What do the RBI fraud risk management directions for NBFCs require?
The Reserve Bank of India (Non-Banking Financial Companies - Fraud Risk Management) Directions, 2026 (the FRM Directions, 2026), issued on July 31, 2026 and effective immediately, set a framework for preventing, detecting early and reporting fraud at NBFCs in the Upper Layer (UL), the Middle Layer (ML) and the Base Layer (BL) with assets of ₹500 crore and above, and at housing finance companies (HFCs) in those layers wherever applicable.
For a credit team, five points carry the most weight:
- No account can be classified as fraud without a detailed show cause notice (SCN), at least 21 days to respond, and a reasoned order.
- A Fraud Monitoring Return (FMR) goes to RBI immediately, and no later than 14 days from the date of classification, whatever the amount. HFCs report to the National Housing Bank (NHB) instead.
- UL and ML NBFCs must run an Early Warning Signal (EWS) framework. BL NBFCs are outside that chapter.
- Persons and entities classified and reported as fraud, and their associates, are debarred from raising funds or seeking additional credit from RBI-regulated financial entities for five years from full repayment or settlement.
- Title documents on credit facilities of ₹1 crore and above need periodic legal audit and re-verification until the loan is fully repaid.
The FRM Directions, 2026 repeal the earlier fraud instructions for NBFCs, as communicated in circular DoS.CO.PPG.66/11.01.005/2026-27 dated July 31, 2026. The text does not list changes against those instructions, so this piece decodes the current text and makes no old-versus-new comparison.
Which lenders do the RBI fraud risk management directions cover?
The FRM Directions, 2026 cover UL and ML NBFCs, BL NBFCs with assets of ₹500 crore and above, and HFCs under the NHB Act in those layers wherever applicable. Asset size is taken from the audited balance sheet as on 31 March of the immediately preceding financial year (para 3).
| Lender type | FRM Directions, 2026 apply | EWS chapter (Chapter III) | Fraud committee (para 8) | Fraud and theft-type reporting |
|---|---|---|---|---|
| UL NBFC | Yes | Yes | Board committee (SCBMF) | RBI |
| ML NBFC | Yes | Yes | SCBMF or Committee of Executives | RBI |
| BL NBFC, ₹500 crore and above | Yes | No | SCBMF or Committee of Executives | RBI |
| BL NBFC, below ₹500 crore | Outside the ‘Applicable NBFC’ definition | No | Not applicable | Not applicable |
| HFC under the NHB Act, in the layers above | Yes, wherever applicable | Not stated in the text | SCBMF, with the Committee of Executives option for ML and BL | NHB, in NHB’s returns and formats |
Chapter III is addressed to ‘NBFCs - UL and ML’, not to ‘Applicable NBFCs’, the term that brings in HFCs. The text does not state how Chapter III applies to HFCs, so an HFC should take that question to its compliance team.
SCBMF is the Special Committee of the Board for Monitoring and Follow-up of cases of Frauds. The SCBMF has at least three Board members: the CEO (or the MD where the CEO is not a whole-time director) and two Independent Directors, with one Independent Director as head. A Committee of Executives also needs at least three members, one of them a whole-time director or official of equivalent rank.
Why do the FRM Directions, 2026 matter for underwriters?
The FRM Directions, 2026 matter for underwriters because a fraud classification reaches beyond one account, and the file has to support the reasoned order. The Directions tie the process to the Supreme Court’s judgment of March 27, 2023 in State Bank of India & Ors. vs. Rajesh Agarwal & Ors., because classification can have civil consequences such as penal measures and caution listing (para 6).
The Directions are not written product by product. Read against the three main retail and MSME products, the provisions land as follows:
- MSME term loans: a fraud finding pulls in other group borrowers with a common promoter or whole-time director for examination (para 29), and the debarment reaches associated entities (para 35).
- Home loans: valuers and advocates can be issued an SCN (para 6), and the title audit rule applies to credit facilities of ₹1 crore and above (para 53).
- Personal loans: a small ticket gives no exemption, because the FMR applies irrespective of amount (para 43).
How does an account move from suspicion to fraud classification?
An account moves from suspicion to fraud classification through audit, notice, response and a reasoned order. These steps come from Chapters II and IV of the FRM Directions, 2026 and apply to all Applicable NBFCs.
| Stage | What the FRM Directions, 2026 require | Para |
|---|---|---|
| Monitoring | Stay alert to activity in loan accounts and other financial transactions that could turn out to be fraudulent | 24 |
| Investigation | On suspicion, use an external or internal audit as per the Board-approved policy | 25 |
| Loan agreement | Include clauses allowing such an audit at the lender’s behest | 27 |
| Notice | Issue a detailed SCN with complete details of the transactions, actions or events relied on | 6(1) |
| Response | Allow not less than 21 days | 6(2) |
| Order | Serve a reasoned order covering the facts relied on, the submissions received and the reasons for the decision | 6(4) |
The SCN goes to the persons and entities under examination and their promoters, whole-time directors and executive directors. Third-party professionals such as architects, valuers, chartered accountants and advocates are covered too. For non-whole-time directors, including nominee and independent directors, the NBFC may take into account that they normally do not run the business (para 6(1)).
A stalled audit does not stop the classification process. If the report is inconclusive or delayed because the borrower will not cooperate, the NBFC concludes on the material on record and its own assessment, while still following natural justice (para 27). Where Law Enforcement Agencies (LEAs) start an investigation on their own, the NBFC still follows its Board-approved policy and the para 6 process (para 30).
Agreements with third-party service providers may include terms that hold them accountable where wilful negligence or malpractice is a causative factor in the fraud (para 31). The para 31 wording is ‘may’, so it is permissive rather than mandatory.
What do the early warning signal rules require of UL and ML NBFCs?
Chapter III of the FRM Directions, 2026 requires UL and ML NBFCs to run an Early Warning Signal (EWS) framework under the Board-approved policy, overseen by the Risk Management Committee or another Board-level committee with similar functions. The main requirements are:
- Both quantitative and qualitative indicators. Illustrative sources are account transaction data, borrower financial performance, market intelligence and borrower conduct (para 19).
- Integration with the Core Banking Solution or other operational systems, and timely remedial action on alerts (para 17).
- Periodic review of indicators, and validation as directed by the Board-level committee (paras 15 and 16).
- Periodic review of credit sanction and monitoring processes (para 17).
- For non-credit transactions, monitoring in real time or with minimum time lag, with specific vigilance on non-KYC compliant and money mule accounts (para 22).
An EWS alert requires an examination of whether the account should be investigated from a potential fraud angle (para 20). An alert alone is not a classification, which still runs through the para 6 process. The FRM Directions, 2026 do not prescribe specific indicators or thresholds. Each NBFC identifies its own indicators (para 15).
What are the fraud reporting deadlines for NBFCs?
The main fraud reporting deadline under the FRM Directions, 2026 is an FMR to RBI immediately, and no later than 14 days from the date of classification. The table below applies to Applicable NBFCs. Chapters VI and VIII do not apply to HFCs, which report to NHB as NHB prescribes (para 3).
| Event | Report to | Deadline | Para |
|---|---|---|---|
| Incident of fraud | LEAs, namely State Police Authorities | Immediately, subject to applicable laws; mandatory reporting advised at ₹1 lakh or more | 40, footnote 5 |
| Fraud case, any amount | RBI, FMR through the online portal | Immediately, not later than 14 days from date of classification | 42, 43 |
| Update to a reported case | RBI, FMR Update Application | Not specified | 43 |
| Theft, burglary, dacoity, robbery, including attempts | RBI Fraud Monitoring Group, by e-mail | Immediately, not later than seven days from occurrence | 57 |
| All such cases in the quarter | RBI, quarterly return through the online portal | Within 15 days of quarter end | 58 |
The FMR uses three dates that are easy to mix up (para 4):
| Date | Meaning |
|---|---|
| Occurrence | When misappropriation actually started, or the event occurred, as shown by audit or other findings |
| Detection | When the fraud came to light in the branch, audit or department, not the date of approval |
| Classification | When competent authority approval is obtained and the reasoned order is passed |
Only people and entities involved in or associated with the fraud should be named in the FMR (para 47). Withdrawal of an FMR or removal of a name is for exceptional circumstances, needs due justification and needs approval from an official of at least director rank (para 48). Court-directed withdrawal can happen immediately and is then placed before an official of whole-time director rank for information (para 49).
How long does fraud debarment last, and what happens on resolution?
Fraud debarment under para 35 of the FRM Directions, 2026 lasts five years from the date of full repayment of the defrauded amount, or of the settlement amount in a compromise settlement. Associated parties are defined as follows:
- For an entity: its subsidiary, joint venture or associate company, under the Companies Act, 2013 definitions cited.
- For a natural person: entities where the person is a promoter, a director or in charge of and responsible for managing the affairs.
After the five years, the lender has sole discretion to lend or decline (para 36).
A resolution under the Insolvency and Bankruptcy Code, 2016 (IBC) or RBI’s resolution framework that changes management and control has a different effect. The NBFC examines whether the fraud classification should continue or be removed. Penal measures no longer apply to the entity once the plan is implemented, but they continue for the erstwhile promoters, directors and persons in charge (paras 37 to 39).
What else should credit teams track in the FRM Directions, 2026?
The FRM Directions, 2026 also set rules on staff accountability, account sales, case closure, governance and cases already running:
- Staff accountability: this must be examined in all fraud cases in a time-bound manner under internal policy (para 32). Delays in identifying and reporting fraud also call for accountability (para 46). Government-NBFCs follow Central Vigilance Commission (CVC) guidelines, and public sector NBFCs also refer cases of ₹3 crore and above to the Advisory Board for Banking and Financial Frauds (para 33).
- Account sales: the fraud investigation must be finished before a transfer to another lender or an Asset Reconstruction Company (ARC). If fraud is concluded, report it to RBI before the sale, or to NHB for HFCs. After a sale to an ARC, keep reporting developments using information from the ARC (para 54).
- Closure: this requires disposal of the case by LEAs or courts and completed staff accountability (para 50). Para 51 allows closure for limited statistical and reporting purposes on cases up to ₹25 lakh, where the staff examination and any disciplinary action are done and investigation or trial has been pending for more than three years from the First Information Report (FIR), on the conditions stated there. Keep details of all closures for auditors (para 52).
- Governance: a Board-approved policy is reviewed at least once in three years (para 7), a sufficiently senior official handles monitoring and reporting (para 11), and the fraud amount is disclosed in Notes to Accounts (para 12).
- Cases already running: action taken or initiated under the repealed instructions stays governed by those instructions (para 60).
The Board sets several parameters under the FRM Directions, 2026, including the amount threshold for committee review (para 8), audit timelines (para 26) and the scope and periodicity of title audits (para 53). Limits vary by institution, so check your own Board-approved policy.
Worked example, made-up numbers
This made-up case applies the FRM Directions, 2026 to an ML NBFC with a ₹40 lakh MSME term loan outstanding. Audit findings show that funds were diverted.
| Step | Made-up date | Note |
|---|---|---|
| Date of occurrence | 5 February | Diversion began, per audit findings |
| Date of detection | 3 September | Internal audit flagged it |
| SCN served | 10 September | Sent to the entity, its promoter and its whole-time director |
| Minimum response window ends | 1 October | 21 days after service |
| Date of classification | 12 October | Approval obtained and reasoned order passed |
| Last date for FMR | 26 October | 14 days from classification |
The other provisions then apply as follows:
- LEA reporting: ₹40 lakh is above the ₹1 lakh level in footnote 5, so the case goes to State Police.
- Closure: ₹40 lakh is above ₹25 lakh, so para 51 is not available and para 50 applies.
- Title audit: ₹40 lakh is below ₹1 crore, so para 53 is not engaged.
- Debarment: if the amount is fully repaid on 1 April 2028, debarment runs until 1 April 2033.
Common pitfalls under the FRM Directions, 2026
These are the points in the FRM Directions, 2026 that are easiest to misread:
- Using the approval date as the date of detection: para 4 rules this out explicitly.
- Starting the FMR clock too late: classification depends on both approval and the reasoned order, so the two need to move together. Filing is due immediately, and 14 days is the outer limit.
- Leaving the LEA trigger undefined: para 40 says immediately but does not state a start point. As working practice, settle this in the policy with legal and compliance input.
- Assuming how days are counted: the FRM Directions, 2026 do not spell out a day-count method for the 21-day and 14-day periods. As working practice, agree one with compliance and leave a margin.
- Applying Chapter III to every NBFC: the EWS chapter is addressed to UL and ML NBFCs only, but the para 24 duty to monitor and stay alert covers all Applicable NBFCs.
- Sending an HFC’s FMR to RBI: HFCs report to NHB.
- Treating the end of debarment as a right to credit: lending after five years stays at the lender’s sole discretion.
- Assuming resolution clears the promoters: relief goes to the entity, not to the erstwhile promoters and directors.
Checklist for the FRM Directions, 2026
Use this checklist to test a credit team’s readiness against the FRM Directions, 2026:
- Confirm your layer and, for BL, the asset size in the audited balance sheet as on the preceding 31 March.
- Check that loan agreements carry the lender audit clause (para 27).
- Review third-party agreements for accountability terms (para 31).
- Keep an SCN template with complete transaction details and a minimum 21-day response period.
- Make sure reasoned orders record the facts, the submissions and the reasons.
- Record occurrence, detection and classification dates separately on each case.
- Diary the FMR deadline from the date of classification.
- On a fraud finding, examine group borrowers with a common promoter or whole-time director (para 29).
- Include debarred persons and their associated entities in pre-sanction checks, using the sources your institution provides.
- Track credit facilities of ₹1 crore and above for periodic title audit (para 53).
- Finish the fraud investigation before any loan sale or ARC transfer (para 54).
- For UL and ML NBFCs, examine each EWS alert for whether the account needs investigating from a fraud angle (para 20).
Sources
- Reserve Bank of India (Non-Banking Financial Companies – Fraud Risk Management) Directions, 2026, rbi.org.in, accessed 2026-11-06
