Suspected Money Mule Account? RBI Proposes a New Debit-Hold Rule

Kalpana Kanungo - Mumbai Bureau Sep 14, 2026 1,950 Views

The RBI has issued draft KYC amendments proposing a strict 60-day cap on temporary debit holds for suspected money mule accounts. The framework outlines clear timelines for customer explanations and police coordination, balancing fraud prevention with consumer rights ahead of its April 2027 implementation.

MUMBAI — The Reserve Bank of India (RBI) has issued the draft RBI (Know Your Customer) Amendment Directions, 2026, establishing a standardized operating procedure (SOP) to combat cyber-enabled financial fraud and money mule networks. Formulated in direct response to a Supreme Court directive, the proposed framework sets a maximum 60-day cap on temporary debit holds while introducing defined timelines for customer notifications, explanations, and law enforcement interventions.

The regulatory intervention addresses a growing bottleneck across domestic financial institutions where broad account freezes have frequently left genuine customers cut off from their funds during prolonged cyber-fraud investigations. Under the proposed mandate, commercial banks, urban cooperative banks (UCBs), small finance banks, and payment banks must align their transaction-monitoring mechanisms with structured compliance timelines.

Standardized Timelines and Operational Workflows

The draft guidelines establish objective criteria for identifying suspicious transactions valued at ₹1,000 and above. When automated monitoring tools—including artificial intelligence and machine learning models—flag activities disproportionate to a customer's declared profile, banks are authorized to place an immediate temporary debit hold on the specific transaction or, in exceptional circumstances, the entire account.

To protect consumer rights, the framework lays down sequential deadlines for resolving flagged cases. Account holders are granted a 20-day window from the date of the hold to submit a formal explanation or justification. Banks must then complete their evaluation and render a decision within 10 days of receiving the response. If a customer fails to respond, banks are required to conclude their internal review within 30 days. Unresolved cases escalated to law enforcement agencies through the National Cybercrime Reporting Portal (NCRP) operate under a 30-day authority response window, culminating in an outer ceiling of 60 days unless an explicit extension is ordered.

According to regulatory disclosure documents and compliance circulars:

Suspended Threshold: Transactions valued at ₹1,000 and above displaying unusual or risk-prone characteristics.
Customer Response Window: 20 days provided to the account holder to furnish transaction justification.
Bank Review Period: 10 days for banks to evaluate customer responses; 30 days if no response is logged.
Law Enforcement Window: 30 days for police or competent authorities to respond following a formal referral.
Maximum Duration: 60-day outer ceiling for temporary debit holds in the absence of contrary legal directives.

Official Sources Section

Reserve Bank of India (RBI) Notifications: Draft Know Your Customer (KYC) Amendment Directions, 2026, regulatory guidelines, and compliance frameworks.
Supreme Court of India Directives: Judicial orders mandating standardized operating procedures for money mule containment and cyber-fraud grievance redressal.

Quote Section

"According to the draft regulatory framework, the standard operating procedure establishes balanced checkpoints to ensure swift containment of financial fraud while providing genuine account holders with a time-bound recourse to restore normal banking operations."

Why It Matters

For everyday bank customers, the proposed guidelines prevent indefinite account freezes by establishing transparent accountability and guaranteed response windows during fraud investigations. For financial institutions and digital payment networks, the unified protocol strengthens systemic defenses against digital laundering syndicates while maintaining strict adherence to anti-money laundering obligations.

Key Facts at a Glance

Regulatory Authority: Reserve Bank of India (RBI).
Mandate Origin: Supreme Court order dated August 4, 2026.
Effective Implementation Date: Scheduled for April 1, 2027, with provisions for earlier voluntary adoption by banks.
Public Feedback Deadline: October 2, 2026.

FAQ Session

What is a money mule account under the RBI's draft proposal?

A money mule account refers to any bank facility utilized—knowingly or unknowingly—to receive, layer, or transfer the proceeds of cyber-enabled financial fraud on behalf of third parties.

How long can a bank keep a temporary debit hold on an account?

Under the proposed SOP, temporary debit holds are capped at a maximum of 60 days unless law enforcement or a competent authority directs an extension.

What must a customer do if their account is placed under a temporary hold?

The account holder is notified digitally or physically and given 20 days to submit documentation verifying the legitimacy of the flagged transactions.

Where can stakeholders submit feedback on the draft KYC directions?

Comments and suggestions on the proposed framework can be submitted to the central bank through the Reserve Bank of India Official Portal.