TL;DR
- A Red Flagged Account is a suspicion stage, not a fraud finding. One or more Early Warning Signal indicators trigger a deeper fraud-angle check.
- The clock is 7 days to CRILC and ordinarily 180 days to a fraud or clear decision. You get at least 21 days to reply to a show-cause notice.
- Your limits, audit duties and exit route turn on bank policy and your sanction letter. Keep a reply file ready before any notice arrives.
Your branch calls. The account is red-flagged. No overdue. No case filed. Just a flag on a system you cannot see. This guide explains what the flag means under the RBI directions of 15 July 2024, what happens week by week, and what to do at each step.
A note on words. Where this guide says the bank shall do something, the direction uses strong wording. Where it says ordinarily or preferably, the wording is softer and I mark it as such. Where a hold or a threshold comes from bank policy and not the direction, I say so. That split decides what you can demand and what you can only request in writing.
What is a Red Flagged Account under the RBI July 2024 directions?
A Red Flagged Account is an account where one or more Early Warning Signal indicators raise suspicion of fraudulent activity, so the bank starts a deeper investigation from a fraud angle and takes preventive measures.
Suspicion, not proof. Investigation, not verdict. The rule book is RBI/2024-25/118, DOS.CO.FMG.SEC.No.5/23.04.001/2024-25, dated 15 July 2024, for commercial banks including Regional Rural Banks and All India Financial Institutions. RBI issued three directions that day, for commercial banks, cooperative banks and NBFCs. The full survey sits in our guide to the RBI fraud risk directions decoded. This article stays on your side of the flag.
Two points borrowers miss. A standard account can be flagged. The flag decision sits at bank level and covers standard and NPA accounts. Dues and conduct are different tests. See the IRAC classification clock for dues. This is the conduct test. And the flag is not the fraud label. The bank must investigate, hear you and pass a reasoned order first. The flag starts the process. It does not end it.
Ignore one vintage number. 2015 reports put early warning monitoring at Rs 50 crore at bank level. That was the old framework. The 2024 text does not use Rs 50 crore as a flag trigger. Its reporting line is Rs 3 crore total fund and non-fund exposure for CRILC. A smaller account can still be flagged under bank policy. Your sanction letter decides.
What triggers a red flag on your loan account?
A red flag is triggered by conduct and transaction patterns that the bank early warning system is built to catch, from a returned high-value cheque to sales proceeds routed outside the lending bank.
Each bank runs its own framework under a Board-approved Fraud Risk Management Policy. The Risk Management Committee of the Board approves the indicators for credit facilities and other transactions. The system reads transaction data, financial performance, market intelligence and conduct, linked to core banking. A Data Analytics and Market Intelligence Unit supports it. Your account is read as data daily, not once a year.
Picture the signs together. A cheque of Rs 2.4 crore returns unpaid. Creditors are paid late. Stock statements do not match the signed books. Sales of Rs 3.1 crore meant for the lending bank sit in another bank. Invoices miss tax details. Collateral title is disputed. Funds arrive from another bank only to repay an instalment. The godown visit is put off. Interest is paid from a fresh ad hoc limit. One sign can be clean. Together they create suspicion. The full catalogue sits in our Early Warning Systems playbook.
If law enforcement has started its own inquiry into the account, the bank flags at once and finishes classification in the same 180 days. Ask in writing if your flag is conduct-led or agency-led. The file you build differs. When diversion is the question, see money-trail analysis in fraud detection for how the trail is rebuilt.
What happens in the first 30 days after an EWS alert?
In the first 30 days the bank examines the alert and decides whether the account needs to be flagged and investigated from a fraud angle.
Generation of an alert does not flag you at once. It starts an examination. The committee prescribes a turnaround time for that examination, with direction guidance that it should preferably not be more than 30 days. Preferably is soft wording. It guides the bank. It does not give you a 30-day right you can enforce against every branch. Your bank Board-approved policy holds the binding number. If a relationship manager quotes 30 days as an RBI order, ask for the policy page that sets the bank own turnaround. Precision here saves a pointless argument later.
The bank tests the alert against the ledger, stock and debtor position and the statement trail. You feel this stage as queries. A call for invoices. A request to explain routing. A visit that is now minuted. Reply in writing even when the ask is verbal. The officer reading your bank statement the way an officer actually reads it will later read your audit replies. Start the paper trail now.
Banks had six months from July 2024 to build or upgrade the system. That window is closed. Conduct that waited for annual review now surfaces fast. Plan for that speed.
Do three things in week one, before any flag letter. Pull the sanction letter and mark the audit clause and any hold or recall wording. Open one indexed folder for the last 12 months of statements, stock statements, invoices and tax returns, in the order an auditor will ask for them. Write a one-page note for each alert you can guess at, with amount, date and correction. If the bank flags you on day 22, as in the worked file below, that folder is already built. The 21-day show-cause window should go on argument, not on hunting for paper.
What does the RFA investigation clock look like, day by day?
The investigation clock runs 7 days to CRILC, then ordinarily 180 days to a fraud or clear decision, with audit and show-cause steps inside that window.
| Step | Direction wording in plain English | What you should do |
|---|---|---|
| EWS alert examination | Committee sets the turnaround, preferably not more than 30 days | Answer queries in writing. Start the reply file. Guidance, not a borrower deadline. |
| Flag and CRILC report | Report at once and not later than 7 days from flag date, for accounts at or above Rs 3 crore total exposure | Ask for flag date and CRILC date in writing. Other lenders can soon read the flag. |
| Audit and investigation | External or internal audit under Board-approved policy, on a Board-approved timeline | Produce documents, log each submission, reply to each query. Do not let silence decide. |
| Show-cause and reply | Detailed notice with material relied on, not less than 21 days to reply, then a reasoned order | Use the full window on documents and argument. Keep delivery proof. |
| Decision | Fraud or removal of flag, ordinarily within 180 days of first CRILC report | Beyond 180 days the case goes to the Board committee with reasons. Ask which stage you are at. |
Watch the clocks on one file. Arjun Textiles of Surat is illustrative. The dates are real. Exposure is Rs 18.6 crore, above the Rs 3 crore threshold. The account is standard, overdue never beyond 12 days. On 2 February 2026 an alert fires: a cheque of Rs 2.4 crore returns unpaid and sales of Rs 3.1 crore routed outside the lending bank are traced.
| Date | Step | Days from first CRILC |
|---|---|---|
| 2 February 2026 | Early warning alert. Examination starts. | Flag still to come |
| 24 February 2026 | Bank classifies the account as flagged. Day 22 from alert, inside the preferably 30-day guidance. | CRILC still to come |
| 26 February 2026 | First CRILC report. Two days after flag, inside the 7-day window. | Day 0 |
| 2 March to 22 April 2026 | External audit fieldwork. Invoices, transport records and bank trail produced. | Day 4 to Day 55 |
| 6 May 2026 | Detailed show-cause notice issued with transactions relied on. | Day 69 |
| 22 May 2026 | Borrower reply filed in writing. Day 16 of the 21-day window, with annexures. | Day 85 |
| 12 June 2026 | Reasoned order removes the flag. Routing found to be a treasury error, corrected and evidenced. | Day 106 |
| 25 August 2026 | Outer date. 180 days from 26 February. Decision already taken, with 74 days to spare. | Day 180 |
Check the arithmetic the way your CA will. Seven days from 24 February 2026 is 3 March, because February 2026 has 28 days. The report on 26 February sits inside it. One hundred and eighty days from 26 February is 25 August 2026. The order on 12 June is 106 days after first reporting, so 74 days spare. The workbook below runs the same dates by formula, so you can drop in your own flag letter dates and read your outer date at once.
Can the bank stop disbursals, freeze limits or block restructuring while you are flagged?
The bank can hold fresh disbursals, unutilised limits and restructuring while you are flagged, but that hold flows from preventive measures, bank policy and your sanction letter, not from one direction sentence you can quote.
The internet misleads here. 2015 reports state a flat bar on restructuring and fresh facilities for flagged accounts. That was the 2015 text. The 2024 chapter does not carry that blanket line. It requires investigation, preventive measures, audit, reporting and a hearing. How preventive measures become a hold is bank policy and sanction terms.
In practice the hold is real. Undrawn headroom is watched drawing by drawing. Fresh disbursals wait for audit comfort. Ad hoc limits and enhancements pause. A restructuring ask is deferred until the fraud angle clears. No committee rewrites tenor while it tests honesty. Monthly drawing power still follows your stock statement. See drawing power calculation for that arithmetic. Auditors re-perform it on flagged files.
Make the hold visible. Ask in writing for the flag date, the facility covered, the hold by limit, and the clause it rests on. Do not route sales outside the lending bank to dodge it. On a flagged file that reads as proof.
When does a forensic audit start, and what does it check?
A forensic or internal audit starts after flagging, when the bank needs an independent evidence-grade test of where the money went before it decides fraud or no fraud. The full audit process, from triggers to fieldwork to the borrower reply playbook, is walked through in our forensic audit in bank fraud cases guide.
The audit is built into your contract. After flagging the bank uses an external or internal audit under Board-approved policy. The engagement policy covers competence and track record. The contract carries a Board-approved timeline. Your loan agreement has an audit-on-flagging clause. You agreed on signing day.
Fieldwork is practical. Auditors trace end use against sanction purpose. They match invoices to credits and stock movement. They test related-party flows for contracts and pricing. They re-perform drawing power from paid stock and debtor age. They read for diversion and ever-greening. Our guide to stock audit in banks shows the same discipline. Keep GST, books and credits reconciled. A gap you explain in one page costs a day. A gap found in the draft costs credibility.
Silence hurts you. If the audit is inconclusive or delayed by non-cooperation, the bank decides on its own record and inquiry. The 180-day clock does not pause. Log each submission with date and officer name. Answer each query in writing. That is how your version reaches the order.
What are your rights before the bank can classify the account as fraud?
Your core right is a hearing before the label: a detailed show-cause notice, at least 21 days to reply, examination of your reply, and a reasoned order that can be read and challenged.
The Supreme Court judgment of 27 March 2023 in State Bank of India v Rajesh Agarwal is now in the procedure. The policy must give a detailed notice with transactions relied on, at least 21 days to reply, a set system to examine replies, and a reasoned served order with facts, your submission and reasons.
Use the 21 days well. The notice of 6 May 2026 in the worked file sets 27 May as the last date. The borrower files on 22 May. Reply to each transaction relied on, not to fraud in general. Annex the trail in the same order. Ask for material not annexed. File in writing and keep proof. Draft with CA and counsel together. The CA owns numbers. Counsel owns the record.
The hearing protects classification. It does not freeze inquiry. The bank can flag, report and audit while you reply. Run both tracks. If the bank skips the hearing or gives no reasons, record it. That defect matters after Rajesh Agarwal. Your reply file also shapes the next credit appraisal memorandum and the full credit appraisal process, step by step.
How does an account exit Red Flagged status?
An account exits Red Flagged status in one of two ways inside the 180-day window: the bank removes the flag after investigation, or it classifies the account as fraud after hearing you.
The clean exit is removal. The order of 12 June 2026 in the worked file removes the flag, records routing as a corrected treasury error and keeps closer watch for two quarters. Ask for the order in writing and keep it with your sanction papers. Your next lender will ask. Confirm the CRILC status is updated after removal and keep that note.
The hard exit is fraud classification, after audit, notice, reply and order. Debarment then runs five years from full repayment or settlement, for the classified person and associated entities. Fresh lending after that is the bank choice. Group accounts with common promoters are also examined. Map your group first.
Past 180 days the case goes to the Special Committee of the Board with reasons and RBI review. Ask your stage in writing after day 150. If control later changes via insolvency or RBI resolution, the bank reviews if the label stays. Penalties stop for the resolved entity, not for past promoters. Take advice on that narrow path.
RFA Action Tracker
All-formula workbook: drop in your flag dates and read your 7-day, 30-day and 180-day deadlines, plus a borrower document and response checklist. No sign-up needed
Reading a flagged file before the bank does? CrediLens reads financial documents the way a credit officer does, so conduct gaps and trail breaks surface before the audit finds them. See how it works
Can other banks see your RFA?
Yes, for larger exposures other banks can see the flag on CRILC within a week, and after a fraud classification they can see the case in the Central Fraud Registry.
CRILC is the Central Repository of Information on Large Credits. At Rs 3 crore total exposure and above, the flag is reported at once and within seven days. Other lenders read CRILC at appraisal. Your flag also feeds the early warning watch of the system. Our CRILC reporting guide for red-flagged accounts walks through the Rs 3 crore line, the seven-day timeline, and the ledger-level detail.
The Central Fraud Registry is next. It is a searchable database fed by Fraud Monitoring Returns. After fraud classification the bank reports at once and within 14 days. That return places the case where other banks search. Payment-system suspect cases go to a separate payments registry and join the main registry if confirmed as fraud. Cases close only after law or court disposal and staff review complete, with a narrow statistical closure for smaller cases after three years. CRILC and the registry do not apply to Regional Rural Banks, which report to NABARD. Ask which return carries your status if that is your lender.
Plan for visibility. A new lender will see the CRILC flag and ask for the flag letter, reply file and removal order. Carry them first. Disclosure with papers reads as control. Discovery reads as concealment.
Sources
- RBI Master Directions on Fraud Risk Management in Commercial Banks (including RRBs) and AIFIs: RBI/2024-25/118, DOS.CO.FMG.SEC.No.5/23.04.001/2024-25, 15 July 2024. Primary source for flag definition, committee oversight, preferably 30-day guidance, Rs 3 crore CRILC threshold, 7-day and 180-day clocks, audit and non-cooperation, 21-day show-cause and reasoned order, group examination, five-year debarment and registry reporting.
- RBI Master Directions on Fraud Risk Management in Banks and Financial Institutions (full text mirror): clause-level text used with the RBI listing for the flagged-account chapter. Wording in this article is paraphrased, with modal force kept as written.
- ELP note: RBI Revised Master Directions on Fraud Risk Management, July 2024: practitioner summary used only where it matches the direction text, for corroboration of reporting and penal points.
The Rs 50 crore monitoring figure and the flat bar on restructuring and additional facilities in 2015 news reports belong to the 2015 framework. They are not stated as borrower rules in the 2024 direction text above. Any hold on your limits flows from preventive measures, bank policy and your sanction letter. Ask for the clause in writing.
Frequently Asked Questions
Is a Red Flagged Account the same as a fraud account?
No. A Red Flagged Account is a suspicion stage. One or more Early Warning Signal indicators raise suspicion, the bank investigates and audits, and only then does it remove the flag or classify the account as fraud. The fraud label comes after a show-cause notice and a reasoned order.
Can a standard account with no overdue be red-flagged?
Yes. The decision to flag an account sits at individual bank level and covers standard and NPA accounts alike. The test is conduct, not dues. A regular account can be flagged if transactions, routing or documents suggest possible fraud and need a fraud-angle check.
How long can my account stay red-flagged?
The whole process of classifying the account as fraud or removing the flag should ordinarily finish within 180 days from the first CRILC report. Cases still flagged beyond 180 days go to the Special Committee of the Board with reasons and face RBI supervisory review.
Will my limits and disbursals stop while the account is flagged?
It depends on your bank policy and sanction letter, not on one direction line. Banks often hold fresh disbursals, ad hoc limits and restructuring while they investigate and take preventive measures. Ask for the hold in writing and which policy clause the branch is using.
What happens if I do not cooperate with the forensic audit?
The bank will decide on its own record. Where an audit stays inconclusive or is delayed because the borrower does not cooperate, the direction lets the bank conclude fraud or otherwise on material on its record plus its own investigation. Silence removes your version from the file.
How many days do I get to reply to a fraud show-cause notice?
You get a reasonable time of not less than 21 days from the notice date. The notice must give complete details of the transactions and events relied on. Reply in writing within that window, annex your trail and keep proof of delivery with the bank.
Can other banks see my Red Flagged status?
For exposures at or above Rs 3 crore in total, the flag is reported on CRILC within seven days, and other lenders read CRILC when they appraise you. After a fraud classification, the case is reported within 14 days and flows to the Central Fraud Registry.
Last updated: October 2026. Direction wording is from the 15 July 2024 instruments cited above. Your sanction letter and your bank fraud policy decide your file.
Get Free CAM Sample Report & AI Parser Demo
Request the official banking CAM Excel template and see how BaseWorks automates bank statement parsing & ratio calculation in seconds.