Master Directions on Fraud Risk Management for Banks

RBI/DOS/2024-25/118 DOS.CO.FMG.SEC.No.5/23.04.001/2024-25 July 15, 2024

The Chairman / Managing Director / Chief Executive Officer All Commercial Banks (including Regional Rural Banks) All India Financial Institutions (AIFIs) * Madam / Dear Sir,

Master Directions on Fraud Risk Management in Commercial Banks (including Regional Rural Banks) and All India Financial Institutions

Please find enclosed as Annex ‘Reserve Bank of India (Fraud Risk Management in Commercial Banks (including Regional Rural Banks) and All India Financial Institutions) Directions, 2024’ issued in exercise of the powers conferred under Chapter III-A and Chapter III-B of the Reserve Bank of India Act, 1934, and Section 21 and Section 35A of the Banking Regulation Act, 1949. These Directions shall supersede the earlier Directions on the subject, namely, the Reserve Bank of India (Frauds - Classification and Reporting by commercial banks and select FIs) Directions 2016 (Ref.DBS.CO.CFMC.BC.No.1/23.04.001/2016-17) dated July 01, 2016 (Updated as on July 03, 2017).

Yours faithfully

(Rajnish Kumar) Chief General Manager

Encl.: as above

Annex

Master Directions (MD) on Fraud Risk Management in Commercial Banks (including Regional Rural Banks) and All India Financial Institutions (AIFIs)

CONTENTS

INTRODUCTION CHAPTER I 1.1 Short Title and Commencement 1.2 Applicability 1.3. Purpose CHAPTER II 2. Governance Structure in banks for Fraud Risk Management CHAPTER III 3. Early Detection of Frauds – Framework for Early Warning Signals (EWS) and Red Flagging of Accounts (RFA) CHAPTER IV 4.1 Credit facility / Loan account classified as Red-flagged Account and Reporting of Fraud 4.2 Independent confirmation from the third-party service providers including professionals 4.3 Staff Accountability 4.4 Penal Measures 4.5 Treatment of accounts under Resolution CHAPTER V 5. Reporting of Frauds to Law Enforcement Agencies (LEAs) CHAPTER VI 6.1 Reporting of Incidents of Fraud to Reserve Bank of India (RBI) 6.2 Central Fraud Registry (CFR) 6.3 Modalities of Reporting Incidents of Fraud to RBI 6.4 Closure of Fraud Cases Reported to RBI CHAPTER VII 7. Cheque Related Frauds - Reporting to LEAs and RBI / NABARD CHAPTER VIII 8. Other Instructions 8.1 Legal Audit of Title Documents in respect of Large Value Loan Accounts 8.2 Treatment of Accounts classified as Fraud and sold to other Lenders / Asset Reconstruction Companies (ARCs) 8.3 Role of Auditors 8.4 ‘Date of Occurrence’, ‘Date of Detection’ and ‘Date of Classification’ of Fraud - for the purpose of reporting under FMR CHAPTER IX 9. Reporting Cases of Theft, Burglary, Dacoity and Robbery CHAPTER X 10. Repeal

INTRODUCTION

In exercise of the powers conferred under Chapter III-A and Chapter III-B of the Reserve Bank of India Act, 1934, and Section 21 and Section 35-A of the Banking Regulation Act, 1949, the Reserve Bank of India being satisfied that it is necessary and expedient in the public interest and in the interest of banking policy to do so, hereby, issues the Directions hereinafter specified.

CHAPTER I

1.1 Short Title and Commencement

These Directions shall be called the Reserve Bank of India (Fraud Risk Management in Commercial Banks (including Regional Rural Banks) and All India Financial Institutions) Directions, 2024.

1.2 Applicability

The provisions of these Directions shall, unless otherwise provided, apply to:

1.2.1 All banking companies [including banks incorporated outside India licensed to operate in India (foreign banks), Local Area Banks (LABs), Small Finance Banks (SFBs), Payments Banks (PBs)], Corresponding New Banks 1 , Regional Rural Banks (RRBs) and State Bank of India as defined under sub-sections (c), (da), (ja) and (nc) of Section 5 of the Banking Regulation Act, 1949 respectively (collectively referred to as ‘Commercial Banks’); and

1.2.2 Export-Import Bank of India (‘Exim Bank’), National Bank for Agriculture and Rural Development (‘NABARD’), National Bank for Financing Infrastructure and Development (‘NaBFID’), National Housing Bank (‘NHB’) and Small Industries Development Bank of India (‘SIDBI’) as established by the Export-Import Bank of India Act, 1981; the National Bank for Agriculture and Rural Development Act, 1981; the National Bank for Financing Infrastructure and Development Act, 2021; National Housing Bank Act, 1987 and the Small Industries Development Bank of India Act, 1989, respectively (hereinafter referred to as ‘All India Financial Institutions or ‘AIFIs’.

1.2.3 The Commercial Banks and AIFIs shall hereinafter collectively be referred to as ‘banks’ for the purpose of these Directions.

1.3 Purpose

These Directions are issued with a view to providing a framework to banks for prevention, early detection and timely reporting of incidents of fraud to Law Enforcement Agencies (LEAs), Reserve Bank of India (RBI) and NABARD 2 and dissemination of information by RBI and matters connected therewith or incidental thereto.

CHAPTER II

2.1 Governance Structure in banks for Fraud Risk Management

2.1.1 There shall be a Board 3 approved Policy 4 on fraud risk management delineating roles and responsibilities of Board / Board Committees and Senior Management of the bank. The Policy shall also incorporate measures for ensuring compliance with principles of natural justice 5 in a time-bound manner which at a minimum shall include:

2.1.1.1 Issuance of a detailed Show Cause Notice (SCN) to the Persons 6 , Entities and its Promoters / Whole-time and Executive Directors against whom allegation of fraud is being examined 7 . The SCN shall provide complete details of transactions / actions / events basis which declaration and reporting of a fraud is being contemplated under these Directions.

2.1.1.2 A reasonable time of not less than 21 days shall be provided to the Persons / Entities on whom the SCN was served to respond to the said SCN.

2.1.1.3. Banks shall have a well laid out system for issuance of SCN and examination of the responses / submissions made by the Persons / Entities prior to declaring such Persons / Entities as fraudulent.

2.1.1.4 A reasoned Order shall be served on the Persons / Entities conveying the decision of the bank regarding declaration / classification of the account as fraud or otherwise. Such Order(s) must contain relevant facts / circumstances relied upon, the submission made against the SCN and the reasons for classification as fraud or otherwise.

2.1.2 The Fraud Risk Management Policy shall be reviewed by the Board at least once in three years, or more frequently, as may be prescribed by the Board.

2.1.3 Special Committee of the Board for Monitoring and Follow-up of cases of Frauds:

2.1.3.1 Banks shall constitute a Committee of the Board to be known as ‘Special Committee of the Board for Monitoring and Follow-up of cases of Frauds’ (SCBMF) with a minimum of three members of the Board, consisting of a whole-time director and a minimum of two independent directors / non-executive directors. The Committee shall be headed by one of the independent directors / non-executive directors.

2.1.3.2 SCBMF shall oversee the effectiveness of the fraud risk management in the bank. SCBMF shall review and monitor cases of frauds, including root cause analysis, and suggest mitigating measures for strengthening the internal controls, risk management framework and minimising the incidence of frauds. The coverage 8 and periodicity of such reviews shall be decided by the Board of the bank.

2.1.4 The Senior Management shall be responsible for implementation of the fraud risk management policy approved by the Board of the bank. A periodic review of incidents of fraud shall also be placed before Board / Audit Committee of Board (ACB), as appropriate, by the Senior Management of the bank.

2.1.5 Banks shall put in place a transparent mechanism to ensure that Whistle Blower complaints on possible fraud cases / suspicious activities in account(s) are examined and concluded appropriately under their Whistle Blower Policy.