The Reserve Bank of India (RBI) has proposed a new Standard Operating Procedure (SOP) requiring banks to follow a uniform, time-bound process for placing temporary debit holds on accounts or amounts suspected to be linked to money-mule activity and cyber-enabled financial fraud.
The proposal comes as an amendment to the RBI’s Know Your Customer (KYC) Directions, 2025, following the Supreme Court’s August 4, 2026 order directing the central bank to adopt and circulate an SOP for action against suspected money-mule accounts.
The draft RBI (Know Your Customer) Amendment Directions, 2026, will come into effect from April 1, 2027, or earlier if a bank chooses to implement the SOP ahead of that date.
What is a money-mule account?
The RBI defines a money mule account as an account used, knowingly or unknowingly, to receive, layer or transfer proceeds of cyber-enabled financial fraud on behalf of another person.
Banks will be required to strengthen transaction monitoring to identify such accounts, including those used in fraud schemes such as phishing, identity theft and smurfing. Where an account is established to be a money mule, the bank will also be required to report a suspicious transaction to the Financial Intelligence Unit-India (FIU-IND).
Importantly, the proposed framework is designed to distinguish between suspected transactions and established fraudulent activity, while giving genuine customers an opportunity to explain transactions that have been flagged.
₹1,000 threshold for suspected transactions
Under the proposed SOP, a suspected money-mule transaction is defined as a transaction of ₹1,000 or above flagged by a bank’s transaction-monitoring systems, including AI/ML-based tools.
A transaction may be flagged if it is unusual or disproportionate to the customer’s declared profile, or if it is linked to an account already reported as a money mule or fraudulent.
Once a bank identifies a suspected money-mule transaction or account, it must immediately place a temporary debit hold on the suspected amount. If the entire account is identified as a suspected money-mule account, the hold can be placed on the entire account.
Customers must be informed
The proposed rules also prescribe a notification process.
Banks must inform the account holder about the temporary debit hold, the reasons for the action, the process for getting the hold removed and the contact details of the concerned bank officer.
Where the customer has a mobile number or email registered with the bank, the notification should be sent digitally immediately. In other cases, the bank must notify the customer by the end of the following day.
Customers get 20 days to explain
A customer whose transaction or account is subjected to a temporary debit hold will get 20 days to submit an explanation or justification regarding the genuineness of the transaction or account.
The bank must then examine the explanation and conduct due diligence where necessary. If satisfied with the customer’s explanation, it must remove the temporary debit hold immediately.
If the bank is not satisfied, it can continue the hold and report the matter to the jurisdictional police authority through the National Cybercrime Reporting Portal’s Citizen Financial Cyber Fraud Reporting and Management System (NCRP-CFCFRMS).
Hold could last up to 60 days
The proposed SOP lays down a maximum period of 60 days for a temporary debit hold in the absence of a contrary instruction from a law-enforcement or competent authority.
The initial bank review process can run for up to 30 days. If the matter is referred to the law-enforcement agency, another period of up to 30 days can apply.
Where no statutory instruction requiring continuation of the hold is received from the law-enforcement or competent authority within 30 days of the reference, the bank must remove the hold on the 31st day from the date of reference.
The account-level debit hold, however, is to be treated as a last resort and used only in exceptional circumstances under the bank’s internal policy. Banks must also use objective parameters to minimise the risk of genuine transactions or accounts being wrongly flagged.
Banks to strengthen monitoring and grievance handling
Banks will be required to maintain a centralised management information system recording details of every temporary debit hold, including the reasons, customer communications, references to law-enforcement agencies and whether the hold was released or continued.
The existing obligation to file suspicious transaction reports with FIU-IND will continue independently of the new SOP.
Banks must also provide enhanced monitoring of accounts and other banking relationships held by customers whose accounts have been subjected to such action.
For customer complaints, banks will have to designate nodal officers at appropriate levels. Their contact details must be displayed prominently on the bank’s website and at branches. Complaints received under the SOP must be acknowledged and resolved within 30 days.
Balancing fraud prevention with customer protection
The proposed framework effectively gives banks a formal mechanism to act quickly when transaction-monitoring systems identify potential links to cyber-enabled financial fraud, while putting timelines and communication requirements around such action.
The RBI’s draft also makes clear that the objective is not merely to freeze suspicious accounts. Banks must provide customers with an opportunity to explain the transaction, follow a defined escalation process and remove the debit hold when the customer’s explanation is found satisfactory.
The SOP will apply to commercial banks, including small finance banks, payments banks, local area banks, regional rural banks and State Bank of India, as well as urban cooperative banks. Certain special-purpose accounts, including nodal, pool and escrow accounts, are excluded from its scope.