Discuss the role of mule accounts in cyber-financial fraud. How far can regulatory measures such as the RBI's KYC Amendment Directions, 2026 contain such fraud?

A mule account is a bank account that receives and moves the proceeds of fraud. Its holder may have been paid, recruited or deceived into lending it. In "digital arrest", investment and loan-app scams, it is the conduit that turns a victim's panic into untraceable money. The RBI's draft KYC Amendment Directions, 2026 target this link, but they can contain the fraud only partly.

Role of mule accounts in cyber-financial fraud

• Choke point of the scam: chat identities are disposable. I4C blocked 83,668 WhatsApp and 3,962 Skype IDs used for digital arrest [2]. Every rupee stolen, however, must pass through a KYC-verified bank account.
• Laundering engine: money lands first in a "first-layer" mule account. It is then split across further accounts and withdrawn as cash. This is the placement and layering stage of money laundering.
• KYC weakness: accounts are rented out by students, the unemployed or low-income people, or opened with lax verification. The holders rarely understand their criminal liability.
• Defeats recovery: rapid layering makes the "golden hour" reporting through 1930/NCRP decisive for freezing funds [2].

How far the KYC Amendment Directions can help

Strengths

• Temporary debit hold on a suspected mule transaction, or on the whole account as a last resort, with notice to the holder [1].
• Shifts the approach from recovering money after the fraud to freezing it pre-emptively. It also links banks to I4C's Cyber Fraud Mitigation Centre [1][2].
• Complements MuleHunter.AI and the AI-driven fraud analytics in the RBI's revised framework [3].

Limitations

• Uneven coverage: MuleHunter.AI is live in only 26 banks [3]. Fraudsters move to the least-screened banks.
• Not yet in force: the directions are still at the draft stage [1], so each bank's practice varies in the meantime.
• False positives: pattern-based flags may freeze the accounts of honest small traders and new account holders, which strains financial inclusion.
• Liability gap: the customer-protection framework is framed around unauthorised transactions [3]. Coerced transfers made by the customer remain uncovered.
• Root causes untouched: mule recruitment networks and insider complicity need enforcement under the PMLA and policing, not just KYC rules.

Mule accounts are the financial spine of cyber fraud, so the 2026 directions strike at the right point but cannot work alone. Way forward:

• extend MuleHunter.AI to all regulated entities;
• make debit holds time-bound, with a fast appeal route;
• make banks liable where their safeguards failed;
• run mule-awareness drives among young people.

Coordinated action by I4C, the RBI and banks can protect citizens' savings and advance SDG 16.4 on curbing illicit financial flows.