The MHA SOP issued in January 2026 introduces a fixed time limit for the first time in the cyber-fraud freeze framework. Where the disputed amount is below Rs. 50,000 and no court order is in place, banks are required to lift the freeze within 90 days. This page sets out the rule, the conditions under which it applies, the conditions under which it does not, and how to enforce it where the bank or the investigating officer is slow to comply.
The 90-day rule sits within the broader SOP framework. The SOP explainer covers the larger picture.
What the rule says
For cyber-fraud freezes processed through NCRP or under a Section 106 BNSS lien/seizure notice, where the disputed sum is below Rs. 50,000 and no judicial order has been issued in the interim, the bank is to lift the freeze on day 90 from the date of the original instruction. The SOP also contemplates refund processing for these low-value matters without requiring a court order, subject to the transaction trail being verified.
This is the first time an administrative time limit has been articulated in this framework. Before 2026, a low-value freeze could remain in place indefinitely while the investigation drifted, often producing prejudice out of proportion to the underlying disputed sum.
When the rule applies — the three conditions
- Disputed amount below Rs. 50,000. The relevant figure is the disputed traceable sum, not the full account balance and not the gross fraud value. Where the larger fraud amount has been spread across multiple downstream accounts and the portion attributable to your account is below Rs. 50,000, the rule applies to your account.
- Freeze instructed administratively, not by a court order. The rule covers freezes issued under NCRP/CFCFRMS notices and Section 106 BNSS lien/seizure instructions. It does not displace freezes ordered by a magistrate or other court.
- No subsequent court order extending the hold. If the investigating authority obtains a court order within the 90-day window extending the hold or seizure, the rule no longer governs the timeline. The rule is specifically structured to force the administrative authority to seek judicial review if the hold is to continue.
When the rule does NOT apply
- Where the disputed sum traceable to your account is Rs. 50,000 or above.
- Where the freeze is under the Prevention of Money Laundering Act, the Income Tax Act, or other statutory regime separate from the cyber-fraud framework.
- Where a magistrate has passed a continuation order within the 90-day window.
- Where the freeze relates to bank recovery, KYC default, or other non-cyber reasons.
- Where the account itself is the subject of investigation (suspected fraud-account status) rather than a downstream beneficiary.
How to count the 90 days
From the date of the original instruction issued by the investigating authority to the bank. Where the bank's written communication identifies the date of the lien or freeze, that is the reference date. Where the date is unclear, ask the bank in writing to confirm. The bank is required, under the SOP, to share this information; a refusal is itself a documented ground.
For accounts where the instruction is renewed or replaced, the counting starts from the original instruction unless a court order has intervened. A fresh administrative instruction without judicial backing does not reset the clock; if it did, the rule could be defeated by repeat administrative instructions, which the SOP framework does not contemplate.
What to do at the 90-day mark
If the freeze has not been lifted by day 90 and no court order is in place, the structured route is:
Day 85: Send a written reminder to the bank's nodal officer and the investigating officer, citing the SOP, the 90-day window, and the date of the original instruction. This puts both on notice that the rule is being invoked.
Day 90: If the freeze is not lifted, file a written representation with the District Grievance Redressal Officer citing the breach. The District officer is meant to respond within 15 days. A separate guide covers the structure.
Day 105: If the District officer has not responded, the escalation is automatic to the District Grievance Redressal Officer (a different designation in the SOP architecture, with appellate authority over the first-line officer) and onwards to the State officer.
Beyond day 105: If administrative routes have not produced a result, the writ jurisdiction of the High Court becomes the next step. The petition cites the SOP, the 90-day breach, the documented representations, and seeks directions for release. Where the inter-state pattern is present, the writ route tends to produce faster orders than magistrate applications.
What the rule does and does not change in practice
The rule is helpful for low-value freezes where the customer is plainly innocent and the disputed sum is identifiable. It is most useful in downstream-beneficiary cases (see the Layer-N guide) where the customer is several layers removed from any fraud and the disputed sum traceable to the account is small.
The rule does not change the position for higher-value matters, where the underlying timeline remains governed by general criminal procedure. It also does not address the cases where the investigating officer obtains a continuation order within the 90-day window — the freeze continues, just on a different (judicial) footing. In practice, the rule's strongest effect is the discipline it imposes on the administrative track: investigating officers either lift the freeze, seek a court order to continue it, or face a documented breach that supports later litigation.
Frequently asked questions
What is the 90-day bank freeze rule?
A provision in the MHA SOP 2026 requiring banks to lift cyber-fraud freezes within 90 days where the disputed amount is below Rs. 50,000 and no court order is in place.
When does the 90-day rule apply?
Three conditions: disputed sum below Rs. 50,000; freeze instructed administratively (NCRP or Section 106 BNSS, not court order); no subsequent court order extending the hold within 90 days.
When does it not apply?
Where the disputed sum is Rs. 50,000 or above, where a court order is in place, where the freeze is under PMLA or other separate regime, or where the freeze is for non-cyber reasons.
How is the 90-day period counted?
From the date of the original instruction issued by the investigating authority to the bank. Repeat administrative instructions without judicial backing do not reset the clock.
What if the bank does not lift on day 90?
Written reminder to bank and investigating officer at day 85; representation to District Grievance Officer at day 90; escalation at day 105; writ petition before the High Court beyond that.
Does the rule extend automatically if the investigation continues?
No. The investigating authority cannot extend the freeze administratively past 90 days. The only legitimate route is a court order, which subjects the extension to judicial review.
Crossed the 90-day window without unfreezing?
Share the freeze communication, the date of the original instruction, the disputed amount, and any responses received for an assessment of the next step.