On September 11, 2026, the Reserve Bank of India published a draft rule that reads, on its face, like a clean win for anyone who has ever had a salary account frozen over a fraud complaint that had nothing to do with them. RBI's draft Know Your Customer (Amendment) Directions, 2026 state that the maximum duration of a temporary debit hold, absent any contrary instruction from a law-enforcement agency or another competent authority, is 60 days from the date the hold is placed. The draft also treats freezing the entire account as a last resort, to be used only in exceptional circumstances, rather than a bank's default response to a suspicious flag. RBI issued the draft citing the Supreme Court's order of August 4, 2026, which directed it to adopt a Standard Operating Procedure for such holds, and opened it for public comment until October 2, 2026.
RBI's draft caps how long a bank can freeze a flagged account, and limits the hold to the money actually in dispute.
It is worth slowing down on that word: cap. A limit that applies equally to everyone applies equally to the mule handler reading the same draft. Sixty days is not just relief for the account holder waiting to be cleared. It is also a schedule. Anyone running money through a chain of mule accounts now knows, to the day, how long a flagged account stays unusable before the specific hold on it is due to lapse. The fix for one problem quietly hands the perpetrators of the other a plan.
The scale RBI is trying to contain
The pressure behind this draft is not abstract. Reported losses to cyber-enabled fraud more than tripled in a single year, from Rs 7,465.18 crore in 2023 to Rs 22,845.73 crore in 2024, the Ministry of Home Affairs told the Lok Sabha, citing figures from the National Cyber Crime Reporting Portal and CFCFRMS. Much of that money moves through exactly the kind of accounts this draft targets: as of December 2025, 24.67 lakh Layer-1 mule accounts had been shared with Suspect Registry participant banks, which had declined transactions worth Rs 8,031.56 crore as a result, the Ministry of Home Affairs told the Lok Sabha.
Every one of those crores sat inside an account that a bank could freeze under no fixed deadline at all, until now.
Courts forced the timeline, and RBI still missed it
RBI did not arrive at this draft on its own schedule. Weeks before it, the Rajasthan High Court ruled that no bank account should face an indefinite blanket debit freeze on the basis of a vague or unverified communication, and that banks should ordinarily preserve only the disputed amount by lien rather than freeze the whole account, in a judgment covering a batch of 105 petitions over frozen accounts, LiveLaw reports. That ruling, and the pattern of petitions behind it, is the clearest evidence that indefinite freezes on genuine account holders were not a hypothetical problem RBI chose to pre-empt. They were already reaching courtrooms in bulk.
The Supreme Court had, separately, told RBI to fix this on a clock of its own. But the court gave RBI four weeks to adopt the SOP, a deadline that ran out on September 1, and what RBI issued on September 11 was only a consultation draft, with a commencement date 18 months away, MediaNama reports. The regulator that is now handing the public a precise 60-day number could not itself meet a four-week one.
A clock that cuts both ways
The 60-day maximum applies "in the absence of any contrary instruction from an LEA or Competent Authority", and a hold can be triggered by a transaction of just Rs 1,000 or more flagged by a bank's AI or machine-learning monitoring as potentially linked to fraud, Free Press Journal reports. That is a low bar for entry into the system and a fixed exit from it. For a genuine customer swept up by a false positive, that predictability is the entire point: a bank can no longer sit on their salary account indefinitely while an investigation stalls. A money-mule network gets the same benefit. It can route a modest transaction through an account, absorb a 60-day cooling period as a known cost of business, and resume once the hold lapses, unless a law-enforcement agency actively intervenes to extend it.
RBI's draft trades an open-ended, full-account freeze for a scoped, time-boxed one.
| Aspect | Practice the courts were reviewing | RBI's September 2026 draft |
|---|---|---|
| Maximum duration of a hold | No fixed limit stated in the rules RBI is now replacing | 60 days, absent a contrary LEA instruction (RBI draft directions) |
| Scope of the freeze | Often the entire account, per the practice the Rajasthan High Court reviewed (LiveLaw) | Limited to the disputed amount by lien wherever identifiable; full-account freeze reserved for exceptional cases (Business Standard) |
| Trigger for a hold | Bank discretion on a flagged transaction | Transactions of Rs 1,000 or more flagged by AI/ML monitoring as potentially fraud-linked (Free Press Journal) |
Source: RBI's draft KYC (Amendment) Directions, 2026, as reported by Business Standard and Free Press Journal, and the Rajasthan High Court's ruling, as reported by LiveLaw.
A recovery system still catching up
The infrastructure meant to act on all this is scaling, but from a low base and with real gaps that persisted into 2025. By August 2025, the Citizen Financial Cyber Fraud Reporting and Management System had saved more than Rs 5,489 crore across 17.82 lakh complaints since its 2021 launch, the Ministry of Home Affairs told the Rajya Sabha.
By June 30, 2026, that had grown to more than Rs 11,158 crore saved across 32.80 lakh complaints, and a dedicated Grievance Redressal Module for complaints specifically about account freezing and lien-marking had gone live only that April, the Ministry of Home Affairs told the Lok Sabha: 32.80 lakh complaints against 17.82 lakh ten months earlier, nearly double.
That dedicated channel for freeze-specific grievances had existed for barely five months by the time this draft was published. The gap shows how late RBI came to treating a mishandled freeze as its own category of complaint, rather than a side effect of fraud enforcement working as intended.
The honest objection
The strongest case against reading this draft as a gift to fraud networks is that the 60-day cap is not actually unconditional. RBI's own text ties the limit to the absence of a contrary instruction from an LEA or competent authority, meaning any police force or investigating agency that is actually working a case can extend the hold well past 60 days simply by saying so. And RBI has kept a full-account freeze available for exceptional circumstances, so a genuinely serious case is not capped by default either. On this reading, the clock only ever expires on the cases nobody bothered to actively pursue, and those were arguably not being productively frozen anyway.
That case holds only if investigating agencies reliably issue extension instructions before day 60, case by case, across every flagged account in a system already processing tens of lakhs of complaints. The Rajasthan High Court did not describe a system moving that briskly. It described 105 petitioners waiting for exactly that kind of individual attention and not getting it. A rule that depends on timely case-by-case intervention is only as fast as the enforcement capacity behind it, and weak enforcement capacity is exactly what the old, indefinite freezes were papering over.
The Signal
RBI has replaced a blank check with a countdown timer, and a countdown timer is a better instrument for a bank that has never met the customer than an indefinite hold ever was. But a countdown only protects the people it is designed for if someone is actually watching the clock on the other side, deciding case by case whether to stop it. The draft's own author missed a four-week court deadline by ten days and then gave itself 18 months before the rule even takes effect. Watch two things once the comment period closes on October 2: whether the final rule requires an LEA to affirmatively renew a hold, rather than merely allowing it to, and whether the accounts that use up their full 60 days belong more to confused customers or to networks that had simply learned to wait it out.
Reporting basis: the text of RBI's draft KYC (Amendment) Directions, 2026 and its accompanying press release are from RBI's own website. Mule-account, cyber-fraud-loss and CFCFRMS recovery figures are Ministry of Home Affairs replies to the Lok Sabha and Rajya Sabha, sourced directly from the ministry's site and, for the 2026 Lok Sabha reply, from the Sansad parliamentary records portal. The Supreme Court's four-week deadline and RBI's delayed, 18-months-out response are as reported by MediaNama; the Rajasthan High Court's ruling on the 105 petitions is as reported by LiveLaw; the last-resort framing of account-level holds is as reported by Business Standard; and the Rs 1,000 AI/ML trigger threshold is as reported by Free Press Journal. Each of those three outlets is cited once here for its respective fact. The characterisation of the complaint count as climbing from 17.82 lakh to 32.80 lakh is a plain reading of the two figures reported to the Rajya Sabha and the Lok Sabha.
