Forty-three mule accounts and a login used on a leave day
Over six weeks, two branches of a small finance bank opened 43 savings accounts that share a pattern: identical electricity-bill templates as address proof, mobile numbers in two number series, immediate activation of UPI-linked accounts, credits arriving from multiple payment applications and near-simultaneous cash withdrawals at ATMs in three districts. The total value passing through is ₹64 lakh. All 43 were opened through video-based customer identification, and each video session was conducted by the same local cyber café operator who had been given the branch's video-KYC link by a relationship officer. One account belongs to a 19-year-old student who has admitted in a written statement that she sold the account for ₹3,000. Separately, the audit trail shows that 12 of the 43 accounts were opened using a branch employee's login credentials on a day she was on sanctioned leave; she says she shared her password with a colleague to 'keep the work moving'. No STR has been filed. The bank's principal officer is on leave and the designated director has not been briefed.
1. List the statutory and regulatory obligations and their timelines that now arise from these 43 accounts.
Read the worked answer
A single incident triggers several distinct obligations, and they must not be collapsed into one.
Suspicious transaction reporting. The bank is a reporting entity under the anti-money laundering law. The pattern - templated documentation, a single intermediary, rapid in-and-out movement through payment applications, withdrawals across districts - establishes suspicion now. The bank must file a suspicious transaction report with FIU-IND in the prescribed format promptly and in any case within the short window the FIU prescribes after suspicion is established. The report goes to FIU-IND, not to RBI, and must set out the facts and the reason for suspicion, not merely a transaction list. Where several accounts belong to one operation, they should be reported together with a common narrative.
No tipping off. No officer may inform any of the 43 customers that a report has been made. This is a statutory prohibition, and the customer-facing staff must be briefed accordingly.
Record keeping and governance. The principal officer is the designated person under the law and must be available; if she is on leave, a formal alternate must be appointed. The designated director on the board must be briefed immediately and the matter minuted. Transaction records and video-KYC artefacts must be preserved for the prescribed retention period.
Fraud and cyber reporting. The UPI transactions should be reported on the cyber-fraud reporting platform so that lien and recovery can be attempted, and the accounts flagged as mule accounts in the payment system's fraud database so that the identifiers are blocked network-wide. The loss of ₹64 lakh, if it becomes a bank loss or a customer loss, must be reviewed for fraud classification and reporting to RBI in the prescribed fraud return within three weeks of detection.
Insider angle. The misuse of an employee's login is a separate incident under the bank's internal fraud framework and potentially an insider-threat report, to be handled without delay because evidence on shared credentials disappears quickly.
2. Should the bank close the accounts at once, and how should it handle the student's account and the cyber café?
Read the worked answer
Closure. Do not simply close and refund. Closure destroys the transaction trail the bank and the investigating agencies need, and it tips off the network, which will move to a third bank. The proportionate step is to freeze operations on all 43 accounts - no fresh credits, no withdrawals beyond what the law requires - pending investigation, and to write to the account holders asking for an explanation of the activity, which is legitimate customer due diligence and not tipping off. Closure follows the investigation, in each case on its own facts, and the bank should be prepared to maintain that a frozen account is not a closed one.
The student. Her conduct - selling an account for ₹3,000 - is a classic money-mule arrangement, and she is a young first-time account holder who was almost certainly recruited rather than the organiser. The bank should record her statement formally, preserve it as evidence, obtain a written indemnity and an explanation of who approached her and how the payment was made, freeze the account, file her within the suspicious transaction report, and consider a police complaint. She should also be told, in writing, that she remains liable for the account's use. The bank should not treat her as a victim and leave the account live, nor treat her as the mastermind.
The cyber café. Video-based identification is an outsourcing of technology, not of judgement: the bank's own authorised official must conduct the session, with live location and face-liveness capture, and the use of an intermediary is a violation of the KYC directions. The bank must stop the arrangement immediately, identify every account opened through that link, terminate the relationship with the relationship officer who shared it, and examine other branches where the same link was used. The café itself should be reported within the STR and to the police if evidence of organised procurement exists.
3. The 12 accounts opened with the branch employee's login on her leave day: what does this change about the bank's response?
Read the worked answer
It converts a customer-fraud case into a possible insider-fraud case, and that changes the response in five ways.
1. Immediate containment of access. Disable the login, force a reset of credentials for all users of that branch, review shared-password practices across the network, and pull the system logs for every user who accessed the account-opening module on that date. Evidence must be imaged before any reset destroys it.
2. Staff accountability. The employee has admitted sharing credentials, which is a disciplinary matter irrespective of whether she knew the purpose. The colleague who used them is a suspect. Both should be placed under suspension, with a formal investigation, and the outcome, including any recovery, reported to the audit committee of the board.
3. Fraud reporting. A fraud involving staff involvement falls within the bank's fraud classification and must be reported to RBI in the prescribed fraud return within three weeks of detection, with the amount, the modus operandi and the staff role. The ₹64 lakh aggregate is below the threshold for reporting to the central repository of large frauds, so that particular report does not arise - but the internal fraud register, the audit committee and the board must still be formally informed, and the classification decision recorded.
4. Root-cause control remediation. The finding is not that one employee misbehaved; it is that a single set of credentials could open 43 accounts without any maker-checker challenge, that a non-official could conduct video-KYC, and that no rule-based monitoring flagged 43 accounts with templated proofs. Each needs a control fix with an owner and a date: mandatory maker-checker on account opening, device and geo-tagging of every session, disabling of dormant logins during leave, and scenario-based transaction monitoring for mule patterns.
5. Governance escalation. The principal officer being on leave and the designated director being uninformed are themselves reportable weaknesses. The board should require a written timeline of who knew what and when, because the bank's defence against a penalty for delayed reporting rests entirely on that record.