MC Explains | As Kotak Bank writes to RBI on standard fraud disclosure norms, 7 key questions answered

Representative image.

Private lender Kotak Mahindra Bank said on August 30 that it wrote twice to the Reserve Bank of India (RBI) requesting enforcement of standardised fraud reporting requirements by all lenders.

This came after a media report, citing government data, said Kotak recorded 5,278 cases of fraud in the first quarter (April to June) of FY22, whereas State Bank of India, the country’s largest lender, reported only nine cases.

Moneycontrol spoke to bankers and experts on whether all banks follow set protocols in reporting frauds and the challenges and reforms needed to plug loopholes:

1. What type of frauds do banks report to the regulator?

Lenders must report frauds of Rs 1 lakh and above pertaining to fund misappropriation, criminal breach of trust, encashment through forged instruments, manipulation of books of accounts or through fictitious accounts, and conversion of property, said Jugal Mantri, chief executive officer at Anand Rathi Global Finance, citing RBI guidelines.

Banks must also report frauds related to unauthorised credit facilities extended for reward or for illegal gratification, negligence and cash shortages, cheating and forgery, and irregularities in foreign exchange transactions, among others.

Kotak Mahindra said of the 5,278 cases it reported, 97 percent were associated with digital and card-related frauds that occurred “due to customers unwittingly compromising their credentials by clicking on unknown links” or giving access to their devices, among others.

“It is our submission that other banks do not appear to be exhaustively or uniformly reporting these types of frauds. Such frauds are not a reflection of any vulnerabilities in the bank’s secure infrastructure and systems,” the bank said.

2. How many frauds did banks report in FY22?

Responding to Moneycontrol’s query, an SBI spokesperson said the bank reported 4,192 frauds in FY22 and 5,724 frauds in FY21 to the regulator.

Data provided by the RBI shows that while private lenders reported more frauds than public sector banks in FY22, the total value of frauds reported by PSU banks was substantially higher than that of private banks.

As per the RBI data, private lenders reported 5,334 fraud cases amounting to over Rs 1 lakh during FY22, higher than 3,078 cases reported by the state-run lenders. The total amount involved in frauds reported by private banks stood at Rs 17,588 crore during FY22, lower than Rs 40,282 crore of frauds reported by state-owned lenders.

Further, according to the latest data provided by the Centre, during Q1FY23 while some lenders did not report any fraud, HDFC Bank reported 303 fraud cases while ICICI Bank reported 436 cases. The two banks did not offer comment for this story.

3. Which are the areas where banks report the most frauds?

According to the SBI spokesperson, the most instances of fraud by volume is in the retail segment, and by value, it is in the corporate segment.

Deloitte India, citing a survey, identified retail banking as a major contributor to fraud incidents, with 53 percent of the respondents indicating they had experienced more than 100 fraud incidents over the past two years, reflecting a 29 percent increase since the previous edition.

“Similarly, the non-retail segment saw an average of 20 fraud incidents, highlighted by 56 percent of the survey respondents, again a rise from the previous edition that stood at 22 percent,” said KV Karthik, partner, financial advisory, at Deloitte India.

Additionally, data theft, cybercrime, third-party induced fraud, bribery and corruption, and fraudulent documentation were identified as the top five concerns with over 42 percent of the respondents (cumulative) reporting to be victims of these, as per the Deloitte survey.

“Similarly, in the RBI annual report, while overall frauds reported decreased, ‘loan frauds’ have been highlighted as one major area of concern. This was based on the data provided by the banks for frauds above Rs 1 lakh,” Karthik said.

4. What are the reasons for banks’ failure to report frauds?

Ashvin Parekh, managing partner at Ashvin Parekh Advisory Services, said the key problem lies in recognising fraud, which is done by banks. After studying the frequency and severity of each fraud, the bank’s risk management committee must report each fraud to the board of directors, he said.

Governance plays a key role in the reporting of frauds, Parekh said.

“Frauds can not only cause financial loss but reputation risk to the bank as well. In many banks, for instance, you may find that the disclosure policy itself may be an open one, leaving decisions to executives. If the board is not vigilant and the risk management practices are weak, then frauds which occur may not be taken as seriously as some other banks may take. That is exactly what Kotak Bank is saying,” Parekh said.

Amit Das, cofounder of Think360.ai, said most banks and non-banking finance companies don’t report fraud comprehensively.

“There are challenges associated with tracking and reporting frauds consistently, resolving fraud-related issues, establishing clear accountability, off-system management, potential expose of internal process failures, reputation risk, among others. This is similar to the teething issues with bureau reporting in the earlier years,” Das said.

5. What is the RBI doing to tackle fraud disclosure challenges?

According to  Karthik, the RBI has mandated banks to report all types of frauds. Banks need to furnish Fraud Monitoring Returns in individual fraud cases, irrespective of the amount involved.

The RBI asked banks to submit fraud reports in cases where central investigating agencies have initiated criminal proceedings suo moto and where the RBI has directed that such cases be reported as fraud, Karthik said, adding that the format for reporting of fraud to the RBI has been provided by the regulator in various circulars issued at regular intervals.

As Moneycontrol reported on August 29, the RBI is also working on a fraud registry aimed at keeping repeat offenders at bay from the banking system.

“The fraud registry will capture information like IP (internet protocol) addresses and phone numbers repeatedly used to commit frauds,” executive director Anil Kumar Sharma said on August 29.

“A mechanism for these details would be created so that banks can report these details to us. That will help us prevent these fraudsters using the banking infrastructure for perpetrating fraud after fraud after fraud,” he added.

6. What are banks doing to lower fraudulent transactions?

Public and private sector banks are raising customer awareness on frauds through digital campaigns, bankers said.

Sending messages and mails to customers advising them not to click on any unknown links, asking them not to provide private bank account information to others through calls and messages, and running digital campaigns to raise awareness are some of the measures, they said.

HDFC Bank recently launched a fraud awareness campaign called #StayVigil through which the bank will “educate people about fraud and its prevention techniques” and guide customers who have been defrauded of their savings.

7. Are better regulations needed to report frauds?

Bankers and analysts are divided on whether the RBI should introduce further fraud disclosure norms.

Das of Think360, who is in favour of further regulation, says there is a “big need” to standardise fraud reporting and fraud management norms across lenders. It will ensure consistency, better fraud repositories, deeper understanding of systemic or process failures, and swifter response to fraud events, he said. It will also allow for faster action against perpetrators, he added.

“Imagine a fraudster replicating the same modus operandi across multiple institutions and accounts and getting away with it because they are aware that no one is tracking aggressively,” Das said.

Mantri of Anand Rathi, on the other hand, said the present fraud disclosure norms are adequate and called for lenders to follow the existing procedure vigilantly.

“As per the RBI circular dated Sept. 29, 2016, frauds are classified under seven broad categories. This classification does not specifically include online/digital frauds. There could be a possibility of non-reporting of such instances. Else, I do not see any incentive for non-reporting,” Mantri said.

The RBI guidelines and internal norms of lending institutions are adequate, he said, adding that true compliance with policies, regular reviews and monitoring mechanisms can help in averting fraud.