From Red-Flagged Account to Fraud Classification: A Borrower's Guide to the RBI Process

A loan account becomes a "fraud" account through a defined RBI process: the bank's early warning signals trigger a red flag, the bank commissions an audit, it serves a show-cause notice giving at least 21 days to reply, and it then passes a reasoned order. Each stage is governed by the RBI's Fraud Risk Management Directions, 2026, which replaced the July 2024 Master Directions. Borrowers who understand the sequence, and engage with the forensic audit rather than waiting for the notice, are far better placed when the decision is made.

This guide follows the process from the borrower's side. For the bank-side framework, including governance and reporting obligations, see our overview of the RBI Fraud Risk Management Directions 2026.

How does the process start?

Early warning signals

Every bank must run an early warning signals framework whose indicators are approved by the Risk Management Committee of its Board. Alerts are to be examined preferably within 30 days. The indicators commonly draw on account conduct, financial statements, transaction patterns and market intelligence, and the bank's data analytics unit monitors them.

An early warning alert is not an accusation. Many alerts are closed after examination. But an unexplained pattern, such as funds moving quickly to entities with no obvious business link, can lead to the next step.

Red-flagging

If the examination suggests possible fraud, the bank can classify the loan as a red-flagged account. Where aggregate exposure is INR 3 crore or more, the bank reports the red flag on the RBI's Central Repository of Information on Large Credits (CRILC) within seven days.

The bank must then either classify the account as fraud or remove the red flag, ordinarily within 180 days of first CRILC reporting. Accounts that stay red-flagged for longer go to the Board's special committee on frauds and are subject to RBI supervisory review.

What happens during the forensic audit?

To decide whether fraud has occurred, the bank investigates through an external audit or an internal audit under its Board-approved policy. External auditors are appointed under a policy covering due diligence, competence and track record, with engagement timelines approved by the Board. In practice this is usually described as a forensic audit, and it tends to focus on:

• End use of funds: whether loan proceeds were used for the sanctioned purpose.
• Diversion and siphoning: movement of funds to group companies, related parties or entities with no real operations, including possible shell companies.
• Circular transactions: funds that leave and return through intermediaries, a pattern associated with round-tripping.
• Sales, purchases and stock: whether reported turnover, receivables and inventory are supported by documents, GST records and physical verification.
• Security and assets: whether charged assets exist and whether any were disposed of without the lender's knowledge.

Why cooperation matters

If the audit is inconclusive or delayed because the borrower does not cooperate, the bank may decide on its own records and investigation. Refusing access rarely prevents an adverse finding; it usually removes the borrower's opportunity to explain transactions while the auditor is still forming a view.

Practical steps during the audit include nominating a single point of contact, keeping a log of every document request and response, and answering in writing. Where a transaction looks unusual but has a commercial explanation, the explanation should arrive with the contracts, invoices, delivery records and bank statements that support it.

What does the show-cause notice require?

Before classifying an account as fraud, the bank must serve a detailed show-cause notice on the persons and entities against whom fraud is alleged, typically the borrower and its promoters and directors, setting out the transactions relied on. It must allow not less than 21 days for a response. It must then consider the reply and pass a reasoned order recording the facts, the submissions and its reasons.

What the Supreme Court has said

These requirements come from the Supreme Court's March 2023 decision in State Bank of India v. Rajesh Agarwal. The Court held that classifying an account as fraud has civil consequences akin to blacklisting, so the principle of audi alteram partem (hear the other side) applies.

In April 2026, in SBI v. Amit Iron Pvt Ltd, the Supreme Court clarified the position in two important ways:

The practical effect is that the written reply is usually the borrower's only chance to be heard. It needs to be complete and supported by evidence.

How should a borrower respond to the show-cause notice?

Twenty-one days is not long when the audit report runs to hundreds of pages. A structured response usually covers:

1. Obtain the full report and annexures. If only a summary was served, ask in writing for the complete report.
2. Map every finding. List each allegation, the transactions behind it and the evidence the auditor relied on.
3. Reconcile with the books. Trace each transaction through ledgers, bank statements and supporting documents, and identify where the auditor's data was incomplete.
4. Test the methodology. Check the period covered, the sampling approach, whether related parties were correctly identified and whether alternative explanations were considered.
5. Separate business failure from fraud. Losses, delays and poor decisions are not fraud. The reply should show where funds went and why.
6. Take legal advice. The reply may be relied on in later proceedings, including criminal complaints, so its content and framing need specific legal advice.

An independent review of the audit report by forensic accountants can help identify factual errors, unsupported inferences and gaps before the reply is filed.

What happens after the reasoned order?

If the bank classifies the account as fraud, several consequences follow:

• Reporting: the bank files a Fraud Monitoring Return with the RBI within 14 days of classification.
• Law enforcement: private and foreign banks refer frauds of INR 1 crore and above to the State Police and the SFIO; public sector banks refer frauds of INR 6 crore and above to the CBI.
• Debarment: the borrower, its promoters and directors and associated entities are debarred for five years from raising funds or seeking additional credit from RBI-regulated entities, counted from full repayment or settlement.
• Resolution: the debarment does not apply to the entity after a resolution plan is implemented under the IBC or the RBI's prudential framework, but it continues to apply to erstwhile promoters and directors.

The wilful defaulter process

Fraud classification is distinct from identification as a wilful defaulter, which is governed by separate 2025 Directions. That process uses an Identification Committee and a Review Committee, requires a 21-day show-cause notice, and obliges the Review Committee to offer a personal hearing, at which lawyers are not permitted. A wilful defaulter faces its own restrictions, including no additional facilities until one year after removal from the list. The same audit evidence often feeds both processes.

For a stressed asset that later enters insolvency, the same transactions may also be examined by a resolution professional. Our post on forensic audits in CIRP explains how that review works.

Why does forensic audit quality matter for both sides?

For the bank, the reasoned order must withstand scrutiny. Now that borrowers receive the complete report, a finding built on incomplete data, untested assumptions or an unexplained leap from "unusual" to "fraudulent" is exposed to challenge, which can delay recovery.

For the borrower, the report frames everything that follows: the classification, the criminal complaint and often the wilful defaulter proceedings. A rigorous audit that records the borrower's explanations fairly is in everyone's interest, because it produces a decision that is both defensible and correct.

How Spectra Forensics can help

Spectra Forensics has 19+ years of investigation experience across 1,250+ investigations. Our stressed asset and insolvency forensics and forensic accounting and data analytics services cover forensic audits of red-flagged accounts for lenders, fund-flow and end-use analysis, and independent reviews of audit reports for borrowers preparing a reply. Our litigation and arbitration support service supports counsel where a classification is challenged.

To discuss a red-flagged account or a show-cause notice, contact us.