The RBI money mule SOP is a draft amendment, released on 11 September 2026, that inserts a Standard Operating Procedure on suspected money mule accounts into the RBI (Know Your Customer) Directions, 2025. It lets banks place a temporary debit hold on suspected mule transactions of Rs 1,000 and above, for up to 60 days, from 1 April 2027.
Banks handling suspected mule accounts have faced two pressures: freeze too little and fraud proceeds vanish in minutes; freeze too much and genuine customers lose access with no clear timeline. The draft codifies the middle ground.
RBI’s press release links the proposal to a Supreme Court order dated 4 August 2026. Comments close on 2 October 2026. This article covers what the draft says, what changes for banks and their partners, and what to build before 1 April 2027.
What the draft RBI money mule SOP says
The Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 add an Annex titled “Standard Operating Procedure on Suspected Money Mule Accounts to Prevent Cyber-enabled Financial Frauds”. Three definitions anchor it:
- Money mule account: an account used, knowingly or unknowingly, to receive, layer or transfer proceeds of cyber-enabled financial fraud on behalf of another person.
- Suspected money mule transaction: a transaction of Rs 1,000 and above, flagged by the bank’s transaction-monitoring systems (including AI/ML-based tools) as suspected proceeds of mule activity or cyber-enabled fraud.
- Temporary debit hold: a temporary restriction on debits on the suspected amount(s) or on the account, pending verification.
Who it applies to
The draft covers commercial banks (including small finance banks, payments banks, regional rural banks and local area banks) and urban co-operative banks. It does not apply to nodal, pool, escrow or other special-purpose accounts such as dividend or share capital accounts. RBI says final Directions will be issued separately for each type of regulated entity.
The draft mandates the SOP from 1 April 2027, or earlier if a bank chooses to implement it sooner. Existing obligations to file suspicious transaction reports (STRs) with FIU-IND continue unchanged.
The temporary debit hold timeline, step by step
| Step | Action | Timeline in the draft |
|---|---|---|
| 1 | Place temporary debit hold on flagging | Immediately on identification |
| 2 | Notify account holder of the hold, reasons, removal process and officer contact | Immediately if digital; by end of next business day if physical |
| 3 | Account holder submits explanation | Within 20 days |
| 4 | Bank decides and informs the account holder | Within 10 days of the explanation, or within 30 days of the hold if no explanation |
| 5 | If suspicion persists, continue hold and report to the jurisdictional police via NCRP-CFCFRMS | On decision |
| 6 | Remove hold if no LEA instruction is received | On the 31st day from the date of reference to the LEA |
The maximum duration, absent a contrary instruction from a law enforcement agency or competent authority, is 60 days from the date of the hold: up to 30 days for Steps 3 and 4, plus up to 30 days for Steps 5 and 6. If the bank is satisfied by the explanation, it must lift the hold immediately.
One limitation flagged in coverage by MediaNama: the 60-day cap governs bank-initiated holds. Holds placed on a specific LEA instruction sit outside this procedure.
What changes for banks
- Holds become proportionate by design. The definition allows a hold on suspected amounts, not only on the whole account.
- Customer notice is mandatory and fast, with reasons and a named contact.
- Decisions run on a clock. A bank that misses its decision window has no clear basis to keep the hold.
- Escalation is standardised through NCRP-CFCFRMS rather than ad hoc letters to police stations.
- Governance is explicit. Banks must keep a centralised MIS recording, among other things, the hold date, reasons, and correspondence, retained for at least five years from the hold (ten years if the account is closed). They must designate Nodal Officers and resolve complaints arising under the SOP within 30 days.
At a Rs 1,000 threshold, alert volumes will be material and batch review of mule alerts will not keep pace.
What it implies for NBFCs, PAs and fintech partners
The draft text applies to banks. Its effects travel further, and the points below are our reading rather than RBI language:
- Disbursals and payouts land in bank accounts. An NBFC disbursing to, or a payment aggregator settling with, an account that is later held may face reconciliation breaks and customer complaints.
- Partnership banks will push requirements down. Banks sponsoring fintech programmes are likely to ask partners for stronger onboarding evidence and faster responses to fraud queries.
- Separate Directions may follow. RBI has said final Directions will be issued per type of regulated entity, so other REs should watch for their version.
The operational build: monitoring, notices, timers, and audit
Compliance with the SOP is mostly an engineering and operations problem.
Monitoring and triage
Monitoring must score incoming credits before funds move on, using rules and models tuned for mule patterns: rapid in-out flows, many small credits from unrelated senders, sudden activity on dormant accounts.
Notice workflow
Notices need templated reasons, the removal process, officer contact details, and delivery proof, with customer explanations captured against the case.
Timers and case management
Each hold needs clocks for the 20-day explanation window, the 10-day or 30-day decision window, the LEA referral date and the 60-day ceiling, with alerts before each deadline.
Audit trail
Every step must land in the centralised MIS with timestamps so audit, inspection or a court can reconstruct it.
Why prevention at onboarding matters
The SOP manages mule accounts after money has arrived, and every hold costs analyst time, customer friction and LEA coordination. The cheaper intervention is not opening the account at all, or opening it with evidence strong enough to support later action.
Mule accounts are frequently opened with genuine but rented identities, borrowed bank accounts, or identity documents used by someone other than the holder. Three onboarding checks address these directly:
- Bank account verification with name match, confirming the account exists and belongs to the person being onboarded.
- Face match against the identity document, confirming the applicant is the document holder.
- Liveness detection, confirming a live person is present rather than a photo or replay.
Where BeFiSc fits: IDProof is BeFiSc’s identity and KYC suite, covering PAN, Aadhaar routes, DigiLocker, bank account verification, name match, face match, and liveness. Used together at onboarding, these checks make it harder to open an account with a rented or borrowed identity. Book a demo of the IDProof onboarding flow to see the checks on your own journeys.
What to do before 1 April 2027
- Submit comments if your institution has views; the window closes on 2 October 2026.
- Map current hold practice against the draft’s steps, timelines and notice contents.
- Size alert volumes at the Rs 1,000 threshold using historical data.
- Build or extend case management with timers, notice templates, and NCRP-CFCFRMS reporting.
- Set up the MIS and retention to the draft’s five-year and ten-year rules.
- Designate Nodal Officers and update grievance handling for the 30-day resolution timeline.
- Strengthen onboarding controls so fewer mule accounts reach the monitoring stage.
- Track the final Directions, which may change details, and the versions for other regulated entities.
You can also review IDProof capabilities as part of the onboarding workstream.
Key Takeaways
- The RBI money mule SOP is a draft amendment to the KYC Directions, 2025, released on 11 September 2026, with comments due by 2 October 2026.
- It allows temporary debit holds on suspected mule transactions of Rs 1,000 and above, capped at 60 days absent LEA instruction.
- Customers get 20 days to explain; banks decide within 10 days of the explanation or 30 days if none arrives.
- The SOP becomes mandatory for banks from 1 April 2027; STR obligations to FIU-IND are unchanged.
- Stronger onboarding checks reduce the number of mule accounts that need holds at all.
Frequently Asked Questions
What can a customer do if their account is put on hold?
Under the draft, the customer receives a notice with reasons and an officer’s contact, and has 20 days to submit an explanation with documents. If the bank is satisfied, it must lift the hold immediately. Complaints are handled by designated Nodal Officers, with a 30-day resolution timeline.
Does the SOP apply to NBFCs and payment aggregators?
The draft covers commercial banks, including small finance banks, payments banks, RRBs and local area banks, and urban co-operative banks. RBI has said final Directions will be issued separately for each type of regulated entity. NBFCs and PAs should still expect indirect effects through bank partners and settlement accounts.
When does the RBI money mule SOP come into effect?
The draft says the Directions take effect from 1 April 2027, or earlier if a bank decides to implement the SOP sooner. Since this is a draft open for comments until 2 October 2026, the final text and dates should be confirmed once RBI issues the final Directions.
What is a temporary debit hold under the RBI draft?
It is a temporary restriction placed by a bank on debits, either on suspected amounts or on the whole account, while it verifies suspected money mule activity. The hold must be notified to the customer with reasons, and under the draft, it cannot exceed 60 days without an instruction from a law enforcement agency or competent authority.
Conclusion
The draft SOP gives banks a clearer legal footing to stop fraud proceeds quickly, and gives customers a defined process and timeline in return. The cost of that balance is operational: low thresholds, short clocks and full audit trails.
Institutions that treat 1 April 2027 purely as a monitoring deadline will carry the full volume of holds. Those that also tighten onboarding will have fewer mule accounts to hold, a more durable way to meet the rule’s intent.
