Following a Supreme Court directive, the RBI has introduced draft regulations to combat cyber-fraud by implementing temporary debit holds on suspicious transactions. Starting April 1, 2027, this framework shifts focus from blanket account freezes to targeted, time-bound restrictions for transactions over ₹1,000. Banks will now face increased compliance and operational costs to upgrade their monitoring systems.
The Reserve Bank of India has taken a major step toward tightening banking security in response to a Supreme Court directive issued on August 4, 2026. The central bank released draft 'Know Your Customer' Amendment Directions on September 11, 2026, aimed at dismantling the network of 'money-mule' accounts that are frequently exploited by cyber-fraudsters to launder money.
Under the proposed framework, banks will move away from the practice of freezing an entire bank account when suspicious activity is detected. Instead, the new rules mandate a temporary debit hold on specific transactions of ₹1,000 or more. This restriction can remain in place for up to 60 days, providing law enforcement and banking internal security teams time to investigate without completely blocking the customer's access to their remaining funds.
The new system relies on a structured timeline to balance security with customer rights. Once a transaction is flagged, the customer will have 20 days to provide a justification for the activity. Banks, in turn, are required to review these submissions within 10 days. This shift is designed to prevent the blanket disruption of legitimate accounts while ensuring that the infrastructure used by criminals is swiftly neutralized.
For the banking sector, this regulatory change brings significant operational implications. Banks are now required to integrate advanced AI and machine learning tools into their transaction-monitoring systems to identify suspicious patterns in real-time. This mandate will lead to higher compliance costs as financial institutions update their digital architecture to meet the new security standards. While these investments are necessary to curb the rising tide of cyber-fraud, they will likely impact the operating expenses of banks in the coming quarters.
There are also potential risks for both banks and customers. Stricter monitoring systems may lead to 'false positives,' where legitimate transactions are accidentally flagged, causing short-term friction for users. Furthermore, banks that fail to maintain the mandated 20-day verification and 10-day review timelines may face increased regulatory scrutiny or legal challenges.
The proposed rules are scheduled to take effect on April 1, 2027, though banks have been granted the flexibility to implement these measures earlier if they choose. As the banking sector prepares for this transition, the primary monitorable for investors will be how effectively banks manage these compliance costs and whether the new, targeted debit hold mechanism successfully reduces the volume of fraud cases without harming the user experience for the broader customer base.