CRILC (Central Repository of Information on Large Credits) platform
• 14 days: Report fraud classification to RBI through Fraud Monitoring Return (FMR)
• 180 days: Complete entire fraud classification process from first red-flagging; cases beyond 180 days must be reported to the Special Committee of Board for Monitoring and Follow-up (SCBMF) with justification
• 30 days: Examine Early Warning System (EWS) alerts/triggers (though banks can prefer shorter turnaround)

For Third-Party Service Providers (Valuers, Architects, Chartered Accountants, Advocates):

If banks discover that your negligence or malpractice contributed to a fraud, banks can hold you accountable and report you to the Indian Banks' Association (IBA). IBA maintains caution lists of such professionals that are circulated among all banks. This could significantly impact your professional reputation and business opportunities.

Reporting to Law Enforcement Agencies - Different Thresholds:

Private Sector and Foreign Banks:

• Below ₹1 crore: Report to State/UT Police
• ₹1 crore and above: Report to both State/UT Police AND Serious Fraud Investigation Office (SFIO), Ministry of Corporate Affairs

Public Sector Banks:

• Below ₹6 crore: Report to State/UT Police
• ₹6 crore and above: Report to Central Bureau of Investigation (CBI)

This distinction is crucial because it determines the investigating agency's level of involvement and the investigation's scope.

For Staff of Banks (Employees):

Banks must examine staff accountability in time-bound manner. For Public Sector Banks, all fraud cases involving ₹3 crore and above must be referred to the Advisory Board for Banking and Financial Frauds (ABBFF) constituted by the Central Vigilance Commission. This means your role in any fraud will be thoroughly examined, and disciplinary action could follow.

What Should You Do Now?

If You Are a Borrower:

1. Review your loan agreements: Ensure they contain clauses permitting the bank to audit accounts upon red-flagging (this is now required)
2. Maintain clean transaction records: Keep all supporting documents for account transactions safe
3. If you receive an SCN on fraud allegations: Don't ignore it. Respond within 21 days with detailed documents and explanations
4. Monitor your account status: Check if your account appears on RBI's Central Fraud Registry (CFR)
5. Maintain compliance: Ensure all banking transactions are transparent and documented

If You Are a Bank/Financial Institution:

1. Update your Fraud Risk Management Policy: Ensure it complies with all new requirements, including governance structure, EWS framework, and natural justice principles
2. Establish/Upgrade Early Warning Systems (EWS): Integrate robust EWS into your Core Banking Solution (CBS) with both quantitative and qualitative indicators
3. Set up Data Analytics Unit: Create a dedicated Data Analytics and Market Intelligence unit for monitoring transactions
4. Create SCBMF: Establish the Special Committee of Board for Monitoring and Follow-up of fraud cases (minimum 3 board members, headed by independent director)
5. Implement strict timelines: Create internal processes to meet 7-day, 14-day, and 180-day reporting deadlines
6. Documentation: Maintain detailed documentation of entire fraud investigation process showing compliance with natural justice
7. Staff training: Train staff on new fraud detection procedures and reporting timelines
8. Auditor agreements: Update contracts with external auditors to specify timeline for audit report submission

If You Are a Professional Service Provider (CA, Advocate, Valuer, Architect):

1. Review engagement letters: Understand your liability limitations in bank engagement agreements
2. Maintain quality standards: Ensure your appraisal reports, valuations, and advice are accurate and well-documented
3. Implement internal QA: Have quality assurance processes to minimize errors or negligence
4. Maintain records: Keep all working papers and supporting documents for minimum 5-7 years

Key Takeaways

• Procedural Protection: Banks must follow strict natural justice principles including 21-day notice period before declaring anyone fraudulent, significantly protecting borrowers' rights
• Strict Timelines: Banks have 7 days to red-flag accounts ≥₹3 crore on CRILC, 14 days to report fraud to RBI, and 180 days to complete entire fraud classification process
• 5-Year Debarment: Persons/entities classified as fraudulent cannot raise credit for 5 years from full repayment date, creating significant financial consequences
• Group Company Scrutiny: If one group company commits fraud, other group companies with common promoters/directors will also be examined, increasing risk across business groups
• Professional Accountability: Third-party service providers (CAs, valuers, architects, advocates) can be reported to IBA if their negligence causes fraud, affecting their professional reputation and future business

Effective Date: These directions came into effect immediately on July 31, 2026, and supersede all previous fraud-related guidelines issued by RBI.

Important Note: This is a banking regulation issued by RBI and does not directly impose Income Tax or GST obligations. However, it affects borrowers' financial condition and creditworthiness, which may have indirect tax implications (such as recognition of fraudulent losses, bad debt deductions under Income Tax Act 2025, or GST treatment of recovered fraud amounts).

Need expert help with this? EaseValue CAs in Jaipur — WhatsApp 63677 44602