RBI’s new money-mule rules explained: What happens when your bank account is flagged for cyber fraud?

What happens if a bank flags a transaction in your account as potentially linked to cyber fraud? Under a new proposal by the Reserve Bank of India (RBI), banks may no longer need to freeze the entire account. Instead, they would, as a general rule, place a temporary debit hold only on the amount under suspicion. 

The proposed framework seeks to make the process more targeted and time-bound while giving customers an opportunity to establish that a flagged transaction is genuine. The draft directions are open for public comments until October 2 and are proposed to take effect from April 1, 2027. Banks can, however, adopt the framework earlier. 

The proposal follows a Supreme Court order dated August 4, 2026, directing the central bank to formulate and circulate a standard operating procedure for temporary debit holds on amounts or accounts linked to money-mule activity and cyber-enabled financial fraud. 

What is a money-mule account? 

A money-mule account is one that is used knowingly or unknowingly to receive, layer or transfer proceeds of cyber-enabled financial fraud on behalf of another person. Under the proposed framework, the process could be triggered when a bank’s transaction-monitoring system identifies a suspected money-mule transaction of ₹1,000 or more. 

Banks could use artificial intelligence and machine-learning tools to identify unusual transactions. These could include transfers that are sudden, inconsistent with a customer’s declared profile, or linked to an account already identified as being involved in fraud or money-mule activity. 

Will the bank freeze the entire account? 

Not ordinarily. The RBI has proposed that banks place a temporary debit hold on the specific disputed amount, rather than freezing the entire account. 

An account-level restriction would be used only as a last resort and in exceptional circumstances. This would allow customers to continue accessing legitimate funds that are unrelated to the transaction under suspicion. 

The bank would also have to inform the customer about the hold, the reason for the action, the process for getting it removed and the contact details of the officer handling the case. 

Where the customer’s mobile number or email address is available, the communication would be made digitally. Otherwise, the bank would use physical means. 

How much time will customers get to respond? 

Customers would get 20 calendar days from the date of the temporary debit hold to explain or justify the transaction. 

They could submit documents establishing their identity, the purpose or context of the transaction, or the source of the funds. 

Once the customer submits an explanation, the bank would have 10 calendar days to examine the response and supporting documents. If the bank is satisfied that the transaction is genuine, the hold would have to be removed immediately. 

What happens if the bank still suspects fraud? 

If the customer does not provide an explanation, the bank would have to take a decision within 30 days from the date on which the temporary debit hold was imposed. 

If the bank continues to suspect that the transaction or account is connected to cyber fraud, it can refer the matter to the jurisdictional police or competent law-enforcement authority through the National Cybercrime Reporting Portal (NCRP)/Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS). 

The bank cannot keep the funds under a temporary hold indefinitely. Once the matter is referred, law enforcement would have a further window to issue a statutory restraint order or other instructions. If there is no contrary instruction, the debit hold would be removed on the 31st day from the date of reference to the agency. 

Overall, the temporary debit hold ordinarily cannot continue beyond 60 days from the date it was first imposed, unless there is a contrary instruction from a law-enforcement agency or competent authority. 

Which banks will be covered? 

The proposed SOP would cover commercial banks, including regional rural banks, small finance banks, payments banks and local area banks. It would also cover urban cooperative banks and State Bank of India. 

Banks would have to establish internal policies covering the identification of suspected transactions, customer communication, removal of holds, and grievance redressal. 

They would also have to designate nodal officers to handle complaints arising from such actions. Such complaints would have to be resolved within 30 days. 

Banks would also be required to maintain records of cases involving temporary debit holds. The proposed directions require such records to generally be retained for at least five years from the date of the hold or 10 years from the closure of the account, as applicable under the directions. 

What should users do if their account is flagged? 

A temporary debit hold does not by itself mean that a customer has been accused of committing fraud. The proposed framework gives the account holder an opportunity to establish that the transaction is legitimate. 

Customers should therefore respond within the 20-day window and provide documents supporting the source and purpose of the funds. This becomes particularly important when a transaction is significantly different from the customer’s normal account activity. 

The proposal also does not replace existing requirements for reporting suspicious transactions. Banks would continue to follow applicable rules, including reporting requirements to the Financial Intelligence Unit-India. 

When will the new rules take effect? 

The RBI’s proposal is still at the consultation stage. The draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026, are open for public comments until October 2. 

The proposed framework is scheduled to take effect from April 1, 2027, although banks can implement it earlier. The final rules could change after the RBI considers feedback from banks, customers and other stakeholders.