Fraud Investigation and Regulatory Compliance
What the exam tests
This domain tests the investigation lifecycle, evidence handling, regulatory reporting and customer-remedy routes after a fraud is detected.
Core rules
- The investigation sequence is detection, preliminary inquiry, evidence collection, forensic review, root-cause analysis, staff accountability, regulatory reporting, recovery and legal action.
- Fraud must be reported to RBI under the 2024 Master Direction within 21 days of detection; RFAs go to CRILC; cyber frauds go to NCRP and CFCFRMS for tracing and freezing.
- Electronic evidence requires forensic imaging, chain of custody and a certificate under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (earlier Section 65B of the Indian Evidence Act).
- Legal provisions commonly used include identity theft and cheating by personation under the IT Act, 2000, and corresponding cheating and forgery offences under the Bharatiya Nyaya Sanhita, 2023.
- Customer grievances go through the bank's internal redressal and the RBI Ombudsman Scheme, 2021; the Ombudsman is not a court and does not award damages in the same way.
Worked example
A customer loses ₹40 lakh through internet banking after a SIM swap. The bank must preserve login logs, IP addresses, device IDs and call records, verify whether AFA was bypassed, and fix liability based on negligence and reporting delay. It must report the fraud to RBI within 21 days, file on NCRP/CFCFRMS, complete root-cause analysis and initiate staff accountability if controls failed. Delay destroys evidence and attracts regulatory criticism.
Traps
Missing the 21-day reporting timeline. Breaking the chain of custody. Treating the Ombudsman as a criminal court. Reporting only after recovery. Skipping root-cause analysis and staff accountability.