Reserve Bank of India (Non-Banking Financial Companies – Fraud Risk Management) Directions, 2026
UR
- Applies toFinance companies
- StatusIn force
- IssuedJul 31, 2026
- Amendmentsnone tracked
- Length41 points in 4 sections · 4 min read
The four dates on this rule
- PublishedJul 31, 2026The day RBI put this document out. This is the same day as the Issued date on this rule.
- Starts to applyJul 31, 2026The day this rule starts to apply, as RBI's own text states it.
- Time to get readyNoneIt starts to apply on the day it was published.
- Last date to actNot statedNo date to act by was found in this document. Other dates may sit inside single paragraphs.
Kept in your browser only. Your desk
Show me the points for
Nothing is removed from the page.
Numbers to remember
| 21 days | The notice must give the person at least 21 days to reply. RBI Para 6(2) |
| three years | The Board must look at the fraud policy at least once in three years. RBI Para 7 |
| ₹3 crore | A Government NBFC refers every fraud of ₹3 crore and above to the Advisory Board for Banking and Financial Frauds. RBI Para 33 |
| 14 days | A fraud must be reported to RBI at once, and never later than 14 days from classification. RBI Para 43 |
What it says
How firm is each point
Stated by RBI — RBI’s own paragraph says this. We have only made it plainer.
Our reading — BankPulse read RBI’s paragraph and shortened it. The paragraph is the authority, not this line.
Needs judgement — RBI leaves this to the bank to settle, so nobody can give you a fixed number here.
Chapter I. Preliminary
1. Fraud rules for NBFCs
This paper sets how non-banking financial companies must handle fraud.
2. Start date
These Directions came into effect immediately upon issuance.
BankPulse example. There is no gap here between issue and effect. The Directions come into effect immediately upon issuance. A bank cannot wait for a separate start date, because there is none.
Chapter II. Governance and Oversight
Must know
1. Twenty-one days to reply
The notice must give the person at least 21 days to reply.
BankPulse example. Suppose the notice is served on 1 September. The person must be given at least 21 days to reply, so the reply is due no earlier than 22 September. A notice allowing 14 days would fall short.
2. Review it every three years
The Board must look at the fraud policy at least once in three years.
Do it
3. A Board policy on fraud
The Board must approve a fraud risk policy setting out who does what.
4. What the policy covers
The policy must cover prevention, early catching, enquiry, staff responsibility, watching, recovery and reporting of frauds.
5. Give the full grounds
The notice must set out every transaction and event the fraud finding rests on.
6. A reasoned order, served
A reasoned order must be served, setting out the facts, the reply and the reasons.
7. It reviews every case
That committee must review fraud cases, find the root cause and suggest fixes.
8. Board sets the money line
The Board decides the size of fraud case that must go to that committee.
9. Senior staff run the policy
Senior management must put the Board's fraud policy into practice.
10. Report cases upward
Senior management must place a regular review of frauds before the Board or its audit committee.
11. Take whistle blowers seriously
Whistle blower complaints about possible fraud must be examined and closed properly.
12. A team for fraud risk
A proper unit for fraud risk must sit inside the wider risk function.
Background
13. Weigh the outside director
A nominee or independent director is normally not in charge of the business, and that counts.
14. A committee on fraud
A special committee, headed by an independent director, oversees fraud work.
Chapter III. Framework for Early Warning Signals for Detection of Frauds (NBFCs in the Upper Layer and Middle Layer only)
1. Test the framework
The warning framework must be validated so its results stay sound and steady.
2. Both kinds of signal
The warning system must use both numbers and judgement to be of use.
3. Test the system often
The warning system must be tested from time to time to see that it works.
4. Watch mule accounts
Accounts that fail KYC and money mule accounts must be watched closely.
Chapter IV. General Instructions
Must know
1. Three crore goes to ABBFF
A Government NBFC refers every fraud of ₹3 crore and above to the Advisory Board for Banking and Financial Frauds.
BankPulse example. The Board is set up by the Central Vigilance Commission. It examines the role of the NBFC's officials and whole-time directors, including former ones. RBI's rule here is for Government NBFCs.
2. They must leave the room
Such executives must not sit in the meeting where their own conduct is weighed.
Do it
3. Put the deadline in writing
The auditor's contract must fix a time to finish the audit and hand in the report.
4. Put the audit in writing
The loan agreement must allow such an audit once the account is red flagged.
5. Settle staff responsibility in time
Staff accountability must be examined and finished within a set time in every fraud case.
Background
6. A policy for outside auditors
A policy is needed on hiring outside auditors, covering their record and fitness.
7. Hear before you brand
Natural justice must be followed strictly before any account is called a fraud.
8. Group accounts get checked
Where one account is a fraud, group companies sharing a promoter are examined too.
9. Government NBFCs follow the CVC
A Government NBFC examines staff accountability under the guidelines of the Central Vigilance Commission.
10. A person pulls firms in
Every firm a named person promotes or directs is treated as tied to him.
11. Lending after is a choice
After the bar ends, whether to lend again is the lender's own commercial call.
12. New owner, bar lifts
The bar stops applying to a firm once a rescue plan under the insolvency code is in place.
13. Not for the old owner
The bar stays on the old promoters and directors who ran the firm.
Chapter V. Reporting of Frauds to Law Enforcement Agencies
1. Name a police contact
A nodal officer must be named to report frauds to the law enforcement agencies.
Chapter VI. Reporting to Reserve Bank of India
1. Fourteen days to report
A fraud must be reported to RBI at once, and never later than 14 days from classification.
2. Report the group entities
Frauds in group entities RBI does not supervise must be reported to RBI separately.
3. Do not name the innocent
People and firms not involved in the fraud must not appear in the report.
4. Keep the closed papers
Details of every closed fraud case must be kept for the auditors to see.
5. Close only when done
A fraud case is closed only when the court or police case ends and staff responsibility is settled.
Chapter VII. Other Instructions
1. Report before you sell
Where fraud is found, it must be reported to RBI before the account is sold.
2. Investigate before you sell
A loan account must be investigated for fraud before it is sold to another lender.
The same subject for other kinds of institution
The same subject for other kinds of institution.
Other RBI rules for NBFCs
Every rule page on BankPulse · Questions bankers ask, answered