Explained: RBI proposes 60-day debit holds for suspected mule accounts | Personal Finance

A bank could temporarily restrict debit transactions in an account for up to 60 days if it suspects money mule transactions linked to cyber fraud, under a new proposal from the Reserve Bank of India (RBI).

 

The proposal aims to bring uniformity to how banks handle accounts suspected of being used to receive or move money from cyber-enabled financial frauds. It also gives customers an opportunity to explain a flagged transaction.

 

The RBI has proposed the changes through the Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026. The draft is open for public comments until October 2 and is proposed to take effect from April 1, 2027, although banks may implement it earlier.

  

The proposal follows a Supreme Court order dated August 4, 2026, which directed the RBI to formulate and circulate a standard operating procedure (SOP) for such cases.

 

When can your bank put a debit hold?

The proposed SOP would apply when a bank’s transaction-monitoring system identifies a suspected money mule transaction of Rs 1,000 or more. 

Banks could use their monitoring systems, including artificial intelligence and machine-learning tools, to identify transactions that appear unusual or inconsistent with a customer’s profile. A transaction may also be flagged if it is connected to an account already identified as being involved in fraud or as a money mule account.

 

A money mule account, under the draft, is used knowingly or unknowingly to receive, layer or transfer proceeds of cyber-enabled financial fraud on behalf of another person.

 

For example, suppose a customer’s account normally receives a monthly salary of Rs 50,000 but suddenly gets and transfers several unusual payments on behalf of unknown parties. If the bank’s monitoring system identifies the activity as suspicious, it could place a temporary debit hold on the relevant transaction.

 

The bank may restrict the specific suspected amount rather than the entire account. An account-level hold is intended to be used only as a last resort and in exceptional circumstances.

 

Customer gets 20 days to explain

The proposed process gives the account holder 20 days from the date of the temporary debit hold to explain or justify the transaction.

 

The bank would have to inform the customer about the hold, the reason for it, the process for getting it removed and the contact details of the officer handling the matter.

 

Where the customer’s mobile number or email address is available, the communication would be made digitally. Otherwise, the bank would communicate through physical means.

 

Once the customer submits an explanation, the bank would examine it and complete its decision within 10 days.

 

If the bank is satisfied that the transaction is genuine, the hold would have to be removed immediately.

 

If the customer does not provide an explanation, the bank would take a decision within 30 days from the date on which the temporary debit hold was imposed.

 

What happens if the bank still suspects fraud?

If the bank continues to suspect that the transaction or account is connected to cyber fraud, the matter can be referred to the jurisdictional police or competent law-enforcement authority.

 

The proposed process gives the law-enforcement agency a further window to issue instructions. If there is no contrary instruction, the debit hold would be removed on the 31st day from the date of reference to the agency.

 

However, the overall temporary debit hold cannot ordinarily continue beyond 60 days from the date it was first imposed unless there is a contrary instruction from a law-enforcement agency or competent authority.

 

This is significant for customers because it creates a time-bound framework instead of leaving them uncertain about how long restrictions on their account could continue.

 

Which banks will come under the framework?

The proposed SOP would cover commercial banks, including regional rural banks, small finance banks, payments banks and local area banks, as well as urban cooperative banks and State Bank of India.

 

Banks would also have to establish internal policies covering how suspected transactions are detected, how customers are informed, how holds are removed and how complaints are handled.

 

The draft proposes designated nodal officers for complaints arising from such actions. These complaints would have to be resolved within 30 days.

 

Banks would also need to maintain records of cases involving temporary debit holds. According to the draft, such records would generally have to be retained for at least five years from the date of the hold or 10 years from the closure of the account.

 

What should customers do if their account is flagged?

A temporary debit hold does not necessarily mean that the customer has been accused of committing fraud. The proposed mechanism specifically provides an opportunity to establish that a transaction is genuine.

 

Customers should therefore respond within the 20-day window and provide supporting documents that establish the source and purpose of the money, particularly for transactions that may appear unusual compared with their normal account activity.

 

The proposal also does not replace existing reporting requirements for suspicious transactions. Banks would continue to follow applicable rules relating to reporting such transactions to the Financial Intelligence Unit-India.

 

The RBI’s proposal is still at the consultation stage. The final framework could change after the regulator considers comments received from banks, customers and other stakeholders.