The Reserve Bank of India (RBI) has issued comprehensive new directions for fraud risk management, effective immediately. All India Financial Institutions (AIFIs) must now implement robust frameworks for prevention, early detection, and timely reporting of fraud incidents, including specific provisions for staff accountability and penal measures.
What Changed: The 30-Second Answer
The RBI, through its Notification RBI/DoS/2026-27/457 (DoS.CO.FMG.51/23.04.001/2026-27) dated July 31, 2026, has mandated new fraud risk management directions for All India Financial Institutions. This RBI Notification 2026 requires AIFIs to establish Board-approved policies, constitute a Special Committee of the Board for Monitoring and Follow-up of cases of Frauds (SCBMF), develop Early Warning Signal (EWS) systems, and adhere to strict timelines for fraud classification and reporting, including a debarment period for entities and persons classified as fraudulent.
Who Does This RBI Notification 2026 Apply To?
These Directions, formally known as the Reserve Bank of India (All India Financial Institutions – Fraud Risk Management) Directions, 2026, are explicitly applicable to “All India Financial Institutions” (AIFIs). The circular names these institutions: Export-Import Bank of India (EXIM Bank), National Bank for Agriculture and Rural Development (NABARD), National Housing Bank (NHB), Small Industries Development Bank of India (SIDBI), and National Bank for Financing Infrastructure and Development (NaBFID).
The scope is clear: if you are one of these five institutions, these directions are now your immediate compliance priority. The framework covers prevention, early detection, and timely reporting of fraud incidents to both Law Enforcement Agencies (LEAs) and the RBI itself.
What Are the Key Requirements for Fraud Risk Management?
AIFIs must establish a Board-approved policy on Fraud Risk Management. This policy needs to delineate clear roles and responsibilities for the Board, Board Committees, and Senior Management. It must cover prevention, early detection, investigation, staff accountability, monitoring, recovery, and reporting of frauds, alongside a specific framework for Early Warning Signals (EWS) and Red Flagging of Accounts (RFA).
The Board must review this policy at least once every three years, or more frequently if the Board deems necessary. Furthermore, AIFIs are required to constitute a ‘Special Committee of the Board for Monitoring and Follow-up of cases of Frauds’ (SCBMF). This committee must have a minimum of three Board members, including a Whole Time Director (WTD) and at least two independent directors or non-Executive Directors, chaired by an independent or non-Executive Director.
The SCBMF’s mandate is to oversee the effectiveness of fraud risk management, review and monitor fraud cases, conduct root cause analysis, and suggest measures to strengthen internal controls. The Board will determine the coverage and periodicity of these reviews, considering factors like fraud categories, trends, industry concentration, and delays in detection or classification.
Early Warning Systems and Red Flagging
The RBI Notification 2026 emphasizes robust Early Warning Signal (EWS) and Red Flagging of Accounts (RFA) frameworks. These frameworks must be integrated with Core Banking Solution (CBS) or other operational systems. The Risk Management Committee of the Board (RMCB) will oversee the effectiveness of this framework and approve EWS indicators for monitoring credit facilities, loan accounts, and other banking transactions. The RMCB must also prescribe a Turnaround Time (TAT) for examining EWS alerts, preferably not exceeding 30 days.
AIFIs must set up a dedicated Data Analytics and Market Intelligence (MI) Unit, scaled to their size and complexity, to collect and process information for early detection and prevention of fraud. For credit facilities/loan accounts with an aggregate exposure of ₹3 crore and above, an account, once red flagged, must be reported as a ‘Red Flagged Account Return’ on the Reserve Bank’s CRILC platform within seven days of being red flagged. This ‘exposure’ includes both funded and non-funded exposures.
For other banking/non-credit related transactions, AIFIs must develop and continuously upgrade their EWS systems to identify and parameterize suitable indicators. The design of these systems must be robust to ensure data integrity, customer data security, and real-time or near real-time transaction monitoring to prevent fraudulent activities, especially in non-KYC compliant and money mule accounts. The Data Analytics and MI Unit should extensively monitor transactions, particularly those through digital platforms, to identify unusual patterns.
For more on how advanced analytics can enhance detection capabilities, consider resources like Why G-SIBs are Scraping Rules-Based Compliance for AI-Native Surveillance Models.
Natural Justice and Fraud Classification
A significant procedural change is the explicit requirement to ensure compliance with principles of natural justice before classifying any person or entity as fraudulent. This applies to all cases that may have civil consequences, such as penal measures or caution listing, referencing the Supreme Court’s judgment in State Bank of India & Ors. Vs. Rajesh Agarwal & Ors. (Civil Appeal No. 7300 of 2022, dated March 27, 2023).
Specifically, AIFIs must issue a detailed Show Cause Notice (SCN) to persons (including third-party service providers and professionals), entities, and their promoters/Whole Time Directors (WTDs) and Executive Directors (EDs) against whom fraud allegations are being examined. The SCN must provide complete details of the transactions/actions/events supporting the contemplated fraud declaration. A reasonable time of not less than 21 days must be provided to respond to the SCN. Finally, a reasoned Order must be served, conveying the decision, including relevant facts, submissions, and reasons for classification.
Timelines and Reporting
Once an account is red-flagged, the entire process of classifying it as fraud or removing the red-flagged status must ordinarily be completed within 180 days from the date it was first reported on the CRILC platform. Cases exceeding this 180-day limit must be reported to the SCBMF for review with adequate justification and will be subject to RBI supervisory review.
AIFIs must report incidents of fraud to Law Enforcement Agencies (LEAs) immediately, based on the amount involved: below ₹6 crore to State/Union Territory (UT) Police, and ₹6 crore and above to the Central Bureau of Investigation (CBI). Each AIFI must establish suitable nodal points or designate officers for this reporting and coordination.
For reporting to the RBI, AIFIs must use the online portal for Fraud Monitoring Returns (FMRs) and choose the most appropriate category from the provided list, including “Misappropriation of funds and criminal breach of trust” and “Fraudulent encashment through forged instruments.” The ‘Date of Detection’ for FMR reporting is the actual date the fraud came to light, not the date of approval by the competent authority.
Penal Measures and Resolution
Persons or entities classified and reported as fraud, along with associated entities and persons, will be debarred from raising funds or seeking additional credit facilities from RBI-regulated financial entities for five years from the date of full repayment or compromise settlement. Associated entities include subsidiary companies, joint ventures, or associate companies. For natural persons, all entities where they are associated as promoter, director, or responsible for management are also deemed associated.
However, these penal measures will not apply to entities that have undergone a resolution under the Insolvency and Bankruptcy Code, 2016 (IBC) or other RBI resolution frameworks, resulting in a change of management and control. The AIFI must examine if the fraud classification can be removed post-resolution plan implementation. Importantly, criminal action against erstwhile promoters/directors/persons responsible for the entity’s affairs will continue, and the penal measures will still apply to them.
What This Circular Does NOT Cover
While comprehensive, the RBI Notification 2026 does not specify the exact technological solutions or vendor requirements for developing the EWS systems. It mandates robustness and integration but leaves the implementation details to the AIFIs, encouraging continuous upgrades. It also does not prescribe specific formats for the Board-approved policy beyond listing the required content elements, allowing for institutional flexibility.
The circular also refrains from detailing the internal disciplinary actions for staff accountability, instead referring to guidelines issued by the Central Vigilance Commission (CVC) and the Advisory Board for Banking and Financial Frauds (ABBFF). It does not set a universal threshold for fraud cases to be placed before the SCBMF, leaving this decision to the AIFI’s Board based on scale and complexity.
The Algoy Perspective
The immediate effective date of this RBI Notification 2026 means AIFIs have no grace period to prepare. The requirement for a “Board approved policy on Fraud Risk Management,” alongside the constitution of a “Special Committee of the Board for Monitoring and Follow-up of cases of Frauds” (SCBMF) and a robust EWS framework, demands swift and decisive action. Many AIFIs may find their existing governance structures and technological infrastructure inadequate for the prescribed 180-day fraud classification timeline, especially given the new natural justice requirements. The challenge will be less about drafting policies and more about operationalizing them with sufficient speed and precision. Integrating EWS with Core Banking Solutions (CBS) and other operational systems, coupled with establishing dedicated Data Analytics and MI Units, will require significant investment and a clear roadmap, potentially leveraging advanced RegTech solutions. The natural justice clause, while critical for fairness, adds layers of procedural complexity that could strain investigative resources and impact the 180-day deadline if not managed meticulously.
Frequently Asked Questions
What is a ‘Red Flagged Account’ as per the RBI Notification 2026?
A ‘Red Flagged Account’ is an account where suspicion of fraudulent activity arises from one or more Early Warning Signal (EWS) indicators. This triggers a deeper investigation into potential fraud and necessitates the initiation of preventive measures by the AIFI, as defined in the Reserve Bank of India (All India Financial Institutions – Fraud Risk Management) Directions, 2026.
What are the reporting requirements for red-flagged accounts?
AIFIs must report an account with an aggregate exposure of ₹3 crore and above, once red flagged, as a ‘Red Flagged Account Return’ on the Reserve Bank’s CRILC platform within seven days of being red flagged. This exposure includes both funded and non-funded exposures, as stipulated in the RBI Notification 2026.
What are the consequences for persons and entities classified as fraudulent?
Persons and entities classified as fraud by an AIFI, along with associated entities and persons, are debarred from raising funds and seeking additional credit facilities from RBI-regulated financial entities for five years. This debarment period begins from the date of full repayment of the defrauded amount or the settlement amount agreed upon in a compromise settlement, as outlined in the RBI Notification 2026.
How does the RBI Notification 2026 address staff accountability in fraud cases?
The AIFI must initiate and complete staff accountability examinations in all fraud cases in a time-bound manner, adhering to its internal policy and guidelines issued by the Central Vigilance Commission (CVC). Fraud cases involving ₹3 crore and above, including the role of officials and Whole Time Directors (WTDs), must be referred to the Advisory Board for Banking and Financial Frauds (ABBFF) constituted by the CVC.
Sources and Further Reading
- Reserve Bank of India (All India Financial Institutions – Fraud Risk Management) Directions, 2026
- Reserve Bank of India
- Search and track this circular on RegChat, Algoy’s regulatory chatbot
Track every new RBI, SEBI and IFSCA circular and ask questions in plain English on RegChat — Algoy’s free regulatory chatbot.
[…] identified gaps align with broader industry challenges in fraud risk management. For instance, the RBI has mandated comprehensive fraud risk management for all India financial institutions, emphasizing the need for robust internal controls, which this IFSCA guidance […]