No More Arbitrary Freezing – Kerala High Court Lays Down Binding Protocol for Banks to Freeze Suspicious Accounts Without Law Enforcement Nod

“In the absence of RBI’s standard procedure, judicial guidelines must fill the vacuum—Banks can freeze accounts, but only with safeguards,”  In a decisive move to ensure regulatory discipline and protection of both public interest and private rights, the Kerala High Court issued a binding eight-point protocol that all banks must follow while temporarily freezing customer accounts on the basis of internal suspicion of unlawful transactions, even when no direction has been received from a law enforcement agency or a court.

The ruling came in the consolidated writ petitions , where Justice M.A. Abdul Hakhim acknowledged the absence of a formal Standard Operating Procedure (SOP) from the Reserve Bank of India (RBI) and stepped in to fill the policy vacuum.

The Court categorically stated:

“Till the time the RBI comes forward with a Standard Operating Procedure… it is for this Court to intervene and give guidance to the Banks… Accordingly, the following guidelines are made.”

The judicially crafted eight-point protocol now operates as a temporary but binding mechanism to govern the manner in which banks can impose preventive debit freezes on accounts suspected of being involved in financial cyber fraud or money mule activities.

“Right to freeze is not a licence to act unilaterally – Accountability, time limits, and oversight are essential”

While the Court upheld the implied power of banks to freeze suspicious accounts in light of Section 35A of the Banking Regulation Act and obligations under the PMLA, it warned that such power cannot be misused or exercised arbitrarily or indefinitely.

Recognizing the lack of procedural safeguards in existing RBI circulars, the Court held:

“Freezing without judicial or executive oversight cannot continue indefinitely. Procedural fairness is not dispensable merely because suspicion exists.”

Highlights of the Court-Mandated Eight-Point Freezing Protocol

1. Banks can impose a debit freeze without prior notice if there is reasonable suspicion of illegal transactions.
2. On the same day, the bank must send a communication to the account holder via SMS and registered post, clearly stating the reason for suspicion.
3. The bank must also inform the jurisdictional cybercrime police and other relevant authorities under RBI guidelines and ensure receipt of such communication.
4. The account holder has the right to respond with a written explanation to the bank. Upon receiving it, the bank must evaluate it within one week and communicate its decision.
5. If no explanation is received, or if the bank finds it unsatisfactory, the freeze can continue only for a maximum of three months, starting from the date of communication to law enforcement authorities.
6. If, within this three-month window, the bank receives no formal direction from the police, cybercrime cell, or court, it must lift the freeze.
7. After lifting the freeze, the bank may allow the account to function normally or demand its closure, depending on continued risk.
8. The account holder has a legal remedy and can challenge the bank’s decision if the explanation is rejected.

“A rulebook where none exists – The judiciary steps in where the regulator remained silent”

The Court’s move comes in response to RBI’s failure to issue clear guidance on preventive freezing, despite the proliferation of cybercrimes. The Court noted that every day it faces over 200 cases involving debit freezes imposed without formal requisition, and observed:

“The RBI has virtually washed its hands of the issue… It is surprising that despite its central role, the RBI has not defined ‘appropriate action’ under its own directions.”

This lacuna in regulatory clarity prompted the Court to act in the public interest, balancing the need to prevent fraud with the fundamental rights of customers.

The judgment sends a strong signal to both banks and regulators: freeze orders must be accompanied by fairness, time-bound actions, and transparency.

Implications for Banks, Account Holders, and the RBI

• Banks now have clear judicial authority to impose short-term freezes, but must comply with mandatory communication and timeline requirements.
• Account holders gain the right to receive prompt information, submit explanations, and seek redress through legal means.
• The RBI has been directed to urgently frame a Standard Operating Procedure, which would eventually replace the Court’s protocol.

“The RBI cannot continue to ignore the issue of account freezing in the age of digital banking and UPI-enabled fraud. It must act.”

Kerala High Court’s protocol sets the national tone on preventive freezing powers

By filling a dangerous policy gap, the Kerala High Court has laid down the first detailed framework in Indian jurisprudence on the preventive freezing of bank accounts in suspected cybercrime cases absent law enforcement orders.

This judgment ensures that banks no longer act in an unstructured, opaque, and potentially arbitrary manner, while also preserving the State’s interest in halting financial frauds before they are consummated.

Date of Decision: 19 November 2025