The Reserve Bank of India (Know Your Customer) Amendment Directions, 2026: Protecting Victims Without Freezing Innocent Accounts

Akansha Aditi
Akansha Aditi
Intern, Policy & Advocacy, CyberPeace
PUBLISHED ON
Oct 30, 2026
10

Introduction

With the development of a digital economy in India, merchants in the country are often caught in a tough situation where their bank accounts have been placed under a debit freeze, due to a suspected link of the bank account with some form of cyber fraud. These merchants are left in a tough situation, as their funds, including their personal earnings, and money earned through the running of their business, have become frozen, regardless of whether or not the account holder had knowingly or intentionally engaged in any kind of illicit activity. The funds of legitimate businesses have become tied up due to this activity. 

This concern was recognized and was addressed by the Supreme Court of India in their order, which was issued in 2026, which prompted the RBI to issue their draft Directions, in 2026. The draft directions are aimed at balancing the need of the state to stop the rapid withdrawal of stolen funds, while also trying to balance the needs of law-abiding citizens to hold and access their own money and maintain some financial stability.

Understanding Money-Mule Accounts

A "money mule" account is used for depositing and/or layering/integrating illicit money. There is a broad range of culpability when a person uses their bank account as a money mule account. Some people knowingly give someone else control over their bank account and use that control to commit illegal acts to make some money. Others, however, are unsuspecting and fall victim to fraudulent activities such as online ads offering bogus jobs or romance scams.

The proliferation of these accounts introduces severe systemic friction into cybercrime investigations, as stolen assets are rapidly dispersed across multiple tranches and jurisdictions before law enforcement can trace the primary beneficiaries. Accordingly, banking institutions bear a rigorous compliance burden to deploy real-time transaction monitoring systems capable of identifying anomalous patterns to pre-emptively mitigate the dissipation of fraudulent proceeds.

However, having an account involved in a questionable money transfer does not make the person account holding automatically a money mule. There is the innocent account holder who is being used as a transferrer for money to a person who has something to trade in exchange, or perhaps an account holder whose account was taken over. There are also accounts who have unknowingly been victim to identity theft. Due process requires a framework that allows an account holder to contest their money hold while providing regulatory safeguards to protect consumers.

What Does the RBI’s Draft Propose?

1. Temporary debit holds on suspicious transactions

The Draft Directions mandate that banking institutions institute temporary debit holds upon detecting transactions or accounts exhibiting a suspected nexus with money mule activities or cyber-enabled financial fraud. Real-time transaction monitoring systems leveraging advanced Artificial Intelligence (AI) and Machine Learning (ML) architectures shall be deployed to identify anomalous or suspicious transactions capturing a threshold value of ₹1,000 or more.

2. Notice and an opportunity to explain

Procedural safeguards within the framework include notice being provided by the banking institution to the customer within a statutory time period following a debit hold. The notice must specify the reason(s) behind the hold, and the procedures for a customer to request for the hold to be vacated, as well as providing information and contact details of the officer handling the matter.

  • Showing Cause: The account holder shall ordinarily be granted a statutory window of 20 days from the receipt of notice to show cause and establish the legitimacy of the transaction or account.
  • Adjudication by Bank: Upon submission of the customer's explanation, the bank is mandated to adjudicate the matter within 10 days. If the explanation is deemed statutorily satisfactory, the institution must vacate the hold instanter.
  • Law Enforcement Referral: In the event the response is found to be lacking in substance, the bank can make a referral to the concerned law enforcement authority through the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) portal of the National Cybercrime Reporting Portal (NCRP).
  • Temporal Sunset Clauses: The framework includes stringent temporal provisions for law enforcement actions to ensure that administrative delays do not turn the temporary holds into perpetual financial incapacitation:
    • The 30-Day Directive Rule: In case the competent law enforcement authority does not issue a formal directive for the need to maintain the hold beyond the stipulated period within 30 days of the referral, then the bank is statutorily bound to remove the restriction after 30 days.
    • Absolute Maximum Ceiling: In the absence of an explicit overriding direction from a competent judicial or statutory authority, the absolute maximum tenure of any temporary hold shall remain 60 days from the date of initiation of the hold.

3. Greater accountability for banks

Beyond the mechanics of fraud detection, the proposed framework also imposes greater responsibilities on banks with respect to compliance and governance. This implies that the banks need to have an internal policy on detection, implementation and release of the hold order, standardized customer communication, coordination with the law enforcement authorities, and also grievances redressal.

Balancing Fraud Prevention with Customer Rights

The promise of a proportionate approach

The core efficacy of the proposed regulatory framework rests upon its adherence to the constitutional doctrine of proportionality, seeking to calibrate administrative restrictions strictly to the scope of the alleged wrongdoing. Historically, the imposition of indiscriminate, blanket account freezes by banking institutions has induced severe financial disenfranchisement. These overreaching actions effectively inhibit the citizen’s ability to ensure basic necessities for oneself, meet one’s tenancy responsibilities, meet one’s medical liabilities, and remain solvent within the commercial environment.

For proprietary firms, micro-traders, and small-to-medium enterprises (SMEs), an inaccessible bank account means instant cessation of business activity, inability to pay salaries, and inability to pay suppliers. A transaction-based debit block, contingent upon statutory justification and limited by time is considerably less disruptive to the economic consequences.

The risks that remain

While Draft Directions are innovative, their effectiveness still rests on the ability of algorithms to detect fraud. An anomaly detection machine learning model is good at finding variations and deviations in transactions and the order of transactions. However, there are many variations in legitimate transactions, such as a large transfer in an otherwise small transaction account. An automated transaction system cannot identify fraud alone.

An over-reliance on unverified automated alerts creates an acute risk of systemic recidivism, wherein innocent depositors face iterative, unwarranted financial restrictions. Without legal and procedural support, automated fraud detection systems should not be used in banking and legal systems.

From an evidentiary standpoint, informal workers, small-scale vendors, and consumers lacking advanced digital literacy face severe structural barriers when ordered to establish the legitimacy of a transaction within the statutory 20-day window. These demographics frequently operate without formal invoices, digital ledger entries, or direct access to professional legal and banking assistance.

To prevent the reversing of the burden of proof onto the vulnerable, banking institutions must be mandated to provide simplified, multilingual channels for showing cause, accept alternative forms of secondary evidence, and eschew overly burdensome compliance hurdles. Crucially, where a depositor submits credible exculpatory evidence, clear statutory escalation and appellate pathways must be available to counter institutional inertia.

Recommendations for Effective Implementation

First, banks need to implement explainable and risk-based detection mechanisms, if needed, accompanied by human review. Secondly, banks need to give customers timely notice regarding the blocked transaction with explanation on what amount it concerns, steps to be taken and how one can submit additional evidence.

Thirdly, the RBI should ensure that grievance redressal is effective in practice, with urgent review of cases concerning necessary expenses and business hardship. Finally, coordination between banks and law-enforcement agencies must improve so that referrals are acted upon within the prescribed timelines.

Conclusion

The RBI’s Draft Know Your Customer Amendment Directions, 2026, represents a significant regulatory effort to resolve the systemic friction between combating cyber-enabled financial fraud and protecting consumer property rights. By introducing transaction-specific holds, mandatory customer notification, a statutory right to be heard, and strict temporal ceilings, the framework introduces a much-needed ethos of accountability into the digital ecosystem.

The sustainability of India’s digital economy in the long run cannot be contingent on a structure that inhibits the flow of illegitimate money through imposing severe, extrajudicial monetary disabilities on innocent people because the true effectiveness of any system entails not only inhibiting the criminals behind cybercrime but also protecting the financial safety and liquidity of regular depositors.

‍

References

  1. Reserve Bank of India, Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 (11 September 2026) RBI official website.
  2. In Re: Victims of Digital Arrest Related to Forged Documents, Suo Motu Writ Petition (Criminal) No. 3 of 2025 (Supreme Court of India, Order dated August 4, 2026)
  3. Reserve Bank of India, Reserve Bank of India (Know Your Customer) Directions, 2025
  4. ‘RBI Proposes Temporary Debit Holds on Suspected Money Mule Accounts’, Business Standard (13 September 2026), https://www.business-standard.com/finance/news/rbi-proposes-temporary-debit-holds-on-suspected-money-mule-accounts-126091300603_1.html.
  5. ‘RBI Proposes Framework to Freeze Only Disputed Transaction Amount in Suspected Cyber Fraud Cases’, News on AIR (14 September 2026), https://newsonair.gov.in/rbi-proposes-framework-to-freeze-only-disputed-transaction-amount-in-suspected-cyber-fraud-cases/.
  6. Reserve Bank of India, Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 (11 September 2026).

‍

PUBLISHED ON
Oct 30, 2026
Category
TAGS
No items found.

Related Blogs