Seven days to respond: where Indian banks actually lose time on NCRP complaints

The deadline is not the constraint

Ask an operations head whether they are meeting the SOP's clocks and the answer is usually yes. Ask what it takes, and the tone changes.

The first action has no clock at all. When CFCFRMS notifies a bank about a transaction, the SOP expects the amount to be put on hold if it is still in the account. Everything slower than that is the part a bank controls.

Hitting a seven-day clock is not difficult when you throw people at it. The clock is generous by design.

What it hides is that a case which should take minutes is taking days, and the difference is being absorbed by analysts rather than showing up as a breach.

So a team can be fully compliant and still have a serious operational problem. The SOP does not measure that, which is why nobody escalates it.

Where the three days actually go

Almost none of it is judgement. It is retrieval.

Cases arrive from the portal, through an API and by email, each in a different format, with no single queue to work from. Building that queue is the first job of the day.

Then each case means pulling transaction history, KYC records and logs from multiple systems. In practice that is five systems per case: the core banking portal, the API, the data lake, the internal service desk and the email inbox.

By the time an analyst has the evidence in front of them, the actual decision usually takes a moment. The days went somewhere else entirely.

Three days to under an hour

Figures from one Indian banking deployment, 2026.

The first two numbers are the headline. The third is the one worth understanding, because it is not a single effect.

What the 75% is actually made of

Two separate things, and they behave differently.

Between 50 and 60% of cases are handled end to end, with no analyst time at all. That is the routine band, where evidence is clear and the correct handling is known.

The rest still involve a person, but the work per transaction drops from about two minutes of manual handling to under a minute, because the evidence is already collected and the recommendation is already drafted. The analyst reviews rather than retrieves.

Those two effects together produce the roughly 75% reduction. Neither one alone would.

Why that distinction matters when you are scoping

A vendor promising to automate everything is describing the first band and quietly ignoring the second.

The second band is where your experienced people are, and speeding them up is worth as much as removing the routine cases. A 50% end-to-end rate with no improvement to the remaining half leaves most of your senior capacity exactly where it was.

Ask for both numbers separately. Any vendor who has run this at volume will have them.

Why meeting the deadline still leaves you exposed

Every hour a case sits open adds SLA exposure. It also pulls analysts away from higher-value fraud work, which is the cost that never appears in a spreadsheet.

And a backlog that is technically within the window is still a backlog. One deployment started from a 15,000-case position and brought it down 95%.

Those cases were not breaching. They were sitting there, absorbing the team's capacity, until the retrieval stopped being manual.

What to measure instead of the deadline

• Time to outcome, not time to submission. A submitted response that comes back has not saved you anything.
• Share of case time spent on retrieval versus decision. If retrieval dominates, you have a plumbing problem rather than a staffing problem.
• Exceptions by reason. Unresolved work should be categorised, not pooled.
• Analyst hours per case. The number that converts directly into capacity for the work only people can do.

Hitting the window is the floor, not the goal. The useful question is how much of your team's week the floor is costing you - and that number is almost never on the dashboard.

Why compliant teams rarely get investment

There is an uncomfortable dynamic here worth naming, because it explains why this problem persists in well-run banks.

Breaches get budget. Costs absorbed inside a compliant process do not. A team hitting the SOP's clocks looks fine on every report that reaches a management committee, so the three days of retrieval never becomes anybody's priority.

The way to surface it is to convert the hidden cost into the currency the committee already uses. Analyst hours per case, multiplied by volume, gives a capacity number. Capacity freed is capacity available for fraud work you are currently not doing.

In one deployment that figure was roughly 75% of analyst hours per case, which is not a process improvement. It is a headcount-equivalent argument.

What a realistic baseline looks like

Before any vendor conversation, write down four numbers for a typical month.

• Cases received, split by channel, because channels are not equally expensive.
• Median time from arrival to response, not the mean, which one bad case distorts.
• Estimated retrieval share of that time, measured on a sample rather than estimated.
• Cases that came back after a response was submitted, as a percentage.

That last number is the one most teams do not track, and it is the one that tells you whether speed improvements are real or just deferred work.