The Reserve Bank of India has proposed a new framework that will fundamentally change how banks handle suspected cyber fraud cases. According to News On AIR, under the proposed rules, banks will freeze only the disputed transaction amount rather than the entire account when unusual transfers of ₹1,000 or more are flagged as potentially linked to mule accounts or cyber fraud. This represents a significant shift from the current practice of freezing entire accounts during investigations, moving from a drastic approach to a more targeted methodology. The key change under the proposed framework is that action in suspected cyber fraud cases would be limited to the suspicious amount rather than the entire account, helping prevent fraudulently obtained funds from being transferred further while allowing customers to continue using legitimate money in their accounts. The framework requires banks to implement AI-based transaction monitoring systems to identify transfers that are sudden, disproportionate to a customer's declared profile, or linked to known cyber-fraud networks. These systems will automatically flag transactions that meet specific criteria and trigger the freeze process.
Under the proposed rules, customers will receive 20 calendar days to establish the legitimacy of a transaction by providing proof of identity, details of its context, or documents showing the source of the funds. According to News On AIR, banks will then have 10 calendar days to assess the explanation and supporting evidence. If the account holder's explanation is satisfactory, the hold must be lifted immediately. The framework introduces 60-day temporary debit restrictions as the standard limit, unless further instructions are received from law-enforcement authorities or another competent authority. If the customer fails to respond within 20 days or the explanation does not dispel the suspicion of cyber fraud, the bank must refer the case to the jurisdictional police through the National Cyber Crime Reporting Portal and the Centralised Financial Cyber Fraud Reporting and Management System. The framework ensures that banks cannot keep funds frozen indefinitely and shifts the onus to law enforcement for formal legal action.
The framework places significant responsibility on law enforcement agencies for formal action. As reported by News On AIR, if banks refer cases to police through the NCRP/CFCFRMS portal, law enforcement will have 30 days from the referral to issue a formal statutory restraint order. This timeline ensures that banks cannot keep funds frozen indefinitely and shifts the onus to law enforcement for formal legal action. Once the case has been referred to the police or the relevant investigating agency, the bank will not be able to keep the amount frozen indefinitely on its own. The police will have to issue a formal statutory restraint within 30 days of receiving the referral, with further legal action concerning the suspicious amount then coming under the jurisdiction of the law enforcement agency. The proposed framework also requires banks to establish grievance-redressal mechanisms and resolve customer complaints relating to the process within 30 days - half the maximum life of the hold itself. The draft amends the RBI's Know Your Customer (KYC) Directions, 2025, and inserts a Standard Operating Procedure (SOP) on suspected money mule accounts as a new annex.
The draft amendment directions, issued for public comments on September 11, 2026, are scheduled to take effect from April 1, 2027, although banks can adopt them earlier. According to News On AIR, the framework follows the Supreme Court's August 4, 2026 order directing the RBI to prescribe and circulate an SOP for temporary debit holds on amounts or accounts linked to money-mule activity and cyber-enabled fraud. The framework will cover commercial banks, including small finance banks, payments banks, regional rural banks and local area banks, as well as urban cooperative banks. Banks will be required to maintain records of debit holds, customer communications, police references and subsequent decisions. Records relating to temporary debit restrictions will have to be retained for at least five years, while records relating to accounts that are subsequently closed must be preserved for at least 10 years. The draft procedure runs on a clock - the bank places the hold immediately on flagging a transaction, must then tell the account holder with reasons and an officer's contact details, and the account holder gets 20 days to explain. Banks get 10 days after that to decide, or 30 days from the hold if no explanation arrives. If the bank is not satisfied, it refers the case to the jurisdictional police through the National Cyber Crime Reporting Portal.
