Mumbai: The Reserve Bank of India (RBI) has proposed a targeted system for handling suspicious transactions linked to cyber fraud or money-mule accounts. Under the framework, banks would freeze only the disputed amount instead of blocking the customer's entire account.
The draft rules are expected to take effect from April 1, 2027, though banks may implement them earlier. The RBI has invited public comments on the proposed changes to its Know Your Customer Directions, 2025.
AI-based checks
Banks will have to deploy artificial intelligence-based monitoring systems to detect unusual transfers of Rs 1,000 or more. These systems will flag transactions that appear sudden, are inconsistent with a customer's declared profile or have links to known cyber-fraud networks.
The proposal aims to protect customers from the hardship caused when their bank accounts are frozen over one disputed transaction. It would allow access to undisputed funds while the flagged amount remains temporarily unavailable.
Customer gets 20 days
Once a hold is placed, the customer will get 20 calendar days to prove that the transaction is legitimate. The account holder may submit identity proof, explain the purpose and circumstances of the transfer, and provide documents establishing the source of funds.
Banks must examine the customer's response and documents within 10 calendar days. If the explanation is satisfactory, the temporary hold must be removed immediately.
Police action within 30 days
If the customer does not respond within the 20-day period, or the evidence fails to address the bank's concerns, the case must be referred to the jurisdictional police through the NCRP/CFCFRMS portal.
Law-enforcement authorities will then have 30 days from the referral date to issue a statutory restraint order. Without such an order, banks cannot continue holding the disputed funds indefinitely.
The framework follows the Supreme Court's August 4, 2026, direction asking the RBI to prescribe and circulate a standard operating procedure for temporary debit holds involving suspected mule activity and cyber-enabled fraud.
