Fraud early warning signals under RBI 2026: working an alert

What should a properly worked EWS alert produce?

A properly worked early warning signal (EWS) alert ends in a recorded decision on whether to red-flag the account, followed where needed by a CRILC report, an audit, a show cause notice and a fraud or no-fraud conclusion. The governing text is the Reserve Bank of India (Commercial Banks - Fraud Risk Management) Directions, 2026, dated 31 July 2026 and in effect immediately on issuance.

These Directions apply to commercial banks: banking companies other than small finance banks, payments banks and local area banks, plus corresponding new banks and the State Bank of India (Paragraph 3). Credit teams at other lender types should work from the directions that apply to them, which this page does not cover.

The 2026 Directions set these limits for commercial banks:

What do you need before working an EWS alert?

A credit manager working an EWS alert at a commercial bank needs these items in hand. Exact limits, formats and authorities vary by institution.

• The current list of EWS indicators approved by the RMCB, which Paragraph 14 of the 2026 Directions makes the approving body.
• The TAT the RMCB has prescribed for examining alerts.
• The Board-approved Fraud Risk Management Policy, including who can red-flag an account and who can classify fraud.
• The account’s total exposure, split into fund-based and non-fund-based.
• The loan agreement, to confirm it has the audit clause that Paragraph 28 of the 2026 Directions requires.
• A named contact for CRILC and FMR filing.

Which fraud red flags does RBI list in the 2026 directions?

The RBI 2026 fraud directions do not prescribe a list of specific red flags. Paragraph 19 requires an EWS system with both quantitative and qualitative indicators, and says the broad indicators may illustratively draw on four bases. The examples in the right-hand column below are general working practice, not RBI text.

How do you move an EWS alert to a red-flag decision and a fraud conclusion?

These steps apply to credit facilities at commercial banks under the 2026 Directions. Paragraph references mark what the Directions say. Each ‘what good looks like’ line is general working practice.

1. Log the alert. Record the indicator, source, date and owner, and calculate the TAT end date. What good looks like: anyone reading the log can see which approved indicator fired and when examination is due.
2. Examine whether to red-flag. Under Paragraph 21, an EWS alert requires examination of whether the account needs to be red-flagged and investigated from a potential fraud angle. What good looks like: a short dated note with the evidence, the conclusion and the reasons, including when the alert is closed without a red flag.
3. Take the red-flag decision. Under Paragraph 29, the decision sits at the individual bank level and covers accounts that are standard or NPA. Under Paragraph 33, the bank must immediately red-flag an account where a law enforcement agency has started an investigation on its own. What good looks like: the decision is dated and stands on the bank’s own assessment, not on the account’s asset classification or on another lender’s view.
4. Report on CRILC. Paragraph 22 requires the Red Flagged Account Return within seven days of red-flagging for aggregate exposure of ₹3 crore and above, counting fund-based and non-fund-based exposure. Paragraph 29 also sets a seven-day outer limit. What good looks like: non-fund-based lines are included in the total before anyone concludes the account falls below the threshold.
5. Start preventive and remedial action. Paragraph 4(6) says a red-flagged account requires preventive measures, and Paragraph 17(2) requires timely remedial action on alerts. Neither paragraph lists the measures. What good looks like: action within the loan agreement and bank policy, such as closer monitoring of drawings and end use, with each action recorded.
6. Commission the audit. Paragraph 26 requires an external audit, or an internal audit as per the Board-approved policy, for further investigation. Under Paragraph 28, if the report is inconclusive or delayed because the borrower does not cooperate, the bank concludes on the material on record and its own investigation. What good looks like: the audit scope names the specific transactions behind the alert, and the delivery date is tracked against the 180-day limit.
7. Follow natural justice before any fraud classification. Paragraph 6 requires a detailed SCN with complete details of the transactions or events relied on, not less than 21 days to respond, and a reasoned order covering the facts, the submissions and the reasons. What good looks like: every point in the order traces back to the SCN and the reply, and the file shows how each submission was considered.
8. Conclude within the limit. Under Paragraph 31, classification as fraud or removal of red-flag status should ordinarily finish within 180 days of first CRILC reporting. Cases beyond 180 days go to the Special Committee of the Board for Monitoring and Follow-up of cases of Frauds (SCBMF) with reasons, and are subject to RBI supervisory review. What good looks like: the SCN goes out early enough that the reply period and the order both fit inside the limit.
9. If fraud is concluded, complete the reporting. Paragraph 49 requires the FMR immediately, and not later than 14 days from the date of classification. Paragraph 44 requires immediate reporting to law enforcement. Paragraph 32 requires examination, from a fraud angle, of other group company accounts with a common promoter or whole-time director. What good looks like: FMR, complaint and group check each have an owner and a date on the day the order is passed.

Paragraph 44 of the 2026 Directions sets where the fraud complaint goes:

Worked example, made-up numbers

Every figure, date and fact in this worked example is invented. A private sector bank has an MSME borrower whose credits in the cash credit account fall out of line with reported sales, and an approved indicator fires.

The fund-based subtotal of ₹2.50 crore is below ₹3 crore, but the aggregate of ₹3.25 crore is above it, so the Red Flagged Account Return applies. The bank in this example has set a 30-day TAT.

The made-up amount involved in the fraud is ₹2.10 crore. At this private sector bank, the amount is above ₹1 crore, so the complaint goes to the State or UT Police, and details go to the Serious Fraud Investigation Office. At a public sector bank, the same amount is below ₹6 crore, so the complaint would go to the State or UT Police alone.

Common errors when handling EWS alerts and red-flagged accounts

These errors come up when commercial banks apply the 2026 Directions to EWS alerts and red-flagged accounts.

• Treating an alert as a red flag. Paragraph 21 requires examination of whether to red-flag after an alert. Paragraph 4(6) ties a red-flagged account to suspicion of fraudulent activity arising from one or more indicators.
• Treating 30 days as a fixed RBI limit. Paragraph 14 has the RMCB prescribe the TAT, preferably not more than 30 days. Work to the figure your bank’s RMCB has set.
• Leaving non-fund-based exposure out of the ₹3 crore test. Paragraph 22 counts all fund-based and non-fund-based exposures.
• Assuming the threshold settles everything for smaller accounts. Paragraph 22 sets the ₹3 crore threshold for the return. Paragraph 29 does not repeat it, and Paragraph 31 starts the 180-day period from first CRILC reporting. For a red-flagged account below ₹3 crore, confirm the reporting and timeline treatment with your compliance team.
• Mixing up the FMR dates. Under Paragraph 4, the date of detection is when the fraud came to light, not the approval date. The date of classification is when approval is obtained and the reasoned order is passed. The date of occurrence is when the misappropriation started or the event occurred. The 14-day FMR limit in Paragraph 49 runs from classification.
• Starting the SCN too late. The 21-day minimum in Paragraph 6(2) has to fit inside the 180 days in Paragraph 31, along with the audit and the order.
• Skipping the conclusion when the borrower blocks the audit. Paragraph 28 has the bank conclude on the material on record and its own investigation, with natural justice still strictly followed.
• Stopping at the borrower. Paragraph 6(1) extends the SCN to promoters, whole-time and executive directors, and third parties such as valuers and chartered accountants against whom allegations are being examined. Paragraph 32 extends examination to group companies with a common promoter or whole-time director.
• Understating the consequence. Paragraph 39 debars persons and entities classified and reported as fraud, and those associated with them, from raising funds or seeking additional credit from RBI-regulated financial entities for five years from full repayment of the defrauded or settlement amount. Treat the file as one that may be read closely.