The story
The borrower group had been a model account. Delinquency across its facilities was suspiciously low, month after month, and internal audit had noticed. Then, without the gradual slide that usually precedes it, the group defaulted.
A sudden default after clean repayment is not a mystery in itself; businesses fail. What troubled the lender was the shape of it. Accounts that had never been late were suddenly, comprehensively bad, and the explanations on offer did not account for how the earlier performance had been possible.
The possibility nobody wanted to write down was that the performance had been manufactured. If relationship managers had been rolling old exposure into new disbursements, the low delinquency was not health but evergreening, and the sudden default was simply the moment the cycle could no longer be sustained. That would take help: a panel valuer whose reports supported the security, an external chartered accountant whose certificates supported the borrower, and insiders willing to look the other way.
Because the exposure was potentially a fraud with regulatory reporting consequences, the matter was routed through counsel. Counsel engaged NARADism to test whether relationship managers, a panel valuer and an external CA had colluded to evergreen the exposure.
How we approached it
- 1
Isolated the money-go-round
Core banking system and ledger analytics traced disbursements as they moved between group entities and back, separating the evergreening cycle from genuine business flows.
- 2
Reconstructed the approval timeline
Deleted sanction correspondence was recovered and the approval sequence was rebuilt forensically.
- 3
Verified in the field
Borrowers, guarantors and the panel valuer were verified on the ground against what the file claimed about them.
- 4
Interviewed in stages
Interviews were staged from the outside in, ending with the insiders once the documentary record was already established.
- 5
Prepared the regulatory pack
An RBI fraud-reporting pack was prepared, together with a look-back review of the implicated officers' wider portfolio.
Disbursements were circling back through 9 group entities with common directors within days of being released. A panel valuer's reports had been reused across unrelated properties, with fees paid partly in cash. The same external CA had certified the financials of both the borrower and two 'independent' guarantors.
Sanction-note emails had been deleted from the branch server shortly before the audit visit.
The lender reported the fraud to RBI within the prescribed timeline on a complete, defensible file. It recovered part of the exposure from insurance and the valuer's security, disciplined three insiders, and closed the maker–checker gap that had allowed the scheme to run.
Illustrative composite built from sector-typical fact patterns encountered in practice. Names, figures and timelines are indicative; no client is identifiable.