Mule accounts: the RBI wants suspect money held before it moves

On 11 September 2026 the Reserve Bank of India published draft amendments to its Know Your Customer Directions that would give banks a single procedure for placing temporary debit holds on money linked to mule accounts and cyber-enabled fraud. The draft follows a Supreme Court order of 4 August 2026 directing the RBI to adopt such a procedure. Comments closed on 2 October, and the draft would apply from 1 April 2027.

The draft is specific. A transaction of ₹1,000 or more that a bank's monitoring flags as suspected mule activity can be held. The account holder must be told the reason, how to have the hold removed and whom to contact, and then has 20 days to explain. Unless a law-enforcement agency or competent authority directs otherwise, no hold may run beyond 60 days. A hold on a whole account is reserved as a last resort for exceptional circumstances. If an account is established as a mule but the bank never filed a suspicious transaction report with FIU-IND, the draft treats the bank as non-compliant.

Prevention is already producing results. The Department of Telecommunications says its Financial Fraud Risk Indicator, which rates mobile numbers as medium, high or very high risk, had helped prevent suspected cyber-fraud losses of ₹5,043.73 crore by August 2026, up from ₹139.16 crore a year earlier. An RBI advisory of 30 June 2025 directed commercial, small finance, payments and co-operative banks to integrate it. In May 2026 the Indian Cyber Crime Coordination Centre and the Reserve Bank Innovation Hub agreed to feed identifiers from I4C's Suspect Registry into AI models such as MuleHunter.ai.

The decision moves inside the bank

Under the draft, the bank's monitoring raises the flag, the bank's officer explains the hold and the bank's file has to justify it when the customer objects. The quality of the evidence behind each hold becomes part of the control. Banks preparing for April 2027 will need:

• A written description of the activity their systems treat as out of line with a customer's profile, and proof that it is applied the same way across branches and channels.
• A case file for every hold: the alert, the analyst's review, the notice sent, the customer's reply and the decision, kept for at least five years, or ten from account closure.
• Nodal officers named on the website and in branches, and a complaints process that closes within 30 days.
• A firm link between holds and STR filing, so that a confirmed mule never sits on the books without a report.

A hold protects a victim only if the bank can show why it was placed. The evidence behind each decision is now part of the control.

Why companies outside banking should care

Mule accounts are often opened or rented in the names of real people who are paid, pressured or deceived into lending them. Businesses meet the problem when their own salary, vendor or collection accounts are misused, or when a payment to a supplier is paused because the supplier's account has been flagged. DoT now shares its risk ratings with banks, payment service providers, insurers and securities intermediaries, so more payments will be checked at the moment they are made. Treasury and procurement teams should know whom to call when that happens, and should be able to show quickly that a counterparty is genuine.

Questions for the board

• How many alerts do our monitoring systems raise each month, and how many end in an STR?
• For any hold we place, can we show why the activity was out of line for that customer?
• Who approves a whole-account hold, and how will we show it was a last resort?
• Are our own salary, vendor and dealer accounts screened for signs of mule use?