Early Warning Signals (EWS) in Indian banking are RBI's illustrative set of Early Warning Signal indicators that banks must track on large borrower accounts: from bouncing high-value cheques and heavy cash withdrawals in loan accounts to promoter stake reductions and suspicious related-party transactions. Under the RBI's July 2024 Master Directions on Fraud Risk Management (RBI/DOS/2024-25/118), every regulated entity must run a board-approved EWS framework integrated with its Core Banking Solution, and when one or more signals throw up suspicion of fraud, the account is classified as a Red Flagged Account (RFA) for accounts with exposure of ₹50 crore and above. From there a fixed workflow kicks in: audit investigation, a show-cause notice with at least 21 days to respond, and ordinarily a final decision - fraud classification or removal of the red-flag status - within 180 days of first reporting on CRILC. This guide walks through the full pipeline the way a risk team actually runs it.
TL;DR: EWS in 30 seconds
- What: RBI's illustrative Early Warning Signal indicators that banks monitor on large accounts (₹50Cr+ exposure).
- Regulatory anchor: RBI Master Directions on Fraud Risk Management, July 15, 2024 (RBI/DOS/2024-25/118); extended July 31, 2026 for small finance banks and co-operative banks.
- The workflow: EWS alert → examine within ~30 days → red-flag (RFA) → external/internal audit investigation → show-cause (≥21 days) → reasoned order → fraud classification or red-flag removal within 180 days of first CRILC reporting.
- What changed in 2026: dedicated Data Analytics & Market Intelligence units, RFA reporting of ₹3Cr+ accounts on CRILC within 7 days (SFBs), explicit money-mule monitoring.
- Why it matters to lenders: most frauds are visible in account and statement data months before default, if someone is watching between annual reviews.
Contents
- The regulatory timeline: 2015 → 2024 → 2026
- The EWS trigger catalogue (grouped)
- The EWS → RFA → forensic-audit workflow
- The detection layer: catching signals between annual reviews
- Case pattern: the governance-failure archetype
- Implementation checklist for risk teams
- Downloadable EWS red-flag checklist
- Frequently Asked Questions
The regulatory timeline: 2015 → 2024 → 2026
2015: the framework is born. RBI introduces the Red Flagged Account (RFA) concept: an account where suspicion of fraudulent activity is thrown up by the presence of one or more Early Warning Signals. The monitoring threshold is set at exposure of ₹50 crore or more at the level of a bank, irrespective of solo, multiple-banking, or consortium arrangements (Business Standard, 2015). Banks are told they "cannot afford to ignore such EWS" and must use them as triggers for detailed investigation.
July 15, 2024: the Master Directions. RBI issues three revised Master Directions on Fraud Risk Management for (1) commercial banks (including RRBs) and AIFIs, (2) co-operative banks, and (3) NBFCs including HFCs, superseding the 2016 Master Directions on Frauds and withdrawing 36 earlier circulars(Economic Laws Practice). The 2024 directions, shaped by the Supreme Court's March 2023 judgment in SBI v. Rajesh Agarwal(banks must hear borrowers before classifying accounts as fraud), add:
- Board-approved EWS/RFA frameworks with the Risk Management Committee of the Board (RMCB) overseeing effectiveness
- EWS integrated with the Core Banking Solution for real-time monitoring
- Mandatory Data Analytics and Market Intelligence units
- Principles of natural justice before fraud classification: detailed show-cause notice, not less than 21 days to respond, and a reasoned order (News18)
- A Special Committee of the Board for Monitoring and Follow-up of Frauds (SCBMF), minimum three members, headed by an independent or non-executive director (Business Today)
If you borrow rather than lend, the borrower-side reading of the same directions matters more: what a red flag means for your next facility, the reply window, and the classification clock. Our decoded guide to the RBI fraud risk management directions walks through those steps in plain words. Once the flag is up, the investigation clock and your reply rights run as set out in our borrower guide to Red Flagged Accounts under the RBI directions.
July 31, 2026: the framework reaches smaller lenders. RBI notifies three parallel directions with immediate effect: the (Small Finance Banks - Fraud Risk Management) Directions, 2026 (RBI/DoS/2026-27/421), the (Urban Co-operative Banks - Fraud Risk Management) Directions, 2026 (RBI/DoS/2026-27/439), and the(Rural Co-operative Banks - Fraud Risk Management) Directions, 2026 (RBI/DoS/2026-27/451) (taxguru). Key additions for SFBs: a dedicated Data Analytics and Market Intelligence Unit, red-flagged accounts with aggregate exposure of ₹3 crore and above reported on CRILC within seven days of red-flagging, explicit vigilance on money-mule and non-KYC-compliant accounts, transaction monitoring "on real-time basis or with a minimum time lag", and legal audit of title documents for credit facilities of ₹1 crore and above.
The direction of travel
From an illustrative trigger list in 2015, to board-owned real-time monitoring in 2024, to entity-specific enforcement machinery in 2026.
The EWS trigger catalogue (grouped)
RBI publishes these as an illustrative list of Early Warning Signal indicators - reproductions of the directions vary slightly in count (typically low-40s), so treat the list as illustrative, not canonical. Below they are grouped the way a risk officer thinks, with what each signal actually looks like in bank-statement and account data, which is where most of these get caught in practice.
This catalogue is written the way a risk officer thinks. For the borrower-side version of the same list, every signal explained in plain language with what it looks like in your books and the practical fix, see our complete EWS list explained for borrowers.
Group 1: fund diversion signals
| EWS trigger | What it looks like in account / statement data |
|---|---|
| Funds coming from other banks to liquidate the outstanding loan amount (unless in normal course) | Inward transfers from unrelated bank accounts routed straight to loan closure; no corresponding business inflow |
| Exclusive collateral charged to several lenders without NOC | Multiple charge registrations on the same asset visible in ROC/MCA records |
| Floating front/associate companies by investing borrowed money | Disbursed funds traced to newly incorporated entities; same directors across entities |
| Non-routing of sales proceeds through consortium/member bank | Sales credits appearing in non-consortium accounts; consortium account shows declining turnover despite reported revenue |
| LCs issued for local trade / related-party transactions without underlying trade | LC devolvements with no matching purchase invoices or GST filings |
| High-value RTGS payments to unrelated parties | Large one-way outflows to entities with no purchase history or business relationship |
| Heavy cash withdrawal in loan accounts | Repeated large ATM/branch cash debits inconsistent with the borrower's stated business |
| Funding of interest by sanctioning additional facilities | Interest debits immediately followed by fresh credits from new facilities (circular servicing) |
| Increase in borrowings despite huge cash and cash equivalents | Balance sheet shows cash piles while fresh drawdowns continue, the classic hoarding/diversion pattern |
| Large number of transactions with interconnected companies and large outstanding from such companies | Dense web of inter-company transfers; round-tripping (funds return to originator via intermediaries) |
| Substantial related-party transactions | Concentrated outflows to entities sharing directors, addresses, or auditors with the borrower |
Group 2: financial distress signals
| EWS trigger | What it looks like in account / statement data |
|---|---|
| Default in undisputed payment to statutory bodies (as declared in the annual report) | PF/ESI/GST payments stopping while operations ostensibly continue |
| Bouncing of high-value cheques | Cheque-return entries clustering in the account |
| Delay observed in payment of outstanding dues | EMIs/interest serviced late, with penal charges appearing regularly |
| Frequent invocation of BGs and devolvement of LCs | Contingent liabilities crystallising into funded exposure |
| Significant movements in inventory, receivables, or other current assets disproportionate to turnover | Drawing power based on inflated stock statements; receivables ageing with no collections |
| Significant increase in working capital borrowing as a percentage of turnover | Utilisation creeping to the limit while sales stagnate, visible in monthly stock statements |
| Increase in fixed assets without corresponding increase in long-term sources | Project funds diverted; short-term borrowings funding long-term assets |
| Frequent change in accounting period and/or accounting policies | Year-on-year numbers that cannot be reconciled; restated comparatives |
| Project cost in wide variance with standard installation cost | Disbursement milestones met on paper; physical progress lags |
| Claims not acknowledged as debt running high | Contingent liabilities swelling in the notes to accounts |
| Substantial increase in unbilled revenue year after year | Revenue recognised without cash collection: the classic receivables bubble |
| Frequent requests for general-purpose loans / frequent ad hoc sanctions | Repeated top-ups and temporary overdrafts outside the sanctioned structure |
Group 3: governance signals
| EWS trigger | What it looks like in account / statement data |
|---|---|
| Concealment of vital documents (master agreement, insurance coverage) | Missing documentation in the credit file; repeated follow-ups logged |
| Liabilities appearing in ROC search report but not in the annual report | Hidden borrowings surface in MCA filings |
| Critical issues highlighted in the stock audit report | Stock auditor flags discrepancies between declared and physical inventory |
| Material discrepancies or inconsistencies within the annual report | Numbers that don't tie across sections, a basic analytical red flag |
| Poor disclosure of materially adverse information; no auditor qualification | Clean audit opinion alongside deteriorating account conduct |
| Raid by income tax / sales tax / central excise officials | Public-domain event; corroborates fund-flow anomalies |
| Significant reduction in promoter/director stake or increase in encumbered shares | Promoter pledging shares to raise parallel funding |
| Resignation of key personnel and frequent management changes | Auditor, CFO, or compliance officer exits in quick succession |
| Dispute on the title of collateral securities | Collateral valuation collapses on legal verification |
| Under-insured or over-insured inventory | Insurance coverage inconsistent with declared stock levels |
| Invoices devoid of TAN and other details; non-production of original bills | Shell-vendor pattern: invoices that don't survive basic verification |
Group 4: conduct and project signals
| EWS trigger | What it looks like in account / statement data |
|---|---|
| Frequent change in the scope of the project | Sanctioned end-use keeps shifting; disbursements don't match any stable plan |
| Request to postpone godown inspection for flimsy reasons | Physical verification evaded, often alongside inventory-related triggers above |
| Critical issues in stock audit (also a governance signal) | The overlap is the point: diversion and distress usually arrive together |
The pattern across all four groups
Fund diversion is visible in transaction data, distress is visible in financial statements, governance failures are visible in public filings, and most accounts show signals from two or more groups at once. That clustering is itself the strongest indicator.
The EWS → RFA → forensic-audit workflow
This is the part no ranking page walks through. In practice, the pipeline runs as six stages with hard regulatory timelines:
| Stage | What happens | Who owns it | Regulatory timeline |
|---|---|---|---|
| 1. Detection | EWS alert fires from the CBS-integrated monitoring system or the Data Analytics & MI unit | Risk / analytics team | RMCB prescribes TAT, preferably not more than 30 days to examine each alert |
| 2. Triage & red-flagging | Account classified as Red Flagged Account (RFA) where EWS indicators throw up suspicion of fraud; commercial-bank framework monitors accounts with ₹50Cr+ exposure | Senior management; RMCB reviews RFA status periodically | Immediate on identification; RFA reported on CRILC |
| 3. Investigation | The red-flagged account is examined through external audit or internal audit from the fraud angle; no restructuring or additional facilities permitted while red-flagged | Audit team / forensic auditors | Within the 180-day outer limit below |
| 4. Natural justice | Detailed show-cause notice served on the persons/entities (including promoters, whole-time directors, and involved third-party professionals); borrower gets not less than 21 days to respond; bank passes a reasoned order | Board committee | ≥ 21 days for the response window |
| 5. Classification | Account classified as fraud, or red-flag status removed | Board / competent authority | Ordinarily within 180 days of first reporting the account as red-flagged on CRILC |
| 6. Reporting & follow-up | Fraud Monitoring Returns (FMR) filed; CRILC updated; law-enforcement reporting (private/foreign banks: below ₹1Cr to State/UT police, ₹1Cr+ to SFIO and police; PSBs/RRBs: below ₹6Cr to police, ₹6Cr+ to CBI); staff accountability examined | Compliance / fraud monitoring group | FMR within 14 days of classification; SFB red-flagged accounts (₹3Cr+) on CRILC within 7 days |
Two consequences worth noting for borrowers: persons/entities classified as fraud are debarred from accessing credit facilities for five years from the date of full repayment or settlement of the defrauded amount, and third-party professionals involved (valuers, CAs, advocates) can be reported to the Indian Banks' Association (ELP analysis).
One honest caveat
RBI's directions mandate the audit investigation and the 180-day outer limit, but they do not prescribe a fixed "forensic audit in X days" deadline in the text; banks set their own board-approved timelines inside that window. Any article quoting a 30/90-day forensic-audit mandate as RBI law is overclaiming. For the investigative techniques used once a forensic audit begins, see our money trail analysis guide. For the audit process itself, from triggers and engagement to fieldwork and the borrower playbook, see our forensic audit in bank fraud cases guide.
The detection layer: catching signals between annual reviews
Here is the structural weakness the RBI keeps tightening the screws on: most EWS monitoring historically happened at the annual review, when the credit officer pulled fresh financials. But fund diversion doesn't wait for the annual review. High-value RTGS outflows to unrelated parties, heavy cash withdrawals, non-routing of sales proceeds through the consortium account, circular inter-company transfers. All of these are visible in transaction data within days, not at year-end.
That is exactly why the RBI now requires:
- EWS systems integrated with the Core Banking Solution for real-time monitoring
- A dedicated Data Analytics and Market Intelligence unit sized to the bank's risk profile
- Continuous monitoring of non-credit transactions too, with the 2026 SFB directions explicitly calling out money-mule accounts and digital-platform transaction patterns
- Examination of every EWS alert within a board-prescribed TAT of preferably ≤30 days
For lenders, the practical implication is continuous bank-statement and account monitoring as the detection layer: automated extraction of transaction data, pattern detection on counterparty networks, and alerts on the diversion signals in Group 1 long before the annual review. This is the layer CrediLens is built for, and it's the part of the EWS framework where most banks are still weakest. And EWS is the after-sanction mirror of the pre-sanction discipline: our guide to the Credit Appraisal Memorandum (CAM) covers how banks assess a borrower's creditworthiness before the loan is ever disbursed. The sanction-side view of the same account behaviour is in our guide to bank statement analysis: what credit officers look for.
See diversion signals fire in real time
The RBI mandates continuous EWS monitoring, but most banks still review accounts annually. CrediLens watches transaction data between reviews and flags Group 1 diversion signals as they appear.
Request a monitoring demoCase pattern: the governance-failure archetype
The most expensive Indian fraud episodes share a structural pattern, visible in the well-documented large private-bank stress and resolution episode of 2020, and in RBI's own case studies. Recognising the archetype early is the whole point of EWS:
Governance erosion first
Promoter stake reductions, key personnel and auditor resignations, rising related-party transactions. These are Group 3 signals: public, cheap to monitor, and almost always the earliest.
Financial engineering next
Unbilled revenue growth, receivables ageing, frequent ad hoc sanctions to bridge gaps. Group 2 signals accumulate.
Diversion last
Once the hole is too large to bridge, funds start moving: related-party outflows, circular transactions, cash withdrawals. Group 1 signals.
The recognition lag
Because monitoring happens at annual reviews, the account is typically recognised as stressed 12-18 months after the governance signals first appeared.
No names need naming: the pattern is structural, and every risk officer who has lived through one recognises it. The EWS framework exists precisely to compress that recognition lag from quarters to weeks.
Implementation checklist for risk teams
The bookmarkable version: what a bank or NBFC risk team needs to have in place under the current directions:
- Board-approved Fraud Risk Management policy covering prevention, early detection, investigation, staff accountability, monitoring, recovery, and reporting
- EWS/RFA framework under that policy, with RMCB-approved EWS indicators and a prescribed TAT of preferably ≤30 days for examining alerts
- EWS system integrated with CBS (or operational systems), upgraded on an ongoing basis
- Dedicated Data Analytics and Market Intelligence unit (mandatory under 2024/2026 directions)
- RFA classification process for accounts meeting the exposure threshold (₹50Cr+ under the commercial-bank framework)
- External/internal audit investigation workflow for every red-flagged account
- Show-cause and reasoned-order machinery: detailed SCN, ≥21-day response, written order with facts and reasoning
- 180-day clock tracked from first CRILC reporting of the red-flagged account
- CRILC reporting discipline: RFA within the prescribed window (2026 SFB directions: ₹3Cr+ within 7 days); FMR within 14 days of fraud classification
- SCBMF constituted (min. 3 board members, headed by independent/non-executive director) with defined review coverage
- Law-enforcement reporting matrix in place (LEA thresholds by bank type)
- Whistle-blower mechanism for fraud/suspicious-activity complaints
- Legal audit of title documents (credit facilities ₹5Cr+ under 2024 directions; ₹1Cr+ for SFBs under 2026 directions)
- Staff accountability examination process (PSBs/AIFIs: reference to the Advisory Board for Banking and Financial Frauds where applicable)
- Quarterly fraud reviews before the Audit Committee; annual review before the Board
Downloadable EWS red-flag checklist
The full trigger catalogue above is long by design; it's a reference. For day-to-day use, we've condensed it into a one-page EWS red-flag checklist your credit and risk teams can run against any large account: the triggers grouped by signal type, with the statement-data signatures to check for each.
EWS Red-Flag Checklist (Excel)
All RBI triggers, grouped into fund diversion, financial distress, governance, and conduct signals, with the statement-data signature to check for each. Built for credit and risk teams running continuous monitoring. Request it via the lead form below, or download it directly.
An early warning is only useful if the file behind it is clean. Two checks keep it that way: why manual Excel bank analysis fails on live borrower files, and the CMA mistakes banks flag before a file ever reaches the warning stage.
Frequently Asked Questions
What are early warning signals in banking?
Early Warning Signals (EWS) are RBI's illustrative set of Early Warning Signal indicators that Indian banks must monitor on large borrower accounts, covering fund diversion (e.g., high-value RTGS to unrelated parties), financial distress (e.g., bouncing cheques, receivables bubbles), governance failures (e.g., promoter stake reduction, auditor resignations), and suspicious transaction patterns. They were introduced in 2015 and consolidated under the RBI's July 2024 Master Directions on Fraud Risk Management.
What is a red-flagged account (RFA)?
A Red Flagged Account is one where suspicion of fraudulent activity is thrown up by the presence of one or more EWS indicators. Red-flagging triggers a deeper investigation from the fraud angle, through external or internal audit, and preventive measures by the bank. Under the commercial-bank framework, EWS monitoring applies to accounts with exposure of ₹50 crore or more. No restructuring or additional facilities may be granted while an account is red-flagged.
What happens after an account is red-flagged in India?
The bank investigates through external or internal audit, then must follow principles of natural justice: serve a detailed show-cause notice, give the borrower at least 21 days to respond, and pass a reasoned order. Classification as fraud or removal of the red-flag status must ordinarily be completed within 180 days of first reporting the account as red-flagged on CRILC. If classified as fraud, the bank files Fraud Monitoring Returns within 14 days and reports to law-enforcement agencies.
What did RBI's July 2026 fraud-risk directions change?
On July 31, 2026, RBI issued parallel Fraud Risk Management Directions for small finance banks, urban co-operative banks, and rural co-operative banks. For SFBs, the key additions are a dedicated Data Analytics and Market Intelligence Unit, reporting of red-flagged accounts with ₹3 crore+ exposure on CRILC within 7 days, explicit monitoring of money-mule and non-KYC-compliant accounts, and legal audit of title documents for credit facilities of ₹1 crore and above. Note the scope: the urban co-operative bank and rural co-operative bank directions of the same date carry no CRILC red-flag reporting line; rural co-operative banks report frauds to NABARD. Our CRILC reporting guide for red-flagged accounts walks through which banks the line applies to.
How do banks actually detect early warning signals?
Under the current directions, detection must run through EWS systems integrated with the Core Banking Solution, overseen by the Risk Management Committee of the Board, with each alert examined within a board-prescribed turnaround time of preferably 30 days. In practice, the strongest detection layer is continuous monitoring of account and bank-statement transaction data: diversion signals like circular inter-company transfers and unrelated-party RTGS outflows are visible in transaction data months before they appear in annual financials.
Where can I get an EWS red-flag checklist for my team?
Request our one-page EWS red-flag checklist (Excel) via the lead form below: it condenses all the RBI triggers with their statement-data signatures, built for credit and risk teams running continuous monitoring.
Get Free CAM Sample Report & AI Parser Demo
Request the official banking CAM Excel template and see how BaseWorks automates bank statement parsing & ratio calculation in seconds.