RBI wants banks to freeze the disputed sum, not the whole account

The Reserve Bank of India has circulated draft amendments to its 2025 KYC directions that would stop banks from freezing an entire account every time a cyber-fraud alert fires. Under the proposal, a suspected transfer of Rs 1,000 or more can trigger a temporary debit hold on the disputed amount. A full-account freeze becomes a last step, not the default. Most holds would expire at 60 days. Customers would get 20 calendar days to explain the credit. The bank would then have 10 days to decide. If the explanation holds, the hold comes off at once. If the customer stays silent, or if the story fails, the bank must push the file to local police through the National Cybercrime Reporting Portal and the CFCFRMS system.

The draft exists because the Supreme Court on 4 August told the RBI to write and circulate a standard operating procedure for temporary debit holds on mule accounts and cyber-enabled fraud. Banks had been using blunt tools. A single flagged UPI credit could lock salary, rent and loan EMIs in the same account. Innocent holders, and holders who were used as pass-throughs without knowing it, sat in that queue for months. The new text tries to separate the disputed rupees from the rest of the balance.

Monitoring is meant to be automated. Banks would have to run systems, including machine-learning tools, that look for transfers which are sudden, out of line with a declared profile, or linked to known fraud networks. The definition of a “suspected transaction” starts at Rs 1,000. That threshold is low enough to catch the small hops mule rings use to test an account before a larger pass-through. It is also low enough to generate false positives on ordinary family transfers. The 20-day reply window is the proposed safety valve for those errors.

Coverage is wide. Commercial banks, small finance banks, payments banks, regional rural banks, local area banks and urban cooperative banks all sit inside the draft. The stated effective date is 1 April 2027. Banks may switch earlier. Public comments close on 2 October 2026. That calendar gives lenders two full financial-year quarters after the comment period to rebuild core-banking flags, customer SMS templates and police-referral desks.

The practical change for a salaried customer is easy to describe. Today a Rs 12,000 credit that a fraud desk dislikes can freeze a Rs 2 lakh balance. Under the draft, the hold should sit on Rs 12,000 while the rest of the account keeps paying the electricity bill. Account-level restriction remains available when the bank thinks the whole relationship is a mule warehouse. The RBI wants that choice written down and time-limited, not left to a branch officer’s fear of a later enforcement notice.

There are still holes. Sixty days is shorter than the old open-ended freezes and longer than a customer who needs the money tomorrow will like. Police referral through NCRP does not guarantee a fast FIR or a fast release. AI monitoring will only be as good as the typologies the banks feed it; mule rings change UPI handles faster than model retraining cycles. And a Rs 1,000 floor will light up a lot of screens. The comment letters due by 2 October will likely ask for a higher trigger, a shorter hold for low-value alerts, and a clearer rule on joint accounts.

For now the direction of travel is the news. The Supreme Court asked for an SOP. The RBI answered with a draft that treats the disputed credit as the object and the account as the exception. If the final directions survive lobbying and still start in April 2027, the next time a mule alert hits a genuine salary account the customer should lose a slice of the balance, not the whole month.