FUTRE CRAFT
On 11 September, the Reserve Bank of India put out a draft rulebook for something Indian banks have been doing for two years without one. It is called a temporary debit hold. Money can still come into your account. You cannot move any of it out.
The draft exists because the Supreme Court ordered it. On 4 August, a bench led by Chief Justice Surya Kant, hearing a suo motu matter on digital arrest scams, gave the RBI four weeks to write a standard operating procedure for accounts locked over cyber fraud. Thousands of people had lost access to their own savings for months with no notice and no timetable for getting it back.
The draft answers that. It also tells every commercial bank and urban cooperative bank in the country that it may place a hold on its own initiative, before a police officer or a magistrate is involved. The protection and the power arrived in the same document.
What the draft actually authorises
Read the definitions before the safeguards. A suspected money mule transaction is any transaction of ₹1,000 and above that a bank’s monitoring system flags, including AI and machine-learning tools, on either of two grounds. The payment looks disproportionate to the account holder’s declared profile, or it is linked to an account someone has already reported as a mule. Neither is a finding of fraud. The first is a mismatch between a payment and a form the customer filled in when the account was opened, possibly years ago. The second is association: someone upstream of you was flagged, so you are.
Once flagged, the bank places the hold immediately and notifies afterwards. The account holder gets twenty days to explain. The bank then has ten days to decide, or thirty if no explanation arrives. If it continues the hold, it refers the case to the jurisdictional police through the national cybercrime portal and waits another thirty days. If nothing comes back, the hold lifts on the thirty-first day. Sixty days is the ceiling, and it binds only when law enforcement does nothing.
The registry arrived first
Ten days before the draft, on 1 September, a separate RBI-backed system went live. The Digital Payments Intelligence Platform’s Smart Registry began operating with eight banks under a company called the Indian Digital Payments Intelligence Corporation. Its chief executive, K. Satyanarayana Raju, described the rollout at the Global Fintech Fest in Mumbai this week. Another twenty-five banks are expected within two months and the top fifteen payment aggregators by the end of January, at which point he estimates the registry will cover roughly eighty per cent of payment volume.
Raju was direct about the problem it solves. A bank could already block a mule account, but it could not stop the same person opening one elsewhere, because nothing was shared between institutions. The registry makes one bank’s suspicion legible to all the others. It is consulted at four points: account opening, changes to a customer profile, addition of a beneficiary, and rechecking of existing customers against the list.
Before it existed, the Indian Cyber Crime Coordination Centre’s own suspect registry had already shared details of 27.37 lakh first-layer mule accounts with participating banks, according to a Lok Sabha reply covering the position as of 31 January this year.A debit hold ends on the sixtieth day. The record of it stays in the bank’s files for five years, and enters a shared registry with no stated expiry at all.
The part the procedure does not cover
The draft requires the bank to keep a central record of every hold, with reasons and correspondence, for at least five years, or ten if the account is later closed. It also requires enhanced monitoring of the account holder’s other accounts at that bank.
What it does not say is what happens to any of this when the hold is lifted because the explanation was accepted. There is no deletion rule and no correction right. The draft does not mention the DPIP registry anywhere, so nothing obliges a bank to withdraw a cleared flag from it.
The sequence for a cleared customer runs like this. Sixty days of restricted access, resolved. Five years of retained record. An entry in a national registry that thirty-three banks and fifteen payment aggregators will consult the next time that person opens an account or is added as a beneficiary by somebody else.
At the same conference, RBI Deputy Governor Rohit Jain said an institution may outsource the computation but cannot outsource the consequence, and that a customer affected by a serious financial decision deserves better than being told the model said so. A shared registry is, structurally, a way of spreading consequence to institutions that did not do the computing.
Why the arithmetic lands differently here
Officials have said more than 8,000 mule accounts were identified and frozen in Jammu and Kashmir over three years, as reported by Greater Kashmir in February. The J&K Police have run public warnings throughout this year about the recruitment of students and first-time earners into account-renting schemes.
Set that beside the ₹1,000 threshold and the profile-mismatch test. A declared profile is thinnest for people whose income is seasonal or sent from abroad. A trader paid in a lump after the season, and a student receiving fees from a relative in the Gulf are the cases most likely to read as disproportionate to a form filled in years earlier.
The case on the other side
The fraud is not imaginary and speed matters. Money routed through layered accounts is gone in minutes. Until 30 June, the Home Ministry told Parliament in August, the cybercrime reporting system had logged more than 32.80 lakh financial fraud complaints and prevented the loss of ₹11,158 crore. A hold that waits for a warrant protects nobody.
The draft also narrows current practice. Banks must notify the customer and state reasons. The customer has a written right to explain. Account-level holds are meant to be a last resort. There is a named nodal officer and a thirty-day window for resolving complaints. None of that is guaranteed today. The gap is not in the hold. It is in the record, and a thirty-day complaint window running against a sixty-day freeze returns the money rather than clearing the file.
Bottom Line
Comments close on 2 October and the directions are proposed to take effect from 1 April 2027. The registry is already running. Whoever writes the final version has one open question worth answering: when a bank accepts your explanation and releases your account, what happens to the flag? Until that is written down, the freeze will be temporary in a way the suspicion is not.
(The Author studies Computer Science and Artificial Intelligence at Rutgers University, New Jersey, USA. He is interested in emerging technologies and innovation, and can be reached on LinkedIn at @arssh-kumar14)
