RBI drafts 60-day cap on cyber-fraud account holds to accelerate victim recovery and safeguard customers

The Reserve Bank of India proposes a 60-day limit on temporary debit freezes for bank accounts involved in cyber-fraud investigations, aiming to balance swift fraud response with customer protection amid evolving digital threats.

The Reserve Bank of India has proposed a 60-day ceiling on temporary debit freezes for bank accounts flagged in cyber-fraud probes, in a move designed to speed up recovery for victims while limiting the time innocent customers can be locked out of their money. The draft changes, issued under the Reserve Bank of India’s Know Your Customer framework, would require banks to act quickly when internal systems detect suspicious activity linked to so-called money mule accounts, according to the draft rules reported by StartUpTalky and Livemint.

Under the plan, banks would have to notify customers when a hold is placed, explain the basis for the suspicion and review any response from the account holder. Livemint reported that customers would get a 20-day window to offer an explanation, after which the bank would have 10 days to decide whether to lift or keep the restriction. If no explanation is received, the bank must still reach a decision within 30 days of the hold being imposed.

The draft also sets out an escalation path to law enforcement through the National Cybercrime Reporting Portal’s Citizen Financial Cyber Fraud Reporting and Management System. If a bank is not satisfied with a customer’s explanation, it would refer the matter to the relevant police authority and inform the customer of the reasons for both the referral and the continued hold. Unless a competent authority orders otherwise, the restriction would have to be lifted on the 31st day if no instruction arrives within 30 days of referral, and in all cases the temporary hold could not run beyond 60 days.

According to LegalitySimplified, the proposals follow a Supreme Court order of 4 August 2026 that directed the RBI to issue a standard operating procedure for banks dealing with money mule and cyber-enabled fraud cases. The draft, announced on 11 September 2026, is open for public comment until 2 October 2026. The RBI appears to be trying to balance two competing priorities: cutting off fraud quickly and preventing legitimate savers from being left stranded for weeks on end.

Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.