The September issue ended on the mule account: the ordinary savings account, opened with real documents in a real person's name, that exists only to be a station on the way to somewhere else. What that account does to the person whose name is on it, and to the next person down the chain whose money passes through it, is the question Indian banking has answered badly for a decade. The answer has been the freeze. A complaint lands, the beneficiary account is identified, and the account stops — all of it, indefinitely, including the salary credit and the school fee and the EMI, with no stated end date and no obvious person to appeal to. For a mule, that is a cost of doing business. For the small trader whose customer happened to pay with tainted money, it has been a catastrophe with no clock on it.
In September the Reserve Bank put out a draft that tries to put a clock on it. The draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 — issued for public comment with submissions closing on 2 October, and following an order of the Supreme Court on 4 August — would replace the open-ended account freeze with a time-bound hold on specific money. As reported, the mechanics are these. A flagged outgoing payment of ₹1,000 or more can be held, and the flag may come from a bank's machine-learning systems; the triggers include activity that does not fit the customer's declared profile, or a link to an account already flagged. The hold applies to debits only, so credits keep arriving. The customer must be told why the hold exists, what would lift it, and whom to contact. They then have twenty days to explain the transaction, and the bank ten calendar days to consider what they send; if the explanation satisfies, the hold must be released at once. Banks would have to run a dedicated grievance channel that closes cases within thirty days. And no hold may run beyond sixty days unless a law-enforcement agency or other competent authority directs otherwise. The proposed commencement is 1 April 2027, with earlier voluntary adoption allowed, and the Bank has said it will issue separate final texts for different categories of regulated entity.
Two things in that design deserve more scrutiny than the headlines gave them. The first is that "only the disputed amount" is not quite what the draft says. The first step permits holding the flagged transaction or, where the account is itself suspected of being a mule account, the whole account — with account-wide restraint cast as the exception rather than the rule. Whether it stays the exception will be decided at branch level, by staff whose incentive, when a police reference arrives, has always been to freeze everything and let the customer argue. The second is the sixty-day cap, which binds the bank and not the state: freezes ordered by law enforcement sit outside it. Medianama's reading, which we think is right, is that police-ordered freezes are where most of this year's litigation has come from. A reform that disciplines the bank's own discretion is worth having. It is not the same thing as a limit on how long the state can stop a citizen's money, and it should not be reported as one.
The sharpest criticism is also the simplest. Dvara Research, in its published comments on the draft, points out that a ₹1,000 floor tells anyone running mule accounts exactly where to aim: below it. India's payment rails make splitting a transfer into twenty pieces free and instantaneous, which is the same property that made the mule economy viable in the first place. The other objection is about who decides. On the draft's own sequence, a machine's alert can stop a person's money before any human being has looked at the file; the twenty days and the ten days are for the argument that follows, not the decision that starts it. For the mule operator, that is an inconvenience to be engineered around. For the account holder who has done nothing, it is still a machine saying no, with a faster appeal. Both of those can be true, and the draft is still a considerable improvement on a freeze with no end date. This is a draft; the final directions will be the thing to judge, and we will report them when they arrive.
Three months on the call
The CBI's Operation Chakra-VI, which began in June, had its largest month. On 4 September the agency searched 89 locations across twenty states in three "digital arrest" cases and arrested three people, in Haryana and in Kolkata. The amounts are substantial — the three cases together account for roughly ₹42.36 crore, with alleged losses of about ₹19.24 crore, ₹15.45 crore and ₹7.67 crore — but the figure that should stay with the reader is the duration. In two of the three cases the victim was kept under a fake digital arrest for about three months; in the third, for roughly a month. Three months of being told daily, by someone impersonating a police officer, that a criminal case exists and that speaking to anyone would make it worse. On 27 September two more people were arrested in a separate ₹11.42 crore case in Gujarat after searches at 22 sites in ten states, bringing the agency's own thirty-day tally across four cases to 142 sites, 22 states and seventeen arrests. Those are the CBI's figures, the site and state totals in the published reporting do not reconcile neatly, and everyone named in them is an accused person and not a convicted one. We have not named any of them, nor the victims. The technique itself is unchanged since this magazine's explainer: the whole fraud rests on the instruction to tell nobody, and its cost is measured in months as much as in crores.
Five weeks, and no Board
On 13 November the consent-manager provisions of the Digital Personal Data Protection rules begin to apply — five weeks from the close of this issue. Registration as a consent manager requires Indian incorporation, a net worth of at least ₹2 crore, independent certification of an interoperable platform, and an application to the Data Protection Board of India. The Board has existed in law since 13 November 2025. On the public record it still has no chairperson and no members. Nominations were invited on 6 May 2026, the posts were advertised the following month, and a written reply in Parliament on 12 August set out the selection process without naming anyone appointed to it; dated reviews in the first week of October found no appointment order. Commentators disagree on what 13 November actually does — whether it opens an application window or bars unregistered operation — and that disagreement is itself a reasonable measure of how much is settled. Meanwhile, on 5 October the ministry issued a Removal of Difficulties Order under section 43(1) of the Act, correcting two pieces of the statute's own drafting: the wording in section 9(1) that governs consent for children and for persons with disabilities who have lawful guardians, and the word "audit" in section 10(2)(c)(ii), which becomes "data audit". Both are editorial corrections rather than changes of substance, and both are a reminder that the text is still being tidied while the clock runs. The duties most Indian businesses are actually waiting for — notice, consent and data-principal rights — arrive on 13 May 2027. Our standing explainer tracks what each phase requires.
The warning, and the first thing that looked like it
In April CERT-In issued a high-severity advisory on frontier AI risks that read, at the time, as a list of plausible futures: models scanning code for flaws and producing working exploits quickly, automated reconnaissance across APIs and cloud estates, and attacks coordinated across several stages with the strategy changed in real time. In September something appeared that resembles the last item. The Dutch Institute for Vulnerability Disclosure, breached on 21 September through two zero-days chained in the open-source Zammad ticketing system, says the evidence indicates the intrusion was AI-driven, and bases that on the pattern by which each next step was selected. It is the victim's reading of its own logs, not an independent finding, and an advisory that described a risk is not a confirmation that the risk arrived. But the shape of the target matters for Indian readers more than the attribution does. Zammad is a self-hosted ticketing system of exactly the kind run by Indian services firms, MSPs and support desks on behalf of clients, usually by a small team, usually behind no particular scrutiny, and usually holding the customer correspondence of several organisations at once. The useful question this month is not whether an agent drove the attack. It is who in your organisation knows which version of the ticketing system is running, and when it was last updated.
The clock starts when you find out
September's edge-appliance failures, set out in this month's Global issue, land awkwardly on Indian compliance. Citrix disclosed two actively exploited NetScaler flaws on 27 September; Mandiant's earliest known case of the more serious one is dated 3 September, which means the attack ran for more than three weeks before any advisory existed to act on. Cisco's 30 September advisory for a critical authentication bypass in Catalyst SD-WAN Manager came after its own responders had already seen the flaw used, with no interim mitigation offered. Both products sit in front of Indian banks, service providers and government networks. CERT-In's six-hour incident-reporting rule, which this magazine covers in detail, starts its clock when an organisation becomes aware of an incident — and the NetScaler campaign is a demonstration of how long an organisation can fail to become aware. A Cloud Security Alliance note, relying on trade coverage rather than CERT-In's own text, reports that CERT-In's May guidance on the AI threat landscape sets an indicative twelve-hour expectation for patching known-exploited flaws on internet-facing systems; indicative or not, that expectation assumes the flaw is known. The harder lesson from both vendors' guidance is the one that no deadline captures: installing the fixed build does not remove a web shell, a modified web-server configuration or a stolen certificate. For anyone who ran either appliance through September, the work after patching — rotating credentials, revoking sessions, hunting for what was left behind — is the actual remediation.
🔍 How this issue was reported
Aegis Sentry does not have reporters in the field. This issue was assembled on 10 October 2026. The cover story is drawn from press and specialist coverage of the Reserve Bank's draft KYC amendment — principally Medianama and Law.asia — together with Dvara Research's published comments on it; we were not able to work from the Reserve Bank's own text, and every description of the draft's mechanics here should be read with that limitation in mind. The CBI figures are the agency's own as carried in Indian reporting, including The420.in and ETV Bharat. The DPDP material rests on the ministry's Removal of Difficulties Order of 5 October, the notified rules, a written parliamentary reply of 12 August 2026 and law-firm commentary; the absence of Board appointments is an absence on the public record, which is not the same as proof that none has been made. International items come from the disclosing parties — Mandiant and Google Threat Intelligence Group, Citrix and Cisco — and from CERT-In's own advisories where quoted. Arrests are allegations until a court says otherwise, and we have named no accused person and no victim. Where later reporting corrects any of this, we will correct it here.