Bank Account Debit Hold RBI Draft: 60-Day Cap on Money-Mule Freezes Explained
A friend who teaches tuition in Bhopal got a nasty surprise in June, the kind of surprise the new bank account debit hold RBI draft is trying to fix. A parent paid her fees by UPI, and two days later her bank froze ₹18,000 in her savings account. Nobody called. She found out when her debit card was declined at a medical store. It took her five weeks, three branch visits and a letter from the local cyber cell to get the money released. The parent, it turned out, had been a victim of a fraud further up the chain, and the money had passed through several accounts before reaching hers.
Stories like hers are why this proposal matters. The draft, released on 11 September 2026, would cap such holds at 60 days in most cases, give account holders 20 days to explain, and force banks to decide within fixed timelines. It is only a draft. Public comments close on Friday, 2 October 2026, and the final rules could look different.
What exactly has RBI proposed?
The RBI has issued the draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026. According to the RBI’s press release, this follows a Supreme Court order dated 4 August 2026 that directed the central bank to adopt a standard operating procedure (SOP) for temporary debit holds on amounts or accounts linked to money-mule activity and cyber fraud.
In short, the bank account debit hold RBI framework would put fixed timelines on something that has so far been left to each bank. The draft would amend the existing section on “Operations of Bank Accounts and Money Mules” in RBI’s KYC Directions, 2025. Business Standard and BusinessLine both report that it’s proposed to take effect from 1 April 2027, though a bank can adopt it earlier if it wants.
What is a money mule account?
A money mule account is a bank account used, knowingly or unknowingly, to receive or pass on money stolen through cyber fraud. Fraudsters rarely keep stolen money in one place. They move it through several accounts quickly to make it hard to trace. Some of those account holders are paid to “rent” their accounts. Others have no idea, like my friend, who simply received a fee payment that turned out to be tainted.
Banks have been freezing such accounts for years, often at police request. The problem is that there’s been no uniform process. Holds could last months, customers often weren’t told why, and there was no clear timeline for getting the money back.
How the bank account debit hold RBI process would work
Here’s the proposed sequence, drawn from the RBI draft and reporting by Business Standard and BusinessLine.
When the hold is placed
When a bank’s monitoring system flags a suspected money-mule transaction, it places a temporary debit hold. Business Standard reports the SOP applies to suspected transactions of ₹1,000 or more. The hold should normally cover just the suspicious amount. Freezing the whole account is meant to be a last resort, used only when the account itself is suspected of being a mule.
A debit hold means you can’t withdraw or transfer the held money. Money can still come in.
You must be told
The bank has to notify you immediately through SMS or email if it has your contact details on record, and otherwise by the end of the next day. The notice must give the reason for the hold, explain how to get it removed, and name the officer handling the case with contact details.
20 days to explain
You get 20 days from the date of the hold to explain the transaction and show it’s genuine. In my friend’s case, that would have meant sending the bank the parent’s name, the tuition arrangement and perhaps a screenshot of their chat about fees.
Bank decides within 10 or 30 days
If you reply, the bank has to decide within 10 days of getting your explanation. If you don’t reply, it has to decide within 30 days of placing the hold. If the bank is satisfied that the transaction is genuine, the hold comes off immediately.
If the bank still suspects fraud
The bank can refer the matter to the police or another law enforcement agency. If the agency doesn’t send an instruction backed by law within 30 days of that reference, the bank must lift the hold and inform you.
The 60-day cap
Overall, a temporary debit hold can’t normally last beyond 60 days from the day it was placed, unless a law enforcement agency or competent authority specifically directs otherwise.
| Stage | Proposed timeline |
|---|---|
| Bank notifies you | Immediately by SMS/email; otherwise by end of next day |
| Your explanation | Within 20 days of the hold |
| Bank’s decision after your reply | Within 10 days of receiving it |
| Bank’s decision if you don’t reply | Within 30 days of the hold |
| Police instruction after referral | Within 30 days, or hold is lifted |
| Maximum hold | 60 days, unless police/authority directs otherwise |
Which accounts are covered?
The draft applies to all commercial banks, including small finance banks, payments banks, regional rural banks and local area banks, plus urban co-operative banks. BusinessLine notes that it won’t apply to nodal accounts, pool accounts, escrow accounts and other special-purpose accounts like dividend accounts. Your regular savings or current account would be covered.
Banks would also need a grievance process with designated nodal officers. Business Standard reports that complaints arising from debit holds would have to be resolved within 30 days.
Bank account frozen right now? What to do today
Remember, the new SOP isn’t in force yet. If you have a bank account frozen by your bank today, the bank account debit hold RBI timelines in the draft don’t legally bind it. But they give you a useful reference point, and some of the steps are just good sense.
Ask for the reason in writing. Visit the branch or write to customer care and ask which transaction triggered the hold and who asked for it: the bank’s own systems, or a police complaint through the national cybercrime portal.
Get the complaint reference. If a police or cybercrime complaint is behind it, ask for the complaint or acknowledgement number. You may need to approach that police station or cyber cell to get a release letter.
Put together your proof. Invoices, chats, agreements, the payer’s details, anything showing why you received the money. If the credit came through UPI, IMPS or NEFT, the transaction reference is on your statement. Our explainer on NEFT, IMPS and RTGS shows where to find it.
Escalate if the bank sits on it. If the bank doesn’t respond in 30 days, or you’re unhappy with the response, you can complain to the RBI Ombudsman through the RBI Complaint Management System.
And if you’ve lost money to a fraud yourself, report it right away on the national cybercrime portal or call 1930. That’s the same system banks use to trace and hold stolen money as it moves through mule accounts.
How to avoid your account becoming a money mule account
Most honest people who get caught up in this did nothing wrong. Still, a few habits lower the risk.
Never let anyone use your account to “receive a payment” for them, even a relative or a friend of a friend, and especially not for a commission. That’s the classic mule recruitment pitch. Be careful with large credits from strangers, especially ones followed by a request to send some of it back or forward it to someone else (“sorry, sent by mistake, please return”). Don’t share UPI PINs, OTPs or netbanking logins with anyone.
If you run a small business that takes UPI payments from many people, keep simple records of who paid for what. If a payment gets flagged, you’ll be able to answer within the 20-day window without scrambling. Knowing your UPI transaction limits also helps you spot odd activity on your own account.
Sudden large cash deposits can also draw attention under separate rules. Our guide to bank cash deposit rules covers those limits.
How to send your feedback on the RBI KYC amendment directions
Anyone can comment on the RBI KYC amendment directions, including members of the public. The deadline is Friday, 2 October 2026. The RBI’s press release gives two channels.
You can use the “Connect 2 Regulate” section on the RBI website, or email amldorfeedback1@rbi.org.in with the subject line “Feedback on Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026”.
If you’ve been through a freeze yourself, your experience of how banks handle a hold today is useful input that can shape the final bank account debit hold RBI rules. Points worth raising: whether 20 days is enough time for someone who doesn’t check SMS often, whether the hold should always be limited to the disputed amount, and whether banks should pay interest or compensation if a hold turns out to be wrong.
FAQ: bank account debit hold RBI rules
Are the RBI debit hold rules in force now?
No. It’s a draft open for comments until 2 October 2026, proposed to take effect from 1 April 2027 unless a bank adopts it earlier.
How long can a bank keep a debit hold under the draft?
Normally up to 60 days from the date of the hold, unless the police or a competent authority directs a longer hold.
Will my whole account be frozen?
Usually not. The draft says the hold should cover the suspicious amount, with a full-account hold only as a last resort.
How much time do I get to explain a flagged transaction?
Twenty days from the date of the hold. The bank then has 10 days to decide after it gets your explanation.
Can I still receive money during a debit hold?
Yes. A debit hold stops withdrawals and transfers of the held amount, not incoming credits.
For ordinary account holders, the most useful thing about this bank account debit hold RBI proposal is the clock. Right now a freeze can drag on for months with no end date. If the final rules keep the 60-day cap and the notice requirement, people like my friend in Bhopal would at least know who to call and how long they’d have to wait. We’ll update this post once the RBI issues the final directions.
Disclaimer: This article describes a draft RBI proposal as of 28 September 2026. The final directions may differ. For a frozen account, follow your bank’s and the investigating agency’s instructions.
