India’s Reserve Bank announces a new framework requiring banks to act swiftly in identifying, notifying, and resolving suspected money mule cases, leveraging AI and strict timelines to combat fraud.
India’s central bank has moved to impose a fixed process for suspected money mule accounts, setting out a timetable that would require banks to act quickly, notify customers and resolve cases within defined limits. According to a draft amendment published by the Reserve Bank of India on 11 September 2026, the new approach would apply when a bank’s monitoring systems identify a transaction of ₹1,000 or more as potentially linked to mule activity or cyber-facilitated fraud. The proposal, which was open for comment until 2 October 2026 and is slated to take effect on 1 April 2027, is designed to replace a looser and more discretionary approach with a standard operating framework.
Under the draft, banks would be expected to place an immediate hold on the suspicious amount, rather than automatically blocking an entire account, except in exceptional cases. Customers would need to be informed straight away through digital channels or by the end of the next day in other cases, and given 20 calendar days to explain the transaction. Once an explanation is received, the bank would have 10 days to decide whether to release the funds or refer the matter to police or another competent authority. If no response is received, the bank would still need to make a decision within 30 days of the hold. In all cases, the hold would have a 60-day limit unless law enforcement instructs otherwise.
The Reserve Bank’s proposal also makes clear that banks are expected to use automated monitoring, including artificial intelligence and machine learning tools, to identify possible mule activity. Suspected cases would have to be reported on the National Cybercrime Reporting Portal, while confirmed mule accounts would go to the Financial Intelligence Unit-India as suspicious transaction reports. The draft says that if an account is confirmed as a mule account and no suspicious transaction report has been filed, the bank will be treated as non-compliant with the KYC directions. That places much more pressure on banks to document every decision and maintain a clear audit trail from the first alert to the final outcome.
The new framework would cover commercial banks, including small finance banks, payments banks, regional rural banks and local area banks, as well as urban co-operative banks. It would not directly apply to non-bank finance companies, payment system operators, merchants or fintech firms, although they would still feel the effect through delayed payouts, held settlements and customer disputes. The RBI has been sharpening its consumer-protection and compliance rules in other areas this year as well, including amendments on limiting customer liability in digital transactions and a separate push to tighten KYC-related obligations. For banks and the businesses that rely on them, the message is the same: detection must come earlier, because once a suspicious transaction is flagged, the clock starts immediately.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
