RBI Fraud Classification and Reporting Rules
14 days to report, 180 days to decide, ₹6 crore to the CBI. The numbers the exam asks for.
When a bank decides that a loss is a fraud, a set of RBI rules takes over: how the decision must be reached, whom to tell, how fast, and what happens to the people involved. Those rules sit in RBI's fraud risk management Directions. The version in force for commercial banks is the Reserve Bank of India (Commercial Banks: Fraud Risk Management) Directions, 2026, issued on 31 July 2026.
They replaced the Master Directions of 15 July 2024, which had themselves replaced the 2016 Directions on frauds classification and reporting. The substance of the 2024 rules carried into the 2026 version almost unchanged, so the numbers below hold for both.
You save ₹300
- Full 120-question mocks
- Cyber law coverage
- Module-wise practice
One payment, no subscription · Valid for 2 months
From Warning Sign to Fraud Report
- 1
Early Warning Signals (EWS)
The bank monitors loan accounts and other transactions against EWS indicators approved by the Risk Management Committee of the Board, which sets a turnaround time for examining alerts, preferably not more than 30 days.
- 2
Red flagging
An account where EWS indicators suggest possible fraud is red flagged for deeper investigation. Accounts with an aggregate exposure of ₹3 crore and above are reported on RBI's CRILC platform within seven days.
- 3
Investigation
By external or internal audit, as the bank's board-approved policy provides. The decision to classify as fraud or remove the red flag should ordinarily be complete within 180 days of first reporting on CRILC.
- 4
Natural justice
Before declaring anyone a fraud, the bank serves a detailed show cause notice, allows at least 21 days to reply, and passes a reasoned order. This follows the Supreme Court's March 2023 judgment in State Bank of India v. Rajesh Agarwal.
- 5
Report
A Fraud Monitoring Return (FMR) to RBI within 14 days of classification, whatever the amount, and a complaint to the police or other agency immediately.
Which Agency Gets the Complaint
Reporting to law enforcement agencies under the 2026 Directions.
Private sector and foreign banks
Amount
Below ₹1 crore
Report to
State or UT police
Private sector and foreign banks
Amount
₹1 crore and above
Report to
State or UT police, and the Serious Fraud Investigation Office (in FMR format)
Public sector banks
Amount
Below ₹6 crore
Report to
State or UT police
Public sector banks
Amount
₹6 crore and above
Report to
Central Bureau of Investigation (CBI)
| Bank | Amount | Report to |
|---|---|---|
| Private sector and foreign banks | Below ₹1 crore | State or UT police |
| Private sector and foreign banks | ₹1 crore and above | State or UT police, and the Serious Fraud Investigation Office (in FMR format) |
| Public sector banks | Below ₹6 crore | State or UT police |
| Public sector banks | ₹6 crore and above | Central Bureau of Investigation (CBI) |
The 11 FMR Categories
Each fraud is reported under the single most appropriate category.
- check_circleMisappropriation of funds and criminal breach of trust
- check_circleFraudulent encashment through forged instruments
- check_circleManipulation of books of accounts or fictitious accounts, and conversion of property
- check_circleCheating by concealment of facts, and cheating by impersonation
- check_circleForgery by making false documents or electronic records
- check_circleWilful falsification, destruction or alteration of books, electronic records or securities with intent to defraud
- check_circleFraudulent credit facilities extended for illegal gratification
- check_circleCash shortages on account of frauds
- check_circleFraudulent transactions involving foreign exchange
- check_circleFraudulent electronic banking or digital payment transactions committed on banks
- check_circleOther fraudulent activity not covered above
Quick practice on banking operations. No signup.
Other Rules Worth a Mark
- SCBMF
- Special Committee of the Board for Monitoring and Follow-up of cases of Frauds: at least three board members, including a whole-time director and at least two independent or non-executive directors, headed by one of the latter.
- Three dates
- Date of occurrence (when the misappropriation started), date of detection (when it came to light, not when it was approved) and date of classification (when the competent authority approved it and the reasoned order was passed). The 14-day FMR clock runs from classification.
- Penal measures
- Persons and entities reported as fraud are barred from raising funds or new credit from RBI-regulated entities for five years from full repayment of the defrauded amount.
- CFR and CPFIR
- The Central Fraud Registry is RBI's searchable database built from FMRs. Disputed, suspected or attempted payment system frauds go to the Central Payments Fraud Information Registry, and to the FMR if later concluded as fraud on the bank.
- Theft, burglary, dacoity, robbery
- Reported to RBI's Fraud Monitoring Group immediately, not later than seven days from occurrence, including attempts.
Which Version Will Your Paper Test?
IIBF's cut-off for the September 2026 to February 2027 sittings is 30 June 2026, so those papers should follow the July 2024 Master Directions; the 2026 Directions came out after the cut-off. The thresholds and timelines above are the same in both. Older material based on the 2016 Directions carries the earlier ₹3 crore CBI threshold for public sector banks, so do not mix the versions.
How the IIBF Exam Tests This
Numbers dominate: 14 days, 21 days, 180 days, ₹3 crore, ₹6 crore, five years. The usual trap uses an old threshold: the CBI limit for public sector banks rose from ₹1 crore (2004) to ₹3 crore (2012) and then to ₹6 crore. Another trap starts the FMR clock at detection instead of classification.
FAQs
Within how many days must a bank report a fraud to RBI?expand_more
Immediately, but not later than 14 days from the date the incident or account is classified as fraud, through the Fraud Monitoring Return. This applies whatever the amount.
What is a red flagged account?expand_more
An account where one or more early warning signals suggest possible fraud, triggering deeper investigation. The bank must decide whether it is a fraud, ordinarily within 180 days.
When must a public sector bank report a fraud to the CBI?expand_more
When the amount involved is ₹6 crore or more. Below that, the complaint goes to the State or UT police.
Can a bank declare a borrower a fraud without hearing them?expand_more
No. The bank must serve a show cause notice with full details, give at least 21 days to respond, and pass a reasoned order, following the Supreme Court's 2023 judgment in SBI v. Rajesh Agarwal.
Next steps
- Staff Accountabilityarrow_forward
- Incident Reporting by Banksarrow_forward
- Customer Liabilityarrow_forward
- Fraud Controlsarrow_forward
120 questions, 2 hours, scored instantly.