Supreme Court asks RBI to prepare SOP for dealing with mule accounts, bank accounts linked to cyber fraud

The Supreme Court's recent directive to the Reserve Bank of India (RBI) to formulate a Standard Operating Procedure (SOP) for tackling mule accounts marks a watershed moment in India's fight against cyber-enabled financial crime. To understand the gravity of this intervention, one must first grasp the anatomy of a 'mule account'. These are bank accounts — often opened using stolen or synthetic identities, or by coercing vulnerable individuals — that act as conduits for laundering proceeds from cybercrimes such as phishing, 'digital arrest' scams, investment frauds, and UPI-based thefts. The money moves rapidly through a chain of such accounts, often across multiple banks and jurisdictions, making traceability a nightmare for law enforcement. The background to this order lies in the explosive growth of digital payments in India. Since the launch of UPI in 2016 and the push for a less-cash economy post-demonetisation (2016), digital transaction volumes have surged from 2 billion in FY 2016-17 to over 13,000 billion in FY 2023-24. While this reflects financial inclusion success, it has also expanded the attack surface for fraudsters. The National Crime Records Bureau (NCRB) reported over 65,000 cybercrime cases in 2022 alone, with financial fraud constituting the lion's share. The 'Jamtara model' of phishing and the recent surge in 'digital arrest' scams — where fraudsters impersonate law enforcement to extort money — have exposed systemic gaps in real-time monitoring, inter-bank coordination, and victim redressal. Key stakeholders in this ecosystem include the RBI, as the central banking regulator under the RBI Act, 1934, and the Banking Regulation Act, 1949; the Supreme Court, exercising its powers under Article 32 (writ jurisdiction) and Article 142 (complete justice); the Ministry of Home Affairs (MHA), which coordinates cybercrime response via the Indian Cyber Crime Coordination Centre (I4C); the Indian Computer Emergency Response Team (CERT-In) under the IT Act, 2000; commercial banks; and state police forces. The Court's directions — issued in a PIL highlighting victim helplessness — mandate not just an SOP from RBI, but also time-bound freezing of suspect accounts, strengthening of grievance redressal mechanisms under the RBI's Internal Ombudsman Scheme, 2018, and better coordination between banks and law enforcement. Constitutionally, this intersects with Article 21 (Right to Life and Personal Liberty), which the Supreme Court has expansively interpreted to include the right to property and protection from arbitrary deprivation — here, loss of life savings to fraud. It also touches Article 300A (Right to Property) and the Directive Principles under Article 38 (promoting welfare) and Article 39 (preventing concentration of wealth). The IT Act, 2000 (as amended in 2008), particularly Sections 43, 66, 66C, 66D, and 72A, provides the legal backbone for prosecuting cyber fraud and data theft. The significance for India is multi-dimensional. Economically, unchecked cyber fraud erodes trust in digital public infrastructure (DPI) — the UPI-Aadhaar-Jan Dhan trinity — which is the backbone of Direct Benefit Transfer (DBT) and financial inclusion. Politically, it pressures the government to modernise policing, a State subject under List II, Schedule VII, requiring Centre-State cooperation. Socially, it disproportionately affects the digitally less-literate — senior citizens, rural users, and women — exacerbating the digital divide. Broader themes include the tension between innovation and regulation in fintech, the need for a dedicated Cyber Security Authority (as recommended by the Krishna Committee, 2018), and international cooperation via the Budapest Convention (which India has not signed but engages with via Mutual Legal Assistance Treaties). Future implications are profound. The RBI's SOP will likely mandate real-time transaction monitoring using AI/ML, a centralised mule account registry, standardized KYC re-verification triggers, and strict timelines for banks to respond to law enforcement requests. We may see amendments to the Payment and Settlement Systems Act, 2007, and tighter norms under the Master Direction on KYC (2016, updated 2023). For aspirants, this case exemplifies the dynamic interplay between judiciary, regulator, and executive in governing India's digital economy — a recurring theme in UPSC, RBI Grade B, and banking exams.