Banks Can Temporarily Freeze Suspicious Accounts to Thwart Cyber Fraud: Kerala High Court Upholds Preventive Freezing Power of Banks

“Preventing the withdrawal of crime proceeds cannot wait for law enforcement directives — Banks must act as the first line of defence”, In a path-breaking ruling with far-reaching implications for banking operations and cybercrime enforcement, the Kerala High Court held that banks are legally empowered to impose a temporary debit freeze on customer accounts based solely on internal suspicion of fraudulent transactions, even without a requisition or direction from any law enforcement agency or court.

Deciding a batch of writ petitions, Justice M.A. Abdul Hakhim pronounced a landmark judgment interpreting the Reserve Bank of India’s (RBI) KYC/AML guidelines and the scope of banks' obligations under the Banking Regulation Act, 1949 and the Prevention of Money Laundering Act, 2002 (PMLA).

The Court declared:

“Though RBI directions do not explicitly authorize debit freezing without law enforcement requisition, such power is implied in light of Section 35A of the Banking Regulation Act and the duties under PMLA… Banks can temporarily freeze accounts for a reasonable period (up to 3 months) to prevent dissipation of suspected illicit funds.”

“Petitioners failed to justify massive cash flow inconsistent with declared income; Banks cannot be forced into inaction in the face of obvious red flags”

The petitioners—holders of bank accounts with South Indian Bank—approached the High Court challenging the unilateral freezing of their accounts, which had credit balances exceeding ₹20–34 lakhs, based on the bank’s suspicion that their accounts were being misused for money mule activity and financial cyber fraud. They contended that:

• There was no directive from any law enforcement authority for the freeze.
• Their right to property under Article 300A of the Constitution was violated.
• They had explained the transactions and produced documents like post-facto Income Tax Returns to show the funds were legitimate.

The Court, however, noted:

“The petitioners have not satisfactorily explained the high-value transactions in their accounts, which are wildly disproportionate to their declared income at the time of opening the account.”

One petitioner declared monthly income below ₹5,000, but his account recorded ₹1.90 crore in deposits and ₹1.56 crore in withdrawals in a span of four months. The other showed declared income between ₹5–10 lakh annually but had ₹2.74 crore in deposits within three weeks of account opening.

The Court observed:

“The account statements reveal transaction volumes entirely out of sync with the petitioner’s declared profiles. Mere filing of an income tax return post-freeze cannot retrospectively sanitize such red flags.”

“RBI’s silence is deafening – Central bank must wake up to the realities of financial cybercrime and frame clear SOPs”

Significantly, the Court pulled up the Reserve Bank of India for its evasive affidavit, stating:

“It is unfortunate that the RBI has filed a counter-affidavit in a casual manner, effectively washing its hands of the issue… It virtually says that banks have no power to freeze accounts absent a law enforcement directive.”

Invoking Section 35A of the Banking Regulation Act, the Court held that RBI’s own directions fail to explicitly address preventive freezing protocols, despite the alarming rise in UPI-enabled financial cybercrime.

The Court issued a stern directive:

“It is incumbent upon the RBI, with its expertise, to take up this issue and formulate a concrete Standard Operating Procedure clearly defining the powers of banks to freeze suspicious accounts.”

“Appropriate action under KYC/AML norms includes temporary freezing, but cannot be indefinite” – Court lays down 3-month cap on freeze

Although the RBI’s Master Direction on KYC (Clause 59) uses the term “appropriate action” against money mule accounts, it fails to specify what that action entails. The High Court decisively interpreted this clause:

“The phrase ‘appropriate action’ includes temporary freezing of accounts without prior notice, where suspicion is reasonably founded. But this freezing cannot continue indefinitely.”

Invoking principles of procedural fairness, the Court held that:

• Freezing must be intimated immediately to both the account holder and jurisdictional cybercrime police.
• If no explanation is received, or if the bank finds it unsatisfactory, the freeze can continue for a maximum of 3 months.
• If no law enforcement agency acts within 3 months, the freeze must be lifted.

The Court stated:

“To balance the rights of the account holder and the need to prevent the dissipation of crime proceeds, freezing is justified only for a reasonable period—three months being sufficient.”

“No prior notice required when fraud is suspected—notice would give fraudsters time to drain accounts”

Relying on public interest considerations, the Court ruled against the argument that advance notice is mandatory before freezing:

“If advance notice is given to the account holders before freezing, there is every chance of the wrongdoers withdrawing the proceeds of the crime. It would not be in the interest of the banking system or the economy.”

The Court emphasized that immediate preventive action is essential when time is of the essence, especially in cyber-enabled frauds where funds can vanish in seconds.

Court issues binding eight-point protocol for preventive account freezing by banks

Filling a regulatory vacuum, the Court framed an interim Standard Operating Procedure, binding on all banks operating within the State until RBI issues formal directions. This protocol includes:

1. Banks may impose a debit freeze without prior notice if there is reasonable suspicion.
2. Immediate SMS and postal notice to account holder with reasons.
3. Mandatory intimation to cybercrime police and relevant RBI authorities on day of freezing.
4. Account holders may submit explanations within one week, to be considered by the bank.
5. If no explanation is received or found unsatisfactory, the freeze may continue for up to 3 months.
6. If law enforcement does not act within 3 months, the bank must unfreeze the account.
7. Banks retain the right to demand account closure after lifting freeze.
8. Aggrieved account holders may challenge rejection of their explanation via legal remedies.

Writ Petitions Dismissed, RBI Directed to Frame SOP

Though acknowledging the absence of law enforcement requisition, the Court refused to grant immediate relief, noting the petitioners’ failure to provide credible explanation for suspicious transactions.

“These admitted facts are favourable to the petitioners to win… Nevertheless, the petitioners have not satisfactorily explained the high-value transactions… On these grounds, I can easily dismiss these writ petitions.”

Ultimately, the Court disposed of the petitions with key directions:

• Banks to notify relevant authorities within 2 working days.
• RBI directed to frame SOP on freezing of accounts in cyber fraud cases.

Kerala High Court Opens New Legal Path for Banks to Act Swiftly Against Financial Fraud

This judgment marks a critical turning point in India’s banking jurisprudence, affirming the power of banks to act proactively against cybercrime. It closes the gap left by ambiguous RBI guidelines, and calls for urgent regulatory clarity from the central bank.

The Kerala High Court has squarely placed the burden of financial vigilance on banks and regulators alike, holding that “preventive action cannot wait for police intervention” when it comes to safeguarding the integrity of the financial system.

Date of Decision: 19 November 2025