RBI Draft Rules Propose 60-Day Limit on Cyber Fraud-Related Account Holds
The RBI has recommended a 60-day restriction on temporary bank account holds in relation to cyber-enabled financial theft in its draft KYC Amendment Directions, 2026. Banks would have to say to clients look at what they say and pass on suspicions of money mule activity to the authorities.
A time-bound framework has been proposed by the Reserve Bank of India (RBI) for banks to freeze transactions or accounts that are suspected of being associated with cyber-enabled financial fraud. Typically, temporary debit holds are limited to 60 days.
Bank customers caught up in cyber-fraud investigations often face the same dilemma, and the proposed guidelines try to fix it. While banks must move swiftly to prevent fraudulent activities from funding accounts, legitimate consumers may be left without access to their money if account freezes are in place for too long.
The New Drafted Guidelines by RBI
Specified timeframes for the placement of temporary debit holds would be enforced by banks in accordance with the proposed RBI (Know Your Customer) Amendment Directions, 2026. Additionally, financial institutions should notify clients, review their explanations, and report instances to the appropriate authorities. This draft is in response to a Supreme Court decision dated August 4, which required the RBI to create and disseminate a standard operating procedure (SOP) for financial institutions to follow when dealing with accounts associated with money-mules and cyber-enabled fraud.
Victims of cyber fraud should have their funds returned to them as soon as possible, according to the court's order. When a bank's transaction-monitoring systems detect a possible money-mule account or transaction, the bank might autonomously put a temporary debit hold under the proposed framework. Machine learning and artificial intelligence capabilities may be included in the systems. A suspected transaction is defined in the draft as a transaction that involves INR 1,000 or more and is recognised as potentially associated with the proceeds of cyber-enabled financial fraud or money-mule activity.
Nevertheless, not all transactions exceeding INR 1,000 would be immediately stopped. There should be red flags with the transaction before it may proceed. Such instances may involve a customer's profile being out of the ordinary, a transaction involving a suspected mule account or an account that has already been flagged as fraudulent, or both.
Commenting on the development, CA Manish P. Hingar, Founder and Chief Executive Officer, Fintoo stated, "The RBI’s proposal to introduce a 60-day limit on temporary debit holds linked to cyber fraud is a significant step towards creating greater balance between fraud prevention and customer protection. From a fintech perspective, the move is particularly relevant as digital transactions continue to scale and financial institutions increasingly rely on technology-led monitoring to identify suspicious activity."
"A clearly defined timeline can help prevent genuine customers from facing prolonged restrictions on their accounts, while also bringing greater consistency and accountability to how suspected fraud cases are handled. The proposal to focus on the disputed amount, rather than automatically restricting an entire account, is also an important step towards minimising disruption for legitimate users," Hingar added.
Dos and Don’ts of the Banks as Per RBI
The bank has 10 days from the date of receipt to review the customer's response and make a determination. Within 30 days of implementing the temporary debit hold, the bank must make a decision if no answer is received. Through the NCRP-CFCFRMS, the National Cybercrime Reporting Portal's Citizen Financial Cyber Fraud Reporting and Management System, the bank will escalate the issue to the relevant police authority if it is dissatisfied with the customer's explanation.
Additionally, the consumer has a right to know from the bank the reasons for the referral and continuation of the hold. The bank would be obligated to comply with any directives made by law enforcement or competent authorities on the continuation of the restriction. The bank is required to release the hold on the 31st day if no such directive is received within 30 days after the referral. Additionally, unless otherwise directed by a competent authority, the proposed regulations cap the total duration of a temporary debit hold to 60 days from the date it was imposed.
