RBI Draft Sets Outer Limit For Bank Holds In Cyber Fraud Cases

The Reserve Bank of India (RBI) has proposed a new procedure for banks to deal with accounts and transactions suspected of being connected with money mule activity and cyber-enabled financial fraud. Under the draft RBI (Know Your Customer) Amendment Directions, 2026, a temporary debit restriction imposed by a bank would generally have a maximum life of 60 days. 

The framework also lays down separate deadlines for customer responses, bank reviews, and police referrals. The proposed rules have been issued following a Supreme Court order dated August 4, 2026. Banks could adopt the provisions before April 1, 2027, while the framework is scheduled to take effect from that date.

How The Temporary Hold Would Work

Banks could impose a temporary debit hold on their own when transaction monitoring systems identify a suspected money mule transaction. The systems may use artificial intelligence (AI) and machine learning (ML) tools.

A suspected transaction would be one involving Rs 1,000 or more that is flagged as potentially linked to cyber-enabled financial fraud or money mule activity. The Rs 1,000 threshold would not mean that every transaction above this amount would be frozen.

A transaction would first need to show suspicious indicators, such as being unusual or disproportionate to the customer’s profile, or being linked to an account already reported as fraudulent or a mule account.

Banks could place a hold on the suspected transaction or, in exceptional cases, the entire account. An account-level hold would be used only as a last resort.

Customers Get 20 Days To Respond

Banks would have to inform customers about the hold, the reasons behind it, the process for removal, and the designated officer handling the case.

Customers would get 20 days from the date of the hold to provide an explanation or justification. If an explanation is received, the bank would have to examine it and make a decision within 10 days. If the customer does not respond, the bank would have to take a decision within 30 days of imposing the hold.

Cases Can Go To Law Enforcement

If the bank is not satisfied with the explanation, it would refer the case to the jurisdictional police authority through the National Cybercrime Reporting Portal’s Citizen Financial Cyber Fraud Reporting and Management System. The referral would include reasons for keeping the hold in place, and the customer would have to be informed.

A competent authority could direct the bank to keep the hold in place. If no such instruction is received within 30 days of the referral, the bank would have to remove the hold on the 31st day.

In all cases, a temporary debit hold could not exceed 60 days from the date it was imposed, unless a competent authority directs otherwise.

Rules Apply Across Banking Sector

The proposed framework would cover commercial banks, small finance banks (SFBs), payments banks, regional rural banks (RRBs), local area banks, and urban cooperative banks.

Banks would also have to file suspicious transaction reports where required under existing anti-money laundering rules. They would need internal policies for detecting suspicious activity, handling holds, customer communication, recordkeeping, and grievance redressal.

Records related to temporary debit holds would have to be retained for at least five years. For closed accounts, the records would need to be kept for at least 10 years from the date of closure.

Banks would also have to designate nodal officers at regional, zonal and head-office levels, and resolve customer complaints relating to the process within 30 days.