Summary: This article aims to analyse the Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 in light of the current legislative and judicial framework and practical challenges faced by entities and individuals upon debit-freezing of accounts in relation to financial crimes and cyber frauds.
New age digital banking, despite its convenience, has given rise to financial crimes engineered through cyber frauds. The modus operandi include routing the defrauded sums through a chain of ‘money mule’ accounts, making it difficult to trace the proceeds of the crime. A money mule account is a bank account wherein usually innocent people unintentionally receive illegally acquired funds on behalf of the fraudsters. This has led to an emerging issue where the Law Enforcement Authorities (“LEA(s)”) direct banks to place blanket debit freeze on the bank account wherein the proceeds are last traceable, resulting in innocent individuals ending up in the midst of legal and financial complications.
The Reserve Bank of India (“RBI”) vide press release dated September 11, 2026,[1] issued the Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 (“Draft Directions”), following the Supreme Court’s order dated August 4, 2026, in a suo motu writ petition titled R: Victims of Digital Arrest Related to Forged Documents.[2] The Supreme Court had directed RBI to adopt and circulate a Standard Operating Procedure (“SoP”) prescribing the actions that banks must take while placing temporary debit holds on amounts or accounts linked to money-mule activity and cyber-enabled fraud.
One of the initial developments to curb digital financial frauds was the Ministry of Home Affairs’ Standard Operating Procedure for the National Cyber Crime Reporting Portal-Citizen Financial Cyber Fraud Reporting and Management System (“MHA SoP”), dated January 2, 2026. The MHA SoP aimed to establish a uniform, victim-centric framework governing complaints registered through the National Cyber Crime Reporting Portal (“NCRP”) and the Citizen Financial Cyber Fraud Reporting and Management System (“CFCFRMS”), including the procedure for placing holds on disputed amounts, custody and restoration of defrauded funds, and grievance redressal. This entitled the LEAs to issue notices under Section 168 read with Section 94 of the Bharatiya Nagarik Suraksha Sanhita (“BNSS”), basis which the relevant banks would be required to put on hold the disputed amount. While the MHA SoP had not contemplated a blanket debit freeze on the account, in practice, banks and investigating authorities frequently freeze entire accounts without providing or adhering to specific timelines for lifting the freeze. There have also been instances of account holders not being informed of the freeze, leaving them with prolonged financial inconvenience and no resolution mechanism.
The Supreme Court addressed this implementation gap in Re: Victims of Digital Arrest Related to Forged Documents vide order dated February 9, 2026, when it directed the MHA to formally adopt and implement the MHA SoP nationwide, aimed at building a uniform process to ensure timely restoration of defrauded funds and to enhance public confidence in the reporting mechanism.[3] However, inconsistent implementation of the MHA SoP has resulted in several instances of LEAs and banks imposing complete debit freezes rather than lien-marking only the reported amount.
The lien-marking procedure contemplated by the MHA SoP, is supported by judicial observations. In Kartik Yogeshwar Chatur v. Union of India (“Kartik Yogeshwar Chatur”), the Bombay High Court found that banks were unilaterally imposing debit freezes without specific LEA direction and held that investigating authorities do not possess statutory powers to freeze accounts in their entirety.[4] It relied on the Kerala High Court’s decision in Headstar Global (P) Ltd. v. State of Kerala, which clarified that the law permits only preservation of the disputed amount, not a complete account freeze.[5] In Malabar Gold and Diamond Limited v. Union of India, the Delhi High Court affirmed that any direction from the LEAs must be confined to a lien on the disputed transaction amount, observing that a complete debit freeze would amount to an attachment requiring a judicial magistrate’s order.[6] It reinforced this position in M/s Indyas Food Industries Ltd. v. Union of India and held that it was impermissible to impose a full debit freeze on an account holder’s banking operations when the dispute involved only a fraction of the balance.[7] The Court also held that the lien-marking envisaged under the MHA SoP through Sections 168 and 94 BNSS, together with Section 106 BNSS, was never meant to substitute a full account freeze.
Against this backdrop, the Draft Directions mark a structural shift from the MHA SoP framework, transforming the regulatory architecture and placing the financial intermediaries, i.e., commercial banks and urban cooperative banks at the centre of the process. Under the previous framework, the banks were passive recipients of LEA instructions. The Draft Directions, however, provide them with a suo motu power to place a temporary debit hold on accounts, with the Annex III – Standard Operating Procedure on Suspected Money Mule Accounts to Prevent Cyber-enabled Financial Frauds introducing a uniform, time-bound procedure for banks to suo motu impose a temporary debit hold on accounts and remove it in coordination with LEAs wherever required. This not only protects innocent account holders, it also provides much-needed clarity and predictability on the lifting timeline of debit freezes.
Once a bank suspects a money-mule transaction or identifies such an account, it must immediately place a temporary debit hold on it and notify the account holder (maximum by end of the next day) about the reasons, the process for removal, and the contact details of the relevant officer. Within a defined 20-day window from the hold date, the account holder must submit an explanation. Within 10 days of receiving that explanation or, if none is received, within 30 days of the original hold, the bank must decide whether to lift the hold, continue with it, or escalate it to the LEA. If the LEA responds with instructions within 30 days from the date of being informed of the debit hold (“Date of Reference”), the bank follows those instructions and informs the account holder. If no such instruction is received, the bank will remove the debit hold on the thirty-first (31st) day from the Date of Reference and notify the account holder. Evidently, the bank’s suo motu debit-hold power is thus limited to a 60-day window, beyond which, without any instructions from the LEAs, it cannot extend the debit hold.
Notably, Para 6 (ii) of the Draft Directions directs banks to treat a debit hold as a last resort reserved for exceptional circumstances, rather than a default response, and to build internal policies around objective parameters designed to minimise the risk of flagging genuine accounts. It also mandates a nodal-officer grievance redressal mechanism with a 30-day resolution timeline and a centralised Management Information System (“MIS”), tracking every hold, correspondence, and LEA reference.
While this is a welcome development considering the Draft Directions seek to protect account holders from the uncertainty of open-ended debit freezes, the RBI might need to assess certain loose ends before these take effect. First, although the temporary debit hold is capped at a maximum of 60 days, it assumes a permanent character with no definitive timelines if the LEA directs the bank to continue the same. Second, while the Draft Directions direct banks to treat a debit hold as a last resort reserved for exceptional circumstances, no objective criterion is provided to assess such “exceptional circumstances”. Accordingly, concerns may arise over the banks’ suo motu power to debit freeze under the Draft Directions, based entirely on their transaction-monitoring systems or internal policy, independent of any specific LEA instruction. Critically, this suo motu power would extend to debit freezing the entire account where the account itself is flagged as a suspected money-mule account, a position that sits awkwardly against the stance taken by the MHA SoP and the judiciary. Further, as observed by Delhi and Bombay High Courts, the power to unilaterally impose debit freeze is not statutorily envisaged, with blanket account freeze requiring approval from a judicial magistrate and restraint, if any, would require, actions strictly proportionate to the disputed amount.
In conclusion, the Draft Directions represent a broadly constructive development; however, the breadth of the suo motu debit-hold power warrants closer scrutiny before it takes effect. Nonetheless, the RBI has, through these Draft Directions, replaced regulatory silence with a defined, time-bound, and transparent framework This is a far more balanced approach towards equipping the ecosystem with the ability to tackle money-mule activity decisively while ensuring that innocent account holders no longer remain frozen in indefinite financial paralysis.
[1] Press Release, RBI invites comments on the Draft “Reserve Bank of India (Know Your Customer) Amendment Directions, 2026, Reserve Bank of India (September 11, 2026) available at < Press Releases | Official Website of Reserve Bank of India>.
[4] Kartik Yogeshwar Chatur v. Union of India and Ors., 2025 SCC OnLine Bom 4778, paras. 10-14.
[5] Headstar Global (P) Ltd. v. State of Kerala and Ors., 2025 SCC OnLine Ker 3546, paras. 12-14.
[6] Malabar Gold and Diamond Limited and Ors. v. Union of India and Ors., W.P.(C) 4198/2025, paras. 11, 16-25.
[7] M/s Indyas Food Industries Ltd. v. Union of India and Ors., WP (C) No. 6204 of 2026, paras. 8-10.