IRDAI's 2025 Insurance Fraud Monitoring Framework: Cyber-Age Fraud, the IIB Database and Insurer Duties

On 9 October 2025, the Insurance Regulatory and Development Authority of India notified the IRDAI (Insurance Fraud Monitoring Framework) Guidelines, 2025 (Ref: IRDAI/IID/GDL/MISC/112/10/2025). The guidelines come into force on 1 April 2026 and replace the 12-year-old framework issued on 21 January 2013, rewriting how every insurer in the country must deter, prevent, detect, report and remedy fraud. This explainer walks through what the 13-page circular actually says, who it binds, how the new Insurance Information Bureau (IIB) fraud database works, and the policy-wording traps that decide whether a genuine claim is paid or an inflated one is caught.

The Rule / Product

The 2025 guidelines were issued under Section 34 of the Insurance Act, 1938 and Section 14(1) of the IRDA Act, 1999, the two statutory powers that let the regulator bind the whole industry at once. Clause 1.2 makes them applicable to all insurers and distribution channels unless otherwise specified, and clause 1.3 sets the commencement date at 1 April 2026, giving the sector roughly six months from the 9 October 2025 notification to build the systems. Clause 13.1 repeals the earlier Insurance Fraud Monitoring Framework of 21 January 2013 (ref IRDA/SDD/MISC/CIR/009/01/2013), so from April 2026 there is a single, current rulebook.

Clause 3.1 defines "Insurance Fraud" as an act or omission intended to gain advantage through dishonest or unlawful means, including misappropriating funds, deliberately misrepresenting, concealing or not disclosing one or more material facts relevant to a transaction, or abusing a position of trust or fiduciary relationship. Clause 3.3 adds a modern category, "Cyber or New Age Fraud", meaning any insurance fraud carried out using digital or new age technologies, while clause 3.2 defines a "Red Flag Indicator" (RFI) as a warning sign pointing to potential fraud that may require further investigation.

Clause 4.1 forces every insurer to classify and report fraud under five fixed categories, so that industry data is finally comparable across companies. The table below reproduces the classification exactly as set out in clause 4.1.1 to 4.1.5.

Clause 5 builds the governance spine. Clause 5.1 requires every insurer to target "zero tolerance for fraud", and clause 5.2 places oversight of the fraud risk management framework squarely on the board-level Risk Management Committee (RMC). Clause 5.3.1 mandates a board-approved Anti-Fraud Policy reviewed at least annually, and clause 5.3.2 requires a Fraud Monitoring Committee (FMC) headed by a Key Managerial Person, plus a Fraud Monitoring Unit (FMU) that is kept independent from internal audit. Under clause 5.3.2.4 the FMC must submit quarterly reports to the RMC, place an Annual Comprehensive Fraud Risk Assessment before the board through the RMC, and report every internal fraud to the Audit Committee as well. The full text is published on the regulator's site as the IRDAI (Insurance Fraud Monitoring Framework) Guidelines, 2025.

Why It Matters

For policyholders, the headline change sits in clause 7: from 1 April 2026 every insurer must plug into the Insurance Information Bureau (IIB) Fraud Monitoring Technology Framework, an industry-wide database that shares threat intelligence on attempted, suspected and reported fraud across all companies. Clause 7.2 says the platform will use a suitable mechanism, such as a unique identifier, to recognise a policyholder irrespective of which insurer they approach, so a suspicious claims pattern no longer disappears the moment a person switches companies. This is the single biggest structural shift from the 2013 regime, which had no common industry database.

Clause 7.3 extends that database into a "caution repository": all insurers must report blacklisted distribution channels, hospitals, third-party vendors and fraud perpetrators to the IIB, which maintains the record so that known bad actors cannot simply move to the next insurer. Clause 7.4 requires the IIB, in joint consultation with the Life Insurance Council and the General Insurance Council, to adopt the unique identifier, procedure and timelines for the repository. For an honest policyholder this matters because the cost of fraud is ultimately loaded back into everyone's premium, and a tighter net on organised fraud protects the pricing of genuine cover. You can see how underwriting assumptions feed a premium using the term insurance premium calculator.

Clause 11 is the clause most policyholders will actually notice. It requires insurers, intermediaries and insurance intermediaries to run regular fraud-awareness programmes for policyholders and the general public, alongside periodic training for employees, senior management and board members. Clause 6 separately obliges insurers to build a robust cybersecurity framework, continuously monitor incident databases, customer verification and access controls, and deploy a team with relevant technology expertise, because the 3.3 "Cyber or New Age Fraud" definition recognises that a growing share of insurance fraud now runs through digital channels, phishing and synthetic identities. If you want to understand the technical vocabulary behind this, our glossary entries on underwriting and the IRDAI are a useful starting point.

Worked Numbers

The guidelines do not set premium rates, but they do impose a precise reporting arithmetic through Form FMR-1 in Annexure I, which every insurer must file with the Authority within 30 days of the close of the financial year under clause 12.2. FMR-1 Part I is a fraud ledger that reconciles cases and rupee amounts (in lakh) across the five categories. The worked example below is illustrative, using round hypothetical figures to show exactly how the ledger closes; the categories, the Rs-lakh unit and the carry-forward logic are taken directly from Annexure I.

Imagine a general insurer that begins the financial year with 20 unresolved fraud cases carrying Rs 450 lakh of exposure. During the year it detects 60 new cases worth Rs 900 lakh and closes 50 cases worth Rs 700 lakh. The closing position is simply opening plus new minus closed:

So the carry-forward is 20 + 60 - 50 = 30 cases, and Rs 450 lakh + Rs 900 lakh - Rs 700 lakh = Rs 650 lakh of unresolved exposure that must then be aged. Annexure I Part II requires that Rs 650 lakh (30 cases) to be split into four age buckets: 30 to 60 days, 60 to 180 days, 180 to 360 days, and more than 360 days, so the regulator can see how long fraud cases sit unresolved. Separately, the Annexure requires every Cyber or New Age Fraud to be reported in its own table regardless of category, and Part III reconciles cases reported to the Police, the CBI and other agencies.

Closure is not at the insurer's discretion. Under the Annexure's closure rules, a case counts as closed only when, for example, the matter pending with the CBI, Police or court is finally disposed of, staff accountability has been examined, and the fraud amount has been recovered or written off. For limited statistical purposes a case may be closed where a charge sheet has not been filed for more than three years from the date of the First Information Report, but the insurer must still pursue the CBI or police for final disposal. The health-side analogue of this discipline, where a padded hospital bill becomes a claims-fraud entry, is exactly why sum-insured adequacy matters; you can test a realistic figure with the health insurance premium calculator and the Section 80D calculator.

Pitfalls

The first trap is treating non-disclosure as a harmless omission. Clause 3.1 expressly brings "deliberately misrepresenting, concealing or not disclosing one or more material facts" within the definition of fraud, so a pre-existing diabetes or cardiac condition left off the proposal form is not a technicality; it is a classifiable Policyholder Fraud under clause 4.1.3. The honest fix is to declare everything on the proposal form, because a disclosed condition at worst triggers a loading or a waiting period, whereas a concealed one invites repudiation. Note that the Insurance Act, 1938 separately protects long-standing policies under its three-year rule, and the Acts themselves are published by the regulator at IRDAI Acts.

The second trap is assuming the database only watches policyholders. Clause 4.1.1 and clause 4.1.2 make Internal Fraud and Distribution Channel Fraud the first two categories, and clause 7.3 feeds blacklisted agents, brokers, hospitals and vendors into the IIB caution repository. An agent who forges a signature or a hospital that inflates a bill is now recorded industry-wide, so the 2013-era habit of a blacklisted intermediary simply re-registering with another insurer is squarely targeted from 1 April 2026.

The third trap is the co-pay, sub-limit and room-rent clause that quietly converts a genuine claim into a dispute that looks like fraud. If a policy caps room rent and the hospital upgrades the room, the proportionate deduction can cascade across the whole bill, and an angry policyholder who then edits documents turns a pricing dispute into Claims Fraud under clause 4.1.3. The defence is to read the sub-limit and room-rent capping clauses before you buy, not at the claims desk. Reinsurance arrangements are not exempt either: clause 8 applies the whole framework mutatis mutandis to reinsurance and ceding business, with foreign reinsurance branches required to follow whichever of the host-jurisdiction or Indian framework is more comprehensive.

The fourth trap is believing cyber fraud is the insurer's problem alone. Clause 6 puts the cybersecurity build on the insurer, but clause 11.1 makes policyholder awareness a statutory programme precisely because phishing links, fake policy-renewal calls and spoofed payment pages depend on a human clicking. A single shared OTP can hand a fraudster control of a policy, and because clause 3.3 classifies this as Cyber or New Age Fraud reportable separately in FMR-1, it is now tracked as its own threat line.

FAQ

When does the IRDAI Insurance Fraud Monitoring Framework 2025 take effect?

The guidelines were notified on 9 October 2025 (Ref IRDAI/IID/GDL/MISC/112/10/2025) and come into force on 1 April 2026 under clause 1.3. From that date they replace the earlier framework of 21 January 2013, so insurers have had roughly six months to stand up the required board-approved anti-fraud policy, Fraud Monitoring Committee and Fraud Monitoring Unit.

What is the Insurance Information Bureau (IIB) fraud database?

Under clause 7, the IIB runs an industry-wide Fraud Monitoring Technology Framework that every insurer must join from 1 April 2026. Clause 7.2 lets it identify a policyholder across insurers through a unique identifier, and clause 7.3 maintains a caution repository of blacklisted distribution channels, hospitals, vendors and fraud perpetrators, so threat intelligence is shared rather than siloed in one company.

What counts as Cyber or New Age Fraud?

Clause 3.3 defines it as any insurance fraud carried out using digital or new age technologies, and the FMR-1 Annexure requires it to be reported in a separate table irrespective of which of the five categories it falls under. Clause 6 obliges insurers to build a robust cybersecurity framework and a specialist technology team to counter it.

Does non-disclosure on a proposal form count as fraud?

Yes. Clause 3.1 explicitly includes deliberately concealing or not disclosing material facts, and clause 4.1.3 classifies this as Policyholder Fraud. Declaring a pre-existing condition upfront on the proposal form at most triggers a loading or waiting period, whereas concealment can lead to the claim being repudiated.

How do insurers report fraud to IRDAI under the new rules?

Clause 12.2 requires an annual return in Form FMR-1 to be filed within 30 days of the close of the financial year, covering all five fraud categories, a separate cyber-fraud table, an age-wise analysis of unresolved cases, and cases reported to the Police and CBI. Clause 12.1 also requires reporting of fraud to Law Enforcement Agencies, and clause 12.3 requires prompt escalation to IRDAI for fraud by IRDAI-registered distribution channels.

Who inside an insurer is responsible for fraud monitoring?

Clause 5.2 puts oversight on the board-level Risk Management Committee, clause 5.3.2 requires a Fraud Monitoring Committee headed by a Key Managerial Person, and clause 5.3.2.1 requires a Fraud Monitoring Unit kept independent of internal audit. The committee reports quarterly to the Risk Management Committee and refers all internal frauds to the Audit Committee.

Do the rules apply to agents and reinsurers too?

Yes. Clause 9 and clause 10 require distribution channels and intermediaries to run their own fraud risk management framework and to alert the insurer on any suspicion of fraud, while clause 8 applies the framework mutatis mutandis to reinsurance and ceding business, with foreign reinsurance branches following the more comprehensive of the host-jurisdiction or Indian rules.