RBI issues draft KYC proposal: Temporary debit holds on suspected money mule accounts, sets timelines

Reports coming in for today mention that The Reserve Bank of India (RBI) has proposed a standardised framework for banks to handle suspected money mule accounts and transactions involving cyber-enabled financial fraud. The proposed procedure includes measures such as placing temporary debit restrictions on suspected amounts or accounts.

The proposal is contained in the Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026, introduced in compliance with the Supreme Court’s August 4, 2026 order. The court had directed the RBI to formulate and circulate a Standard Operating Procedure (SOP) for banks to identify and deal with money mule accounts and transactions linked to cyber-enabled financial fraud.

The RBI has proposed that the directions take effect from April 1, 2027, although banks may implement the procedure earlier. Comments on the draft can be submitted until October 2, 2026.

Bank can immediately place a temporary debit hold

Once a bank identifies a suspected money mule transaction or account through its transaction-monitoring system or its internal policy, it would be required to act immediately. The bank can place a temporary debit hold on the suspected transaction. Where the entire account is identified as a suspected money mule account, the hold can extend to the account.

The customer would additionally have to be informed around the hold, the reason for imposing it, the process for getting it removed and the contact details of the concerned bank officer. If the bank communicates digitally, the intimation must be sent immediately; otherwise, it must be issued by the end of the following day.

The RBI proposal additionally provides that suspected transactions may be identified through transaction-monitoring systems, including technology-based tools. The framework is intended to allow banks to respond quickly to potentially fraudulent transactions while providing customers with a defined process to challenge a hold.

Customers get 20 days to explain the transaction

After imposing the temporary debit hold, the bank would seek an explanation or justification from the account holder regarding the genuineness of the transaction or account. The customer would get 20 days from the date of the temporary debit hold to submit the explanation.

“The bank shall give 20 days’ time from the date of Temporary Debit Hold to the account holder for submission of the explanation / justification,” RBI stated in the draft.

If the customer responds, the bank would have to examine the explanation and take a decision within 10 days of receiving it. If the bank is satisfied, it would remove the temporary debit hold immediately and inform the customer.

If the customer does not submit an explanation, the bank would have to complete its examination and take a decision within 30 days from the date of the temporary debit hold.

“The bank shall take decision, within 10 days of receipt of the explanation / justification. In case no explanation is received, the bank shall take decision, within 30 days from date of temporary debit hold,” RBI furher stated.

Unsatisfactory explanation can lead to police referral

If the bank is not satisfied with the customer's explanation, it can continue the temporary debit hold and report the matter to the jurisdictional police authority through the National Cybercrime Reporting Portal-Citizen Financial Cyber Fraud Reporting and Management System (NCRP-CFCFRMS).

The bank would additionally have to communicate its decision to the customer, including the continuation of the hold and the reasons for referring the matter to the police.

Where a law enforcement agency (LEA) or competent authority issues a direction during this period, the bank would have to comply with that instruction immediately, provided it is backed by the appropriate statutory provisions.

Hold can be removed if no LEA direction comes within 30 days

Once the matter is referred to the LEA, the proposed framework gives the agency a further 30 days to offering an instruction or direction requiring the temporary debit hold to continue.

If no such direction is received within those 30 days, the bank would have to remove the temporary debit hold on the 31st day from the date of reference to the LEA. The customer must be informed of the removal immediately through digital communication, or by the end of the following day if physical communication is used.

“The bank shall remove the debit hold on the 31st day from the date of reference to the LEA. It shall notify the account holder of removal of debit hold immediately, if communicating through digital mode, otherwise by EOD of the next day,” RBI stated.

Maximum temporary hold: 60 days

Overall, the proposed framework places a 60-day maximum period on a temporary debit hold in the absence of a contrary instruction from an LEA or competent authority.

The first 30 days cover the customer's opportunity to respond and the bank's examination and decision-making process. If the bank refers the matter to an LEA, a further period of up to 30 days is available for the authority to offering instructions. Thus, the temporary debit hold cannot ordinarily continue beyond 60 days from the date it was first imposed, unless an LEA or competent authority directs otherwise.

Why RBI is proposing the time-bound process

The proposed SOP seeks to balance two competing concerns: enabling banks to act quickly when accounts or transactions appear connected with cyber fraud, while preventing genuine customers from being subjected to indefinite restrictions on their bank accounts.

The framework follows the Supreme Court's August 4 order requiring the RBI to establish a uniform procedure for banks dealing with money mule accounts and cyber-enabled financial fraud. The proposal would cover commercial banks, including small finance banks, payments banks, regional rural banks and local area banks, as well as UCBs.