What Should a Comprehensive Early Warning System Monitor?

An Early Warning System is effective only when it looks beyond repayment defaults.

By the time a loan account becomes overdue or is classified as an NPA, several earlier signals may already have been visible. The borrower may have delayed statutory payments, diverted loan proceeds, overstated inventory, created additional charges or transferred money to connected parties.

A comprehensive EWS must bring these diverse signals together and identify the accounts that require immediate attention.

Four Sources of Early Warning Signals

RBI’s fraud risk management framework indicates that an effective EWS may include indicators based on:

1. Transactional data

2. Financial performance

3. Market intelligence

4. Conduct of the borrower

The objective is not to treat every unusual event as fraud. It is to identify combinations of signals that justify deeper examination from a potential fraud angle.

1. Account Conduct and Repayment Behaviour

Repayment behaviour is an important starting point, but the system should examine more than the current overdue amount.

Relevant indicators include:

• Persistent SMA-2 behaviour

• First or second EMI default

• Repeated cheque returns

• Broken promises to pay

• Frequent restructuring requests

• Interest payments funded through new facilities

• Repayment immediately following borrowing from another lender

• Frequent ad hoc limit requests

For example, a borrower may regularise an overdue account immediately before a reporting date and become overdue again shortly thereafter. Viewed separately, each event may appear manageable. Viewed as a pattern, it could indicate stress or evergreening.

2. Financial-Performance Indicators

Financial statements often provide early evidence of deterioration or manipulation.

A robust EWS should examine:

• Revenue compared with GST turnover

• Revenue compared with bank credits

• Inventory compared with sales

• Receivable ageing and collection periods

• Unbilled revenue

• Other current assets

• Cash levels compared with borrowings

• DSCR and ICR deterioration

• Related-party transactions

• Auditor qualifications and resignations

• Differences between MCA records and financial statements

Consider a borrower reporting revenue of ₹100 crore when GST filings indicate ₹65 crore and credits in its designated bank accounts show ₹55 crore. The difference does not automatically prove fraud, but it requires a documented explanation.

3. Collateral and Security Indicators

Weaknesses relating to collateral can materially increase the bank’s loss.

Important indicators include:

• Delayed CERSAI or MCA charge creation

• Pending post-disbursement documents

• Collateral-title disputes

• Duplicate property identifiers

• Multiple charges over the same asset

• Inflated valuation

• Insurance lapse

• Insufficient insurance

• Repeated delay in stock or site inspection

• Material stock-audit discrepancies

• Non-existent or vacant collateral

A loan may appear adequately secured in the core lending system while the underlying property is disputed, overvalued or already charged elsewhere. An integrated EWS helps identify such inconsistencies.

4. Fund Diversion and Evergreening Indicators

Monitoring end-use is essential after disbursement.

The system should identify:

• Loan proceeds transferred to unrelated beneficiaries

• Large cash withdrawals immediately after disbursement

• Round-tripping through connected entities

• Loan repayments funded by another lender

• Interest serviced through additional facilities

• Sales proceeds not routed through designated accounts

• Transfers to front or associate companies

• High-value payments inconsistent with the borrower’s business

For example, if a business loan is disbursed for machinery purchase but a large amount moves to a promoter-linked real-estate company, the transaction requires immediate review.

5. Digital and Non-Credit Transactions

Fraud risk extends beyond loan accounts.

A modern EWS must also monitor:

• Dormant-account activation

• Sudden transaction-volume changes

• New-beneficiary transfers

• Account-profile changes before a debit

• Repeated authentication failures

• Unusual device or geographic access

• Card and UPI velocity

• Mule-account networks

• Common devices or mobile numbers across unrelated customers

RBI expects regulated entities to strengthen the monitoring of other banking and non-credit transactions, including transactions conducted through digital platforms.

6. Channel, Employee and Third-Party Risk

Fraud can originate through an intermediary or internal employee.

Indicators should therefore cover:

• High-fraud or high-NPA DSAs

• Fraud clustering at a branch

• Abnormal policy deviations

• Valuer or legal-advisor concentration

• Repeated overrides

• Maker-checker exceptions

• Employee-customer linkages

• Suspicious employee access

• Duplicate documents across applications

A high number of fraudulent loans involving the same branch, DSA and valuer may indicate an organised network rather than isolated customer fraud.

How FraudSentinel360 Is Better

Many EWS tools concentrate primarily on loan-account delinquency and a limited number of financial indicators.

FraudSentinel360 offers a broader approach through more than 95 configurable checks covering the complete fraud-risk ecosystem.

The module is better suited for enterprise-wide implementation because it provides:

• Credit and non-credit monitoring

• Internal and external data integration

• Customer, employee and third-party indicators

• Rule-level threshold configuration

• Composite risk scoring

• Link and network analysis

• Alert-to-investigation conversion

• RFA assessment workflow

• Management dashboards

• Complete audit trail

Instead of treating every alert independently, FraudSentinel360 can combine multiple signals relating to the same borrower or connected network.

Designed for RBI-Aligned Implementation

FraudSentinel360 is designed to provide complete functional coverage for applicable RBI expectations relating to comprehensive indicators, integration, timely examination, investigation, validation, remedial action and oversight.

This aligns with the direction of RBI’s revised framework, which strengthened EWS and RFA for early detection and prevention of fraud, as noted in the RBI Annual Report 2024–25.

A bank must still approve its own indicators, thresholds and governance arrangements. FraudSentinel360 provides the configurable technology needed to operationalise those decisions consistently.

Conclusion

A comprehensive EWS should not wait for repayment default. It should continuously examine the borrower, account, collateral, transactions, connected parties, digital behaviour and market developments.

FraudSentinel360 enables banks to bring all these signals together, prioritise the highest-risk cases and initiate timely investigation.

Because the earliest warning sign is often found outside the overdue report.