The RBI rewrote its fraud rules. The clocks did not stop.

On 31 July 2026 the Reserve Bank of India issued nine Fraud Risk Management Directions, one for each of nine types of regulated entity: commercial banks, small finance banks, payments banks, urban and rural co-operative banks, local area banks, regional rural banks, all-India financial institutions, and NBFCs including housing finance companies. Each took effect on issue. A repeal circular issued the same day withdrew 628 circulars across the RBI's wider consolidation into 64 supervisory Directions, among them the three fraud Master Directions of 15 July 2024.

The RBI describes the exercise as consolidation "on an 'as is' basis", and a side-by-side reading bears that out: the core obligations are where they were. That is the point for boards. New paragraph numbers do not reset any deadline. The summary below follows the Direction for commercial banks; NBFCs are covered separately, and the Directions for co-operative banks, regional rural banks and payments banks differ in places.

The clocks that still run

• Early warning signals are to be examined, preferably within 30 days of the alert. For banks, the EWS must be integrated with the core banking solution or other operational systems and supported by a dedicated data analytics and market intelligence unit.
• A bank reports red-flagged accounts with exposure of ₹3 crore or more on CRILC within 7 days, and is ordinarily expected to classify the account as fraud, or lift the flag, within 180 days.
• Before an account is classified as fraud, the lender issues a detailed show cause notice, allows at least 21 days for a reply and passes a reasoned order.
• Frauds are reported to law enforcement immediately, and Fraud Monitoring Returns go to the RBI immediately and in any case within 14 days of classification.
• Borrowers reported as fraud, and their associates, are barred from fresh finance from RBI-regulated entities for five years from full repayment or settlement.
• The Board reviews the fraud risk management policy at least once in three years. In banks, a Board committee of at least three members, chaired by an independent or non-executive director, monitors and follows up frauds.

What differs from the 2024 text

• The Board now decides the threshold above which fraud cases are placed before its fraud committee.
• The Directions state expressly that the monthly certificate on frauds, the monthly CFR certificate and the flash report are not required.
• A Fraud Monitoring Return can be withdrawn at once on a court's direction, and placed before a whole-time director afterwards.
• Upgrades to the early warning system are expected on an ongoing basis, replacing the six-month deadline in the 2024 text.
• For NBFCs, reporting on group entities is limited to the NBFC's own subsidiaries, affiliates and joint ventures.
• Small finance banks, payments banks, local area banks, regional rural banks and all-India financial institutions now have Directions of their own.

NBFCs

The NBFC Direction applies to Upper and Middle Layer NBFCs, and to Base Layer NBFCs with assets of ₹500 crore or more, including housing finance companies, which file their returns with the National Housing Bank. The early warning chapter applies only to the Upper and Middle Layers, and NBFCs have no red-flagged account mechanism. Their fraud committee is a Board committee of at least three, including the chief executive and two independent directors and chaired by one of them; Middle and Base Layer NBFCs may instead use a committee of at least three executives that includes a whole-time director or equivalent.

Which agency receives the complaint

The Directions also say where a fraud complaint goes. A private sector or foreign bank reports a fraud below ₹1 crore to the State or Union Territory police; at ₹1 crore and above it also reports to the Serious Fraud Investigation Office, in the Fraud Monitoring Return format. A public sector bank reports to the State or UT police below ₹6 crore, and to the Central Bureau of Investigation at ₹6 crore and above. NBFCs report to the State police. Each lender names nodal officers to deal with the agencies.

A footnote explains that section 33 of the Bharatiya Nagarik Suraksha Sanhita, 2023 does not make reporting mandatory for every offence, but lenders are advised to report every fraud of ₹1 lakh or more. In consortium lending, the bank Direction lets members file separate complaints where separate offences were committed against each of them. Otherwise one member files, and the others support it with information and documents.

Staff accountability and closing a case

Every fraud case needs an examination of staff accountability, started and finished on a timetable set by the lender's own policy, and lenders must also fix accountability for delays in identifying and reporting frauds. Public sector banks follow the Central Vigilance Commission's guidelines and refer every fraud of ₹3 crore and above to the CVC's Advisory Board for Banking and Financial Frauds, which examines the role of officials at every level, including former officials and whole-time directors. Where the MD and CEO or an executive director is involved, the audit committee starts the examination and places it before the Board, and the executive concerned stays out of those meetings.

A case is closed in the RBI's Closure Module only when the matters with law enforcement and the courts are disposed of and the staff accountability examination is complete. For statistical purposes, a bank may close cases of up to ₹1 crore, and an NBFC cases of up to ₹25 lakh, once staff accountability and any disciplinary action are done, if the police investigation or the trial has been pending for more than three years from the FIR. Details of every closed case are kept for the auditors.

Title deeds, loan sales and debarment

Three provisions reach beyond the fraud desk. A commercial bank must put the title deeds and related documents for every credit facility of ₹5 crore and above through periodic legal audit and re-verification until the loan is repaid; the NBFC threshold is ₹1 crore. A lender must finish its fraud investigation before selling a loan to another lender or an asset reconstruction company, report any fraud it finds before the sale, and keep reporting developments in accounts sold to an ARC. Auditors who see signs of fraud must tell senior management and, where necessary, the audit committee.

The five-year debarment runs from full repayment of the defrauded amount, or of the agreed settlement. It covers a company's subsidiaries, joint ventures and associate companies and, for an individual, every entity where that person is a promoter, director or in charge of management. After five years, lending is a commercial decision. Where a company classified as fraud is resolved under the Insolvency and Bankruptcy Code or the RBI's resolution framework, with a change in management and control, the lender must consider whether the classification should stay. The debarment stops applying to the company once the plan is implemented, but continues for the former promoters and directors, and criminal action against them is unaffected.

A renumbered direction does not reset a deadline. The 21 days, the 180 days and the 14 days still run.

What boards should check

• Policies, procedures and board papers cite the 2026 Directions, not the 2024 Master Direction.
• The board has set, and minuted, the threshold for cases placed before its fraud committee.
• Early warning alerts are reported by age against the 30-day expectation, and red-flagged accounts against the 180-day clock.
• Every fraud classification file shows the notice, the reply window and a reasoned order.
• Each return is tracked from the date of classification, with evidence of the date it reached the RBI.
• Each complaint went to the agency the thresholds require, and staff accountability is tracked to a conclusion before a case is closed.
• A register shows every facility above the legal audit threshold and the date its title was last re-verified.