RBI Fraud Risk Management Directions 2026: What Banks and Borrowers Need to Know

The RBI's Fraud Risk Management Directions, 2026 are the current rules that tell banks and NBFCs how to prevent, detect, classify and report fraud. Issued on 31 July 2026 as separate instruments for each class of regulated entity, they replaced the Master Directions of 15 July 2024 with immediate effect. For banks the substance is largely continuous; for borrowers, the process that can end in a fraud classification remains one of the most consequential events in a lending relationship.

This post covers the regulatory framework itself. For a step-by-step view from the borrower's side, see From Red-Flagged Account to Fraud Classification.

What are the RBI Fraud Risk Management Directions 2026?

In July 2024 the RBI issued three Master Directions on fraud risk management: one for commercial banks (including RRBs) and all-India financial institutions, one for co-operative banks and one for NBFCs. On 31 July 2026 it reissued the framework as entity-specific Directions. The main instruments are:

The commercial bank Directions came into effect immediately on issue (para 2). Para 67 repeals the earlier directions and para 68 is a savings clause: anything done or begun under the repealed directions continues to be governed by them, and existing rights, liabilities and investigations are unaffected.

How do the 2026 Directions compare with the 2024 Master Directions?

For commercial banks, the headline requirements carry forward almost unchanged. What has changed is mainly the form: entity-wise instruments, new paragraph numbering and a single consolidated text.

The practical consequence is administrative rather than conceptual. Board policies, credit manuals, show-cause templates and loan documents that cite 2024 paragraph numbers need to be updated so that internal references point to the instrument now in force.

What must banks have in place under the 2026 Directions?

Governance and policy

Each bank needs a Board-approved fraud risk management policy covering prevention, detection, investigation, staff accountability, monitoring, recovery, reporting and the early warning signals and red-flagged account framework (para 5). The special committee of the Board oversees fraud monitoring, and internal audit must cover fraud prevention, detection, classification, reporting, closure and staff accountability, including delays and non-reporting (para 64). Auditors escalate suspected fraud to senior management or the Audit Committee of the Board (para 63).

Early warning signals and analytics

The Risk Management Committee of the Board approves the bank's early warning indicators, and alerts are to be examined preferably within 30 days (paras 13–14). Banks must maintain a dedicated Data Analytics and Market Intelligence Unit (para 20), monitor transactions on digital platforms and applications (para 25) and remain vigilant over non-KYC-compliant and money mule accounts (para 24). This is where fraud prevention overlaps with know your customer controls.

Red-flagging and audit

Where early warning signals suggest possible fraud, the bank may red-flag the account. A red-flagged account with aggregate exposure of INR 3 crore or more is reported on CRILC within seven days (paras 22 and 29). The bank then investigates through an external audit or an internal audit under its Board-approved policy (para 26).

The bank must also have a policy on engaging external auditors that addresses due diligence, competence and track record, and audit contracts should carry Board-approved timelines for completing the work (para 27). If the audit report is inconclusive or delayed because the borrower does not cooperate, the bank decides on the basis of its own records and investigation, while still following natural justice (para 28).

Reporting, law enforcement and staff accountability

Once an account is classified as fraud, the bank files a Fraud Monitoring Return with the RBI within 14 days (para 49). Payment-system frauds are reported through the Central Payments Fraud Information Registry (para 48). Referral to law enforcement follows the familiar thresholds (para 44): private and foreign banks refer cases of INR 1 crore and above to the State Police and the SFIO, and public sector banks refer cases of INR 6 crore and above to the CBI.

Staff accountability must be examined in a time-bound manner in every fraud case (para 36). Public sector banks follow CVC guidelines and refer cases of INR 3 crore and above to the Advisory Board for Banking and Financial Frauds (para 37), and accountability extends to delays in identifying or reporting fraud (para 52).

What do the 2026 Directions mean for borrowers?

Natural justice before classification

Before classifying an account as fraud, the bank must serve a detailed show-cause notice and give the borrower, its promoters and directors at least 21 days to respond. It must then examine the response and pass a reasoned order (para 6). These safeguards trace back to the Supreme Court's 2023 decision in State Bank of India v. Rajesh Agarwal, which held that fraud classification carries civil consequences akin to blacklisting.

In April 2026, in SBI v. Amit Iron Pvt Ltd, the Supreme Court clarified that Rajesh Agarwal did not create a right to a personal or oral hearing. The Court also held that the bank must furnish the complete forensic audit report, not a summary, with sensitive third-party data redacted only for recorded reasons.

Consequences of a fraud classification

The borrower and associated persons are debarred for five years from raising funds or seeking additional credit from RBI-regulated entities, counted from full repayment or the date of settlement (para 39). The debarment does not apply to an entity after a resolution plan is implemented under the IBC or the RBI's prudential framework (para 42), but it continues to bind erstwhile promoters and directors (para 43).

Fraud classification is separate from the wilful defaulter regime, which is governed by its own 2025 Directions and its own committee process. The two can run in parallel on the same facts, and the evidence gathered in one will often be relied on in the other.

Why does the forensic audit sit at the centre of the process?

The Directions speak of external or internal audits rather than defining a "forensic audit", but in practice the audit report is the evidential foundation for the show-cause notice and the reasoned order. A well-constructed forensic audit traces fund flows end to end, tests related-party transactions and distinguishes diversion of funds from ordinary business failure. A weak one invites challenge and delay.

According to the RBI Annual Report 2025-26, banks reported 10,114 fraud cases involving INR 48,021 crore in 2025-26. Now that the full audit report must be shared with the borrower, every assumption, sampling choice and gap in the working papers is open to scrutiny.

What should boards and compliance teams do now?

1. Re-map the fraud risk policy to the 2026 paragraph structure and confirm the three-year Board review cycle.
2. Refresh early warning indicators and confirm that the data analytics unit covers digital channels and mule-account patterns.
3. Review the external auditor panel policy and engagement letters, including competence criteria and completion timelines.
4. Update show-cause notice templates so that they set out the transactions relied on and are issued with the complete audit report.
5. Test reporting timelines for CRILC, the 180-day window and the 14-day Fraud Monitoring Return.

A periodic fraud risk assessment and a review of internal controls will show whether these steps work in practice. Our guide to building a fraud risk management framework sets out the wider board-level structure.

How Spectra Forensics can help

Spectra Forensics has conducted 1,250+ investigations over 19+ years. Our forensic accounting and data analytics service covers forensic audits of red-flagged accounts, fund-flow tracing and analysis of related-party and end-use transactions. Our stressed asset and insolvency forensics service supports lenders assessing diversion and recoverability, and can support borrowers and their counsel in reviewing an audit report before responding to a show-cause notice.

Decisions on classification, response and litigation strategy need specific legal advice. To discuss a matter, contact us.