RBI Draft KYC Amendment Directions 2026: What Banks Need to Know About Money-Mule Accounts and Temporary Debit Holds

The Reserve Bank of India (RBI) has sought public feedback on a proposed adjustment to the operation of accounts and funds deemed potentially related to money mule activity and cyber-enabled financial fraud.

On 11 September 2026, RBI issued the Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 for consultation. The draft amendment relates to the Know Your Customer (KYC) Directions, 2025, which currently contain instructions relating to the operational aspects of banks' accounts and money mules.

The draft follows an order passed by the Supreme Court on 4 August 2026. The Court directed the central bank to set up and circulate a Standard Operating Procedure (SOP) which explains what measures banks should take in the event that a temporary debit hold is required to be placed on an amount or account associated with suspected money mule activity or cyber-enabled fraud.

However, it should be noted that the legal standing of the document is important for banks and other interested parties. This is a draft directive that is issued for consultation rather than an order that has been implemented.

RBI has invited comments from regulated entities and members of the public on or before 2 October 2026. Following the review of feedback, RBI will issue the final Directions separately.

RBI Draft KYC Amendment Directions 2026 at a Glance

This release by RBI makes the process clear but still does not announce a final date for implementation. 2 October 2026 is just the deadline for comments, not implementation.

What Are the Draft RBI KYC Amendment Directions, 2026?

These Directions will seek to solve the following specific problem in the banking sector: how to react where there is an assumption that a bank account or the balance therein might have been affected by mules and cyber-fraud.

Currently, RBI’s existing KYC guidelines have a section dealing with “Operations of Bank Accounts and Money Mules.” The 2026 Direction Proposal will try to modify these guidelines based on an SOP approach. 

That means this is not being presented as a completely new KYC law. Rather, RBI is proposing to modify an existing part of its KYC framework. The press release does not contain the entire operational procedure. For example, it does not state:

• exactly when a debit hold can be placed, 
• how long it can continue, 
• whether only a disputed amount or the whole account may be affected, 
• who within the bank has to approve the action, 
• what documents must be recorded, 
• how the customer must be informed, 
• when the hold must be reviewed, or 
• how it may be released. 

Those details cannot safely be filled in from assumptions.

Why Has RBI Proposed the KYC Amendment?

"The immediate explanation from the RBI is the order from the Supreme Court regarding the need for a standard procedure for temporary debit blocks."

Existing Instructions Already Deal With Money-Mule Activity

The RBI has particularly cited current KYC instructions related to the use of bank accounts and money mules.

So the issue is not about whether or not the RBI has ever taken care of mule accounts. It has done so. The current consultation is on revising that particular regulatory area and making connections between them and temporary debit blocks."

Supreme Court Order Dated 4 August 2026

As per RBI, it was directed by the Hon'ble Supreme Court to implement and disseminate the SOP regarding the action to be taken by banks in the event of temporary holds on the amount/ account linked to money laundering and frauds via cybernetics.

As for the RBI statement attached, it does not contain the entire order passed by the Court. Therefore, the reasoning behind the Court's verdict should not be interpreted based on the single-page RBI statement.

Why an SOP Could Matter

An SOP is meant to provide a uniform way of addressing a certain situation for operational teams. In the case of banking, an SOP might facilitate understanding of:

• the circumstances when a particular issue should be escalated,
• who should be involved in the process,
• any internal review processes that should take place,
• how decisions would be recorded, and 
• how similarly-situated cases should be addressed.

It is a purely practical comment on the relevance of an SOP. The exact RBI process will depend on the actual regulations.

What Is a Money-Mule Account?

While the press release of the RBI uses the concept of money-mule activity, the definition of a money-mule account has not been defined.

In layman’s terms, the concept normally implies the use of a bank account for the purposes of receiving, transferring, or transmitting money that has anything to do with suspicious activity.

The individual who uses their bank account for such activities normally does not perform the same task each time. This is one of the reasons why banks have to conduct an assessment before considering something as fraudulent.

For this article, that general explanation should not be read as the exact statutory or RBI definition. The attached press release itself does not provide one.

What Is a Temporary Debit Hold?

A temporary debit hold can be understood, at a basic level, as a restriction on debits from an amount or account for a limited period while the suspected fraud-linked activity is dealt with.

The concept differs from that of detecting suspicious transactions, as it involves placing a hold on the transactions, affecting the customers' ability to conduct their transactions.

According to the press release by the Reserve Bank of India, it is clear that the proposed SOP relates to debit holds on amounts/accounts for money mules and cyber-fraud. However, there are some things that the RBI press release doesn't reveal.

From the press release, we cannot find any mention of:

• the holding time limit,
• monetary value limit,
• possibility of restricting the full amount,
• investigation period,
• approving authority,
• notice period,
• limit for releasing the funds, or
• customer recourse process.

Until all this information becomes available from an official source, it should not be considered a requirement by RBI.

How Does the Proposed SOP Fit Into RBI's Existing KYC Framework?

The regulatory structure can be better explained with the help of four tiers.

This is important for the compliance division of the bank since the regulations need to be read in conjunction with the existing KYC regulations. They cannot be looked at as a separate regulation for cyber fraud.

Which Banks Are Covered by the Draft Consultation?

According to RBI, the following kinds of banks are covered under the consolidated draft consultation.

The consultation applies to the Commercial Banks that include the following:

• Small Finance Banks, 
• Payments Banks, 
• Regional Rural Banks, and 
• Local Area Banks. 

Also covered are the Urban Cooperative Banks. 

Applicability Matrix

The last two rows are important. The press release should not be stretched to cover every financial-sector business simply because cyber fraud is involved.

What Exactly Has RBI Proposed to Change?

The one-page press release gives us the direction of the proposed change, but not every clause of the amendment.

This is the safest way to describe the change from the available source.

An in-depth “old versus new clause” comparison will need the full text of the draft amendment.

What May Change in the Handling of Suspected Money-Mule Accounts?

If the Directions adopt the approach outlined above, it may be necessary to examine whether the bank’s process of handling such accounts needs to be changed.

1. Detection of Suspicious Activity

Fraud detection and KYC units might need to take into consideration how suspicious activity in the account could be detected.

The problem here is that not only can a fraudulent transaction be recognized, but a suspicious transaction by a genuine customer might also be legitimate.

2. Internal Escalation

A case that is suspected of being fraudulent may need to escalate rapidly from monitoring functions to fraud, compliance, legal, and other areas.

Otherwise, either action will be postponed or inconsistent.

3. Debit Restrictions

If the proposed framework allows the imposition of a debit block temporarily, then banks may require well-defined controls on when to impose it and how to document the decision.

4. Customer Handling

Account blocks are not just an anti-fraud control measure. They are also going to be a customer service issue in no time.

Customers may wish to find out:

• the reason why their money is not available, 
• the disputed transaction, 
• how much information they have to give, 
• to whom they should speak, and 
• the timeline of the review.

The above details will depend on the final RBI framework.

What Could the Draft Mean for KYC and AML Teams?

The KYC (Know Your Customer) and Anti-Money Laundering departments would most certainly be amongst those which will have to read the final Directions carefully. They might have to check if there is any change required in the following areas:

•    account-monitoring practices, 
•    suspicious-activity escalation, 
•    customer-risk assessment, 
•    policy wording, 
•    record-keeping, and 
•    internal reporting. 

That does not mean every one of these items has already been mandated by the current press release. They are areas that banks may reasonably need to review once the final framework is available.

What Could It Mean for Fraud-Risk and Cybersecurity Teams?

The draft explicitly mentions cyber-based financial fraud; hence, the fraud risk teams are expected to play an important operational role in this regard. They might be required to determine whether the current systems are capable of gathering information on:

• disputed transfers, 
• suspicious account behaviour, 
• linked transactions, 
• fraud alerts, and 
• information received from other internal functions. 

Cybersecurity teams may also become involved where the underlying incident involves compromised credentials, phishing, unauthorised access or another cyber-enabled event.

The RBI Directions will determine which of the above become specific compliance obligations.

What Could It Mean for Legal and Compliance Teams?

Legal and compliance teams have a different task: they need to separate what is legally required from what is merely an internal fraud-control practice.

This becomes crucial when dealing with the restriction of an account. Internal teams should be careful about considering all of the following as the same thing:

• a fraud alert, 
• a KYC issue,
• the suspicion of a money mule, 
• a temporary debit hold, 
• an account freeze, and 
• a court or statutory restriction. 

Different actions may arise from different legal or regulatory grounds.

The current press release does not collapse these categories into one.

Temporary Debit Hold and Account Freeze: Are They the Same?

The RBI press release uses the term temporary debit hold. It should not automatically be replaced with the broader expression “account freeze.”

Usage of the two terms can differ based on the type of legal document that uses them, the extent of the limitation, and the jurisdiction under which the measure is being enacted.

Since this information does not explain the difference between the two terms, it would not be wise to make a definitive legal comparison.

For banks, the practical lesson is simple: use the terminology contained in the applicable RBI Directions, SOP, or legal instruction instead of treating similar-sounding terms as interchangeable.

What Could the Proposal Mean for Bank Customers?

For customers, the biggest concern is access to funds.

Where a debit hold is applied, the customer may be unable to move the affected money until the matter is dealt with according to the applicable process.

This can actually make a difference because a genuine customer might require the money to fulfill such obligations as:

• salaries, 
• purchases, 
• payments, 
• loans, 
• personal expenses, or 
• other immediate requirements.

On the other hand, a bank that suspects an occurrence of fraud will have to move fast so as not to lose the funds.

This dilemma of acting promptly and properly will definitely prove to be one of the key practical problems within any resulting framework.

Customer Protection and Fraud Prevention: Where Is the Balance?

This type of framework needs to cover both aspects of this issue.

From the Fraud-Control Side

The imposition of an account block can assist because it:

• reduces the flow of money from fraudulent transactions,
• enables banks to scrutinize the transaction more efficiently,
• promotes greater uniformity in responses, and
• facilitates faster resolution of cyber fraud.  

From the Customer Side

• Banks should also protect their customers from:
• mistakenly having their accounts blocked,
• prolonged restrictions without any review,
• lack of communication,
• inconsistent decisions and
• unnecessary hardship for legitimate customers.

The enclosed press release does not list the safeguards that would be employed. That would have to be verified later in the final Directions.

How Could Different Bank Functions Be Affected?

The proposal is not simply an issue for the KYC team. These figures represent operational implications rather than RBI’s obligations.

Who Can Submit Comments on the RBI Draft?

RBI has widened the consultation process to include non-regulated banks as well. Comments or feedback may be submitted by:

• regulated entities, 
• other stakeholders, and 
• members of the public. 

That gives banks, industry bodies and other interested persons an opportunity to point out practical issues before the text is finalised.

Consultation responses might concentrate on issues like:

• Is the suggested procedure workable?
• Do the terms have to be clarified?
• Are there clearly delineated roles?
• Is the protection of customers workable?

Will there be major changes to the system for implementation?

How Can Feedback Be Submitted to RBI?

RBI has provided two ways.

Through Connect 2 Regulate

Feedback may be sent using Connect 2 Regulate on the RBI website.

Through Email

RBI has also made provision for feedback to be sent by email under the subject line:

“Feedback on Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026”.

The release that is attached mentions the procedure and subject line for sending feedback. Please do not use the unverified email ID for sending feedback to RBI.

October 2, 2026: The Date Banks Should Track

The consultation closes on or before 2 October 2026. 

Regulatory Timeline

The latter two rows are of particular significance from a compliance point of view. There is nothing in the above press release to suggest that 2 October marks the beginning of a new debit-holding policy.

Draft Directions and Final Directions Are Not the Same Thing

The banks should prepare for change in regulation without confusing a work in progress as being set in stone.

The process is very straightforward as follows:

• RBI releases the draft. The draft policy is made available for review. 
• Comments are provided. The banks and other stakeholders raise issues relating to legal, technical, and operational matters. 
• RBI reviews the comments. The regulator reserves the right to retain, revise, modify, or even discard sections of the draft. 
• The final directions are released. This is the document that the banks have to review to see what their obligations are. 

It is clearly stated by the RBI that the final directions will be issued separately.

What Happens After the Consultation Ends?

Next comes the review of feedback by the RBI.

Then, the RBI will finalize its Directions for the regulated entities under consultation.

There are certain things, however, which have not been revealed in the press release:

• When will the Directions come out?
• What will be their effective date?
• Will there be a phase-wise implementation?
• Will there be a transition period provided to banks?
• How many banks will be treated differently from other banks? And so forth.

This situation will remain like this until such clarifications from the Reserve Bank of India are provided.

What Should Banks Review Now?

The fact that this proposal is not yet final does not imply that banks should pay no attention to it.

Internal assessment during the period of consultations is helpful indeed.

Existing KYC Policies

Banks may evaluate if their policies contain procedures to handle misuse of accounts, suspicion of money mules, and fraud escalations.

Fraud-Monitoring Process

The teams may review the process through which fraud alerts get escalated to action. Things to be reviewed include:

• Who receives the initial alert,
• How the case gets escalated,
• Which teams get involved,
• What documentation is kept, and
• How priority cases are handled.

Internal SOPs

The existing SOPs can be compared to the topic of the RBI proposal. It is not necessary to rewrite everything before the finalization of the Directions, but identifying potential gaps now would save time later.

Decision-Making Authority

The banks can check which individuals currently have the power to give approvals on matters that may affect customer transactions.

The press statement by the RBI does not outline a new approval process, and therefore, no new power structure is implied by the press statement.

Customer Communication

Banks can examine how customers are currently informed when transactions or account access are restricted for fraud-related reasons.

Clear internal ownership may help prevent customers from being passed repeatedly between teams.

Audit Trail

A decision affecting a customer's money should be capable of later review. Banks may therefore want to assess whether existing records show:

• what triggered the case, 
• what information was considered, 
• who reviewed it, 
• what action was taken, and 
• when the decision was reconsidered. 

These are sensible preparatory checks. They are not being presented as final RBI-mandated record formats.

Operational Challenges Banks May Need to Manage

Distinguishing Fraud From Unusual but Genuine Activity

Not all odd payments are frauds. A huge payment to the bank account can take place due to a property deal, business payments, insurance payments, or any other genuine reason.

Hence, banks must have some controls that will be able to assess the risk without considering all odd transactions as evidence of fraud.

Speed Versus Accuracy

Fraud response often needs to be fast.

But a rushed decision can create a different problem if legitimate funds are restricted without a sufficient basis.

The final framework will need to be read carefully to understand how RBI expects banks to manage this balance.

Multiple Teams Handling One Case

A cyber-fraud case can move through:

• the branch, 
• fraud-control team, 
• AML team, 
• KYC team, 
• cybersecurity, 
• operations, 
• legal, 
• compliance, and 
• customer support. 

Weak coordination can lead to delays or inconsistent handling.

False Positives

Indeed, a customer can be flagged by the anti-fraud system. Therefore, banks must have a good review process in place in order to prevent automatic restrictions from occurring.

Customer Communication

Account restrictions are stressful for customers, particularly when they do not understand why they cannot access funds.

Banks may need clear internal communication routes, though the exact customer-notice requirements cannot be taken from the press release alone.

Could a Standardised Debit-Hold Framework Help Banks?

Potentially, yes.

The use of a standard framework can simplify the management of fraud response decisions. Advantages that could potentially arise include:

• Consistency of approach: Similar types of cases could be processed using a common approach instead of individual approaches by branches. 
• Response time: They may know the departments that need to act once a certain threshold has been reached.
• Coordinated actions: The fraud team, KYC team, legal team, and operations team could collaborate on the basis of a single set of SOPs.
• Internal responsibility: Internal responsibility could be easy to assign and monitor. 
• Documenting decisions: The process for making decisions may be documented properly. 
• Controlling fraud more quickly: Once a certain level is achieved in the final framework, suspicious funds could be restrained before transferring further.

These are possible benefits. The actual outcome will depend on the final design and implementation of the Directions.

What Could Increase the Compliance Burden?

A new operational process can require time, people, and technology. Depending on the final Directions, banks may have to review:

1. Technology

Changes may be required in systems to accommodate fraud warning capabilities, account-level restrictions, or internal processes.

2. Monitoring

Transaction monitoring guidelines may need adjustment to conform to the chosen regulatory approach.

3. Training

Branch personnel, fraud personnel, operations personnel, and customer service personnel may need training.

4. Documentation

There might be a need for revision of regulations, SOPs, escalation matrices, and internal documentation.

5. Customer Service

More account activity might mean more customer complaints and queries.

6. Audit and Monitoring

An internal audit or compliance monitoring exercise may need to verify whether the process is being adhered to properly.

RBI has not stated any implementation cost in the attached release. Therefore, no rupee estimate should be attached to these possible changes.

Is the RBI Proposal the Right Step or an Additional Burden?

Neither cancels out the other.

A procedure can serve the purpose where rapid action must be taken against the proceeds of cyber fraud. The banks cannot keep reinventing the wheel each time an account is identified as potentially being used by a mule.

On the other hand, limitations on bank accounts are imposed on real customers and real firms. An overly wide, vague, or lengthy procedure may have its own drawbacks. 

Potential Regulatory Value

The recommendation could assist with:

• quick response to possible cyber fraud, 
• increased consistency across banks, 
• responsibility inside banks, 
• cooperation, and 
• proper treatment of possible mule accounts.

Possible Burden on Banks

Banks might encounter:

• developing systems, 
• training of employees,
• more workload in regard to fraud reviews, 
• customer complaints, 
• wrongful detections, 
• documentations, and 
• increased compliance monitoring.

Therefore, the concluding evaluation will have to take into account the real Directions, especially regarding RBI’s approach to triggers, scope, protections, reviews, and releases of debits.

What Are the Risks of Treating the Draft as Final Law?

Consultation is another piece of regulatory content that is one of the most vulnerable to misinterpretations. Banks should refrain from:

• informing their customers that the draft has legal force, 
• introducing a new deadline without being informed about such plans on the part of the RBI, 
• expecting that the draft will remain unchanged until the adoption of the final version, 
• imposing prohibitions that have no legal basis, 
• taking the date of the end of consultation as the date when the document becomes legally effective, and 
• talking about requirements as obligatory ones. 

Instead, it is advisable to examine the draft, determine the issues that can arise for the operations of banks, and submit comments if needed.

What Could This Mean for Businesses Outside the Banking Sector?

The consultation is directed at specified banks, but ordinary businesses can still be affected indirectly.

Businesses Maintaining Bank Accounts

If any firm is queried regarding suspected fraud in cases of transactions involving disputes in relation to money deposited in the company’s bank account, then proper accounting books will serve their purpose.

Where there are proper accounting books, firms need to maintain books for:

• customer payments,
• supplier invoices,
• contracts,
• credits,
• inter-firm transfers, and
• unusual credits.

This is just proper finance management and not something new that RBI has recently communicated in its press release.

Fintechs and Digital Payment Companies

There is no mention of Fintechs as specific coverage in the press release. However, companies dealing with covered banks may face future changes in partner bank procedures in case the ultimate Directions demand some different fraud management procedures.

Corporate Finance Teams

Finance teams may want to pay particular attention to unexplained credits, unusual counterparties and requests to receive or transfer money on behalf of third parties.

Again, these are practical fraud-risk measures rather than new duties expressly imposed by this draft announcement.

What Should Banks Do Next?

Practical action at this stage would include:

The bottom line is that you do not want to begin the process until you know what is required.

How Can Corpseed Help?

Where the bank is concerned, a short regulatory announcement may become quite an involved compliance activity. The announcement may be only a few pages, but compliance staff will need to determine what policy, department, system, or process could be impacted.

Corpseed can support organisations through relevant banking regulatory compliance services and regulatory review.

1.    RBI Regulatory Applicability Assessment

Corpseed can assist in examining whether a particular RBI direction, amendment, or compliance requirement applies to the organisation's regulated activity.

The review can cover:

• type of regulated entity, 
• applicable RBI framework, 
• business activity, 
• existing licences or registrations, and 
• regulatory scope. 

2. KYC Compliance Consulting

With KYC compliance consulting, organizations have the opportunity to assess if their existing KYC policy and internal controls comply with the RBI regulations.

This could be done by analyzing: 

• KYC policy framework,
• customer risk controls,
• internal controls,
• monitoring of accounts, and 
• documentation. 

3. AML Compliance Services

If AML regulations apply, Corpseed can help your organization assess the existing compliance controls and documentation. The focus should remain on requirements that are actually applicable to the entity rather than on using a generic AML checklist.

4. Compliance Gap Assessment

Gap analysis is useful in determining the gap between current internal procedures and regulatory standards.

In case of regulatory changes like:

• The RBI proposal,
• Existing policies, 
• Internal SOPs, 
• Processes,
• Control ownership,
• Documentation, and 
• Reporting.

5. Review of Internal Policies and SOPs

After RBI issues the Direction, there may be a requirement to review the internal policies and SOPs in light of the new regulatory requirements.

Corpseed can assist in reviewing and restructuring the compliance documentation according to the final regulatory requirements.

6. Regulatory Change Management

A new Direction can affect more than the compliance team. Corpseed can assist organisations in mapping a regulatory change across:

• compliance, 
• operations, 
• legal, 
• technology, 
• customer service, 
• risk, and 
• internal audit. 

It may assist companies in realizing where internal actions have to be taken.

7. Continuous Compliance Assistance

Financial laws keep evolving due to amendments, circulars, clarifications, and directions.

The continuous compliance assistance provided by Corpseed's regulatory compliance consulting will be useful for tracking any changes in laws, assessing the applicability of these laws, and evaluating their impact on the documents already in place.

The idea is not to consider each RBI directive as a mandatory requirement. The idea is to find out what really matters, what remains under proposal, and what needs action upon finalization of the rule.

Key Takeaways

The RBI's notification dated 11 September 2026 commences a consultation on modifications being proposed to the KYC guidelines in relation to money mules and financial fraud.

• This modification is in reference to existing KYC guidelines mentioned in the KYC Directions, 2025.
• RBI refers to an order of the Supreme Court dated 4 August 2026.
• This SOP pertains to temporary debit holds on the amount or account involved in money mules and cyber fraud. 
• Commercial Banks, including Small Finance Banks, Payments Banks, Regional Rural Banks and Local Area Banks, are covered. 
• Urban Cooperative Banks are also covered. 
• Feedback can be submitted until 2 October 2026. 
• The deadline pertains only to the consultations, not its enforcement.
• The directions that follow will be released separately, after RBI considers the comments it receives.

For the banks, the important step now is to go through the draft proposal, raise any issues, and implement the final RBI Directions.