Forensic Bank Statement Analyzer
Round-trip detection + CTR structuring flags + balance continuity checks — forensic bank statement analysis in under 60 seconds per statement.
| Txn Date | Narration | Counterparty | Ref/UTR | Debit | Credit | Balance |
|---|---|---|---|---|---|---|
| 2026-01-10 | NEFT CR — ACME VENDORS | Acme Corp LLP | NEFT2601001 | 4,82,500 | 9,82,500 | |
| 2026-01-13 | CASH DEP BR-7821 — SELF | SELF / CASH | CASH13012026 | 9,90,000 | 19,72,500 | |
| 2026-01-15 | RTGS OUT — ACME HOLDINGS | Acme Holdings Pvt Ltd | RTGS2601152 | 9,75,000 | 9,97,500 | |
| 2026-01-15 | RTGS IN — ACME HOLDINGS | Acme Holdings Pvt Ltd | RTGS2601153 | 9,75,000 | 19,72,500 | |
| 2026-01-20 | MISC ADJ — BR REF 4421 | (BANK ADJUSTMENT) | ADJ4421 | 24,72,500 |
The Problem
Manual forensic bank statement analysis breaks at scale. A controller or forensic accountant reviewing a current-account statement for fraud investigation or lender due diligence faces five overlapping failure modes that no single Excel sort or filter can catch simultaneously.
Two to four analyst-days per account
A 300–500 row bank statement reviewed manually for round-tripping, structuring, shell payees, and balance anomalies consumes two to four working days per account per period. With multi-entity due diligence packages spanning five to ten accounts, the timeline becomes unmanageable before the credit committee deadline.
Round-trips invisible to column-based review
A debit of Rs 9,75,000 and a matching credit to the same counterparty on the same calendar date nets to zero in the closing balance and leaves no footprint in any single-column sort. Detecting it requires counterparty-level grouping and amount-matching within a rolling date window — a computation a manual reviewer almost never performs row by row across 400 transactions.
CTR threshold structuring missed without aggregation
Under Rule 3 of the PML (Maintenance of Records) Rules, 2005, cash transactions above Rs 10 lakh require a Cash Transaction Report filed with FIU-IND. Amounts structured just below this threshold — a single Rs 9,90,000 cash deposit, or three consecutive Rs 9,80,000 deposits totalling Rs 29,40,000 — each pass undetected in a column-filtered view that looks only at individual amounts, not at band membership or cross-day aggregation.
Balance jumps hidden in zero-debit/credit rows
An off-statement bank adjustment — a line that carries zero debit and zero credit but causes the running balance to change by Rs 5,00,000 — is completely invisible to any review that focuses on transaction flow rather than row-by-row balance recomputation. Such adjustments are a recognised indicator of either a bank processing error requiring confirmation under ICAI SA 505 (External Confirmations) or intentional balance manipulation for credit-appraisal purposes.
The analyst time consumed per account in a manual forensic bank statement review — before a single exception is confirmed. At Rs 2,000–4,000 per hour for forensic accountant time, a five-account due diligence package costs Rs 8–16 lakhs in reviewers' time alone, often on a three-day turnaround that forces shortcuts and omissions. Missed structuring patterns or undetected round-trips can expose a lender to PMLA Section 13 regulatory action or result in disbursements against manipulated cash flows.
Why It Matters: Regulatory Framework
Forensic bank statement review sits at the intersection of four overlapping bodies of law — PMLA reporting obligations, RBI AML guidelines, ICAI audit standards, and FinCEN's BSA framework for cross-border engagements. Missing any one exposes the reviewer or lender to material liability.
CTR and STR reporting thresholds
Rule 3 requires reporting entities to file a Cash Transaction Report for every cash transaction above Rs 10 lakh. Rule 4 requires a Suspicious Transaction Report for patterns suggesting structuring, round-tripping, or shell-entity routing — regardless of amount. Analysts who miss transactions in the Rs 9.5L–Rs 9.99L structuring band or fail to flag same-day equal-amount pairs create an STR omission under the Financial Intelligence Unit–India (FIU-IND) mandate.
Ongoing transaction monitoring obligations
The RBI's KYC/AML Master Direction (updated 2023), Para 18–22, requires regulated entities to implement ongoing transaction monitoring against a risk-based threshold matrix covering round-tripping, unusual cash deposits, and first-time large-value payees. Lenders performing financial due diligence on a borrower inherit these monitoring obligations when assessing the borrower's bank statements as part of credit underwriting.
Balance confirmation requirement
ICAI SA 505 requires auditors to obtain external confirmations of bank balances where the risk of material misstatement is significant. An unexplained balance jump — a row where the computed closing balance diverges from the stated balance without a matching debit or credit — is a direct trigger for an SA 505 confirmation request, and an auditor who issues a clean opinion without identifying such a row may face professional liability for failure to detect a material misstatement.
Anti-structuring provisions (cross-border)
For engagements involving US-regulated entities or cross-border fund flows, 31 U.S.C. § 5324 prohibits structuring transactions to evade the USD 10,000 Currency Transaction Report (CTR) threshold — the US parallel to India's Rs 10 lakh PMLA threshold. Forensic reviews on Indian subsidiaries of US-listed entities or US-regulated lenders must apply both thresholds simultaneously, as the relevant regulator may request evidence of compliance with whichever framework applies first.
What This Workflow Automates
Seven deterministic passes from raw Excel bank statement to forensic working paper — in under 60 seconds per statement. Each pass applies a discrete, reproducible rule to every row in the statement, producing a structured exception queue and risk register that any investigator can trace line by line back to the source data.
Ingest and normalise the statement
Accepts an Excel (.xlsx) or CSV bank statement export and normalises all data types — date formats (DD-MM-YYYY, DD/MM/YYYY, ISO), null debit/credit fields, and encoding artefacts in narration strings — into a canonical row schema containing txn_date, value_date, narration, counterparty, ref_no, debit, credit, and balance before any rule fires.
Verify balance continuity row by row
For every consecutive row pair, computes the expected closing balance as prior balance + credit − debit and compares it to the stated running_balance. Any divergence — including lines that carry zero debit and zero credit — is flagged as a balance_continuity FAIL, with the specific discrepancy amount and source row reference recorded under ICAI SA 505 confirmation-trigger criteria.
Detect round-trip transaction pairs
Groups all transactions by counterparty and scans within a rolling 7-calendar-day window for debit/credit pairs of equal amount (within a Rs 1 rounding tolerance). Any matching pair triggers the round_trip_detection FAIL rule; the two constituent lines are linked in the evidence record and the counterparty's risk score is elevated to the highest tier.
Flag structuring against the CTR threshold
Every cash transaction (counterparty field contains 'CASH', 'SELF', or self-deposit indicators) is tested against the Rs 9.5 lakh–Rs 9.99 lakh band defined under Rule 3 of the PML Rules, 2005. Individual hits trigger structuring_threshold FAIL; a secondary aggregate check groups cash deposits across consecutive business days and raises an aggregate structuring flag when the 7-day window total exceeds Rs 10 lakh through multiple sub-threshold deposits.
Identify weekend and bank-holiday transactions
Transaction date is compared against a calendar of Saturdays, Sundays, and RBI-notified bank holidays. Any non-business-day posting triggers the weekend_holiday_txn WARNING rule, which is co-reported with any other flags on the same line, surfacing the combination of a weekend date and a shell-counterparty pattern as a dual-flag finding in the exception queue.
Score shell-pattern and first-time large payees
Counterparty names are tested against a pattern library of generic offshore and holding-company structures — terms such as 'Holdings', 'Overseas', 'Global', 'Impex', 'Traders', 'Enterprises' combined with zero prior-transaction count in the statement period. First-time payees receiving more than Rs 10 lakh trigger first_time_large_payee WARNING; name-pattern matches trigger shell_counterparty_pattern WARNING per FIU-IND typology report heuristics.
Generate the forensic working paper
All flagged items are categorised by finding type (Round-Tripping, Structuring, Weekend/Holiday, Shell Counterparty, Balance Discontinuity, First-Time Large Payee), each flag is linked to the underlying UTR or reference number, and a risk score is computed per counterparty. Output is a structured Excel workbook with one tab per finding category, a summary risk register, a per-counterparty risk score table, and a clean-pass register — formatted to the documentation framework of ICAI's Technical Guide on Forensic Accounting and Fraud Detection (2020 edition).
Edge Cases We Simulate
The workflow ships with a battery of synthetic test scenarios that exercise every failure mode seen in real forensic engagements. Each scenario produces a deterministic outcome an auditor or controller can verify in seconds — the same input file always produces the same flag set.
Same-Day Round-Trip
round_trip_detection triggers. Both lines are linked in the evidence record, counterparty risk score is elevated to High, and the pair is exported to the Round-Tripping finding category.Structured Cash Deposit Below CTR Threshold
structuring_threshold triggers. Flagged for potential CTR avoidance, risk-scored High, and exported to the Structuring exception queue.Weekend Transfer to Shell-Pattern Payee
weekend_holiday_txn and shell_counterparty_pattern fire simultaneously. Counterparty receives highest risk tier; line appears under two co-occurring finding categories in the working paper.Unexplained Balance Jump (Zero-Debit/Credit Row)
balance_continuity triggers. Working paper records the Rs 5,00,000 discrepancy between computed and stated balance with the specific row reference — triggering a bank-confirmation requirement under ICAI SA 505.Consecutive-Day Cash Deposits (Aggregate Structuring)
Sample Documents & Results
Five seeded bank statement files — each engineered to exercise a different red-flag pattern. One passes all rules cleanly; four trigger FAIL or WARNING findings, demonstrating deterministic exception detection across every scenario the forensic ruleset covers.
bank_statement_clean.xlsx
Confirms the workflow produces zero false positives on normal, compliant transactions — the baseline performance gate for any forensic automation tool.
bank_statement_round_tripping.xlsx
Both transaction lines are linked in one finding record in the working paper; an investigator sees the full cycle without manually cross-referencing narrations across hundreds of rows.
bank_statement_structuring_below_threshold.xlsx
Exported to the Structuring exception queue; flagged for potential CTR avoidance under FIU-IND reporting guidance on transactions structured to remain below the reporting threshold.
bank_statement_balance_jump_unexplained.xlsx
The most operationally significant exception type: a balance jump that is invisible to any column-based scan and only surfaces through row-by-row arithmetic recomputation — which the workflow performs for every line.
Why Automation Wins Here
For a forensic accountant or lender credit analyst reviewing a 300-row bank statement, this bank statement fraud detection workflow replaces two to four days of manual computation with under 60 seconds of deterministic, rule-based analysis — and catches exception classes a human reviewer misses by design.
Balance jumps caught that column-scanning misses
A zero-debit/zero-credit row that causes the running balance to change by Rs 5,00,000 is invisible to any scan of the debit and credit columns alone. The workflow recomputes the expected balance for every consecutive row pair — the only reliable way to detect off-statement adjustments that are an ICAI SA 505 confirmation trigger and a recognised indicator of balance manipulation for credit-appraisal purposes.
Audit-ready working paper, instantly
Every exception is linked to the underlying UTR or reference number, severity-ranked (FAIL vs WARNING), and exported to a structured Excel workbook formatted to the ICAI Technical Guide on Forensic Accounting and Fraud Detection (2020 edition). The controller uploads the workbook to the case file without reformatting — satisfying ICAI SA 230 documentation standards for audit working papers.
Deterministic, consistent across reviewers
Human reviewers applying five different computational tests sequentially to 300–500 rows introduce both omission errors and reviewer-to-reviewer inconsistency. The workflow applies all six rules simultaneously and identically to every line — the same input file always produces the same flag set — eliminating the variance that makes manual forensic reviews difficult to defend in regulatory or legal proceedings.
Frequently Asked Questions
The questions forensic accountants, lenders, and internal audit teams ask most often before deploying automated bank statement analysis.
Upload a bank statement as an Excel (.xlsx) or CSV file with the standard columns — Txn Date, Value Date, Narration, Counterparty, Ref/UTR, Debit, Credit, and Running Balance. Cadel classifies and extracts every transaction row automatically. This is the tabular format that Indian scheduled commercial banks generate from their net-banking download portals.
A consolidated Forensic Findings Report (Excel) per statement. It scans every transaction against the red-flag taxonomy and reports: transactions scanned, total flagged, the high-risk flagged amount, a per-pattern finding count, and a per-finding detail list ranked by severity. The report also includes a per-counterparty risk register and a clean-pass register of rows that passed all six rules.
Six — round-tripping (equal debit/credit to the same counterparty within seven days), structuring just below the Rs 10 lakh CTR reporting band under Rule 3 of the PML Rules, 2005, weekend/holiday postings, shell-counterparty name patterns per FIU-IND typology heuristics, unexplained running-balance jumps, and first-time large payees receiving more than Rs 10 lakh with no prior transaction history in the statement period.
Any cash debit or credit (counterparty field contains 'CASH', 'SELF', or self-deposit indicators) landing in the Rs 9.5 lakh to Rs 9.99 lakh band is flagged as a FAIL, on the basis that values pinned just under the Rs 10 lakh Cash Transaction Report threshold are a classic CTR-avoidance signal. A secondary aggregate check groups cash deposits across consecutive business days and raises a combined flag when the 7-day window total exceeds Rs 10 lakh through multiple sub-threshold deposits — catching the pattern that individual-row filtering misses.
Round-tripping is money sent out and returned (or vice versa) to disguise its origin, inflate turnover, or cycle funds between related parties. The workflow flags an equal-and-opposite debit and credit to the same counterparty within a seven-day rolling window — within a Rs 1 rounding tolerance. Both transaction lines are linked in a single finding record so an investigator sees the full cycle without manually cross-referencing narrations across hundreds of rows. The lookback window is configurable for engagements where the instructing forensic accountant specifies a tighter or broader period.
For every row the workflow recomputes the expected running balance as prior balance + credit − debit. If the printed balance diverges by more than Rs 1 (to allow for rounding), the row is flagged as an unexplained balance jump — often the fingerprint of a deleted or altered transaction, or an off-statement bank adjustment. This class of exception is a direct trigger for a bank-confirmation request under ICAI SA 505 (External Confirmations) and is invisible to any review that scans the debit and credit columns without independently verifying the arithmetic.
No. The findings are risk indicators for an investigator to corroborate, not conclusions. A weekend posting or a first-time large payee can be entirely legitimate; the report prioritises FAIL-severity findings (round-tripping, structuring, balance jumps) so reviewers focus their effort where the pattern is strongest. The working paper is designed to support legal proceedings, but the instructing practitioner remains responsible for forming and signing the expert opinion in accordance with ICAI's Technical Guide on Forensic Accounting and Fraud Detection.
Yes — export the Forensic Findings Report to Excel from the report toolbar to attach the forensic summary to due-diligence working papers, a lender credit-appraisal package, or an investigation case file. The workbook's tab structure (one tab per finding category + summary risk register + clean-pass register) maps directly to the documentation format expected in financial due-diligence case files and internal audit workpapers prepared under ICAI SA 230 (Audit Documentation).