Reserve Bank of India (All India Financial Institutions – Fraud Risk Management) Directions, 2026

भारतीय ǐरज़वर् बैंक Reserve Bank of India

पयर्वेक्षण ͪ वभाग, भारतीय ǐरज़वर् बैंक, केंद्रȣय कायार्लय, मेकर टावर-ई, 20वीं मंिजल, कफ परेड, कोलाबा, मुंबई-400 005 दूरभाष: 022-6989 2022 ई-मेल: fmgdosco@rbi.org.in Department of Supervision, Reserve Bank of India, Central Office, Maker Tower-E, 20th floor, Cuffe Parade, CoIaba, Mumbai- 400 005 Tel: 022-6989 2022 Email: fmgdosco@rbi.org.in

ᳲहंदी आसान है, इसका ᮧयोग बढ़ाइए RBI/DoS/2026-27/457 DoS.CO.FMG.51/23.04.001/2026-27 July 31, 2026 Reserve Bank of India (All India Financial Institutions – Fraud Risk Management) Directions, 2026

Table of Contents

Chapter I - Preliminary ............................................................................................. 4 A. Short Title and Commencement ..................................................................... 4 B. Applicability ..................................................................................................... 4 C. Definitions ........................................................................................................ 4 Chapter II - Governance and Oversight .................................................................. 6 A. Governance Structure for Fraud Risk Management ..................................... 6 Chapter III – Early Detection of Frauds - Framework for Early Warning Signals and Red Flagging of Accounts ............................................................................... 9 A. Governance Structure ..................................................................................... 9 B. Early Warning Signal / Red Flagging of Accounts Framework for Credit Facilities / Loan Accounts ............................................................................. 10 C. EWS Framework for Other Banking / Non-Credit Related Transactions ... 10 Chapter IV - General Instructions ......................................................................... 12 A. Credit facility / Loan Account Classified as Red-flagged Account and Reporting of Fraud ........................................................................................ 12 B. Independent Confirmation from Third-party Service Providers including Professionals ................................................................................................. 13 C. Staff Accountability ....................................................................................... 13 D. Penal Measures .............................................................................................. 14 E. Treatment of Accounts under Resolution ................................................... 15 Chapter V - Reporting of Frauds to Law Enforcement Agencies ....................... 16 Chapter VI - Reporting to Reserve Bank of India................................................. 17 A. Reporting of Incidents of Fraud ................................................................... 17 B. Central Fraud Registry .................................................................................. 17 C. Modalities of Reporting Incidents of Fraud ................................................. 18 D. Closure of Fraud Cases Reported ................................................................ 19 Chapter VII - Other Instructions ............................................................................ 21 A. Legal Audit of Title Documents in respect of Large Value Loan Accounts ........................................................................................................ 21 B. Treatment of Accounts classified as Fraud and sold to other Lenders / Asset Reconstruction Companies ............................................................... 21 C. Role of Auditors ............................................................................................. 21 Chapter VIII - Reporting Cases of Theft, Burglary, Dacoity and Robbery ......... 22 Chapter IX - Repeal and Other Provisions ........................................................... 23 A. Repeal and Saving ......................................................................................... 23 B. Application of Other Laws not barred .......................................................... 23 C. Interpretations ................................................................................................ 24

Introduction

These Directions are issued with a view to providing a framework for prevention, early detection, and timely reporting of incidents of fraud by All India Financial Institutions to Law Enforcement Agencies (LEAs) and Reserve Bank of India (‘RBI’) and dissemination of information by RBI and matters connected therewith or incidental thereto.

In exercise of the powers conferred under Chapter III-B of the Reserve Bank of India Act, 1934, and all other provisions / laws enabling RBI in this regard, RBI being satisfied that it is necessary and expedient in public interest so to do, hereby, issues these Directions hereinafter specified.

Chapter I - Preliminary

A. Short Title and Commencement

1. These Directions shall be called the Reserve Bank of India (All India Financial Institutions - Fraud Risk Management) Directions, 2026.
2. These Directions shall come into effect immediately upon issuance.

B. Applicability

3. These Directions shall be applicable to All India Financial Institutions (hereinafter collectively referred to as ‘AIFIs’ and individually as a ‘AIFI’), viz., Export-Import Bank of India (EXIM Bank), National Bank for Agriculture and Rural Development (NABARD), National Housing Bank (NHB), Small Industries Development Bank of India (SIDBI), and National Bank for Financing Infrastructure and Development (NaBFID).

C. Definitions

4. In these Directions, unless the context states otherwise, the terms herein shall bear the meaning assigned to them below: (1) ‘Central Fraud Registry (CFR)’ is a web-based searchable database maintained by RBI. Fraud related data, including the updates thereof, directly flow to CFR from online reporting by the AIFI through Fraud Monitoring Returns (FMRs). (2) ‘CRILC’ is the Central Repository of Information on Large Credits as referred to in the Reserve Bank of India (All India Financial Institutions – Supervisory Returns) Directions, 2026. (3) ‘Date of Classification’, for the purpose of reporting under FMR, is the date when due approval from the competent authority has been obtained for such classification, and the reasoned order is passed. (4) ‘Date of Detection’ to be reported in FMR, is the actual date when the fraud came to light in the concerned branch / audit / department of the AIFI, as the case may be, and not the date of approval by the competent authority of the AIFI. (5) ‘Date of Occurrence’, for the purpose of reporting under FMR, is the date when the actual misappropriation of funds has started taking place, or the event occurred, as evidenced / reported in the audit or other findings. (6) 'Red Flagged Account' is one where suspicion of fraudulent activity is thrown up by the presence of one or more Early Warning Signal (EWS) indicators, alerting / triggering deeper investigation from potential fraud angle and requiring initiation of preventive measures by all banks.

Chapter II - Governance and Oversight

A. Governance Structure for Fraud Risk Management

5. The AIFI should put in place a Board approved policy on Fraud Risk Management delineating roles and responsibilities of Board / Board Committees and Senior Management of the AIFI. The policy shall inter alia contain measures towards prevention, early detection, investigation, staff accountability, monitoring, recovery, and reporting of frauds as well as a framework for Early Warning Signals (EWS) and Red Flagging of Accounts (RFA). In this context, ‘Board’ will refer to ‘Board of Directors’ of the AIFI.

6. The Policy shall also incorporate measures for ensuring compliance with principles of natural justice in a time-bound manner, which at a minimum, shall include: (1) Issuance of a detailed Show Cause Notice (SCN) to the Persons (including Third Party Service Providers and Professionals, inter alia, architects, valuers, chartered accountants, advocates and other professionals/service providers), Entities and their Promoters / Whole Time Directors (WTDs) and Executive Directors (EDs) against whom allegation of fraud is being examined. The SCN shall provide complete details of transactions / actions / events basis which declaration and reporting of a fraud is being contemplated under these Directions. As non-Whole Time Directors (like nominee directors and independent directors) are normally not in charge of, or responsible to the company for the conduct of business of the company, the AIFI may take this into consideration before proceeding against such directors under these Directions. (2) The AIFI shall provide a reasonable time of not less than 21 days to the Persons / Entities on whom the SCN was served to respond to the said SCN. (3) The AIFI shall have a well laid out system for issuance of SCN and examination of the responses / submissions made by the Persons / Entities prior to declaring such Persons / Entities as fraudulent. (4) The AIFI shall serve a reasoned Order on the Persons / Entities conveying its decision regarding declaration / classification of the account as fraud or otherwise. Such Order(s) must contain relevant facts / circumstances relied upon, the submission made against the SCN and the reasons for classification as fraud or otherwise. Explanation: The requirement of ensuring compliance to the principles of natural justice is applicable to all Persons / Entities and their Promoters / WTDs and EDs classified as fraud by the AIFI. In other words, this requirement is applicable in all cases of fraud classification which may have civil consequences (i.e., penal measures, caution listing) as observed in the Judgement of the Hon’ble Supreme Court dated March 27, 2023 (Civil Appeal No. 7300 of 2022 in the matter of State Bank of India & Ors. Vs. Rajesh Agarwal & Ors.)

7. The Board shall review the Fraud Risk Management Policy at least once in three years, or more frequently, as may be prescribed by the Board.

8. Special Committee of the Board for Monitoring and Follow-up of cases of Frauds: (1) The AIFI shall constitute a Committee of the Board to be known as ‘Special Committee of the Board for Monitoring and Follow-up of cases of Frauds’ (SCBMF) with a minimum of three members of the Board, consisting of a WTD and a minimum of two independent directors / non-Executive Directors. The Committee shall be headed by one of the independent directors / non-Executive Directors. (2) SCBMF shall oversee the effectiveness of the Fraud Risk Management in the AIFI. SCBMF shall review and monitor cases of frauds, including root cause analysis, and suggest mitigating measures for strengthening the internal controls, risk management framework and minimising the incidence of frauds. The Board of the AIFI shall decide the coverage and periodicity of such reviews. The coverage may include, among others, categories / trends of frauds, industry / sectoral / geographical concentration of frauds, delay in detection / classification of frauds and delay in examination / conclusion of staff accountability. (3) The Board of the AIFI shall decide the threshold amount of fraud cases to be placed before the SCBMF, after duly taking into account the scale and complexity of its operations.

9. The Senior Management shall be responsible for implementation of the fraud risk management policy approved by the Board of the AIFI. The Senior Management of the bank shall also place a periodic review of incidents of fraud before Board / Audit Committee of Board (ACB), as appropriate.

10. The AIFI shall put in place a transparent mechanism to ensure that Whistle Blower complaints on possible fraud cases / suspicious activities in account(s) are examined and concluded appropriately under its Whistle Blower Policy.

11. The AIFI shall set-up an appropriate organisational structure for institutionalisation of Fraud Risk Management within its overall risk management functions / department. Fraud Risk Management includes prevention, early detection, investigation, staff accountability, monitoring, recovery, analysis, reporting of frauds, and other related aspects under the Board approved Policy. A senior official in the rank of at least a General Manager or equivalent shall be responsible for monitoring and reporting of frauds.