The Reserve Bank of India (RBI) has issued draft guidelines establishing a strict 60-day cap on temporary debit holds for bank accounts suspected of involvement in cyber-enabled financial fraud and money mule activities. Released as part of the draft Know Your Customer (KYC) Amendment Directions, 2026, the proposed standard operating procedure introduces time-bound verification rules to protect genuine account holders from indefinite freezes while ensuring swift coordination with law enforcement agencies. Background and Need for Standard Operating ProceduresIn recent years, the rapid surge in digital banking transactions across India has been accompanied by a sharp increase in cyber fraud, frequently involving "money mule" accounts used to route illicit funds. To contain suspicious transactions, financial institutions routinely freeze debit facilities on flagged accounts. However, in the absence of uniform national timelines, innocent account holders often faced prolonged debit freezes without clear communication or immediate avenues for resolution. Following a Supreme Court order issued in August 2026 directing the central bank to streamline processes, the RBI designed this comprehensive framework to balance fraud mitigation with customer protection. Core Provisions of the RBI Draft GuidelinesThe proposed regulations introduce structured timelines for banks, account holders, and law enforcement agencies to eliminate administrative delays during fraud investigations. Operational StagePrescribed TimelineKey Regulatory RequirementCustomer Response Window20 Days from hold dateCustomer receives notice and presents proof of legitimate transactions.Bank Review Period10 Days post-responseBank evaluates the submitted explanation and decides to release or maintain hold.Default Decision Window30 Days totalApplies if no customer response is received; bank must take formal action.Police Referral Hold30 Days maxIf referred to police, hold lifts on day 31 unless law enforcement mandates continuation.Overall Maximum Cap60 Days maximumAbsolute limit for temporary debit restrictions without explicit judicial/police extension orders.Step-by-Step Procedure for Account HoldsUnder the proposed rules, banks are empowered to initiate temporary debit holds on their own (suo moto) using automated transaction monitoring tools, artificial intelligence, and machine-learning models. 1. Flagging and Initial ActionTransactions of ₹1,000 or more that display unusual patterns inconsistent with a customer's profile, or transfers linked to previously reported mule accounts, can trigger an immediate hold. The RBI explicitly emphasized that account-level freezes must remain a measure of last resort, applied primarily to specific flagged transactions whenever possible. 2. Mandatory Customer NotificationUpon placing a hold, banks must immediately notify the affected customer. The communication must detail: The specific reason for the debit hold. Step-by-step instructions on how to challenge or clear the restriction.Contact details for the designated nodal officer managing the case. 3. Investigation and Police EscalationIf a customer provides satisfactory proof of a legitimate transaction within 20 days, the bank must remove the hold. If the explanation is deemed unsatisfactory, the bank must escalate the case via the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) on the National Cybercrime Reporting Portal. If law enforcement agencies do not issue a formal directive to continue the freeze within 30 days of receiving the referral, the bank is mandated to lift the restriction on the 31st day. Applicability and Implementation RoadmapThe draft directions cover the entire regulated banking ecosystem in India, including:Public and Private Commercial BanksSmall Finance Banks (SFBs) and Payments Banks Regional Rural Banks (RRBs) and Local Area Banks Urban Cooperative Banks The framework is scheduled to take full mandatory effect from April 1, 2027, though banks are encouraged to adopt the Standard Operating Procedure voluntarily ahead of the deadline. In addition, financial institutions are required to retain complete records of holds, customer notices, and police referrals for a minimum of five years to ensure regulatory accountability.Also Read :- Tax Reforms Drive 1.32 Crore Updated ITRs, Add ₹16,083 Crore in Tax Revenue: CBDT
