Fraud risk, preventive vigilance and internal controls
Fraud risk, preventive vigilance and internal controls
This domain tests fraud classification and reporting, the vigilance machinery in Indian banks, and the internal controls that stop fraud before money leaves the bank.
Fraud framework
RBI's fraud directions require a board-approved fraud risk management policy, board-level oversight of frauds, and reporting of frauds to RBI through the prescribed channel. Frauds are classified by the party involved (staff, customer, outsider) and by modus operandi. Red Flagged Accounts (RFAs) are accounts where early warning signals suggest incipient fraud; they trigger forensic audit and committee-level review before further exposure. Fraud is distinct from wilful default: fraud requires intent to deceive, while wilful default is deliberate non-repayment despite capacity to pay.
Preventive vigilance
The Central Vigilance Commission framework applies to public sector banks, where a Chief Vigilance Officer heads vigilance administration. Preventive vigilance means rotating staff in sensitive posts, mandatory leave, surprise checks, scrutiny of staff transactions and property returns, whistleblower protection, and closing procedural loopholes found in past cases. It is not the same as punitive vigilance, which is investigation and disciplinary action.
Internal controls
Segregation of front and back office, maker-checker, independent reconciliation, KYC verification with de-duplication, sanction limits, and concurrent audit of high-risk branches.
Worked example
A current account is opened on a forged GST certificate and ₹40 lakh is withdrawn in cash within a week. Failures: KYC was done by the officer who sourced the account, so there was no segregation; the certificate was never independently verified; there was no velocity check on a new account. Fixes: independent KYC verification, system velocity limits on new accounts, and concurrent audit sampling.
Traps
- Labelling every wilful default a fraud without evidence of intent.
- Confusing preventive vigilance with investigation.
- Assuming CVC directly supervises private sector banks.
- Missing the RFA trigger, which delays forensic audit and increases exposure.