RBI puts a 60 day clock on suspected mule accounts

On 11 September 2026 the Reserve Bank of India published a draft amendment to its Know Your Customer Directions. It is a short document with one big idea: once a bank suspects a money mule account, there is now a fixed procedure and a fixed clock. Hold the money, tell the customer, give them 20 days, decide in 10, never hold beyond 60.

The comment window closed on 2 October 2026 and the proposed effective date is 1 April 2027. This blog covers three things: what has changed, why it matters, and what your business needs in place before the clock starts running.

What has changed

Until now there was no fixed procedure or timeline for what happens after a suspicious transaction is flagged. The draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026, published under press release 2026-2027/1109, replaces that with a standard operating procedure.

• Flag. A transaction of ₹1,000 or more that the bank’s monitoring system, including any AI or machine learning tool, identifies as potentially linked to mule activity or cyber enabled fraud.
• Hold. A temporary debit hold, placed immediately, on the suspect amount. A hold on the entire account is a last resort for exceptional cases.
• Notify. The customer is told immediately on digital channels, or by the end of the next day otherwise, with the reason, the removal process and the officer handling it.
• 20 days. The customer has 20 calendar days from the hold to explain the transactions.
• 10 days. After the explanation arrives, the bank has 10 days to decide: release the funds, or refer the case to the police or a competent authority. If no explanation arrives, the decision is due within 30 days of the hold.
• 60 days. No hold runs past 60 days unless law enforcement or a competent authority directs otherwise. If the case was referred to the police and no instruction comes within 30 days, the hold is removed on day 31.
• Report. Suspected mule accounts are reported on the National Cybercrime Reporting Portal, and confirmed mule accounts go to FIU India as a Suspicious Transaction Report. If an account is established as a mule account and no STR was filed, the bank is deemed non compliant with the KYC Directions.

Three things matter here. Hold, not freeze: the draft prefers a hold on the suspected amount, with a whole account hold reserved for exceptional cases, so other funds stay usable. Calendar days, not working days: the clock does not pause. And “including AI and ML based tools”: the regulator expects automated monitoring to be part of how a flag is raised.

Why it matters

The draft applies to commercial banks, including small finance banks, payments banks, regional rural banks and local area banks, and to urban cooperative banks. It does not cover NBFCs or payment system operators, and it exempts nodal, pool, escrow and other special purpose accounts. If you are a bank, this becomes your procedure.

If you are a merchant, lender or platform that depends on those banks, you are not the regulated entity, but you will feel it in two places. Your customers’ bank accounts can be held, which hits payouts, settlements and refunds. And your onboarding and payout records become part of the evidence trail when a flagged account is traced back to where it was opened and how it was used.

For everyone, the draft changes what a good flag looks like. Under an open ended review, a loose flag cost little. Under a fixed clock, every flag starts a 60 day process with a customer notice, a case file and a decision deadline attached. Flag too loosely and genuine customers sit locked out while ops drowns in explanations. Flag too late and the money is gone before day one. The procedure is only as good as the signal that triggers it.

What businesses need to know

If the draft is finalised as written, here is what to have ready before April 2027.

• A monitoring rule set that can explain itself. For every flag, you should be able to show why the transaction met the ₹1,000 threshold and the suspicion criteria.
• A customer notice that goes out the same day. A template and a digital channel that can deliver it immediately, with the reason and the removal process built in.
• A case queue with the timers built in. 20 days for the customer, 10 days for you, 30 if they never reply, a hard stop at 60, all visible to the team working the case.
• A referral path. To the police, the National Cybercrime Reporting Portal and FIU India, with a log of any direction received and a day 31 release if none comes.
• Fewer cases to begin with. The cheapest hold is the one you never place. Catching a mule at onboarding, before the first payout, keeps the queue small and the clock quiet.

That last point is where Cashfree Secure ID fits. The draft tells you how long you have after a flag. Secure ID helps you be sure before the flag is ever needed: Phone Risk Intelligence checks the number against revocation and fraud risk data at signup, Reverse Penny Drop and UPI Penny Drop confirm the bank account belongs to the person you verified before any money moves, and Mule Sentinel scores the applicant from 0 to 100 for mule risk at the gate. The RBI procedure is the net. These checks decide how much ends up in it.

FAQs

What is the RBI draft KYC amendment 2026 about?

It proposes a standard procedure for suspected money mule accounts: a temporary debit hold, a customer notice, 20 days for the customer to explain, 10 days for the bank to decide, and a 60 day outer limit unless law enforcement directs otherwise. It was published on 11 September 2026 under press release 2026-2027/1109.

When does it come into effect?

The proposed effective date is 1 April 2027. Banks may adopt it earlier. The draft was open for comments until 2 October 2026 and may change before it is final.

What is a temporary debit hold?

A restriction on debits from a suspected amount, or in exceptional cases an entire account, while the bank verifies the transactions. The hold cannot exceed 60 days without direction from a competent authority.

What triggers a hold?

A transaction of ₹1,000 or more that the bank’s monitoring system, including AI or machine learning tools, identifies as potentially connected to mule activity or cyber enabled fraud.

Does it apply to fintechs and merchants?

Directly, it applies to commercial banks and urban cooperative banks. NBFCs, payment system operators, fintechs and merchants are not covered, and nodal, pool and escrow accounts are exempt, but these businesses will see its effect through holds on their customers’ bank accounts and through the evidence trail of their own onboarding and payout flows.

How can businesses reduce mule accounts before the rule applies?

Check phone numbers against revocation and fraud risk data at onboarding, verify bank account ownership through the payment rail before the first payout, and score applicants for mule risk before approval. Cashfree Secure ID covers each of these with Phone Risk Intelligence, Reverse Penny Drop and UPI Penny Drop, and Mule Sentinel.