RBI Money-Mule Draft Sets a 60-Day Hold Clock

Key takeaways

The RBI money-mule draft proposes a uniform debit-hold process, not a final rule.
Banks would normally target the suspected amount and reserve a whole-account hold for suspected mule accounts.
Absent a contrary instruction from law enforcement or another competent authority, the temporary hold would end within 60 days.

The RBI money-mule draft published on September 11 proposes a time-bound process for banks to restrict suspicious funds while giving customers notice, a chance to explain and a defined route to release. It would amend the Reserve Bank of India’s 2025 Know Your Customer directions after the Supreme Court asked the regulator to create a uniform procedure for cyber-fraud-linked accounts. The RBI’s primary release identifies the consultation and links the draft text.

This is a recovery analysis of the September 11 disclosure, not a claim that the draft is already binding. RBI invited comments through October 2 and said final directions would be issued after feedback. Everyone else is reporting a 60-day cap; we are explaining the operating clock inside that cap and why the distinction between a disputed transaction and an entire account is the draft’s most consequential design choice.

What the RBI money-mule draft proposes

The draft amendment directions apply to commercial banks, including small finance banks, payments banks, regional rural banks and local area banks, as well as urban cooperative banks. RBI says it is responding to an August 4 Supreme Court order directing it to adopt and circulate a standard operating procedure for temporary debit holds linked to money-mule activity and cyber-enabled financial fraud.

Under the proposed sequence, a bank that identifies a suspected money-mule transaction through its monitoring system or internal policy would place an immediate temporary debit hold on the amount. A hold across the entire balance is meant for circumstances in which the account itself is identified as a suspected money-mule account. That distinction matters for customers whose legitimate salary, rent or business receipts sit beside one disputed transfer.

The bank would have to notify the account holder about the restriction, the reason, the route to removal and the responsible contact. Moneycontrol reports that the customer would receive 20 days from the hold date to provide an explanation or justification. The proposal therefore combines quick intervention with a documented chance to contest the bank’s initial risk signal.

The 60-day clock is a workflow, not a waiting period

The RBI money-mule draft does not simply tell banks to wait two months. The first part of the clock is for notice, customer response and the bank’s review. If the explanation is satisfactory, the bank should release the restriction. If it is not, the bank may refer the matter to a law-enforcement agency under the proposed process.

Independent reporting describes a maximum temporary hold of 60 days when no law-enforcement agency or competent authority gives a contrary instruction. Moneycontrol breaks that into an initial 30-day customer-and-bank phase followed by up to 30 days for the authority to act after referral. An operative statutory order can change that outcome, so the headline number should never be read as an automatic release guarantee in every investigation.

The practical accountability test is whether every hold has a visible timestamp, stated amount, named owner and next action. Without those fields, a nominal deadline can still produce stranded complaints. With them, banks can measure which holds were released after explanation, which were escalated and which exceeded the standard clock because a competent authority intervened.

Why transaction-specific holds are the key safeguard

Cyber-fraud investigations often follow money through several accounts. A recipient may be a deliberate mule, an unwitting intermediary or an ordinary customer who received a transfer without knowing its origin. Restricting only the disputed amount preserves the evidentiary trail while reducing the harm caused by blocking unrelated money.

Whole-account restrictions can interrupt payroll, supplier payments, loan instalments and household spending. The draft’s graduated design makes the bank show why the account, rather than a specific transaction, is suspected. That should improve proportionality, but only if transaction-monitoring systems and investigators retain enough context to distinguish a genuine customer from a coordinated mule network.

A narrow hold also creates a cleaner audit trail. The bank can connect the restricted value to the alert or complaint that triggered action, rather than treating every rupee in the account as equally suspicious. For customers and grievance officers, this makes it easier to explain what evidence is needed and what funds remain usable.

What changes for banks and fintech partners

Banks will need more than a policy memo. Their monitoring, case-management, customer-notification and law-enforcement workflows must share the same timestamps and identifiers. A fraud alert that cannot travel into a customer-service case will leave call-centre teams unable to explain the hold, while an escalation that lacks the original transaction reference will slow an investigator.

Fintech apps and payment partners are also part of the experience even when the regulated bank makes the legal decision. They need accurate status messages and escalation routes without exposing investigation-sensitive detail. The broader lesson matches the site’s earlier analysis of how bank-fintech risk guidance shifts to material harm: outsourced interfaces do not outsource accountability for customer outcomes.

Automation should support, not erase, judgement. The draft anticipates transaction monitoring, including technology that flags suspected mule activity, but a risk score cannot supply the legal basis for an indefinite freeze. Banks should preserve the alert inputs, reviewer decision, customer evidence and release or referral rationale so the chain can be audited later.

What customers should expect if the draft becomes final

A customer affected by a temporary debit hold should receive a notice that identifies the restriction and explains how to respond. The most useful response will link the disputed transfer to invoices, messages, contracts or other records that show its legitimate purpose. Customers should keep the notice and case reference because the clock begins with the hold, not with a later branch visit.

The proposal is not a substitute for reporting fraud quickly. Victims should continue using the bank’s fraud channel and India’s established cybercrime reporting routes. Nor does the draft decide ownership of disputed money by itself; it structures the bank’s temporary action while investigators and competent authorities use their own powers.

It also does not mean every account restriction disappears after 60 days. A contrary direction from law enforcement or another competent authority can continue or alter the restraint. Careful reporting therefore has to separate the proposed default bank process from a statutory seizure, attachment or court-backed direction.

What the consultation still needs to resolve

The draft’s effectiveness will depend on implementation detail: how banks authenticate customer replies, how duplicate complaints are reconciled, how a hold is reduced when only part of the amount remains disputed and how institutions exchange status with police without creating conflicting instructions. Standard reason codes and interoperable case references could prevent the same funds from being treated differently across institutions.

Smaller banks may also need common technical guidance. Large institutions can build integrated case systems, while a cooperative bank may rely on manual handoffs. The deadline must remain enforceable across both environments. RBI’s consultation gives banks, consumer groups and investigators a chance to test whether the proposed sequence has clear ownership at each handoff.

The draft follows the same principle visible in the RBI’s wider push for timely compensation and customer redress at credit bureaus: a control is incomplete when the affected person cannot see who must act next. For money-mule cases, speed and proportionality have to coexist. Fast holds protect recoverable funds; time-bound review protects legitimate access.

Facts at a glance

Primary disclosure	RBI press release and draft amendment directions
Public date	11 September 2026
Status	Draft for consultation, not final directions
Comments close	2 October 2026
Customer response window reported	20 days from the temporary hold
Default maximum hold reported	60 days absent a contrary competent-authority instruction
Institutions covered by consolidated draft	Commercial banks and urban cooperative banks

Frequently asked questions

Are the RBI money-mule directions already in force?

No. RBI published draft amendment directions on September 11, 2026 and invited comments through October 2 before issuing final directions.

Would every bank-account hold end automatically after 60 days?

No. The reported 60-day maximum is the proposed default when law enforcement or another competent authority has not issued a contrary instruction.

Can a bank freeze only the disputed amount?

That is the draft’s preferred structure for a suspected transaction. A whole-account hold is associated with cases in which the account itself is identified as a suspected money-mule account.