TL;DR
- On 15 July 2024 RBI issued three Fraud Risk Management directions. The commercial-banks one, RBI/2024-25/118, is the rule behind most borrower files.
- An Early Warning Signal is a bank alert. One or more alerts make a Red Flagged Account. A flag is suspicion under investigation, not a fraud finding.
- The bank reports the flag to CRILC within 7 days and should finish the fraud-or-clear decision within 180 days. Natural justice comes first: no hearing, no fraud label.
Fraud is the heaviest word in banking. It follows a promoter across lenders, across group companies, and across years. Until July 2024, borrowers met that word through a patchwork of old circulars. This guide decodes the single direction that replaced them, in borrower language, with the exact timelines your bank now works to.
A short reading guide. Words like shall and must below carry the direction force. Words like preferably and ordinarily carry a softer force, and I mark them as such. Where a number comes from bank policy and not the direction, I say so. That distinction decides what you can demand and what you can only request.
What did the RBI change on 15 July 2024?
On 15 July 2024, RBI replaced the old fraud circulars with three principle-based Master Directions on Fraud Risk Management, one each for commercial banks, cooperative banks, and NBFCs.
The commercial-banks instrument is the Reserve Bank of India (Fraud Risk Management in Commercial Banks (including Regional Rural Banks) and All India Financial Institutions) Directions, 2024. Its citation is RBI/2024-25/118, DOS.CO.FMG.SEC.No.5/23.04.001/2024-25, dated 15 July 2024. It is issued under Chapters III-A and III-B of the RBI Act, 1934 and Sections 21 and 35A of the Banking Regulation Act, 1949. It supersedes the 2016 directions on frauds classification and reporting. In all, 36 earlier circulars stood withdrawn when the revised directions issued (Instruments withdrawn, 2024).
Three shifts matter to a borrower. First, the Board now owns fraud risk. Each bank must run a Board-approved Fraud Risk Management Policy, and the Risk Management Committee of the Board oversees how well the early-warning system works. Second, early warning moved from guidance to architecture. The framework for Early Warning Signals and Red Flagged Accounts was strengthened for early detection and for timely reporting to law enforcement agencies and supervisors. Third, borrower rights entered the text. The directions expressly require the bank to follow the principles of natural justice, in a time-bound manner, before it classifies any person or entity as fraud, taking the Supreme Court judgment of 27 March 2023 in State Bank of India v Rajesh Agarwal into account.
That judgment changed the ground. The Supreme Court held that classifying a borrower account as fraud carries serious civil consequences, so the borrower must get a hearing first. The 2024 directions wrote that holding into bank procedure. A fraud label without a hearing is now a defective label, and borrowers have used exactly that defect in court. Read every timeline in this guide with that right in mind.
Who does the fraud-risk direction apply to?
The direction binds the bank, not the borrower directly: your duties flow from it through your loan documents, your bank policy, and the notices your bank sends you.
The commercial-banks direction is addressed to all commercial banks, including Regional Rural Banks, and to All India Financial Institutions: Exim Bank, NABARD, NaBFID, NHB and SIDBI. Two companion directions of the same date cover cooperative banks and NBFCs, including housing finance companies. If your lender is an NBFC, the parallel NBFC direction governs your file, with the same skeleton: Board policy, early warning, red flagging, natural justice, reporting. Coverage also widened in 2024. Regional Rural Banks, rural cooperative banks and housing finance companies were brought in so that no lender class sits outside the framework (RBI revised directions, July 2024).
| Direction (15 July 2024) | Lenders covered | If this is your lender |
|---|---|---|
| Commercial Banks and AIFIs, RBI/2024-25/118 | Scheduled commercial banks, Regional Rural Banks, AIFIs | This article quotes your rule book. |
| Cooperative Banks direction | Urban, State and Central cooperative banks | Same framework, cooperative-bank instrument. |
| NBFCs including HFCs direction | NBFCs and housing finance companies | Same framework, NBFC instrument. Check your lender class before you quote a clause. |
Why does the lender class matter to you? Because procedure lives in the instrument that binds your lender. Timelines, committees and reporting lines differ in detail across the three directions. Before you reply to any notice, ask your lender which direction and which internal policy clause it is acting under. That one question forces the file onto the record, and it costs you nothing.
What is an Early Warning Signal under the direction?
An Early Warning Signal is a bank-side alert that something in your account conduct needs a fraud-angle look: it is a monitoring trigger inside the bank, not an accusation against you.
The direction asks each bank to build its own framework for these signals under its Board-approved policy. The Risk Management Committee of the Board approves the indicators the bank will track across credit facilities, loan accounts and other banking transactions. Senior management owns the implementation. The bank also runs a Data Analytics and Market Intelligence Unit to strengthen its risk systems. In plain words, your account is watched by systems plus a specialist unit, and the watch list is approved at Board-committee level, not invented by your branch.
Two modal words protect you from over-reading. First, the direction speaks of indicators the bank identifies for monitoring. It does not publish one fixed national trigger list that decides your fate. Banks draw on RBI guidance and their own portfolio, so the same conduct can alert one bank and not another. Second, the examination timeline is soft. The Committee prescribes an appropriate turnaround time for examining alerts, preferably not more than 30 days. Preferably is guidance. Your bank Board sets the binding number in its own policy. If a branch tells you RBI gives exactly 30 days, ask for the bank policy page. The direction wording is softer than the branch claim.
What does this mean at your desk? Account conduct is now read as data. Drawing patterns, end use of funds, stock statements and repayment behaviour feed the same monitoring that your next renewal depends on. The full trigger catalogue and the detection workflow sit in our Early Warning Systems playbook, which this article builds on rather than repeats. And when diversion is the question, the money itself leaves a trail: see money-trail analysis in fraud detection for how investigators follow it.
What is a Red Flagged Account, and what happens next?
A Red Flagged Account is an account where one or more Early Warning Signal indicators throw up a suspicion of fraudulent activity, so the bank investigates from a fraud angle and starts preventive measures.
That definition carries the whole article, so read it slowly. Suspicion, not proof. Investigation, not verdict. The decision to classify an account, standard or NPA, as red-flagged sits at the individual bank level. The flag can rise on a fully regular account. It can also rise on an account already stressed under the IRAC classification clock. The two systems answer different questions. IRAC asks whether you are paying. The fraud framework asks whether the conduct looks dishonest. A borrower can fail either test, or both, and each failure has its own procedure.
Once the flag rises, the reporting clock starts. The bank reports the status of the account on the CRILC platform immediately, and not later than seven days from the date of classification as a red-flagged account. CRILC is the Central Repository of Information on Large Credits, the shared ledger through which your flag becomes visible to the system. Other lenders read CRILC. That is why a flag you treat as a branch matter can surface at your next lender meeting without warning.
The direction then sets the outer clock. Once an account has been red-flagged, the entire process of classifying it as fraud, or removing the red-flagged status, shall ordinarily be completed within 180 days from the first CRILC report. Ordinarily is again a modal word: the norm is 180 days, with room for a justified longer case. Cases still in red-flagged status beyond 180 days go to the Special Committee of the Board for Monitoring and Follow-up of cases of Frauds, with reasons recorded, and they face RBI supervisory review. If your case crosses 180 days, that committee review is a fact you can ask about in writing. The bank must have a reason on record.
If the flag is on your account, the week-by-week borrower playbook, the triggers banks watch and the reply file to build sit in our guide to what a Red Flagged Account means for the borrower.
One widening rule needs your attention. When an account is identified as fraud, the borrowal accounts of other group companies with common promoters or whole-time directors must also be examined from the fraud angle. Your flag is never only about one company. Promoters who run three entities through one finance team should expect all three files to be read together. Keep that structure in mind long before any flag rises, when a credit officer studies your bank statement the way an officer actually reads it.
When does forensic audit come in?
Forensic audit comes in after red-flagging, when the bank needs an independent, evidence-grade look at where the money went before it decides fraud or no fraud. We walk the whole audit as a process, from who the bank can appoint to what the fieldwork examines and the borrower playbook while it runs, in our forensic audit in bank fraud cases guide.
The direction builds the audit into the loan contract itself. Your loan agreement carries clauses for an audit at the lenders behest once the account is red-flagged. That means you consented to this audit on the day you signed, whether you remember the clause or not. The bank commissions an internal or external audit of the flagged account. Auditors trace end use, test related-party flows, and check whether the books match the trail. Our stock audit guide shows the field discipline auditors bring, and the drawing power calculation shows the arithmetic they will re-perform on your limits.
The non-cooperation clause is the sharpest line in this section, and it is direction text, not branch invention. Where the audit report stays inconclusive, or gets delayed due to non-cooperation by the borrower, the bank shall conclude on the status of the account as fraud or otherwise, based on the material available on its record and its own internal investigation. Silence does not stall the process. Silence hands the decision to a file that holds only the bank side. Every CA who advises a flagged borrower should read that sentence twice. Produce documents, log every submission, and answer queries in writing. Cooperation is not courtesy here. It is evidence management.
Audit timelines deserve the same modal care. The direction requires the audit agreement to carry a Board-approved time limit for completion and report submission. It does not hand borrowers one fixed national audit deadline to quote back. If your bank states a completion date, ask which Board-approved limit it flows from. Precision about which clock applies will matter if the 180-day outer limit comes under pressure.
What must the bank report, and by when?
The bank must report the red-flag status to CRILC within seven days, close the fraud-or-clear decision within 180 days in the ordinary course, and route fraud reporting and Board oversight through the committees the direction creates.
| Step | Direction wording | What it means for you |
|---|---|---|
| EWS alert examination | Turnaround prescribed by the Board committee, preferably not more than 30 days | Guidance, not a borrower right. Your bank policy holds the binding number. |
| RFA report to CRILC | Immediately, not later than 7 days from red-flagging | Other lenders can see the flag fast. Do not learn about it from a new lender. |
| Fraud-or-clear decision | Ordinarily within 180 days of first CRILC report | Your outer clock. Beyond it, Board-committee review with reasons. |
| Fraud classification | Only after natural justice, in a time-bound manner | No hearing means a defective label. Keep the show-cause record. |
Beyond CRILC, the direction runs fraud reporting to supervisors and law enforcement through Board-set governance: the Special Committee of the Board, or a Committee of Executives where the Board so provides, watches fraud cases, and the Board sets the exposure threshold for that watch. Monthly certificates and flash reports from the old regime stand discontinued under the revised framework (RBI FAQs on the 2024 directions). Borrowers feel this reporting layer in one place: speed. A case no longer waits for a monthly cycle. It moves on the seven-day and 180-day clocks above. For what exactly the bank files at each step, see our CRILC reporting guide for red-flagged accounts, which walks through the Rs 3 crore reporting line, the seven-day timeline, and the ledger-level detail.
A threshold warning, stated plainly. You will read online that EWS monitoring starts at Rs 50 crore, or that CRILC reporting starts at Rs 5 crore. Those figures come from older RBI reporting practice and from bank policy, not from a borrower threshold stated in the 2024 direction text this article quotes. Treat any rupee threshold your lender cites as bank policy unless the lender shows you the direction paragraph. Your sanction letter and your bank fraud policy are the binding papers for your file. The same discipline governs your limits day to day: the credit appraisal memorandum is where these conduct readings get recorded for the next sanction.
What does natural justice mean for your loan?
Natural justice means the bank must tell you the case against you, hear your reply, and only then decide: a fraud label without that hearing breaks the direction.
The mechanics run like this. The bank issues a show-cause notice setting out the fraud allegation and the material it relies on. You reply within the window the notice gives. The direction itself sets that window as not less than 21 days (2.1.1.2). The bank considers your reply and the record, then passes a reasoned decision to classify as fraud, or to drop the flag. RBI stated the rule in mandatory words: regulated entities shall ensure compliance with the principles of natural justice in a time-bound manner before classifying persons or entities as fraud. Shall is the strongest modal in the book. A bank that skips the hearing has not followed its own rule book, and the Rajesh Agarwal judgment gives that skip legal weight.
The consequence of a fraud label explains why the hearing matters. A classified borrower faces penal consequences, including debarment from further bank finance for five years after full payment of the defrauded amount, as practitioner notes on the direction record. Group accounts come under examination, as covered earlier. Future lenders see the record. A promoter can spend longer fighting the label than running the business. That is why the reply window is the most valuable fortnight in the whole framework. Spend it on documents, not on phone calls. Reply in writing, annex the trail, and keep the acknowledgment.
One boundary needs care. Natural justice protects the classification step. It does not freeze the investigation. The bank can flag, report to CRILC, audit and examine while your reply is prepared. Do not mistake the hearing right for a stay on the process. Run both tracks at once: cooperate with the audit trail, and build the show-cause reply with your CA and counsel together.
What should borrowers and CAs do now?
Borrowers and CAs should keep account conduct clean enough to survive a fraud-angle reading, and keep a reply file ready before any notice arrives.
Start with conduct, because conduct is the data. End use of funds should match the sanction purpose, on the statement, without detours through unrelated accounts. Stock and book-debt statements should match the books your auditor signs. Related-party flows need contracts, invoices and pricing logic on file before anyone asks. None of this is new advice. The direction changed the reader: a Board-approved system now reads this conduct continuously, and a specialist unit tests what the system throws up. Files that once waited for the annual review now get read in near real time.
Next, build the reply file while times are good. Keep sanction letters, audit clauses, end-use certificates, and statement submissions in one indexed folder, physical or digital. Note who in your team owns bank queries, and how fast you can produce a 12-month trail. If a show-cause notice lands, your 21 days should go into argument, not into hunting for paper. CAs add one more layer: reconcile the bank statement with the books every quarter, and flag conduct patterns to the client before the bank system flags them. That quarterly habit is the cheapest fraud-direction compliance a mid-size borrower can buy.
Finally, know your clocks and your words. Seven days to CRILC. One hundred and eighty days to a decision. A hearing before any fraud label. Preferably 30 days is guidance, while shall and not later than are mandates. When a lender quotes a rule at you, ask one calm question: is that the direction, or your bank policy? Both bind you in practice, but they bind you differently, and your reply strategy changes with the answer. The workbook below turns these checks into a monthly self-audit you can run before your bank does.
EWS and RFA Self-Check Tracker
All-formula workbook: score your account conduct across 12 fraud-direction checks. Get your risk band, the checks to fix first and your reply-file readiness. No sign-up needed
Worried a conduct flag could hit your next renewal? The EWS and RFA clocks in your file decide what the bank sees first. CrediLens reads financial documents the way a credit officer does, so gaps surface before the bank finds them. See how it works
Sources
- RBI Master Directions on Fraud Risk Management in Commercial Banks (including RRBs) and AIFIs: RBI/2024-25/118, DOS.CO.FMG.SEC.No.5/23.04.001/2024-25, 15 July 2024. Primary source for instrument identity, EWS objective, RFA definition, CRILC and 180-day wording.
- RBI Master Directions on Fraud Risk Management in Banks and Financial Institutions (full text mirror): Ch. IV wording on CRILC reporting, forensic audit and non-cooperation. Verbatim mirror used with the RBI listing.
- RBI FAQs on Master Directions on Fraud Risk Management in Regulated Entities, 2024: Board-set committee thresholds; discontinued monthly certificates and flash reports.
Rupee thresholds for monitoring or reporting that lenders cite in practice come from bank policy and CRILC practice unless a direction paragraph states them. This article states that limit wherever a threshold appears.
Frequently Asked Questions
Is a Red Flagged Account the same as a fraud account?
No. A Red Flagged Account is a suspicion stage, not a finding. One or more Early Warning Signal indicators raise suspicion, the bank investigates, and only after that process does it classify the account as fraud or remove the flag. The direction gives 180 days for that decision.
Can my standard account be red-flagged, or only NPAs?
Both can. The direction covers any account, standard or NPA, where Early Warning Signal indicators suggest possible fraud. A standard current account with clean repayments can still be flagged if the conduct pattern triggers investigation. The flag is about conduct, not about dues alone.
How many days do I get to reply to a fraud show-cause notice?
The direction requires the bank to follow natural justice in a time-bound manner before any fraud classification, and explainers record a 21-day reply window on the show-cause notice. Treat that window as your deadline. Ask for the material relied on, reply in writing, and keep proof of delivery.
What happens if I do not cooperate with the forensic audit?
The direction covers this directly. Where an audit stays inconclusive or delayed because the borrower does not cooperate, the bank concludes the matter on the material on its record and its own investigation. Silence does not stop the clock. It removes your version from the file the bank decides on.
Does a fraud classification bar me from all bank credit?
A fraud classification carries a penal bar. Practitioner notes on the direction record debarment from further bank finance for five years after full payment of the defrauded amount. Your other group accounts with common promoters or directors also get examined from the fraud angle. The stakes go beyond one facility.
My account crossed 180 days as an RFA. What happens next?
The whole process should ordinarily finish within 180 days of the first CRILC report. Cases still open beyond 180 days go to the Special Committee of the Board for review with reasons, and they face RBI supervisory review. Ask your bank, in writing, which stage your case is at.
Is the Rs 5 crore EWS threshold an RBI rule I can rely on?
No. The 2024 direction asks each bank to run its own approved Early Warning Signal framework. Exposure thresholds for monitoring or reporting are set by bank policy and CRILC practice, not stated as one borrower rule in the direction. Your sanction letter and your bank policy decide your file.
Last updated: October 2026. Direction wording is from the 15 July 2024 instruments cited above. Your sanction letter and your bank fraud policy decide your file.
Get Free CAM Sample Report & AI Parser Demo
Request the official banking CAM Excel template and see how BaseWorks automates bank statement parsing & ratio calculation in seconds.