FraudSentinel360 EWS Check Library

Explore 95+ Configurable
Early Warning Signals

The FraudSentinel360 EWS library covers credit, collateral, financial, transactional, digital, market-intelligence, channel and employee-related risks.

95+ Configurable Checks 9 Risk Categories Fully Configurable Thresholds RBI-Aligned Governance

The checks described below represent configurable early warning indicators. Triggering a check does not automatically mean that fraud has occurred. It means that the activity requires examination based on the bank’s policy, materiality limits and risk appetite.

All thresholds shown are illustrative and can be configured separately for different products, portfolios and customer segments.

The Library

Every Check, Organised by Risk Category

Click any category to expand its checks. Each entry shows what the indicator identifies and a worked example of when it would trigger.

Post-Disbursement and Portfolio Monitoring
Documentation, charge-creation, construction-progress and repayment-behaviour signals after a loan is disbursed.
7 Checks
EWS-1
Critical PDD Overdue
Identifies critical post-disbursement documents that remain pending beyond the permitted period.
Example: A housing loan has been disbursed, but the original registered sale deed has not been deposited even after nine months.
EWS-2
CERSAI or MCA Charge-Creation Delay
Identifies delays in registering, modifying or perfecting the bank’s security interest.
Example: A company receives a secured loan, but the charge is not registered with MCA within the stipulated period.
EWS-3
Persistent SMA-2 Behaviour
Identifies accounts that repeatedly remain 61–90 days overdue or return to SMA-2 shortly after regularisation.
Example: A borrower clears overdue instalments at quarter-end but becomes 70 days overdue again within two months.
EWS-4
Composite Loan—Construction Not Started
Identifies purchase-plus-construction loans where construction has not commenced within the expected period.
Example: A plot and construction loan is disbursed, but no construction activity is visible for 18 months.
EWS-5
Builder Construction Not Progressing
Identifies builder-linked projects where verified construction has stopped or milestones are not being achieved.
Example: The bank releases money for a construction milestone, but site inspections show no further progress for 12 months.
EWS-6
Self-Construction Not Progressing
Identifies self-construction loans where progress does not match the amounts disbursed.
Example: Two construction instalments are released, but the house remains at foundation level after nine months.
EWS-7
Aggressive Balance Transfer or Top-Up
Identifies a recent balance transfer followed by an unusually large top-up without independently verified end-use.
Example: A ₹50 lakh housing loan is transferred and increased to ₹65 lakh within three months without evidence supporting the additional requirement.
DSA and Branch Risk
Sourcing-channel and branch-level clustering of NPAs, fraud incidence and performance against benchmark.
5 Checks
EWS-8
High NPA or Fraud DSA—High Volume
Identifies high-volume DSAs with an unusually high incidence of NPA or confirmed fraud.
Example: A DSA sources 500 loans and 20 become NPA or fraud cases, significantly exceeding the bank’s normal rate.
EWS-9
High NPA or Fraud DSA—Low Volume
Identifies smaller DSAs with a disproportionate number of bad accounts.
Example: A DSA sources only 40 loans, but four become early NPAs or confirmed frauds.
EWS-10
Branch 90+ DPD Rising Trend
Identifies branches where seriously overdue accounts are increasing continuously.
Example: A branch’s 90+ DPD accounts increase from 6 to 11 and then 18 over three consecutive months.
EWS-11
Worst Branches Against Benchmark
Identifies branches performing materially worse than comparable branches or the bank-wide benchmark.
Example: A branch has a 9% 90+ DPD rate against the bank average of 2.5%.
EWS-12
Branch Fraud Clustering
Identifies several suspected or confirmed fraud cases originating from the same branch.
Example: Seven fraudulent property-loan applications are traced to one branch within 12 months.
Statutory, Project and Collateral Risk
Statutory-due defaults, project-scope changes, collateral disputes, trade-finance and guarantee irregularities.
22 Checks
EWS-13
Default in Statutory Dues
Identifies delays or defaults in GST, TDS, PF, ESI, income tax, customs or other statutory payments.
Example: A profitable company has not deposited GST and employee PF for four months.
EWS-14
High-Value Cheque Bounces
Identifies repeated or unusually large cheque returns inconsistent with the customer’s profile.
Example: Three supplier cheques of ₹25 lakh each are returned for insufficient funds in one month.
EWS-15
Frequent Material Changes in Project Scope
Identifies repeated changes to project cost, contractor, design, approval or completion schedule without satisfactory reasons.
Example: A project changes its machinery supplier twice and increases its cost from ₹30 crore to ₹48 crore.
EWS-16
Under- or Over-Insured Inventory
Identifies a material difference between insured stock and independently assessed inventory.
Example: Stock recorded at ₹10 crore is insured for ₹4 crore—or stock worth ₹8 crore is insured for ₹20 crore.
EWS-17
Invoices Missing Statutory Identifiers
Identifies material invoices lacking GSTIN, e-way bill details, supplier identity or other mandatory information.
Example: A borrower submits ₹80 lakh of machinery invoices without supplier GSTIN or e-way bills.
EWS-18
Collateral Title Dispute
Identifies disputes concerning ownership, possession, mutation, encumbrance or charge priority.
Example: A property offered as collateral is subject to an inheritance dispute and an existing lender’s charge.
EWS-19
Project Cost Variance
Identifies a material difference between the declared project cost and independent estimates.
Example: Machinery is shown as costing ₹12 crore, while comparable quotations indicate a normal cost of ₹8 crore.
EWS-20
Repayment Funded by Another Bank
Identifies loan repayment made using newly borrowed funds rather than operating cash flow.
Example: A ₹2 crore instalment is paid immediately after ₹2.1 crore is received from another lender.
EWS-21
Foreign Bills Overdue
Identifies export or foreign bills that remain unrealised beyond the expected or permitted period.
Example: Export proceeds of ₹5 crore remain unpaid for several months without credible buyer correspondence.
EWS-22
Onerous BG or LC Clause
Identifies unusual or high-risk clauses in a BG, LC or SBLC that deviate from approved wording or the underlying transaction.
Example: A guarantee is made unconditionally payable to an unrelated beneficiary without adequate supporting documentation.
EWS-23
Merchanting Trade Import Leg Not Disclosed
Identifies merchanting-trade transactions where the purchase side or import leg is missing or inconsistent.
Example: A borrower shows a foreign sale but cannot establish from whom the goods were originally purchased.
EWS-24
Repeated Postponement of Stock or Site Inspection
Identifies repeated attempts to avoid physical inspection of stock, collateral or project activity.
Example: A borrower cancels three warehouse inspections using different reasons each time.
EWS-25
Delayed Dues to Creditors
Identifies worsening creditor ageing or persistent supplier-payment delays.
Example: Average supplier payment time increases from 45 days to 150 days despite reported normal operations.
EWS-26
Financing Unit Far from Servicing Branch
Identifies lending relationships where the financed unit is far from the responsible branch without adequate justification or monitoring.
Example: A Mumbai branch finances a remote factory with no connection to Mumbai and no enhanced inspection arrangement.
EWS-27
Claims Not Acknowledged as Debt
Identifies material claims or obligations that are not recognised or adequately provided for.
Example: A supplier files a ₹10 crore recovery case, but the company does not disclose or provide for it.
EWS-28
Frequent BG Invocation or LC Devolvement
Identifies repeated failure to honour commitments under bank guarantees or letters of credit.
Example: Four LCs devolve within six months because the borrower does not provide funds on their due dates.
EWS-29
Interest Funded Through New Facilities
Identifies fresh lending that is directly or indirectly used to service interest on existing debt.
Example: A temporary limit of ₹1 crore is sanctioned and immediately used to pay term-loan interest.
EWS-30
Same Collateral Charged to Multiple Lenders
Identifies the same asset being pledged to different lenders without a valid pari-passu arrangement or consent.
Example: A warehouse already mortgaged to one bank is offered to another bank using another set of documents.
EWS-31
Concealment of Vital Documents
Identifies failure to provide important financial, legal, insurance, litigation or security documents.
Example: A borrower suppresses the termination notice received from its largest customer.
EWS-32
Front or Associate Companies Created with Borrowed Funds
Identifies loan proceeds transferred to newly created or connected entities without genuine commercial purpose.
Example: A borrower transfers ₹7 crore of working-capital funds to a recently incorporated company controlled by a promoter’s relative.
EWS-33
Promoter Stake Reduction or Encumbrance
Identifies a significant reduction or pledge in promoter shareholding without disclosure or satisfactory justification.
Example: Promoter ownership falls from 60% to 35%, while most of the remaining shares are pledged.
EWS-34
Key-Person Exits or Management Churn
Identifies frequent or unexpected departures of directors, senior management, auditors or other key officials.
Example: The CFO, company secretary and statutory auditor resign within six months.
Financial and Business-Performance Risk
Revenue, receivables, borrowings, disclosures and financial-statement inconsistencies that point to stress or manipulation.
15 Checks
EWS-35
Unbilled Revenue Spike
Identifies a sharp increase in unbilled revenue without supporting contracts, work certification or subsequent invoices.
Example: Unbilled revenue rises from ₹10 crore to ₹40 crore, but customer approvals cannot be produced.
EWS-36
Large Connected-Party Transactions
Identifies material transactions with entities having common directors, addresses, GSTINs or other connections.
Example: A borrower makes large purchases from a company sharing the same director and registered address.
EWS-37
Inventory Movement Inconsistent with Turnover
Identifies inventory changes that are disproportionate to sales, production or seasonality.
Example: Sales remain unchanged, but inventory increases from ₹15 crore to ₹40 crore.
EWS-38
Receivables Movement or Ageing Deterioration
Identifies receivables growing faster than sales or taking substantially longer to collect.
Example: Sales increase by 5%, but receivables rise by 50% and collection time doubles.
EWS-39
Other Current Assets Movement
Identifies large unexplained changes in other current assets.
Example: Other current assets increase from ₹3 crore to ₹18 crore without supporting schedules.
EWS-40
Borrowings Rise Despite Cash Surplus
Identifies increasing borrowings despite the borrower reporting substantial available cash.
Example: A company reports ₹25 crore in cash but obtains an additional ₹20 crore working-capital facility without a clear requirement.
EWS-41
ROC Liabilities Missing from Financial Statements
Identifies charges or liabilities appearing in MCA or ROC records but not in borrower financial statements.
Example: MCA records a ₹10 crore bank charge that is absent from the company’s accounts.
EWS-42
Substantial Related-Party Transactions
Identifies material related-party dealings lacking arm’s-length support or a clear business purpose.
Example: A company with ₹100 crore turnover advances ₹25 crore interest-free to a promoter-owned entity.
EWS-43
Material Annual-Report Discrepancies
Identifies conflicting information across financial statements, notes, reports and disclosures.
Example: The directors’ report mentions no litigation while the notes disclose a major regulatory case.
EWS-44
Inconsistent Annual-Report Information
Identifies figures or disclosures that do not reconcile internally.
Example: Total borrowing is shown as ₹50 crore in the balance sheet and ₹70 crore in the debt note.
EWS-45
Poor Disclosure of Adverse Information
Identifies known defaults, litigation, regulatory action or covenant breaches that were not properly disclosed.
Example: A borrower fails to tell the bank that its principal factory licence has been suspended.
EWS-46
Frequent Accounting Policy or Period Changes
Identifies repeated changes in accounting policies, revenue recognition or reporting periods without sound justification.
Example: A company changes its revenue-recognition method and extends its reporting year, materially improving reported results.
EWS-47
Frequent General-Purpose Loan Requests
Identifies repeated requests for loans or top-ups without a specific, verifiable end-use.
Example: A company requests three general corporate-purpose facilities in one year despite existing limits.
EWS-48
Frequent Ad Hoc Sanctions
Identifies repeated temporary limit increases, excess drawings or covenant waivers.
Example: A borrower requires four temporary overdraft enhancements within nine months.
EWS-49
Sales Not Routed Through the Lender
Identifies a material difference between declared turnover and receipts routed through designated lender accounts.
Example: A borrower reports sales of ₹100 crore, but only ₹45 crore is routed through the agreed banking accounts.
Trade, Payment and Fund-Diversion Risk
Genuineness of trade transactions, unusual fund movement and evidence of loan-proceeds diversion.
6 Checks
EWS-50
Local or Related-Party LC Without Genuine Trade
Identifies LCs issued for local or connected-party transactions without evidence of genuine goods movement.
Example: An LC favours a promoter-linked supplier, but no e-way bills, transport documents or stock receipts exist.
EWS-51
High-Value Transfer to Unrelated Parties
Identifies large transfers to parties that do not match the borrower’s stated business or approved end-use.
Example: A textile manufacturer transfers ₹3 crore of working-capital funds to a real-estate company.
EWS-52
Heavy Cash Withdrawals from Loan Account
Identifies large or repeated cash withdrawals from loan, cash-credit or overdraft accounts.
Example: ₹40 lakh is withdrawn in cash immediately after a machinery-loan disbursement.
EWS-53
Original Bills Not Produced
Identifies borrowers who cannot provide original invoices or submit altered, duplicate or reused documents.
Example: The same photocopied machinery invoice is submitted to support finance from two lenders.
EWS-54
Critical Stock-Audit Findings
Identifies serious stock discrepancies, negative drawing power, fictitious stock or unsupported receivables.
Example: The records show stock of ₹12 crore, but physical verification confirms only ₹5 crore.
EWS-55
Regulatory Raid or Enforcement Action
Identifies a raid, search, seizure or material action by tax, customs, ED, police or another authority.
Example: GST authorities search the borrower’s premises in connection with suspected fake invoices.
Identity, Application and Early-Default Risk
KYC, identity and early-repayment-behaviour signals visible right at onboarding.
5 Checks
EWS-56
KYC Mismatch or Identity Red Flags
Identifies inconsistencies across PAN, Aadhaar, address, income, employer, beneficial-owner and bureau information.
Example: The PAN belongs to one person, while the photograph, mobile and salary account belong to another.
EWS-57
Multiple Loans on the Same Identity or Asset
Identifies multiple facilities linked to the same identity, mobile, property or vehicle without proper disclosure.
Example: The same property survey number appears in three unrelated loan applications.
EWS-58
Negative or Unverifiable Field Investigation
Identifies residences, employment or businesses that cannot be verified or differ from declared information.
Example: An applicant claims to operate a factory, but the stated address is a locked residential room.
EWS-59
Digital Footprint Inconsistency
Identifies devices, IP addresses, locations, mobile numbers or emails inconsistent with the declared customer profile.
Example: Ten supposedly unrelated borrowers submit applications from the same device and IP address.
EWS-60
First or Second EMI Default
Identifies borrowers who miss the first or second instalment without a genuine post-sanction event.
Example: A vehicle-loan customer fails to pay even the first EMI, suggesting possible identity, asset or transaction fraud.
Transaction and Digital Fraud Risk
Real-time monitoring of cash structuring, fund diversion, mule-network clustering and digital account-takeover patterns.
11 Checks
EWS-61
Cash Deposit or Withdrawal Structuring
Identifies multiple cash transactions deliberately kept below internal or regulatory monitoring thresholds.
Example: Instead of depositing ₹10 lakh once, the customer makes several deposits of ₹95,000.
EWS-62
Rapid Disbursal-to-Beneficiary Diversion
Identifies a substantial portion of loan proceeds moving quickly to unapproved beneficiaries.
Example: ₹70 lakh of a ₹1 crore business loan moves to personal accounts within three days.
EWS-63
Round-Tripping of Loan Proceeds
Identifies disbursed funds returning to the borrower, promoter or group entity through intermediaries.
Example: Funds move to a supplier, then to another company and finally return to the promoter.
EWS-64
Dormant Account Activation Anomaly
Identifies sudden high-value activity in a dormant or historically inactive account.
Example: An account inactive for two years is activated and transfers ₹50 lakh on the same day.
EWS-65
Sudden Transaction-Volume Anomaly
Identifies transaction count or value that materially exceeds the customer’s historical pattern.
Example: A small retailer with monthly credits of ₹5 lakh suddenly receives ₹40 lakh in one week.
EWS-66
New-Beneficiary High-Value Transfer
Identifies a large transfer to a recently added beneficiary, particularly after a profile change.
Example: A beneficiary is added and receives ₹20 lakh within two hours.
EWS-67
Beneficiary or Mule-Network Clustering
Identifies common beneficiaries, mobiles, devices, addresses or UPI IDs across unrelated customers or fraud cases.
Example: Multiple fraud victims transfer money to accounts linked to the same device and mobile number.
EWS-68
Unusual Login, Device or Geographic Change
Identifies a new device, IP, SIM or implausible geographic movement before a risky transaction.
Example: A customer logs in from Mumbai and another login from Dubai occurs ten minutes later.
EWS-69
Repeated Failed Authentication or Reset
Identifies repeated login or OTP failures followed by a successful high-value transaction.
Example: Twelve failed OTP attempts are followed by a password reset and a ₹15 lakh transfer.
EWS-70
Account-Takeover Profile Change
Identifies changes to customer contact or beneficiary information shortly before a debit or loan drawdown.
Example: The registered mobile is changed and ₹8 lakh is transferred within 24 hours.
EWS-71
Card or UPI Velocity Anomaly
Identifies unusual transaction frequency, value, merchant category, timing or geography.
Example: A customer who normally makes five UPI payments per week suddenly makes 60 gaming-related payments at night.
Disbursement, Valuation and Security Risk
Collateral valuation, insurance, covenant, regulatory and negative-media signals across the life of the facility.
16 Checks
EWS-72
Loan Disbursal Before Conditions Precedent
Identifies disbursement made before mandatory legal, valuation, insurance or sanction conditions are fulfilled.
Example: A mortgage loan is disbursed before obtaining the original title documents and legal-search report.
EWS-73
Valuation Outlier
Identifies collateral valued materially above comparable properties, earlier valuations or expected realisation value.
Example: A property is valued at ₹2 crore while comparable properties are valued at approximately ₹1.3 crore.
EWS-74
Repeated Valuer or Legal-Opinion Concentration
Identifies unusual concentration or adverse outcomes linked to a valuer, lawyer, FI agency or DSA.
Example: One valuer handles 70% of a branch’s cases, and several later show inflated valuations.
EWS-75
Property Identifier Duplication
Identifies the same property address, unit number, survey number, location or image across multiple facilities.
Example: Two unrelated borrowers submit different title documents for the same flat.
EWS-76
Insurance Lapse or Inadequate Collateral Cover
Identifies expired, unverifiable or insufficient insurance on secured assets.
Example: A factory securing a ₹20 crore facility has an expired fire-insurance policy.
EWS-77
Covenant Breach Unresolved
Identifies a financial, information, escrow, leverage or security breach not resolved within the permitted period.
Example: The borrower exceeds the approved debt-equity ratio for two quarters without corrective action.
EWS-78
DSCR or ICR Deterioration
Identifies declining capacity to service debt or interest from operating cash flow.
Example: DSCR falls from 1.6 to 0.9, indicating that cash flow may no longer cover scheduled debt payments.
EWS-79
Revenue, GST and Bank-Credit Mismatch
Identifies material differences between declared revenue, GST turnover and receipts in bank accounts.
Example: Financial statements show ₹100 crore revenue, GST returns show ₹62 crore and bank credits show ₹55 crore.
EWS-80
Tax-Filing Lapse or Return Anomaly
Identifies missing, repeatedly delayed or inconsistent GST, TDS or income-tax returns.
Example: Bank credits indicate monthly sales of ₹5 crore, while GST filings report only ₹1 crore.
EWS-81
Bureau Deterioration After Sanction
Identifies a falling bureau score, new delinquency or significant additional borrowing after sanction.
Example: Within six months of sanction, the borrower obtains five unsecured loans and defaults with two lenders.
EWS-82
Undisclosed New Lending or Charge
Identifies a new borrowing, guarantee or security charge created without lender disclosure or consent.
Example: MCA records a new ₹8 crore charge in favour of another bank despite a negative-lien undertaking.
EWS-83
Related-Party Counterparty KYC Overlap
Identifies undisclosed linkages between borrowers, vendors and beneficiaries.
Example: The borrower’s principal supplier shares the director’s address, mobile number and bank-account introducer.
EWS-84
Negative Media or Litigation Escalation
Identifies credible adverse media, insolvency, criminal action, fraud allegations or material litigation.
Example: Court records and credible reports show that the promoter has been charged in a fake-invoice case.
EWS-85
Auditor Qualification or Resignation
Identifies an adverse audit opinion, significant qualification or unexpected auditor resignation.
Example: The statutory auditor resigns after being denied evidence supporting ₹30 crore of receivables.
EWS-86
RERA or Project-Approval Lapse
Identifies expired, revoked or delayed project registration, approval, completion certification or escrow compliance.
Example: Disbursements continue even though the builder’s RERA registration has expired.
EWS-87
Collateral Inspection or Occupancy Anomaly
Identifies collateral that is vacant, nonexistent, materially altered or inconsistent with the financed activity.
Example: A property described as an operational factory is found vacant with all machinery removed.
Collection, Employee and Process Risk
Collection-behaviour patterns and internal-control failures spanning employees, overrides and process deviations.
8 Checks
EWS-88
Collection Promise-to-Pay Failure
Identifies customers who repeatedly fail to honour agreed payment dates.
Example: A customer gives three payment commitments within 60 days but fails to pay each time.
EWS-89
Repeated Restructuring or Settlement Request
Identifies multiple requests for restructuring, moratorium, waiver or settlement without sustainable cash flow.
Example: A borrower requests two restructurings and a settlement within 12 months while transferring funds to group companies.
EWS-90
Employee Override or Maker-Checker Exception
Identifies a manual override, backdated change, KYC waiver or maker-checker failure in a high-risk process.
Example: An officer waives mandatory KYC and obtains post-facto approval only after disbursement.
EWS-91
Employee-Customer or Vendor Linkage
Identifies a common mobile, address, device, account, beneficiary or introducer between an employee and an external party.
Example: A loan applicant’s contact number is also registered as the alternate number of the processing employee.
EWS-92
Suspicious Employee Access Pattern
Identifies account access outside an employee’s role, branch, working hours or normal activity level.
Example: An employee accesses 200 dormant accounts at midnight before several are activated.
EWS-93
Sanction or Disbursal Deviation Concentration
Identifies a branch, officer, DSA or product with an unusually high rate of policy deviations or document waivers.
Example: The bank-wide deviation rate is 4%, but 35% of loans sanctioned by one officer contain deviations.
EWS-94
Credit-Bureau Enquiry Velocity
Identifies multiple credit applications or bureau enquiries within a short period.
Example: Eight lenders make enquiries for the same customer within 20 days despite only one declared loan requirement.
EWS-95
Duplicate Document or Image Reuse
Identifies the same statement, payslip, invoice, identity image, selfie or property photograph across unrelated applications.
Example: Identical bank statements and property photographs appear in applications submitted by three different borrowers.
Configuration

How FraudSentinel360 Uses These Checks

The EWS library is not a static checklist. Each indicator can be configured based on:

Product and portfolio Borrower or customer segment Transaction or exposure amount Monitoring period Data availability Trigger threshold Alert severity Examination timeline Alert owner Escalation hierarchy Suppression and exclusion criteria Composite risk score

Multiple indicators can be combined to identify higher-risk cases and reduce dependence on isolated alerts.

Important Disclaimer

An Early Warning Signal is an indicator requiring examination. It is not, by itself, proof of fraud, wilful default or customer wrongdoing.

Every alert should undergo evidence-based review and documented disposition under the bank’s approved policies. The indicators and thresholds must be calibrated and approved by the bank according to its products, portfolios, risk appetite, data availability and applicable regulatory requirements.

Want to Understand Which EWS Checks Are Relevant for Your Bank?

Our team can help you map the FraudSentinel360 EWS library to your products, portfolios and risk appetite.