Capillary Technologies India Limited has announced the receipt of the final forensic audit report from KPMG concerning a cyber-enabled banking fraud incident at one of its step-down subsidiaries. The company had previously disclosed the initiation of this audit. The report details findings and recommendations, which have been shared with the Audit Committee and the Board of Directors for review and discussion in upcoming meetings. A summary of key findings is also provided.
Forensic Audit Concludes
Capillary Technologies India Limited has officially received the final forensic audit report from KPMG. This audit was initiated to investigate a cyber-enabled banking fraud incident that affected a step-down subsidiary of the company. The company had previously informed stakeholders about the commencement of this audit on July 31, 2026.
Report Findings and Next Steps
The final report, received on October 30, 2026, has been distributed to all members of the Audit Committee and the Board of Directors. These findings will be deliberated upon during the upcoming committee and board meetings, where comments and actions will be recorded. The company has also attached a summary of the key findings as Annexure A.
Disclosure and Accessibility
In compliance with SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, this disclosure has been made. The information, including the summary of key findings, will be made available on Capillary Technologies’ official website. Investors can access this update and related corporate announcements at the provided link: https://www.capillarytech.com/investors/shareholder-information/corporate-announcements/2026-27/.
Forensic Report Context
The forensic report, prepared by KPMG Česká republika, s.r.o., investigated four disputed payments totaling EUR 3,041,169.90 executed from Session M Czech Republic s.r.o. between June 26, 2026 and July 2, 2026. The investigation involved reviewing laptop images, mailbox and authentication records, communications, and transaction documentation. The findings suggest a multi-stage payment-diversion fraud based on executive and legal-professional impersonation, social engineering, a lookalike domain, and off-channel communications. The report notes that evidence did not support findings of malware, endpoint compromise, or traditional email spoofing. The allegation of deepfake use could not be substantiated or refuted due to unavailable original audio and video evidence.
Key Management Implications
The primary business risk identified is the potential for external personas to exploit authority, secrecy, and urgency through non-standard channels and formal-looking documents to induce unauthorized payment activity. Management is advised to enhance scrutiny and verification for time-sensitive, high-value transactions, especially with new counterparties. The use of personal email and WhatsApp channels has reduced organizational visibility and data availability, prompting consideration for independent verification procedures for executive payment requests. The report explicitly states that the absence of identified compromise in the reviewed artefacts is not proof that compromise was impossible.
Source: BSE
