08 - 10 - 2026

RBI’s Draft KYC Directions 2026 position banks as the cyber-crime’s first line of defence

The Reserve Bank of India’s Draft Know Your Customer (Amendment) Directions, 2026 point to a significant structural and strategic shift in the role of banks.

Banks are no longer being treated only as payment intermediaries or being responsible for complying with anti-money-laundering rules. They are increasingly being assigned frontline responsibilities in the state’s response to cyber-enabled financial fraud.

The draft was not issued in isolation. It follows a Supreme Court order dated August 4, 2026, directing the Reserve Bank to prescribe an SOP for banks placing temporary debit holds on amounts or accounts linked to money-mule activity.

The draft, issued under Section 35A of the Banking Regulation Act, 1949, connects three systems: bank transaction-monitoring, RBI-mandated temporary debit holds, and the National Cybercrime Reporting Portal’s Citizen Financial Cyber Fraud Reporting and Management System (NCRP-CFCFRMS).

Let us understand the proposed process which first begins inside the bank. The framework applies to a “Suspected Money Mule Transaction” — defined as a transaction of ₹1,000 or more – flagged by the bank’s monitoring systems including AI/ML-based tools. In general, it is seen as an unusual or disproportionate activity to a customer’s declared profile or it is linked to an account – already reported as fraudulent or as a money-mule account.

The draft defines a money-mule account as one used “knowingly or unknowingly” to receive, layer or transfer fraud proceeds. Once a suspected transaction or account is flagged, the bank must place a temporary debit hold immediately and suo motu.

In cases where the account itself is assessed as a suspected money-mule account, an account-level hold may be imposed.

The draft requires account-level holds to be used only as a last resort and in exceptional circumstances. The bank must notify the customer at once, or by the end of the next day, stating reasons and providing a nodal officer’s contact details.

The customer then has 20 days to explain the transaction. If an explanation is received, the bank has 10 days to decide; if none is received, the bank must still decide within 30 days of the original hold.

It can then lift the hold, or continue it and refer the case to the jurisdictional police via National Cybercrime Reporting Portal’s Citizen Financial Cyber Fraud Reporting and Management System (NCRP-CFCFRMS).

This is where the SOP’s most important safeguard sits. Once a case is referred to police, the bank has a further 30 days to receive a formal instruction.

If none arrives, the hold must be lifted automatically on the 31st day. Absent any law-enforcement direction, the total hold cannot exceed 60 days. Only a specific, statutorily backed instruction from an LEA or competent authority can extend it further.

This is where the “cyber-policing infrastructure” angle comes in. Banks are not becoming police agencies in the formal sense but they are taking on the task of detection, disruption, customer questioning, record preservation and referral – functions that sit adjacent to law enforcement.

The draft sharpens the incentive: if an account is later established as a money mule and the bank had not filed a Suspicious Transaction Report, the bank itself is deemed non-compliant. That clause alone will push banks toward more aggressive flagging, not less.

The NCRP-CFCFRMS channel runs alongside existing obligations. Banks must also maintain a centralised MIS — recording the hold, communications, police references, and outcomes — retained for five years, or ten after account closure, and open to supervisory review.

The draft requires complaints to be acknowledged and resolved within 30 days by designated nodal officers.

Here however this SOP does not itself establish an independent appeal process or compensation mechanism for customers whose accounts are wrongly restricted. That gap may become important where automated or risk-based detection produces false positives.

Banks will remain private institutions. But their monitoring systems and operational judgment calls are becoming load-bearing parts of India’s public response to cybercrime — with limited independent check on the calls they get wrong.

By Sreevalsan M

If you spotted a mistake or have feedback on this story, write to us at editor@newsassociate.com. Email us your press releases on the same ID.