What is business overreach?
Why HDFC Bank used the term in MSRDC case

New Delhi, Jul 28, 2026

HDFC Bank called the MSRDC matter 'business overreach'. Here's what the term means, why it is not a legal concept, and how it differs from fraud

HDFC Bank's board has described the conduct of three senior executives in the Maharashtra State Road Development Corporation (MSRDC) deposit matter as "business overreach" rather than "mala fide action, personal enrichment, or improper motive".

The board on Monday imposed a monetary penalty of ₹1 lakh each on Managing Director and Chief Executive Officer Sashidhar Jagdishan, Chief Financial Officer Srinivasan Vaidyanathan and Group Head-Retail Assets Arvind Vohra, besides issuing warning letters.

The term, however, is not commonly used in corporate disclosures and does not have a specific definition under Indian law.

What happened in the HDFC Bank case?

The action relates to HDFC Bank's arrangements for mobilising deposits from the Maharashtra State Road Development Corporation in 2017 and 2021.

The controversy surfaced after media reports surfaced in May that the bank had allegedly disguised ₹45 crore in interest payments to MSRDC as marketing expenses.

According to HDFC Bank, the matter was first examined through an internal review of the MSRDC deposit arrangements. It was then reviewed by the Special Disciplinary Committee of Independent Directors. Based on its findings, the board concluded that the conduct amounted to "business overreach" rather than mala fide action, personal enrichment or improper motive.

It issued warning letters to three senior executives, imposed a penalty of ₹1 lakh on each of them, and directed that the matter be communicated to the RBI.

The bank has maintained that it has robust internal oversight, audit and control processes and has denied any wrongdoing in connection with the MSRDC deposit matter.

What is business overreach?

"Business overreach" is not a term defined under the Companies Act, 2013, the Reserve Bank of India's (RBI's) regulations or the Securities and Exchange Board of India's (Sebi's) Listing Obligations and Disclosure Requirements (LODR).

"'Business overreach' is not so much a legal term as it is a characterisation adopted by the bank based on its assessment of the facts," Faraz Alam Sagar, Partner and Head of Dispute Resolution & White Collar Crimes at CMS INDUSLAW, told Business Standard.

The expression is generally used in a corporate governance context to describe situations where executives exceed approved authority, internal controls or an organisation's accepted risk appetite while pursuing business objectives.

The focus is on whether governance processes and internal standards were followed, rather than whether the underlying business objective itself was improper. Unlike statutory offences, business overreach is an internal assessment made by a company's board or disciplinary committee based on the facts of a particular case. However, Sagar added, "only the bank can explain what conduct it believes falls within that category."

Why is it treated as a governance issue?

Corporate governance is built around the principle that directors and senior executives must exercise their powers within established policies, internal controls and fiduciary duties.

The Companies Act requires directors to act in good faith, exercise due care, skill and diligence, and act in the interests of the company. Academic literature on corporate governance explains that directors are expected to make informed business decisions while discharging these duties.

A board may therefore consider conduct to be business overreach if it involves: bypassing internal approvals; exceeding delegated authority; ignoring compliance procedures; stretching commercial discretion beyond approved limits; or prioritising business objectives over governance safeguards.

Such conduct may not necessarily amount to a violation of criminal law, but it can still raise concerns about governance and internal oversight.

How is it different from fraud?

Business overreach and fraud are not the same. Business overreach generally refers to governance failures or poor judgement in pursuing business objectives, such as exceeding delegated authority, bypassing internal controls or ignoring compliance processes. It does not necessarily imply dishonest intent or personal gain.

Fraud, on the other hand, involves deception, dishonest intent or deliberate misconduct and can attract civil, regulatory and criminal liability.

“As a matter of law, fraud requires a much higher evidentiary threshold. Fraud involves both intent and conduct. There must be evidence of deliberate deception, concealment, misrepresentation or some form of dishonest objective. By describing the conduct as business overreach rather than mala fide action or fraud, the board seems not to have found evidence of dishonest intent,” Sagar said.

While companies may address business overreach through internal disciplinary measures or governance actions, allegations of fraud can trigger investigations by regulators and law enforcement agencies.

Can regulators still investigate?

Yes. A company's internal findings do not prevent regulators from examining the same matter independently.

Even if a board concludes that an incident amounts to business overreach, regulators such as the RBI or SEBI may independently assess whether any laws, regulations or supervisory directions were violated.

“An internal review and a board conclusion do not prevent regulatory scrutiny. If a regulator chooses to examine the matter, it will look independently at the factual matrix that led the board to this conclusion. So while the board's findings are relevant, they do not foreclose further examination by regulators,” Sagar said.

In HDFC Bank's case, the board has already directed that the matter be communicated to the RBI.

[The Business Standard]