The Reserve Bank of India has introduced a more structured framework for banks to act on accounts linked to suspected cyber fraud, including provisions to prevent an entire bank account from being blocked when only a specific amount is under suspicion. The directions also set out procedures for placing and removing debit restrictions and require banks to strengthen technology-based controls.
What Changes for Fraud-Linked Bank Accounts?
The amended directions introduce a framework under which banks can place restrictions on amounts suspected to be linked to fraudulent transactions.
A key change is that the restriction should correspond to the suspected amount rather than automatically affecting the entire balance available in the account.
This distinction is important in cases where an account may contain legitimate funds alongside an amount that has been flagged in connection with suspected fraud.
How Will Banks Restrict the Suspected Amount?
Banks will be required to identify the amount connected to the suspicious transaction and place a debit restriction on that amount.
The remaining balance can continue to be available to the account holder, subject to the applicable conditions and directions.
The framework is intended to allow banks to respond to suspected fraud while avoiding unnecessary restrictions on funds that are not connected with the disputed transaction.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
What Is a Debit Restriction?
A debit restriction prevents the specified amount in an account from being withdrawn or transferred.
Under the revised approach, banks can restrict the suspected amount while allowing the remaining funds to continue operating normally, instead of treating every case as requiring a complete account freeze.
This creates a more targeted response when suspicious money is identified in an account.
How Can a Debit Restriction Be Removed?
The directions also provide a process for lifting restrictions placed on an account.
Banks are expected to act when appropriate instructions or information are received from the relevant authorities. This gives financial institutions a defined mechanism for reviewing and removing restrictions rather than allowing them to continue without a clear process.
The framework therefore covers both the initial action taken against suspected funds and the subsequent restoration of access when the restriction is no longer required.
What Role Will Law Enforcement Play?
The revised framework recognises the role of law enforcement directions in cases involving suspected fraudulent transactions.
Banks must act on relevant instructions concerning the funds under investigation and maintain procedures for handling restrictions connected with such cases.
The approach seeks to ensure that action against suspected fraud proceeds is coordinated while clearly identifying the amount that needs to remain restricted.
Why Are Banks Being Asked to Upgrade Technology?
Banks have also been directed to implement technological solutions to support the new system.
Technology will be important in identifying suspicious transactions, placing restrictions on the appropriate amount and managing the subsequent removal of those restrictions.
The revised framework places greater responsibility on banks to develop systems capable of responding quickly to fraud-related information without unnecessarily disrupting the operation of an entire account.
What Does This Mean for Bank Customers?
In simple terms, if only a certain amount in your bank account is linked to a suspected fraud, the entire account may not need to be blocked. The new framework allows banks to restrict the suspected amount while keeping other funds accessible, making action against fraud more targeted and reducing unnecessary disruption for account holders.
About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
