The Reserve Bank of India fraud risk framework directs non-banking lenders with assets of ₹500 crore and above to run early warning systems, board oversight, and firm reporting schedules. Lenders link early warning alerts to core loan systems, uphold natural justice before declaring fraud, and file returns within 14 days. These rules fix direct accountability on staff and third-party vendors.
- The Reserve Bank of India Fraud Risk Management Directions took effect on 15 July 2024, replacing the 2016 framework.
- The six-month window to set up early warning systems closed on 15 January 2025.
- Rules cover Upper, Middle, and Base Layer lenders with assets of ₹500 crore and above, including housing finance firms.
Governance Structure and Layer Scope
Every non-banking lender with assets of ₹500 crore or more must keep a board-approved fraud risk policy reviewed every three years.
The Reserve Bank of India set these standards in its Fraud Risk Management in NBFCs Directions, 2024, repealing its earlier 2016 directions. Asset size on March 31 sets scope across Upper, Middle, and Base Layers, including housing finance firms. Base Layer entities under ₹500 crore are exempt.
Board oversight varies by tier:
- Upper Layer NBFCs: Must form a board Special Committee for Monitoring Frauds with the CEO and two Independent Directors, chaired by an Independent Director.
- Middle and Base Layer NBFCs (₹500 crore+): May form the board committee or an executive committee with three members, including a Whole-Time Director.
Natural Justice and Borrower Defense
Lenders cannot classify a borrower as fraud without giving a fair hearing and issuing a reasoned written order.
Under the Supreme Court ruling in State Bank of India & Ors. v. Rajesh Agarwal & Ors., lenders must observe natural justice before declaring fraud. Lenders must issue a detailed Show Cause Notice covering all disputed deals and audit findings.
As analyzed by S&R Associates, borrowers get 21 days to respond. The committee reviews the reply and issues a reasoned speaking order detailing its factual grounds.
Early Warning Signals and System Tracking
Upper and Middle Layer lenders must build automated early warning signal monitoring into their core loan systems.
The system needs board committee approval and executive rollout. As noted by AZB & Partners, tracking must be automated across two groups:
- Quantitative Signals: Cheque or NACH bounces, turnover mismatches, asset gaps, and inventory variance.
- Qualitative Signals: Negative market news, key executive exits, and auditor resignations.
Lenders also track digital channels, mobile apps, unverified accounts, and potential mule account networks. The setup window closed on January 15, 2025.
The 10-Step Fraud Governance Lifecycle
Managing suspected fraud follows ten structured stages under Reserve Bank directions, from initial early warning detection to legal closure:
- 01
EWS Detection
Core systems flag quantitative or qualitative transaction anomalies.
- 02
Forensic Audit
Lender triggers loan agreement rights to inspect accounts and group entities.
- 03
Show Cause Notice
Institution serves notice detailing all alleged events and evidence.
- 04
21-Day Defense Window
Borrower receives a statutory minimum of 21 days to respond.
- 05
Committee Evaluation
Board or executive committee reviews borrower submissions against audit findings.
- 06
Reasoned Speaking Order
Committee issues written order confirming or dropping classification.
- 07
FMR Regulatory Filing
Compliance files Fraud Monitoring Return on central portal within 14 days.
- 08
Law Enforcement FIR
Nodal officer reports fraud to police or investigating agencies.
- 09
Statutory Debarment
Classified promoters face 5-year credit freeze; errant vendors blacklisted.
- 10
Staff Accountability & Closure
Audit committee oversees staff action; legal disposal required before closure.
Penalties, Third-Party Rules, and Debarment
Classified borrowers face a five-year credit freeze, while delinquent third-party professionals face industry blacklisting.
Loan agreements must grant lenders clear rights to run external forensic audits and inspect group firms sharing common promoters. For loans of ₹1 crore and above, lenders must audit title deeds periodically until debts are cleared.
| Role | Governance Duty | Regulatory Consequence |
|---|---|---|
| Borrowers & Promoters | Reply to Show Cause Notice within 21 days | 5-year credit ban across all RBI lenders after full loan clearance |
| Third-Party Vendors | Valuers, CAs, advocates sign indemnity terms | Blacklisting via industry bodies (such as the Indian Banks' Association) for gross negligence |
| Staff & Executives | Time-bound internal inquiries | Board Audit Committee oversees reviews for MD, CEO, or Directors |
If ownership changes under corporate insolvency, the firm sheds debarment, but the five-year ban stays on former promoters.
Reporting Timelines and Case Closure Rules
Regulatory reporting clocks start ticking the moment an account is classified or a theft occurs.
Key filing deadlines include:
- Fraud Monitoring Returns: Under Reserve Bank rules on TaxGuru, lenders file an FMR within 14 days of classification. Housing finance firms report to the National Housing Bank.
- Police Complaints: Nodal Officers must report fraud to police or central agencies without waiting for audits to finish.
- Thefts and Robberies: Report to the RBI Fraud Monitoring Group within 7 days, with quarterly returns.
- Financial Disclosures: Disclose fraud sums, provisions, and recoveries in annual financial notes.
- Case Closure: Accounts close after court disposal and completed staff action. Statistical closure applies to cases up to ₹25 lakh after 3 years of pending trial.
Firms failing these rules face penalties under Section 58G of the Reserve Bank of India Act, 1934. Many lenders use enterprise fraud detection tools to track risk and meet these operational duties.
What This Means for NBFC Compliance Teams
Read together, the 21-day notice rule and early warning signals mean fraud controls cannot operate as a post-default check. Alerts must build an evidence trail that supports a reasoned speaking order. This suggests risk teams should audit alert logs regularly to ensure triggers receive timely review or documented clearance.
The practical implication of the five-year credit ban and vendor blacklisting is that third-party checks must merge with underwriting. Because errant professionals face blacklisting, lenders should review vendor contracts and enforce group audit terms now.
Furthermore, filing returns within 14 days while lodging police reports means teams cannot wait for slow committees. This suggests using playbooks that let Nodal Officers and fraud committees act in parallel.
Frequently Asked Questions
This article is for informational purposes only and does not constitute legal, regulatory, tax, or compliance advice. Institutions should consult qualified legal or compliance counsel before establishing fraud governance committees, issuing classification notices, or modifying credit agreements.