All Workflows

Forensic Bank Statement Analyzer

Round-trip detection + CTR structuring flags + balance continuity checks — forensic bank statement analysis in under 60 seconds per statement.

Live demo Drop a bank statement Excel and watch Cadel score every transaction against six forensic red-flag patterns — in seconds.

The Problem

Manual forensic bank statement analysis breaks at scale. A controller or forensic accountant reviewing a current-account statement for fraud investigation or lender due diligence faces five overlapping failure modes that no single Excel sort or filter can catch simultaneously.

Two to four analyst-days per account

A 300–500 row bank statement reviewed manually for round-tripping, structuring, shell payees, and balance anomalies consumes two to four working days per account per period. With multi-entity due diligence packages spanning five to ten accounts, the timeline becomes unmanageable before the credit committee deadline.

Round-trips invisible to column-based review

A debit of Rs 9,75,000 and a matching credit to the same counterparty on the same calendar date nets to zero in the closing balance and leaves no footprint in any single-column sort. Detecting it requires counterparty-level grouping and amount-matching within a rolling date window — a computation a manual reviewer almost never performs row by row across 400 transactions.

CTR threshold structuring missed without aggregation

Under Rule 3 of the PML (Maintenance of Records) Rules, 2005, cash transactions above Rs 10 lakh require a Cash Transaction Report filed with FIU-IND. Amounts structured just below this threshold — a single Rs 9,90,000 cash deposit, or three consecutive Rs 9,80,000 deposits totalling Rs 29,40,000 — each pass undetected in a column-filtered view that looks only at individual amounts, not at band membership or cross-day aggregation.

Balance jumps hidden in zero-debit/credit rows

An off-statement bank adjustment — a line that carries zero debit and zero credit but causes the running balance to change by Rs 5,00,000 — is completely invisible to any review that focuses on transaction flow rather than row-by-row balance recomputation. Such adjustments are a recognised indicator of either a bank processing error requiring confirmation under ICAI SA 505 (External Confirmations) or intentional balance manipulation for credit-appraisal purposes.

2–4 days

The analyst time consumed per account in a manual forensic bank statement review — before a single exception is confirmed. At Rs 2,000–4,000 per hour for forensic accountant time, a five-account due diligence package costs Rs 8–16 lakhs in reviewers' time alone, often on a three-day turnaround that forces shortcuts and omissions. Missed structuring patterns or undetected round-trips can expose a lender to PMLA Section 13 regulatory action or result in disbursements against manipulated cash flows.

Why It Matters: Regulatory Framework

Forensic bank statement review sits at the intersection of four overlapping bodies of law — PMLA reporting obligations, RBI AML guidelines, ICAI audit standards, and FinCEN's BSA framework for cross-border engagements. Missing any one exposes the reviewer or lender to material liability.

PMLA Rules 2005 · Rule 3 & 4

CTR and STR reporting thresholds

Rule 3 requires reporting entities to file a Cash Transaction Report for every cash transaction above Rs 10 lakh. Rule 4 requires a Suspicious Transaction Report for patterns suggesting structuring, round-tripping, or shell-entity routing — regardless of amount. Analysts who miss transactions in the Rs 9.5L–Rs 9.99L structuring band or fail to flag same-day equal-amount pairs create an STR omission under the Financial Intelligence Unit–India (FIU-IND) mandate.

RBI KYC/AML Master Direction · Para 18–22

Ongoing transaction monitoring obligations

The RBI's KYC/AML Master Direction (updated 2023), Para 18–22, requires regulated entities to implement ongoing transaction monitoring against a risk-based threshold matrix covering round-tripping, unusual cash deposits, and first-time large-value payees. Lenders performing financial due diligence on a borrower inherit these monitoring obligations when assessing the borrower's bank statements as part of credit underwriting.

ICAI SA 505 · External Confirmations

Balance confirmation requirement

ICAI SA 505 requires auditors to obtain external confirmations of bank balances where the risk of material misstatement is significant. An unexplained balance jump — a row where the computed closing balance diverges from the stated balance without a matching debit or credit — is a direct trigger for an SA 505 confirmation request, and an auditor who issues a clean opinion without identifying such a row may face professional liability for failure to detect a material misstatement.

BSA/FinCEN · 31 U.S.C. § 5324

Anti-structuring provisions (cross-border)

For engagements involving US-regulated entities or cross-border fund flows, 31 U.S.C. § 5324 prohibits structuring transactions to evade the USD 10,000 Currency Transaction Report (CTR) threshold — the US parallel to India's Rs 10 lakh PMLA threshold. Forensic reviews on Indian subsidiaries of US-listed entities or US-regulated lenders must apply both thresholds simultaneously, as the relevant regulator may request evidence of compliance with whichever framework applies first.

What This Workflow Automates

Seven deterministic passes from raw Excel bank statement to forensic working paper — in under 60 seconds per statement. Each pass applies a discrete, reproducible rule to every row in the statement, producing a structured exception queue and risk register that any investigator can trace line by line back to the source data.

01

Ingest and normalise the statement

Accepts an Excel (.xlsx) or CSV bank statement export and normalises all data types — date formats (DD-MM-YYYY, DD/MM/YYYY, ISO), null debit/credit fields, and encoding artefacts in narration strings — into a canonical row schema containing txn_date, value_date, narration, counterparty, ref_no, debit, credit, and balance before any rule fires.

02

Verify balance continuity row by row

For every consecutive row pair, computes the expected closing balance as prior balance + credit − debit and compares it to the stated running_balance. Any divergence — including lines that carry zero debit and zero credit — is flagged as a balance_continuity FAIL, with the specific discrepancy amount and source row reference recorded under ICAI SA 505 confirmation-trigger criteria.

03

Detect round-trip transaction pairs

Groups all transactions by counterparty and scans within a rolling 7-calendar-day window for debit/credit pairs of equal amount (within a Rs 1 rounding tolerance). Any matching pair triggers the round_trip_detection FAIL rule; the two constituent lines are linked in the evidence record and the counterparty's risk score is elevated to the highest tier.

04

Flag structuring against the CTR threshold

Every cash transaction (counterparty field contains 'CASH', 'SELF', or self-deposit indicators) is tested against the Rs 9.5 lakh–Rs 9.99 lakh band defined under Rule 3 of the PML Rules, 2005. Individual hits trigger structuring_threshold FAIL; a secondary aggregate check groups cash deposits across consecutive business days and raises an aggregate structuring flag when the 7-day window total exceeds Rs 10 lakh through multiple sub-threshold deposits.

05

Identify weekend and bank-holiday transactions

Transaction date is compared against a calendar of Saturdays, Sundays, and RBI-notified bank holidays. Any non-business-day posting triggers the weekend_holiday_txn WARNING rule, which is co-reported with any other flags on the same line, surfacing the combination of a weekend date and a shell-counterparty pattern as a dual-flag finding in the exception queue.

06

Score shell-pattern and first-time large payees

Counterparty names are tested against a pattern library of generic offshore and holding-company structures — terms such as 'Holdings', 'Overseas', 'Global', 'Impex', 'Traders', 'Enterprises' combined with zero prior-transaction count in the statement period. First-time payees receiving more than Rs 10 lakh trigger first_time_large_payee WARNING; name-pattern matches trigger shell_counterparty_pattern WARNING per FIU-IND typology report heuristics.

07

Generate the forensic working paper

All flagged items are categorised by finding type (Round-Tripping, Structuring, Weekend/Holiday, Shell Counterparty, Balance Discontinuity, First-Time Large Payee), each flag is linked to the underlying UTR or reference number, and a risk score is computed per counterparty. Output is a structured Excel workbook with one tab per finding category, a summary risk register, a per-counterparty risk score table, and a clean-pass register — formatted to the documentation framework of ICAI's Technical Guide on Forensic Accounting and Fraud Detection (2020 edition).

Edge Cases We Simulate

The workflow ships with a battery of synthetic test scenarios that exercise every failure mode seen in real forensic engagements. Each scenario produces a deterministic outcome an auditor or controller can verify in seconds — the same input file always produces the same flag set.

Clean Vendor Receipt

What's wrongA known counterparty (Acme Corp Pvt Ltd) remits Rs 4,82,500 via NEFT on a weekday. Debit/credit flow reconciles to the running balance and the counterparty has prior transaction history in the period.
Expected outcomeNo flags raised; the transaction passes all six validation rules and appears only in the clean-pass register — confirming the workflow produces zero false positives on normal transactions.

Same-Day Round-Trip

What's wrongAn Rs 9,75,000 RTGS debit and an equal Rs 9,75,000 RTGS credit both post to Acme Holdings Pvt Ltd on the same calendar date, leaving the net closing balance unchanged.
Expected outcomeFAIL — round_trip_detection triggers. Both lines are linked in the evidence record, counterparty risk score is elevated to High, and the pair is exported to the Round-Tripping finding category.

Structured Cash Deposit Below CTR Threshold

What's wrongA cash deposit of Rs 9,90,000 is credited against counterparty 'SELF / CASH' on 2026-01-13. The amount falls in the Rs 9.5L–Rs 9.99L band, just below the Rs 10 lakh CTR threshold under Rule 3 of the PML Rules, 2005.
Expected outcomeFAIL — structuring_threshold triggers. Flagged for potential CTR avoidance, risk-scored High, and exported to the Structuring exception queue.

Weekend Transfer to Shell-Pattern Payee

What's wrongAn RTGS outward transfer of Rs 18,00,000 is dated Sunday 2026-01-18 to a first-time payee 'Acme Overseas Traders Pvt Ltd' — name matching generic offshore patterns with no prior transaction history.
Expected outcomeWARNING — both weekend_holiday_txn and shell_counterparty_pattern fire simultaneously. Counterparty receives highest risk tier; line appears under two co-occurring finding categories in the working paper.

Unexplained Balance Jump (Zero-Debit/Credit Row)

What's wrongOn 2026-01-20, the running balance changes from Rs 13,32,300 to Rs 18,32,300 via ref ADJ4421 carrying zero debit and zero credit — narration 'MISC ADJ — BR REF 4421', counterparty '(BANK ADJUSTMENT)'.
Expected outcomeFAIL — balance_continuity triggers. Working paper records the Rs 5,00,000 discrepancy between computed and stated balance with the specific row reference — triggering a bank-confirmation requirement under ICAI SA 505.

Consecutive-Day Cash Deposits (Aggregate Structuring)

What's wrongThree separate cash deposits of Rs 9,80,000, Rs 9,85,000, and Rs 9,70,000 posted on three consecutive business days — each individually below the CTR trigger but collectively totalling Rs 29,35,000.
Expected outcomeFAIL on each individual deposit; plus an aggregate structuring flag covering the consecutive-day window with all three lines grouped under one finding in the Structuring exception tab.

Sample Documents & Results

Five seeded bank statement files — each engineered to exercise a different red-flag pattern. One passes all rules cleanly; four trigger FAIL or WARNING findings, demonstrating deterministic exception detection across every scenario the forensic ruleset covers.

Bank Statement · clean baseline
All rules pass

bank_statement_clean.xlsx

Single NEFT credit of Rs 4,82,500 from Acme Corp Pvt Ltd on a weekday. All balance continuity checks pass; no structuring, no round-trip, no shell patterns.
Flags raised0zero exceptions
Clean-pass rows1in clean register
Risk scoreLowno flags

Confirms the workflow produces zero false positives on normal, compliant transactions — the baseline performance gate for any forensic automation tool.

Bank Statement · round-trip
FAIL

bank_statement_round_tripping.xlsx

Rs 9,75,000 RTGS debit and equal credit to Acme Holdings Pvt Ltd on the same date — net balance unchanged, round-trip pattern present.
Finding typeFAILround_trip_detection
Amount involved₹9.75 Lboth legs
Counterparty riskHighelevated tier

Both transaction lines are linked in one finding record in the working paper; an investigator sees the full cycle without manually cross-referencing narrations across hundreds of rows.

Bank Statement · structuring
FAIL

bank_statement_structuring_below_threshold.xlsx

Rs 9,90,000 cash deposit to 'SELF / CASH' on 2026-01-13 — sitting in the Rs 9.5L–Rs 9.99L CTR-avoidance band under the PMLA Rules, 2005.
Finding typeFAILstructuring_threshold
Amount₹9.90 Lin CTR band
Risk scoreHighPMLA exposure

Exported to the Structuring exception queue; flagged for potential CTR avoidance under FIU-IND reporting guidance on transactions structured to remain below the reporting threshold.

Bank Statement · balance jump
FAIL

bank_statement_balance_jump_unexplained.xlsx

Ref ADJ4421 on 2026-01-20 carries zero debit and zero credit yet the running balance increases by Rs 5,00,000 — off-statement adjustment unreconcilable from transaction flow.
Finding typeFAILbalance_continuity
Discrepancy₹5.00 LADJ4421
SA 505 triggerYesconfirm with bank

The most operationally significant exception type: a balance jump that is invisible to any column-based scan and only surfaces through row-by-row arithmetic recomputation — which the workflow performs for every line.

Why Automation Wins Here

For a forensic accountant or lender credit analyst reviewing a 300-row bank statement, this bank statement fraud detection workflow replaces two to four days of manual computation with under 60 seconds of deterministic, rule-based analysis — and catches exception classes a human reviewer misses by design.

2–4 days → 60 s
Per-statement forensic review time for a 300-row current-account extract
6 rules
Applied simultaneously to every row — round-trip, structuring, weekend, shell, balance jump, first-time large payee
100%
Row coverage — every transaction scored, not just those that catch a reviewer's eye
0
False positives on the clean baseline file — confirmed by the zero-exception clean-pass register

Balance jumps caught that column-scanning misses

A zero-debit/zero-credit row that causes the running balance to change by Rs 5,00,000 is invisible to any scan of the debit and credit columns alone. The workflow recomputes the expected balance for every consecutive row pair — the only reliable way to detect off-statement adjustments that are an ICAI SA 505 confirmation trigger and a recognised indicator of balance manipulation for credit-appraisal purposes.

Audit-ready working paper, instantly

Every exception is linked to the underlying UTR or reference number, severity-ranked (FAIL vs WARNING), and exported to a structured Excel workbook formatted to the ICAI Technical Guide on Forensic Accounting and Fraud Detection (2020 edition). The controller uploads the workbook to the case file without reformatting — satisfying ICAI SA 230 documentation standards for audit working papers.

Deterministic, consistent across reviewers

Human reviewers applying five different computational tests sequentially to 300–500 rows introduce both omission errors and reviewer-to-reviewer inconsistency. The workflow applies all six rules simultaneously and identically to every line — the same input file always produces the same flag set — eliminating the variance that makes manual forensic reviews difficult to defend in regulatory or legal proceedings.

Frequently Asked Questions

The questions forensic accountants, lenders, and internal audit teams ask most often before deploying automated bank statement analysis.

Which documents do I upload?

Upload a bank statement as an Excel (.xlsx) or CSV file with the standard columns — Txn Date, Value Date, Narration, Counterparty, Ref/UTR, Debit, Credit, and Running Balance. Cadel classifies and extracts every transaction row automatically. This is the tabular format that Indian scheduled commercial banks generate from their net-banking download portals.

What does the workflow produce?

A consolidated Forensic Findings Report (Excel) per statement. It scans every transaction against the red-flag taxonomy and reports: transactions scanned, total flagged, the high-risk flagged amount, a per-pattern finding count, and a per-finding detail list ranked by severity. The report also includes a per-counterparty risk register and a clean-pass register of rows that passed all six rules.

Which red-flag patterns does it detect?

Six — round-tripping (equal debit/credit to the same counterparty within seven days), structuring just below the Rs 10 lakh CTR reporting band under Rule 3 of the PML Rules, 2005, weekend/holiday postings, shell-counterparty name patterns per FIU-IND typology heuristics, unexplained running-balance jumps, and first-time large payees receiving more than Rs 10 lakh with no prior transaction history in the statement period.

How is structuring detected?

Any cash debit or credit (counterparty field contains 'CASH', 'SELF', or self-deposit indicators) landing in the Rs 9.5 lakh to Rs 9.99 lakh band is flagged as a FAIL, on the basis that values pinned just under the Rs 10 lakh Cash Transaction Report threshold are a classic CTR-avoidance signal. A secondary aggregate check groups cash deposits across consecutive business days and raises a combined flag when the 7-day window total exceeds Rs 10 lakh through multiple sub-threshold deposits — catching the pattern that individual-row filtering misses.

What is round-tripping and how is it caught?

Round-tripping is money sent out and returned (or vice versa) to disguise its origin, inflate turnover, or cycle funds between related parties. The workflow flags an equal-and-opposite debit and credit to the same counterparty within a seven-day rolling window — within a Rs 1 rounding tolerance. Both transaction lines are linked in a single finding record so an investigator sees the full cycle without manually cross-referencing narrations across hundreds of rows. The lookback window is configurable for engagements where the instructing forensic accountant specifies a tighter or broader period.

How does it check balance continuity?

For every row the workflow recomputes the expected running balance as prior balance + credit − debit. If the printed balance diverges by more than Rs 1 (to allow for rounding), the row is flagged as an unexplained balance jump — often the fingerprint of a deleted or altered transaction, or an off-statement bank adjustment. This class of exception is a direct trigger for a bank-confirmation request under ICAI SA 505 (External Confirmations) and is invisible to any review that scans the debit and credit columns without independently verifying the arithmetic.

Does a flag mean fraud has occurred?

No. The findings are risk indicators for an investigator to corroborate, not conclusions. A weekend posting or a first-time large payee can be entirely legitimate; the report prioritises FAIL-severity findings (round-tripping, structuring, balance jumps) so reviewers focus their effort where the pattern is strongest. The working paper is designed to support legal proceedings, but the instructing practitioner remains responsible for forming and signing the expert opinion in accordance with ICAI's Technical Guide on Forensic Accounting and Fraud Detection.

Can I export the report for a due-diligence case file or lender stress-test pack?

Yes — export the Forensic Findings Report to Excel from the report toolbar to attach the forensic summary to due-diligence working papers, a lender credit-appraisal package, or an investigation case file. The workbook's tab structure (one tab per finding category + summary risk register + clean-pass register) maps directly to the documentation format expected in financial due-diligence case files and internal audit workpapers prepared under ICAI SA 230 (Audit Documentation).