Early warning signals for NBFCs: credit EWS and fraud EWS are different things
RBI asks NBFCs to catch credit stress and fraud early under two separate sets of rules. What each requires, who it covers, and how one loan record feeds both.
An NBFC runs two kinds of early warning. Credit early warning catches stress before an account slides: RBI’s special mention account bands apply from the first day of default on every loan. Fraud early warning catches accounts that may need a fraud investigation: RBI’s 2026 fraud directions require a framework for it in Upper and Middle Layer NBFCs. The two have different owners and outcomes, and they can read the same loan record.
If you own risk at an NBFC, you are asked about early warning in two meetings that keep separate notes: the credit committee, worried about roll rates, and the fraud committee, worried about accounts that were never meant to pay. RBI keeps the two under separate rules. Your frameworks can stay separate and still read the same account record.
Early warning guides written for banks describe red-flagged accounts and reporting to CRILC, RBI’s Central Repository of Information on Large Credits. NBFCs work under different directions, and in July 2026 RBI issued new fraud directions for them. RBI’s own stressed-assets directions call default “a lagging indicator of financial stress”, and they ask lenders to look for financial difficulty before anything is overdue.
- Two frameworks, two questions. Credit early warning asks whether the borrower can keep paying. Fraud early warning asks whether the loan was honest.
- Credit stress rules reach every layer. Special mention account bands apply from the day of default, on every loan of any size.
- Fraud EWS is mandatory for Upper and Middle Layer NBFCs. The 2026 fraud directions put it under the board’s fraud risk policy.
- No red-flagged accounts for NBFCs. That step and its CRILC reporting belong to the bank directions.
- A signal is not a verdict. Fraud classification needs a show-cause notice, at least 21 days to respond and a reasoned order.
What are early warning signals for an NBFC?
Early warning signals (EWS) are facts about a borrower or an account that suggest trouble before a loss shows up. They split by the question they answer.
Owned by credit risk and collections. Leads to earlier contact, a different treatment or a closer watch. Rules: SMA classification in the Resolution of Stressed Assets Directions.
Owned by the fraud risk function. Leads to an examination from a fraud angle, and possibly a fraud classification. Rules: the Fraud Risk Management Directions, 2026.
What does RBI require for credit stress?
Recognition from the first day of default. The NBFC Resolution of Stressed Assets Directions, 2025, require NBFCs to classify accounts as special mention accounts “immediately on default”: SMA-0 up to 30 days overdue, SMA-1 from 31 to 60 and SMA-2 from 61 to 90. The rule reaches retail loans and exposures of every size, and the flag is set in the day-end run for the due date. The SMA and NPA classification post covers the bands in detail.
The same directions go further than arrears. They give a non-exhaustive list of signs of financial difficulty drawn from the Basel Committee’s guidelines, and they state that financial difficulty can be identified even when nothing is overdue. Deposit-taking NBFCs and those with assets of ₹500 crore or more also report to CRILC: every borrower with ₹5 crore or more of aggregate exposure each month, and a weekly default report every Friday. An NBFC that hides the real status of an account faces accelerated provisioning.
What does RBI require for fraud EWS?
A framework under the board’s fraud policy, for the larger NBFCs. The Reserve Bank of India (Non-Banking Financial Companies - Fraud Risk Management) Directions, 2026, dated 31 July 2026, replaced the 2024 directions. They apply to NBFCs in the Upper and Middle Layers and to Base Layer NBFCs with assets of ₹500 crore or more. The early warning chapter applies to the Upper and Middle Layers:
- a framework for early warning signals under the board-approved fraud risk management policy, overseen by the Risk Management Committee
- an EWS system integrated with the core banking or loan system, or other operational systems
- quantitative and qualitative indicators, which RBI illustrates with transactional data, the borrower’s financial performance, market intelligence and conduct
- indicators reviewed periodically, and the framework validated
- monitoring of non-credit transactions in real time or close to it
- an alert that leads to an examination of whether the account should be investigated from a fraud angle
The directions set outcomes and leave the indicators to the lender. They contain no numbered list of warning signals.
Do NBFCs have to red-flag accounts?
No. The red-flagged account step belongs to the fraud directions for commercial banks, which report such accounts on RBI’s CRILC platform and expect the question to be closed within 180 days of first reporting. The 2026 fraud directions for NBFCs do not mention red-flagged accounts. An NBFC’s early warning alert goes to its own examination process, on timelines its board policy sets.
An NBFC adapting a bank’s EWS playbook can reuse its indicators, but it has no red-flag reporting step to follow.
Which signals belong in each framework?
Your policy decides, and the same event can feed both. The examples below are ones a retail lender might use. None of them is an RBI list.
| Signal | Credit reading | Fraud reading |
|---|---|---|
| First instalment never paid | Severe early stress | Possible misrepresentation at origination |
| Repeated returns for insufficient funds | Cash-flow strain | Rarely relevant alone |
| Promises to pay broken | Weakening intent or ability | Rarely relevant alone |
| Phone and address unreachable soon after disbursal | Contact risk | Possible identity or intent problem |
| Two or more borrowers sharing a device, address or bank account | Concentration | Possible organised fraud |
| Business inflows falling below the account’s own baseline | Stress before any miss | Possible diversion of funds |
What keeps the two readings honest is that they come from the same record. When the collections view and the fraud view each keep their own copy of the account, they can disagree about what happened and when.
What happens after a signal fires?
Different things, on different clocks.
A credit signal leads to a treatment: an earlier reminder, a call, a hardship conversation, a field visit. The NACH and UPI AutoPay bounce post walks through the first 72 hours after a returned NACH or UPI AutoPay debit.
A fraud signal leads to an examination, and a fraud classification has formal steps. The 2026 directions, which build in the Supreme Court’s 2023 ruling in State Bank of India v. Rajesh Agarwal, require a detailed show-cause notice, at least 21 days for the borrower to reply, and a reasoned order before an account is declared a fraud. Once classified, the fraud is reported to RBI in the Fraud Monitoring Return within 14 days, whatever the amount.
What should the early warning record keep?
For every signal, a reviewer should be able to read:
- the signal, the data behind it and when it fired
- the rule or model version that raised it, and its threshold at the time
- who looked at it, when, and what they decided
- for a credit signal, the treatment chosen and what happened next
- for a fraud signal, the examination and its outcome, and where classification follows, the notice, the borrower’s reply, the order and the return filed
Without the version of the rule, a reviewer cannot tell whether a signal that did not fire should have.
Where do agents fit in early warning?
In watching and assembling, inside the lender’s policy. An agent can watch every account every day, flag the signals the policy names, assemble the account history behind each one and propose a treatment for credit signals. A fraud classification is a decision about a person with civil consequences, and it stays with the lender’s fraud process and the people named in it.
Which path fits your risk team?
- Run one early warning list owned by collections. It is simple to operate. Fraud signals get treated as collections cases, and the evidence a fraud examination needs is not kept.
- Run the two frameworks separately, with their own owners and outcomes, both reading the same account record. It takes two policies and a clear hand-off between teams, and each signal can then be traced to its outcome.
- Rely on a bureau score pulled once a month as the main warning. It needs little build. A monthly pull can be weeks behind the lender’s own payment data, which shows a bounce the day it happens.
The second path asks more of the data. Signal definitions, thresholds and their versions have to be recorded, or the frameworks drift apart and nobody can show why an account was or was not flagged.
Lokta’s AI Loan Servicing covers credit early warning on the live book: agents prioritise accounts on overdue and early-warning signals and propose the treatment, and the lender’s deterministic core decides what changes on the record. Fraud examination and classification stay with the lender’s fraud process. Before Lokta, its team wrote Apache Fineract.
Frequently asked questions
Is an EWS framework mandatory for NBFCs?
For fraud, yes for NBFCs in the Upper and Middle Layers. RBI's Fraud Risk Management Directions for NBFCs, 2026, require them to run a framework for early warning signals under their board-approved fraud risk policy. Separately, NBFCs in every layer must classify accounts as special mention accounts as soon as they default, which is the credit-stress side of early warning.
Do NBFCs have to classify red-flagged accounts?
No. The red-flagged account step, with its reporting on RBI's CRILC platform and a 180-day window to conclude, sits in the fraud directions for commercial banks. The 2026 fraud directions for NBFCs do not use it. An NBFC's early warning signal leads to an examination of whether the account should be investigated from a fraud angle, under its own board policy.
What are examples of early warning signals for a retail loan book?
On the credit side, a first instalment that bounces, repeated returns for insufficient funds, broken promises to pay, and business inflows falling below the account's usual level. On the fraud side, a first instalment never paid at all, contact details that fail soon after disbursal, and borrowers who share a device, address or bank account. The lender chooses and tunes its own signals.
Can an AI system classify a borrower as a fraud?
It should not. RBI's fraud directions require a detailed show-cause notice, at least 21 days for the borrower to respond, and a reasoned order before an account is classified as fraud. Software can raise the signal and assemble the evidence. People in the lender's fraud process decide, and the record should show who decided and on what.
Sources:
- Reserve Bank of India (Non-Banking Financial Companies - Fraud Risk Management) Directions, 2026: RBI/DoS/2026-27/463, 31 July 2026. Paragraph 3 (applicability), paragraph 6 (natural justice), paragraphs 13 to 23 (early warning signals), paragraph 43 (Fraud Monitoring Return), paragraph 59 (repeal of the 2024 directions).
- Reserve Bank of India (Non-Banking Financial Companies - Resolution of Stressed Assets) Directions, 2025: paragraphs 14 and 15 (signs of financial difficulty), 18 and 19 (SMA bands and scope), 20 to 22 (CRILC, weekly report, concealment), 30 (default as a lagging indicator), 157 (application to NBFCs below ₹500 crore).
- Reserve Bank of India (Non-Banking Financial Companies - Income Recognition, Asset Classification and Provisioning) Directions, 2025: paragraph 19 (classification in the day-end process).
- Reserve Bank of India (Commercial Banks - Fraud Risk Management) Directions, 2026: paragraphs 22 and 31 (red-flagged accounts and the 180-day timeline, for banks).
