On September 11, the Reserve Bank of India published a draft rule that will decide how quickly an innocent person's salary account can come back to life. The Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 cap most bank-initiated freezes on suspected cyber-fraud accounts at 60 days. Public comments close on October 2. Banks are free to start early, but the direction will take effect from April 1, 2027 at the latest.

The public debate around the draft has centred on customers: how fast they are notified, how long a hold lasts and whether they get their money back. That misses a harder question. Every freeze pulls money out of circulation before anyone establishes that it was criminal proceeds in the first place. Neither the RBI's draft nor the Supreme Court order that produced it puts a number on that cost. India's cyber-fraud enforcement counts what fraud takes from citizens. It does not count what enforcement itself takes out of circulation.

Two Clocks
The RBI's new procedure, inserted as Annex III to the 2025 KYC Directions, covers a narrow slice of freezes: those a bank places on its own initiative, using artificial intelligence monitoring, after the Supreme Court directed the central bank on August 4 to adopt a Standard Operating Procedure within four weeks. The order came in the court's suo motu proceedings on digital-arrest scams, heard by a bench led by Chief Justice Surya Kant. The RBI missed that deadline. What it published on September 11 is a consultation draft, ten days late and not yet binding on banks.

Under the draft, a transaction of ₹1,000, about $10.50, or more triggers a hold once a bank's AI or machine-learning system flags it as inconsistent with a customer's profile, or linked to an account already reported as suspicious. The bank places the hold immediately, on the transaction, or, where it judges the whole account a "Suspected Money Mule Account", on the account itself. The customer gets 20 days to explain. The bank then has 10 days to decide, or 30 days from the hold if no explanation arrives. An unresolved case goes to the jurisdictional police, who get 30 days to act. Absent instructions, the hold lifts on day 31. The maximum period is 60 days, start to finish.

Banks defend that speed on real grounds. Money routed through a mule account moves within minutes and layers across further accounts fast enough that recovery grows unlikely once it clears the first hop. The case for an immediate hold is not in dispute.

What is in dispute is the exception written into the draft's own text. The 60-day clock does not apply "where the temporary debit is placed or continued pursuant to a specific instruction" from a law-enforcement agency, the RBI's text states. Nearly every account-freeze case that reached a High Court in 2026 began exactly that way, with a police communication, not a bank algorithm. The Rajasthan High Court disposed of 105 such writ petitions in a single judgment on August 20, in Shree Balaji Enterprises versus Reserve Bank of India, ruling that a bank "cannot be used as a substitute for the statutory judicial process." The RBI's new clock does not run on any of those cases. A separate Home Ministry procedure, in force since January 2, 2026, sets a 90-day outer limit for police-instructed holds instead. That leaves two procedures, two clocks and nothing in either document that tells an account holder which one applies to their money.

The scale involved is large enough to matter for growth accounting, not individual grievance alone. Minister of State for Home Affairs Bandi Sanjay Kumar told the Rajya Sabha in March that banks have shared more than 2.7 million mule accounts through the Suspect Registry since it began in September 2024, declining transactions worth ₹95.18 billion, close to $1 billion, along the way. Separately, Home Ministry data placed before Parliament puts total cyber-fraud losses at ₹224.9 billion in 2025, about $2.4 billion, a marginal fall from ₹228.4 billion in 2024. The two figures sit close enough in scale to ask the question neither answers: how much of the money stopped each year returns to its owner as clean funds, and how long does the owner wait for it? No agency publishes that series.

The ₹1,000 trigger sits below the average UPI transaction. NPCI recorded 24.51 billion UPI transactions worth ₹29.82 trillion, about $314 billion, in August 2026 alone, at an average ticket size near ₹1,300. A large share of India's daily digital economy therefore clears above the level at which an algorithm can trigger a hold.

Who Pays
The RBI's draft calls a whole-account freeze a "last resort". That instruction sits only in the internal-policy paragraph, not in the operative step that authorises the freeze, and 2026's court record is the gap between the two written out case by case. A liquor contractor running seven shops in Narsinghpur had a current account holding ₹25.1 million, about $264,000, frozen over a disputed ₹980. The Madhya Pradesh High Court, ruling in Archana versus State of Madhya Pradesh on July 27, ordered the balance released and told investigators to secure only the disputed amount. In August, the Allahabad High Court released an account that had been held under a lien of ₹36,000, more than the disputed sum. In Tamil Nadu, an association representing roughly 5,000 petrol pumps threatened to stop accepting UPI altogether after automated systems began flagging dealer accounts as suspected mules, echoing a protest by fuel retailers in Nagpur in May 2025.

None of these account holders is accused of fraud. Their money stopped moving because a machine matched a pattern. For a household, that means a blocked EMI or a missed rent payment. For a business operating on the 60-to-90-day receivables cycles common across India's roughly 62 million MSMEs, a freeze compounds a cash-flow gap the enterprise did not create and the fraud did not touch. The RBI's draft offers no interest or compensation where a hold is later found wrong. Grievances go to a bank nodal officer, with 30 days to resolve them, half the maximum life of the freeze itself.

India tracks fraud losses prevented, complaints filed and mule accounts flagged in detail every year. It has no matching series for money frozen and later released clean, or for how many days a legitimate rupee sits outside an economy that moved ₹29.82 trillion through one payment rail in a single month.

Until that series exists, the RBI's 60-day cap measures only the ceiling on one category of freeze. It does not measure what freezing costs the economy the rule is meant to protect.