Bank account freeze: RBI's draft rules on 60-day temporary debit holds for suspected mule accounts
RBI's draft KYC rules let banks hold suspected fraud money for up to 60 days. What the 20-day reply window means if your account or UPI payment is flagged.
RBI has proposed a standard way for banks to freeze money linked to "money mule" fraud. If your account is flagged by mistake, the draft sets out how long a hold can last and how fast the bank must tell you and decide. These rules are not final yet.
What RBI has proposed
On 11 September 2026 RBI published the draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 for public comment. The Supreme Court had asked RBI on 4 August 2026 to adopt a standard procedure for temporary debit holds on money linked to money-mule activity and cyber fraud. The comment period ended on 2 October 2026.
A money-mule account is one used, knowingly or not, to receive or pass on money stolen in a cyber fraud. Many mule account holders are ordinary people who were tricked, for example by a fake job offer.
How a hold would work, as reported from the draft
- What can be held. A bank that spots a suspected mule transaction of ₹1,000 or more through its monitoring system can hold that transaction. If it thinks the whole account is a mule account, it can hold the entire account.
- Telling you. The bank must notify you straight away, or by the end of the next day, with the reason, how to get the hold removed and an officer's contact details. It uses your registered mobile number or email where it has one.
- Your reply. You get 20 days from the hold to explain why the transaction or account is genuine.
- The bank's decision. It must decide within 10 days of your reply. If you send no reply, it decides within 30 days of the hold. If it is satisfied, the hold is removed.
- Police referral. If the bank is not satisfied, it reports the matter to the police through the National Cybercrime Reporting Portal.
- Maximum length. If the police or another competent authority has not asked the bank in writing to keep the hold within 30 days of the reference, the bank must remove it. Without such an order, a hold cannot last more than 60 days.
- Complaints. Each bank must name nodal officers, show their details on its website and branches, and resolve complaints within 30 days.
The draft applies to commercial banks and urban co-operative banks. It does not cover nodal, pool or escrow accounts. Banks must also use a policy that keeps whole-account holds for exceptional cases and reviews flagged transactions to avoid wrongly flagging genuine ones.
When it starts
The draft says the rules would apply from 1 April 2027, or from an earlier date if a bank chooses to start sooner. In the Supreme Court on 29 October 2026, RBI said the final directions will be notified by 30 November 2026 and put into operation by 31 December 2026. Our guide on that hearing is here. The final text may differ from the draft, so check RBI's notification when it comes.
What you can do now
- Keep your registered mobile number and email updated with your bank, because the notice will go there.
- Do not let anyone use your account to receive or send money for a "commission" or a "job". That can make your account a mule account.
- If a bank holds your money, reply in writing within the window and keep proof of the source of the money, such as an invoice, salary slip or chat history.
- If money is lost to a fraud, call 1930 or report at cybercrime.gov.in at once. Also read our guide on OTP fraud and zero liability.
Sources: RBI press release: draft KYC Amendment Directions, 2026, 11 September 2026, The Hindu BusinessLine: RBI proposes 60-day temporary debit holds, DSCI: brief on the draft RBI KYC Amendment Directions, 2026, Saifu: Supreme Court on digital arrest scams
Rules, rates and limits change. Check the official source linked above before you rely on a figure here. Posts never contain referral or affiliate links from the writer.
Want to write for Saifu? Here is how.