RBI proposes 60-day limit on bank account holds in cyber fraud cases: What customers need to know
The Reserve Bank of India (RBI) has proposed a time-bound framework for banks to freeze transactions or accounts suspected to be linked to cyber-enabled financial fraud, with temporary debit holds generally capped at 60 days.
The proposed rules are aimed at addressing a common problem for bank customers caught in cyber-fraud investigations. While banks need to act quickly when money from fraudulent transactions enters an account, prolonged freezes can leave genuine customers unable to access their funds.
Under the draft RBI (Know Your Customer) Amendment Directions, 2026, banks would have to follow defined timelines for placing a temporary debit hold, informing customers, examining their explanations and referring cases to law enforcement agencies.
The draft follows a 4 August Supreme Court order directing the RBI to formulate and circulate a standard operating procedure for banks dealing with money-mule accounts and accounts linked to cyber-enabled fraud. The court had also called for faster grievance redressal and restoration of money to victims of cyber fraud.
Banks can freeze suspicious transactions, but account-level holds are a last resort
Under the proposed framework, a bank could place a temporary debit hold on its own when its transaction-monitoring systems identify a suspected money-mule transaction or account. The systems could include artificial intelligence and machine-learning tools.
The draft defines a suspected transaction as one involving ₹1,000 or more that is flagged as potentially connected with proceeds of cyber-enabled financial fraud or money-mule activity. However, the ₹1,000 threshold does not mean every transaction above that amount would automatically be frozen.
The transaction would first need to show suspicious indicators. These could include activity that is unusual or disproportionate to the customer’s profile, or a transaction involving an account already reported as fraudulent or a suspected mule account.
Banks could place the hold on the specific transaction or, in exceptional circumstances, the entire account. The RBI’s proposed framework says an account-level restriction should be used only as a last resort.
Customers would have to be told why the hold was imposed, how it could be removed and which designated bank officer is handling the matter. They would then get 20 days from the date of the hold to submit an explanation or justification.
Customer gets 20 days, bank gets 10 days to decide
If a customer responds, the bank would have to examine the explanation and take a decision within 10 days of receiving it. If there is no response, the bank would have to take a decision within 30 days of imposing the temporary debit hold.
If the bank is not satisfied with the customer’s explanation, it would refer the matter to the jurisdictional police authority through the National Cybercrime Reporting Portal’s Citizen Financial Cyber Fraud Reporting and Management System, or NCRP-CFCFRMS.
The bank would also have to tell the customer why the hold was being continued and why the case had been referred.
If a law-enforcement agency or competent authority directs the bank to continue the restriction, the bank would have to comply. However, if no such instruction is received within 30 days of the referral, the bank would have to remove the hold on the 31st day.
Separately, the proposed rules put an overall ceiling of 60 days on a temporary debit hold from the date it was imposed, unless a competent authority directs otherwise.
What the new RBI proposal means for bank customers
The proposed framework would apply to commercial banks, including small finance banks, payments banks, regional rural banks and local area banks, as well as urban cooperative banks.
The RBI said the proposed procedure would operate alongside existing obligations under the Prevention of Money Laundering Act and its KYC framework. Banks would continue to file suspicious transaction reports where required. If an account is established to be a money-mule account but the bank fails to file the required suspicious transaction report, the draft treats this as non-compliance.
Banks would also need internal policies covering the identification of suspicious transactions, imposition and removal of debit holds, customer communication, record keeping and grievance redressal. Records relating to temporary debit holds would generally have to be retained for at least five years, and for at least 10 years from account closure where the account is subsequently closed.
The RBI has proposed that the directions take effect from 1 April 2027, although individual banks could implement the procedure earlier. Stakeholders and members of the public can submit comments on the draft by 2 October 2026.
For customers, the key change is the introduction of a clearer timeline. A suspected cyber-fraud transaction may still be blocked quickly, but the proposed framework would give the customer a defined opportunity to explain the transaction and put an outer limit on how long a temporary hold can ordinarily remain in place.
