Indian Masterminds Stories
On 5 November 2026, a landmark judgment by the Abu Dhabi Global Market (ADGM) Court of First Instance held NMC Health founder Dr B.R. Shetty and former CEO Prasanth Manghat liable for fraudulent and wrongful trading, setting USD 5.397 billion as the starting point for the amount they must restore to the collapsed healthcare group. The judgment brings into focus one of the most extraordinary corporate frauds in recent history: the rise and spectacular collapse of a hospital empire built by an entrepreneur from Udupi.
From its journey to the FTSE 100 to its collapse within months of a short-seller’s revelations, the NMC story exposes how hidden borrowings, manipulated accounts, sham suppliers and questionable financial transactions allowed a massive fraud to go undetected for years. But the case also raises uncomfortable questions about the institutions meant to prevent such failures. How did one of the world’s leading audit firms issue seven consecutive clean audit opinions? Why did an apparently independent board fail to act on warning signs? And how did Bank of Baroda become entangled in a settlement involving USD 600 million while continuing to pursue the founder for unpaid dues?
In this detailed analysis, P. Sesh Kumar, IAAS-82, Former Director General, CAG of India, retraces the NMC saga, examines the accountability of auditors, directors, banks and enforcement agencies, and explores the implications for India. From the role of foreign-owned hospital chains and cross-border financial oversight to gaps in corporate governance and the protection of public assets, the article draws important lessons for India’s rapidly expanding healthcare sector.
The Auditor Who Never Opened the Books: EY’s Seven Clean Opinions
If Shetty and Manghat were the architects of the fraud, Ernst & Young (EY) was the inspector who certified the building safe seven years running. EY was NMC’s auditor from its London listing in 2012 until the collapse, and the administrators’ case was that it issued seven consecutive unqualified opinions, for 2012 to 2018, each of them fundamentally flawed.49 It was paid about GBP 14 million for the work.50 Over those same years the hidden borrowing grew relentlessly. The UK Financial Conduct Authority (FCA) later found that NMC’s March 2019 results, the last full-year accounts EY signed, reported debt of USD 1.99 billion when the true figure should have been about USD 5.91 billion, and that roughly USD 4 billion of the debt was guaranteed by NMC Health plc itself.51 That last fact deserves emphasis. A guarantee given by the listed parent is not an obscure transaction in a distant subsidiary; it is an obligation of the very company whose accounts the group auditor signs directly.
The heart of the case against EY was disarmingly simple: its auditors, the administrators said, “never even opened the books.” Over seven years EY did not obtain proper access to NMC’s general ledger, the master record in which every transaction is posted. Management gave what the administrators called implausible and contradictory reasons for withholding it, and the auditors made do with limited information obtained by looking at a single screen over the shoulder of an NMC employee. Had EY obtained proper access, the administrators argued, the fraud would quickly have become apparent, because the ledgers contained thousands of manipulated entries.52 A lead auditor’s own email in 2018 expressed scepticism about NMC’s so-called technical barriers to a full data download.53 Imagine a bank inspector who audits a branch’s cash by reading the cashier’s summary over his
, year after year, while noting privately that the cashier’s excuses for not opening the safe sound thin. That, in essence, was the allegation.
What makes the allegation sting is that EY knew the engagement was dangerous. Its staff internally described NMC as the UK firm’s “number one red label audit,” the firm’s marker for its highest-risk engagements.54 According to the administrators’ skeleton argument, as reported by one financial news service, EY placed the audit on a “close monitoring” list in 2015 and on a separate “worry list” in 2018; this detail rests on a single secondary report of a court filing.55 This was not, therefore, a failure of perception. EY saw the risk. The failure, if the administrators are right, was in the response: the procedures did not rise to meet the risk the firm itself had identified.
The second strand concerned the most elementary safeguard in auditing, the external confirmation. The administrators alleged that EY failed to keep control of its communications with NMC’s banks, allowing executives to manipulate bank statements before they were used to confirm the company’s financial position.56 The Financial Reporting Council’s (FRC) draft investigation report, excerpts of which were read out in court, found that EY had ignored a “very significant inconsistency” between NMC’s reported debts and a creditor’s own statement, an inconsistency which, in the regulator’s words, should have prompted major investigation.57 The FCA later described how NMC kept parallel spreadsheets classifying debts as “Showing” or “Non-Showing”, with only the former disclosed; the non-showing debts were about twice the reported figure.58 Every one of those hidden facilities existed in some bank’s books. A confirmation request sent by the auditor directly to each lender, and answered directly to the auditor, is designed precisely so that management cannot edit the answer. That is the whole point of the procedure; it is meant to work even when management is lying.
The third strand concerned independence and objectivity. The FRC’s provisional report reportedly found that EY failed to perform adequate audit procedures, to bring objectivity to bear and to exercise professional scepticism; that a UK audit partner bowed to the pressure of NMC’s clear threats to terminate the engagement and failed to exercise objectivity from that point; and that two EY Middle East staff remained on the audit beyond the usual time limits.59 The web of familiarity extended into the boardroom. Two of NMC’s non-executive directors, Abdulrahman Basaddiq and Jonathan Bomford, had each been partners of EY for more than twenty years.60 Basaddiq, a non-independent director and a former head of EY’s Abu Dhabi office, was later described by EY’s own lawyers at trial as “plainly a fraudster”, an
allegation he denies and on which he was never a party or a witness.61 An auditor whose former partners sit across the boardroom table faces what auditing standards politely call a familiarity threat.
The fourth strand was the structure of the audit itself. EY UK signed the group opinion but, as its defence put it, “properly relied on the work of EY Middle East” as component auditor under the relevant professional standard.62 In most multinational groups a component is one of many parts. At NMC the London parent was a listing shell and virtually the entire business sat in the UAE, so the “component” was, for practical purposes, the whole group. Reliance on a network firm in those circumstances is reliance on oneself under a different letterhead, and it allowed responsibility to fall into the gap between two offices of the same brand. Late in the trial the administrators added a fifth charge: that EY partners had led the FRC to believe the auditors had full access to a complete list of NMC’s transactions when they could only view data on a device controlled by NMC staff. An EY partner accepted in evidence that what the regulator had been told was “incorrect and misleading”, though the administrators allowed that this might have been inadvertent.63
EY’s defence deserves to be stated at full strength, because it is not frivolous. EY said it was itself the “principal target and victim” of the fraud, that everyone who could have told it the truth about NMC’s finances was engaged in deceiving it,64 and that it should not be held responsible for a concealed fraud involving around eighty NMC staff who actively circumvented the audit.65 It drew the time-honoured distinction between an auditor as watchdog and an auditor as bloodhound, argued that management’s fraud should reduce its liability for contributory negligence, and contended that where those charged with governance were themselves complicit, the losses a clean audit could have prevented were limited. One law firm’s post-mortem regarded these arguments as having serious merit.66
EY also turned the spotlight on the lenders. It argued that banks lent billions on the strength of perceived royal connections, conducting due diligence with the “lightest of touches”, and that the administrators had made no serious attempt to pursue two other major shareholders, the bin Butti brothers, whom EY accused of stealing billions alongside Shetty; they reject the allegations.67 There is force in the point about banks. Every lender knew exactly what it had lent; it is odd that creditors who could have compared their own exposure with NMC’s published debt should recover from an auditor who could not see it.
Even at its strongest, however, the watchdog defence protects an auditor who performs the right procedures and is still deceived. It does not protect an auditor who did not perform them. A collusive fraud involving dozens of staff is exactly the risk that direct access to the general ledger and independently controlled bank confirmations exist to defeat; those procedures are valuable precisely because they do not depend on management’s honesty.
An auditor that classifies an engagement as its highest-risk audit in the country and then accepts a screen-over-the-shoulder view of the books has not been outwitted by a sophisticated fraud; it has declined to look. The settlement tells its own story. EY settled the GBP 2-billion claim in February 2026 without admitting liability, just before judgment, for GBP 105.5 million, about one-twentieth of the sum claimed.68 No court will now rule on whether the audits were negligent, and the profession has lost what could have been the most important audit- liability judgment in a generation.69 The FRC opened its investigation in April 2020;70 as of March 2026 it was still under way,71 more than six years later, while EY faced several other investigations, including one that produced a GBP 4.9-million fine over its audits of Thomas Cook.72 When EY resigned as auditor of Finablr, Shetty’s other London-listed company, in March 2020, it cited concerns about governance and the composition of the board.73 The firm, in short, found its voice about governance in the month the empire collapsed, not in the seven years before.
For India the NMC audit is not an exotic foreign scandal; it is the textbook case for a reform that India has been arguing about for two years. In September 2024 the National Financial Reporting Authority (NFRA) issued a revised SA 600 on group audits, citing what it called severely deficient quality and a serious lack of due diligence in Indian group audits.74 In November 2024 the NFRA board recommended it to the government, making the group auditor ultimately responsible for the group opinion in line with the global standard, over the dissent of the Institute of Chartered Accountants of India, (ICAI) which maintained that the existing standard was adequate and that aligning with ISA 600 was not desirable.75 The global standard, ISA 600 (Revised), has applied since December 2023 and makes the group engagement partner responsible for directing, supervising and reviewing component auditors’ work.76
In June 2026 the Ministry of Corporate Affairs was reported to be preparing to notify the revised Indian standards with effect from 1 April 2027;77 this note could not confirm, at the time of writing, that the notification has issued. Two points follow. NMC shows exactly how “reliance” on a component auditor becomes a place where accountability disappears, and India should notify the standard without dilution. And the NFRA version, as proposed, would exclude public
sector banks and public sector undertakings and their branches,78 which is to say entities such as Bank of Baroda, whose overseas branches are at the centre of this very story. That exclusion is difficult to defend.
9. The Board That Was Independent on Paper
On paper, NMC’s board was a model of British governance. Its 2018 annual report described a board of three executive directors and seven non-executives, five of whom it judged independent, under an independent non-executive joint chairman, Mark Tompkins, sitting alongside Shetty as non-executive joint chairman; the board declared itself independent.79 The audit committee, according to the 2017 report, consisted entirely of independent non-executive directors.80 Every box in the UK Corporate Governance Code appeared to be ticked.
If we look more closely, the boxes concealed some awkward shapes. The founder and controlling shareholder was not merely a director but a joint chairman, an arrangement that put the person with the most to gain from a rising share price at the head of the body meant to supervise management on behalf of all shareholders. Two non-executives were long-serving former partners of the company’s own auditor. The audit committee’s chair, Jonathan Bomford, a chartered accountant and the committee’s financial expert, handed the chair in March 2018 to Lord Clanwilliam, who, according to an academic case study, had no accounting experience.81 When Muddy Waters published its report it said bluntly that it did not see NMC’s independent board members as truly independent.82
The real test of an independent board comes not in the annual report but on the morning a credible outsider says the accounts are false. NMC’s board failed that test. Within a day of the Muddy Waters report the company branded the allegations baseless, reaffirmed its forecasts and announced a share buyback.83 The FCA later found that NMC’s December 2019 rebuttals were themselves false or misleading, issued when the company knew or ought to have known it, and that the 18 December announcement had cited a disclosure committee that did not exist at the time.84 The committee of independent directors appointed to oversee the review of the short-seller’s allegations was chaired by Bomford,85 a former EY partner,86 examining allegations that went to the heart of the accounts EY had audited. Whatever his personal integrity, that is a conflict of perception any experienced board should have avoided.
The independent directors’ case also deserves a fair hearing. Non-executives are part-timers who depend on information that management chooses to give them, and here management ran two sets of books precisely to deceive them. When NMC disclosed the hidden USD 2.7 billion it said the facilities had not been disclosed to or approved by the board.87 The FCA did not find that every member of the board knew the published information was false; it attributed knowledge to NMC through people at a sufficiently senior level.8889 It was, moreover, the review overseen by the non-executives that in February 2020 reported discrepancies between NMC’s bank statements and ledger entries,90 that suspended the founder from board discussions91 and that hired Louis Freeh. When the board finally moved, it moved decisively.
But “finally” is the operative word, and the defence of ignorance has limits for directors of a FTSE 100 company. A listed parent that guaranteed about USD 4 billion of borrowings92 was a company in which the board had lost control of the most basic levers: who may sign a guarantee, who may open a bank account and who may borrow in the company’s name. Controls over those matters are not management detail; they are the core of what a board, and especially an audit committee, exists to oversee.
The red flags were not invisible. They included the scale of supplier financing, related-party suppliers whose balances the FCA said should have been reported but were not,93 returns that a short-seller found too good to be true,94 and a founder whose personal borrowings were secured on shares, including, it emerged, shares belonging to the board’s own vice-chairman.95 The administrators sent letters before action to twelve former directors in 2021,96 yet the public record shows the claims that reached trial were brought only against Shetty and Manghat. No independent director of NMC has, so far as this note could trace, faced any public sanction or judgment. That is an accountability gap of its own.
For India the lessons are pointed. Indian law already sets out the independent director’s role in some detail through section 149 of the Companies Act 2013 and its Schedule IV, the audit committee mandate in section 177 and SEBI’s listing regulations. The NMC board suggests where those frameworks must bite hardest. Audit committees of companies with complex or foreign- held groups should be chaired by members with genuine, current financial expertise. Former partners of the incumbent auditor, however long retired, should not lead reviews of allegations that implicate that auditor’s work. Boards should require that every guarantee, borrowing facility and bank account opened in the company’s name be listed in a register reconciled annually against confirmations obtained directly by the auditor from every bank, and that the register be placed before the audit committee. And when a credible critic speaks, the board’s first act should
to commission an independent forensic review, not to issue a denial and buy back shares. Independence is not a status conferred by an annual report; it is a habit of asking the question management does not want asked.
10. Bank of Baroda: Peace Bought, Questions Unanswered
On 1 July 2026, with closing arguments under way, Bank of Baroda agreed to pay USD 600 million through its Abu Dhabi branch to settle the ADGM and English claims of NMC and its administrators, without any admission of liability, explaining to the stock exchanges that it wished to bring the disputes to a conclusion and avoid prolonged litigation.97 Its shares fell more than four per cent on the news.98 In the June quarter the bank booked an exceptional charge of Rs 5,680.23 crore, and its standalone net profit fell about 72 per cent to roughly Rs 1,278 crore.99 Consolidated profit fell 48 per cent to Rs 1,783 crore, and the management said it had deliberately not drawn on its Rs 2,500-crore floating provision to meet the payout.100 At least one brokerage did not believe the bank had provided for the settlement beforehand.101
The bank’s case deserves a fair hearing. USD 600 million is about eleven per cent of the UUD 5.4- billion claim; a defendant facing joint liability for the whole could rationally pay a fraction to avoid a catastrophic tail. Its executives told the court that frequent high-value transactions on these accounts appeared commonplace and legitimate, that a lender must primarily believe its client, that sufficient due diligence had been done, and that the bank had no motive to collude in fraud.102 A bank is not an auditor, and a customer that is a FTSE 100 company with a Big Four audit opinion is, on paper, among the safest customers a branch can have.
Yet the questions do not go away. The administrators alleged gross negligence in anti-money- laundering and know-your-customer (KYC) procedures, inadequate diligence on the accounts of the alleged sham suppliers through which “pass-through” payments reached Shetty and others, and continued processing of payments the bank knew to be fraudulent. One bank executive was asked in cross-examination whether alerts had been cleared “very quickly and in bulk”, suggesting perfunctory clearance.103 A commentator citing the court documents has put figures on this: 907 alerts cleared in 75 minutes in June 2014 and 583 in 121 minutes in 2017. These figures come from a single secondary source and should be treated with caution until the record is public.104 Earlier, over the bank’s objection, the ADGM court had ruled that the UAE’s 2025
anti-money-laundering law permitted court-ordered disclosure of suspicious transaction reports and related internal records in civil proceedings.105 Add to this the judge’s description of the administrators’ arguments about a Shetty–Jayakumar arrangement as “persuasive”, and the timing of a settlement struck during closing arguments,106 and a reasonable observer is left with a question rather than an answer.
The bank now sits in three uncomfortable chairs at once. It is a creditor, pursuing Shetty for about Rs 2,800 crore of dues, holding decrees in India and the UAE and a 2021 Karnataka High Court order restraining him from disposing of assets.107 It is an alleged facilitator that has paid USD 600 million to end the allegation. And since 13 October 2026 it is a defendant in Shetty’s USD 15-billion suit in the Bombay High Court, alongside ten of its officials, the Manghat brothers, their associates and two Indian companies.108109 The bank says it has not been served, regards the pleadings as untested and will defend them firmly.110
For India the implications are four. The first is accountability. A Rs 5,680-crore loss in a majority state-owned bank is, in the end, a loss to the public exchequer, and yet no public account has been given of how the Abu Dhabi relationship was managed, who cleared the alerts and whether any staff accountability exercise has been completed.
Readers familiar with the public audit landscape will note an irony: the Comptroller and Auditor General (CAG) does not audit the accounts of nationalised banks, whose statutory audit is done by chartered accountant firms appointed with the approval of the Reserve Bank. A loss of this size therefore escapes the one constitutional auditor that reports to Parliament.
The second is supervision. As long ago as February 2021 the Karnataka High Court, hearing Shetty’s travel case, called it a grave concern that public sector banks had permitted exposures of Rs 2,000 crore (Bank of Baroda) and Rs 800 crore (Punjab National Bank) without adequate security, and asked for lending guidelines to be revisited.111
The overseas branches of Indian public sector banks operate under host-country regulation, but their risk appetite and alert-handling culture are set in India, and the Reserve Bank must satisfy itself that they are fit for purpose.
The third is disclosure. Investors were entitled to ask, and still are, whether the contingent liability was adequately described in the bank’s accounts and exchange filings before July 2026; that is a question for SEBI and the bank’s auditors rather than an accusation.
The fourth is recovery. The bank’s Rs 2,800-crore claims against Shetty, secured in part by sixteen properties he and his wife put up as guarantees in 2020,112 will now compete with the NMC administrators, who can execute their ADGM judgment directly in India because India notified the UAE, including the ADGM and DIFC Courts, as a reciprocating territory under section 44A of the Code of Civil Procedure in January 2020.113 We can expect a race of creditors over the same Indian assets.
11. India’s Enforcers: The Sound of Silence
In October 2020 Shetty himself sent a complaint, with more than a hundred pages of supporting material, to the Central Bureau of Investigation, the Enforcement Directorate, the Prime Minister’s Office and the Reserve Bank, asking for a probe into the former chief executives of NMC and Finablr and into two Indian banks, Bank of Baroda and Federal Bank.114115 Whatever one thinks of the complainant’s motives, the request raised a legitimate question: did proceeds of a foreign fraud come to rest in India? Six years on, the public record of what India’s agencies did with that question is remarkably thin. One online reference, citing a New Indian Express report of March 2022, states that the Enforcement Directorate froze the Manghat brothers’ Indian accounts in a case connected with NMC; this note could find no second source or any subsequent charge sheet.116
What the Indian state did do, energetically, was to stop Shetty from leaving the country. Immigration officials turned him back at Bengaluru airport in November 2020 on Look Out Circulars requested by Bank of Baroda and Punjab National Bank, and the Karnataka High Court upheld the restriction in 2021.117 In February 2024 Justice Krishna S. Dixit suspended those circulars and allowed him to travel to the UAE,118 and in April 2024 the Bombay High Court, in a separate case, struck down the very power of public sector bank chiefs to request such circulars, saying that the bank had become “judge and executioner at once”.119 The lesson is uncomfortable. An immigration tool was pressed into service as a debt- collection tool, and was eventually struck down, while the harder question of money laundering went unanswered in public.
The Abu Dhabi judgment now hands Indian agencies a ready-made map. The Prevention of Money-laundering Act 2002 reaches offences with cross-border implications, that is, conduct abroad which would be a scheduled offence in India where the proceeds are transferred to India.
Shetty’s Bombay plaint alleges that some disputed proceeds went into Avitis Super Speciality Hospitals and SMARD Building Solutions;120 the ADGM court has found that Manghat facilitated the misappropriation of NMC funds for Shetty, himself “and others”.121 These are allegations and findings in civil proceedings, not proof of laundering in India. But they are precisely the kind of predicate that the Enforcement Directorate, the Serious Fraud Investigation Office and the Financial Intelligence Unit, working with their UAE counterparts, exist to test. A country that wants to be taken seriously as a financial centre cannot leave a USD 5-billion foreign fraud with Indian beneficiaries entirely to foreign courts.
12. Did NMC Own Hospitals in India? A Tale of Two Letters
The short answer is no, but the long answer is more interesting. This note found no evidence in the public domain that NMC Health plc, its operating subsidiaries or the creditor-owned group that succeeded them in 2022 held equity in any Indian hospital or hospital chain. That conclusion rests on press and public-record searches, not on a search of corporate registers, and should be read with that limitation. NMC’s core business after restructuring was in the UAE and Oman, and its other foreign assets, in Spain, the United Kingdom and Saudi Arabia, were sold or earmarked for sale.122
The confusion arises because Shetty built a separate Indian hospital business through his personal holding company, BRS Ventures, and its healthcare arm BR Life, which the trade press routinely described as NMC’s “India affiliate”. BR Life entered India in 2013 with the SUT hospital at Pattom in Thiruvananthapuram and added Sree Narayana Hospital in Raipur, the SSNMC super-speciality hospital in Bengaluru, the mother-and-child hospital in Udupi and Kalinga Hospital in Bhubaneswar.123 By December 2019 it claimed to operate close to 1,600 beds across these cities.124 Shetty’s New Medical Centre Pvt. Ltd., an Indian company whose name echoes NMC’s own, was the vehicle through which he bid for Mumbai’s insolvent SevenHills Hospital.125 The press reported that bid as a win for NMC Healthcare,126 a confusion of brands that is itself a governance warning.
Each of these Indian ventures has had an unhappy afterlife. The Udupi project began as a public- private partnership in which the Karnataka government handed a well-regarded government maternity and children’s hospital to Shetty’s company, amid local protests that a free public facility was being turned over to a private operator.127 In 2022, with staff salaries in arrears,
Shetty told the government he could no longer run it, and the state took it back.128 The SevenHills bid foundered when the Supreme Court upheld the objection of the Municipal Corporation of Greater Mumbai, on whose land the hospital stands, that no objection certificate had been obtained;129 in July 2026 the civic body cleared a takeover by Capri Global with backing from Reliance Foundation.130 Kalinga Hospital, in which BR Life announced a 96 per cent stake in 2018 for about Rs 200 crore,131 was in 2026 the subject of a Max Healthcare acquisition of 58.4 per cent from Hospital Corporation of Orissa, the company through which non-resident Odia doctors had originally set it up;132133 this note infers, without documentary confirmation, that BR Life’s control did not endure.
One more Indian hospital belongs in this story, though it is the Manghats’ rather than Shetty’s. Avitis Institute of Medical Sciences at Nemmara in Palakkad was founded by Prasanth and Promoth Manghat while they were senior executives at NMC.134 Since April 2026 it has been run by KIMS under a twenty-year operations and management agreement that also gives KIMS a call option on a majority stake.135 Given Shetty’s allegation that disputed proceeds reached Avitis and the ADGM finding against Manghat, any acquirer of that equity would be wise to price in the risk of tracing or proprietary claims by NMC’s administrators. That is a diligence risk, not a finding of wrongdoing by Avitis or KIMS.
13. Lessons for India’s Private Hospital Chains
India’s hospital sector has become one of the most attractive destinations for foreign capital. Temasek became majority owner of Manipal Health with a 59 per cent stake for about USD 2 billion in 2023;136 Blackstone wrote a USD 700-million cheque for Care Hospitals the same year;137 Malaysia’s IHH holds 31.17 per cent of Fortis138 and has signalled an intention to reach 51 per cent by 2030;139 and hospitals accounted for half of all healthcare foreign direct investment
-24.140 Aster DM, founded by an Indian doctor in Dubai, separated its Gulf and Indian businesses in 2024.141 India has also had its own NMC in miniature: in 2018 SEBI found that the Singh brothers had diverted about Rs 403 crore from Fortis Healthcare through inter-corporate deposits routed via conduit entities.142 Against that backdrop the NMC saga offers lessons that are neither exotic nor foreign.
The first lesson is that the founder is not a firewall. NMC’s money moved through a company the founder solely owned and whose directors were the founder and the chief executive. Where an Indian hospital chain is owned by a foreign parent or a founder’s overseas holding company, the most dangerous transactions are the ones that leave India quietly, as management fees, brand royalties, inter-corporate deposits, advances to related suppliers or guarantees for the parent’s borrowings. Audit committees should insist that every such flow is mapped to the ultimate beneficial owner and approved in advance, not ratified after the fact.
The second lesson is that supplier finance is debt by another name. A hospital’s vendor base is large, fragmented and opaque, which makes it the natural home for a sham supplier scheme. Boards should require that every supplier-finance, reverse-factoring and bill-discounting arrangement be disclosed as such, that auditors obtain direct confirmations from the financing banks as well as the suppliers, and that new vendors with large first-year volumes trigger forensic review.
The third lesson concerns the plumbing of accounting itself. NMC kept two sets of books while it migrated systems. Every chain undergoing an ERP migration, merger integration or post-acquisition harmonisation is at its most vulnerable during that window, and auditors should treat it as a high-risk period rather than an IT project.
The fourth concerns group audits across borders. EY’s defence in London was that it relied on its Middle East member firm as component auditor.143 Indian chains with Gulf or Southeast Asian parents, and Indian groups with foreign subsidiaries, should ensure that the group auditor actually tests the component work, and the National Financial Reporting Authority (NFRA) should make this a focus of its inspections.
The fifth lesson is that a founder’s personal leverage is the company’s risk. Shetty’s pledged and misreported shareholding was the second crack in the edifice. Indian disclosure rules on promoter pledges are already strong; boards and lenders should read them as early-warning signals, not compliance trivia.
The sixth is that critics deserve investigation rather than denunciation. NMC called the Muddy Waters report baseless and launched a buyback; four months later it was in administration. Indian boards facing a short-seller, a whistle-blower or a probing journalist should commission a genuinely independent review before issuing a denial.
The seventh lesson is about public assets in private hands. Udupi, SevenHills and Kalinga all stood on public or publicly allotted land. When a private operator collapses, the state is left holding the patients, the staff and the building. Public-private partnership contracts for hospitals must carry step-in rights, escrowed salaries, performance guarantees and a clean exit path.
The eighth lesson is about continuity of care. NMC’s hospitals kept treating patients through administration and emerged as going concerns within two years. SevenHills, by contrast, entered insolvency in March 2018 and found its final owner only in 2026. India needs a special administration regime for systemically important hospitals, as Britain has for essential utilities, so that insolvency does not mean eight years of empty wards.
14. The Way Forward
For Bank of Baroda and its majority owner, the Government of India through the Department of Financial Services, the first step is candour. A bank that has paid Rs 5,680 crore to end allegations of facilitating fraud owes its shareholders, including the taxpayer, a summary of its internal review: how the Abu Dhabi relationship was approved and monitored, how alerts were cleared, what accountability has followed and what has changed. If no such review has been done, it should be commissioned from outside the bank and its findings placed before the board and the Reserve Bank. The bank should simultaneously coordinate rather than compete with the NMC administrators in enforcing against Shetty’s Indian assets, so that recoveries are maximised rather than dissipated in inter-creditor litigation.
For the Reserve Bank, the case argues for a thematic inspection of anti-money-laundering alert handling in the overseas branches of Indian banks, with particular attention to time-stamped evidence of bulk closure, the treatment of transfers from corporate accounts to promoters’ personal accounts at the same branch, and the escalation of alerts on large corporate customers to head-office compliance. Overseas exposures to a single promoter group should be reported to the Indian board in the same detail as domestic large exposures.
For SEBI, the Ministry of Corporate Affairs and NFRA, the priorities are disclosure and audit quality. Listed banks should be asked to describe material overseas litigation and its potential financial effect with greater specificity. Listed hospital companies should disclose supplier- finance arrangements and related-party flows to foreign parents in a standard format, and group auditors of Indian entities with significant foreign components should be inspected on how they supervise component auditors.
Above all, the Ministry should notify the revised SA 600 that NFRA recommended in 2024 without diluting the group auditor’s responsibility, and should reconsider the proposed exclusion of public sector banks and their overseas branches. SEBI, for its part, should require listed companies to place before the audit committee, and summarise in the annual report, a register of all guarantees and borrowing facilities reconciled to bank confirmations obtained directly by the auditor, and should expect boards facing credible allegations of accounting fraud to commission independent forensic reviews by persons with no past connection to the auditor before responding to the market.
For the Enforcement Directorate, the Serious Fraud Investigation Office and the Financial Intelligence Unit, the ADGM judgment should be the trigger to complete, and to report publicly on, an inquiry into whether proceeds of the NMC fraud reached Indian companies or assets, using the cross-border offence provisions of the money-laundering law and mutual legal assistance
with the UAE. The 2020 complaints should not be allowed to gather dust simply because the complainant has now been found dishonest.
For state governments and the National Health Authority, every public-private partnership hospital agreement should be reviewed for step-in rights, escrow and exit clauses, and for the financial standing of the private partner’s ultimate owner. For Parliament, the case for a special administration regime for hospitals within or alongside the Insolvency and Bankruptcy Code deserves early consideration. And for the courts, particularly the Bombay High Court as it takes up Shetty’s US$15-billion suit, the Abu Dhabi findings on dishonesty, the DIFC findings on his guarantees and the New York dismissal will be part of the landscape; the forensic questions he raises about the bank’s conduct should still be examined on their merits, because a dishonest plaintiff can sometimes point to a genuine wrong.
Finally, for the boards of India’s hospital chains, domestic or foreign-owned, the homework is simple to state and hard to do: know where every rupee of debt is booked, know where every rupee of cash goes when it leaves the group, and never mistake a famous founder or a famous auditor for a control.
15. Verdict
“Delegate or stagnate” was Shetty’s creed, and it built an empire. The Abu Dhabi court has supplied the missing clause: one may delegate the work, but never the duty, and never the dishonesty. The founder’s plea that he was the fraud’s chief victim foundered on the simplest fact in the case, that the fraud’s proceeds arrived in his own accounts. Bank of Baroda has bought legal peace at a price equal to roughly a quarter’s profit, but peace is not absolution, and a majority state-owned bank owes the public an account that a settlement agreement cannot provide. EY, which rated NMC its highest-risk audit and still signed seven clean opinions, has paid a twentieth of the claim and admitted nothing, while the regulator’s investigation enters its seventh year; and a board of independent directors that answered a short-seller with a buyback has faced no reckoning at all. India’s enforcement agencies, having spent years arguing over a businessman’s travel plans, now have a judicial road map and no excuse not to follow it. And India’s hospital boardrooms, flush with foreign capital, should read this judgment not as a Gulf curiosity but as a dress rehearsal. The tricks that sank NMC, two ledgers, obliging suppliers, an auditor content to read the books over a clerk’s shoulder, a board that believed management, and a bank that cleared its alerts in bulk, require no passport.
Indian Masterminds Stories