RBI Fraud Risk Management Rules: CAIIB ABM Quick Revision

Ask any branch manager what the scariest word in a credit file is, and you will not hear "NPA". You will hear "fraud". An account slipping into NPA is a recovery problem. An account classified as fraud is a reputational, regulatory and sometimes criminal problem — for the borrower, and occasionally for the officers who signed the sanction note. That is exactly why the RBI rewrote the rulebook on fraud risk management in banks, and why this topic keeps turning up in CAIIB ABM papers.

The short above gives you the headline. This page gives you the detail you actually need to answer a case-let: who decides, what notice the borrower gets, how many days you have to report, and which numbers the examiner loves to swap around in the options.

Why the fraud rules were rewritten in 2024

On 15 July 2024 the Reserve Bank issued a fresh set of Master Directions on fraud risk management, replacing the 2016 framework. Three separate directions were issued so that the same principles apply across the system — one for commercial banks (including regional rural banks) and All India Financial Institutions, one for co-operative banks, and one for NBFCs including housing finance companies.

The trigger was not a scam. It was a judgment. On 27 March 2023 the Supreme Court, in the State Bank of India vs Rajesh Agarwal matter, held that a borrower cannot be branded a fraud behind their back. The consequences of that label — reporting to the RBI's central database, debarment from raising bank finance, possible referral to investigating agencies — are civil consequences serious enough that the principles of natural justice must apply first. The Court said what every first-year law student would say: hear the other side before you decide.

So the 2024 directions bake that hearing into the process. You will find the full text on the RBI Master Directions page, but for the exam you need the sequence and the day counts.

The three steps every bank must now follow

Before an account can be classified as fraud, the bank has to walk through a defined path.

Step one — the Show Cause Notice. The bank serves a detailed SCN on the persons or entities concerned, setting out the transactions and the material relied on. The direction is explicit that a reasonable time of not less than 21 days must be given to respond. Twenty-one days is the floor, not the norm; a bank may give more.

Step two — consider the reply. The submissions have to be examined on merits, not filed away. This is where a lot of pre-2023 classifications used to fail.

Step three — the reasoned Order. Whatever the bank decides, it must issue a written, reasoned order conveying the decision. That order has to contain the facts and circumstances relied upon, the submissions made against the SCN, and the reasons for classifying — or not classifying — the account as fraud. A one-line "declared fraud" letter no longer survives scrutiny.

Notice the shape of this. It is an administrative adjudication, not an internal note. Good fraud risk management in 2026 looks less like a suspicious-transaction memo and more like a small quasi-judicial file.

Who actually decides: SCBMF and the Committee of Executives

The decision cannot rest with one officer. Banks must constitute a Special Committee of the Board for Monitoring and Follow-up of cases of Frauds — the SCBMF — with a minimum of three Board members: one whole-time director and at least two independent or non-executive directors. Crucially, the committee is headed by an independent or non-executive director, not by the MD or the whole-time director. That chairing rule is a favourite trick question.

Alongside it, entities operationalise a Committee of Executives to handle the day-to-day examination of cases, with a Board-approved policy governing the whole framework. Remember the split: executives investigate and recommend, the Board committee monitors and follows up.

Early Warning Signals and Red Flagged Accounts

The prevention half of the framework rests on Early Warning Signals. An EWS is any indicator — sudden routing of sales outside the consortium, frequent change of auditors, disproportionate related-party transactions, delayed submission of stock statements — that suggests something is off well before the account turns bad.

When an EWS fires, the bank has to examine it inside an appropriate turnaround time, and the directions state a TAT of preferably not more than 30 days. If the signals hold up, the account is marked a Red Flagged Account. From that point a clock runs: the RFA is expected to be resolved — either classified as fraud or the flag removed — ordinarily within 180 days of first being reported as red-flagged.

The timelines you must memorise

If you remember nothing else from this page, remember this table. Every number below is a day count, and every one of them has appeared as a distractor.

The 21 and the 14 are the ones that get swapped. Twenty-one days flows to the borrower; fourteen days flows from the bank to the regulator after the decision is taken.

How ABM frames this in the exam

CAIIB ABM rarely asks "what is fraud". It asks a case-let: a mid-corporate account shows three EWS triggers, the bank sits on them for two months, then declares fraud by circulating an internal note — identify what went wrong. The answer is usually two defects at once: the turnaround time was breached, and no SCN or reasoned order was issued.

Three habits will carry you through.

First, separate prevention (EWS, RFA, staff accountability, a Board-approved policy) from process (SCN, reply, reasoned order) from reporting (FMR within 14 days, disclosures). Most questions live in exactly one of those three boxes.

Second, treat natural justice as the organising principle of the whole subject. Any option that lets a bank classify without notice is wrong after March 2023, however senior the sanctioning authority.

Third, practise with the numbers cold. Work through a mixed set on the IIBF mock tests, then run the credit and risk chapters again in the CAIIB Advanced Bank Management course. If your exam is close, build the revision order first on the study planner so the compliance-heavy chapters are not the ones you meet for the first time on exam morning.

One more thing worth saying plainly, because candidates often miss it: fraud risk management is not only about catching the borrower. The same directions expect banks to examine staff accountability and to preserve the underlying data and audit trail. A framework that punishes only the outsider is an incomplete framework, and the examiner knows it.

For the wider syllabus map and the rest of this revision series, start from the CAIIB course page or browse the recent updates on the blog.