Source-led article
RBI Proposes Uniform Rules for Freezing Accounts in Cyber Fraud Cases, Caps Hold at 60 Days
The Reserve Bank of India (RBI) has published draft rules that aim to create a single, time-bound standard operating procedure (SOP) for banks when dealing with accounts and transactions suspected of being linked to cyber-enabled financial frauds. The proposed framework, titled the Reserve Bank of India (Know Your Customer) Amendment Directions, 2026, comes in response to a Supreme Court directive issued in August 2026 asking the central bank to build a uniform protocol for such cases.
The draft rules are open for public comment until October 2, 2026, and are scheduled to take effect from April 1, 2027, though banks may choose to implement them earlier.
A Shift to Transaction-Level Freezes
One of the most significant changes proposed is a move away from blanket account freezes. Under the new framework, banks will be required to place a temporary debit hold only on the specific transaction amount that has been flagged as suspicious, rather than freezing the entire account. An account-wide hold will only be permitted in cases where the account is suspected of being a money-mule account—an account used to receive and transfer stolen funds on behalf of fraudsters.
This change directly addresses a long-standing pain point for account holders whose entire finances have been disrupted by fraud-related account blocks, often with no clear timeline for resolution.
Automated Monitoring and AI Flagging
The draft rules mandate that banks deploy automated transaction-monitoring tools, including artificial intelligence and machine learning systems, to flag suspected mule transactions of ₹1,000 and above. Once a transaction is flagged, the bank must immediately place a temporary debit hold on the flagged amount and notify the account holder digitally on the same day or physically by the end of the next business day.
This use of AI-based monitoring aligns with broader government efforts to modernise cyber fraud response. In early 2026, Union Home Minister Amit Shah directed officials to upgrade the National Cybercrime Helpline using AI to simplify the reporting process and to address the specific issue of frozen bank accounts in fraud investigations.
60-Day Cap on Account Freezes
The proposed rules impose a maximum duration of 60 days for a temporary debit hold in the absence of an explicit statutory order from a court or law enforcement agency. If no such order is received within 60 days, the hold must be lifted.
This time cap is a direct response to the Supreme Court’s observation that indefinite account freezes without judicial oversight cause disproportionate hardship to account holders. Nodal accounts, escrow accounts, and special-purpose accounts are exempt from these measures.
Clear Timelines for Account Holders and Banks
The draft framework introduces a structured timeline for both account holders and banks:
- The account holder has 20 days from the date of the debit hold to provide an explanation or supporting documents.
- The bank must review the account holder’s submission within 10 days.
- If the bank finds the response unsatisfactory, it must escalate the case to law enforcement through the National Cybercrime Reporting Portal (NCRP-CFCFRMS) within 30 days.
- If the response is satisfactory, the bank must immediately lift the hold and notify the account holder.
Datos clave
| Item | Detail |
|---|---|
| Public comment deadline | October 2, 2026 |
| Effective date | April 1, 2027 (banks may adopt earlier) |
| Maximum freeze without court order | 60 days |
| Account holder response window | 20 days |
Strengthened Grievance Redressal
As directed by the Supreme Court, the draft rules also prescribe stronger grievance redressal measures. Banks will be required to appoint designated nodal officers whose contact details must be displayed on the bank’s website and at all branches. These nodal officers are responsible for resolving customer grievances within 30 days.
The RBI has also separately issued directives to limit customer liabilities in cyber fraud cases. Customers who lose up to ₹50,000 in a cyber fraud incident are eligible for compensation of up to 85% of the net loss amount, or ₹25,000, whichever is lesser.
The Scale of the Problem
The regulatory push comes amid a surge in cyber-enabled financial frauds across India. According to data from the Ministry of Home Affairs, Indians lost at least ₹22,495 crore to cyber fraud in 2025, only slightly lower than the ₹22,845 crore lost in 2024. The National Human Rights Commission reported in June 2026 that Indians have lost approximately ₹52,976 crore to cyber-enabled frauds over the past six years, with nearly 8% of those losses linked to “digital arrest” scams.
A report cited in the draft rules context also noted that nearly 7.1% of attempted digital consumer transactions in India in 2025 were suspected fraud—almost double the global average of 3.8%.
What This Means for Digital Banking Users
For the millions of Indians using digital banking and payment platforms, these draft rules represent a move toward greater procedural clarity and consumer protection. The shift from blanket account freezes to transaction-level holds means that a single flagged transaction will no longer disrupt an account holder’s entire financial life. The 60-day cap on freezes without a court order provides a clear outer limit, and the 20-day response window gives account holders a defined opportunity to contest a hold.
However, the rules are still in draft form and subject to change based on public feedback. Banks and financial technology companies will need to update their compliance systems and automated monitoring tools to meet the new requirements by the April 2027 deadline.