Someone offered you Rs 10,000 a month to use your bank account. That makes you a money mule

In Chitwan, a boy sitting his SEE exams collected his citizenship certificate. Days later a man connected to a nearby relative made him an offer: now that you have citizenship you should open a bank account, and there will be a little something in it for you. The uncle paid the account-opening costs. The boy handed over the chequebook, the ATM card, the mobile-banking password, and the SIM linked to the account, and collected Rs 10,000 at the end of every month.

Over the next three months, more than Rs 3 crore moved through that account. He was 16, and the Cyber Bureau's spokesperson described him afterwards as someone who had become part of a serious crime after falling for the lure of small pocket money.

What the offer actually looks like

Almost nobody is approached with the words "money mule". The pitch arrives as a job, a favour, or a technical problem that only your account can solve. These are the versions Nepali police and journalists have documented, with the payments as reported.

The TechPana investigation that documented four of these quotes the Kathmandu Valley Crime Investigation Office spokesperson, SP Kazi Kumar Acharya, on why they work: "They lure people with help and commissions. It is a combination of emotional manipulation and financial temptation."

Two tells run through all of them. The first is that they want more than a transfer. They want the card, the password, the chequebook, or the SIM, because a mule account is only useful if the operator can move money at three in the morning without asking you. The 19-year-old college student in Rukum described by Ratopati couriered her ATM card to an address she was given and handed over her mobile-banking password. The second tell is the request for silence: she was told the money arriving was business money, and that it was better not to mention the arrangement to anyone.

The Central Investigation Bureau described the business model from the other end after arresting seven people over a racket that had moved more than Rs 3 billion. Its spokesperson, SP Sudhir Raj Shahi, told myRepublica the group lured people through social media adverts and asked them "to open accounts in various banks and digital wallets using their citizenship and phone numbers", then "use the account themselves and pay a certain amount for using it".

Why the recruiters want a young, brand-new account

The demographics are not an accident. NRB's Financial Information Unit analysed the accounts used to receive cyber-fraud money in its 2024 Strategic Analysis Report and found that 49% of the individuals reported were aged 19 to 24 and another 21% were 25 to 30. Where KYC records showed an occupation, "student" was the largest single category, ahead of employees, farmers and shopkeepers. Roughly half the flagged accounts had been opened within three months of being reported, three-quarters within nine.

A brand-new account with no transaction history is what the operator needs, and someone who has just turned 16 or just collected citizenship is who has one. The same report notes the tell in the other direction: heavy ConnectIPS, wallet and Fonepay activity showing up in the accounts of people who "seem to be incapable of such digital payment methods".

Scale, for context. Nepal Police Cyber Bureau registered 18,926 cybercrime cases in FY 2024/25, of which 7,723 were financial scams, about 41% of the total and up nearly 88% in a year, per the Kathmandu Post. All of that money has to land somewhere, and it lands in accounts belonging to people like the boy in Chitwan.

The law does not weigh what you were paid

Here is where the arithmetic turns against you. Nepal has three separate statutes that reach an account holder, and none of them scales the penalty to your commission.

The Banking Offence and Punishment Act 2064. Section 3(ख) bars opening or arranging an account in another person's name outside what the law permits. On its own the penalty under section 15(1) is mild: recovery of the amount, a fine equal to it, and up to three months in prison. The dangerous provision is section 6, which bars misuse or unauthorised use of a credit card, debit card, ATM card or other electronic means to take or give payment. Handing over your card and mBanking credentials to someone who then transacts is squarely that, and section 15(2) grades the sentence by the amount:

On top of the prison term, the amount is recovered and a fine equal to it is imposed. Section 15(6) gives half the punishment to a person indirectly involved or assisting. Run the Chitwan case through that table: Rs 3 crore lands in the 4-to-6-year band, so even at the half rate the boy is looking at 2 to 3 years and a fine measured against Rs 3 crore, against the Rs 30,000 he collected.

The Asset (Money) Laundering Prevention Act 2064. Section 3(1) makes it an offence to convert, transfer, conceal, or acquire, use or possess property while knowing, or having reasonable grounds to believe, that it is proceeds of crime. Section 30(1) sets the penalty at a fine of twice the amount involved plus 2 to 15 years, graded by gravity. That figure comes from the amendment certified on 2080.12.30, which is 12 April 2024; older English translations still floating around online show one to four years or two to ten, and they are stale. Section 30(2) gives half to those who aided, abetted or facilitated. Section 23 removes any limitation period, so the exposure does not expire, and section 24 makes the government the plaintiff, so no victim can withdraw the case as a favour to you.

The Muluki Criminal Code 2074. Ordinary cheating under section 249(3)(ग) carries up to seven years and a fine up to Rs 70,000, with an extra year where the victim was a child, illiterate, helpless or over 75. In practice this is often the charge that actually gets filed, which is worth knowing because it is the one people least expect.

"I did not know" is a real argument, and a weak one

Whoever recruits you will imply that you are insulated, because you never touched the fraud itself. The statutes are built to close exactly that gap.

Start with the mental element, which is disjunctive: knowingly or having reasonable grounds to believe. Section 42 then provides that knowledge, intent and purpose "shall be inferred from objective factual circumstances". Handing over an ATM card, taking a monthly fee, and being told not to tell anyone are objective factual circumstances. Section 28 goes further and puts the burden on you to explain property that is out of proportion to your income, with confiscation under 28(5) if you cannot.

A Full Bench of the Supreme Court stated the consequence bluntly in निर्णय नं. ९७०८ (माधवकुमार भगत v. Government of Nepal, 2073): if the defendant cannot show the source, it must be taken that he committed the offence of money laundering. The same decision dismisses the "it was someone else's money" line unless you can produce that someone else as a witness.

The counterweight is real but narrower. In निर्णय नं. १०९४१ (रमिलादेवी राउत, 2079) the Court held that where officers or members were passive, convicting them without seriously examining whether the evidence established a guilty mind risks grave injustice. In an earlier fraud case relatives at the far end of a transfer chain were acquitted because direct involvement was not proved. Neither of those is a decision about a rented bank account, and no Nepali reported case squarely on that fact pattern appears to exist yet. They are the analogy your lawyer would reach for, not a precedent you can rely on.

The Department of Money Laundering Investigation's annual report records the argument being run and failing. One defendant told the court he had committed no offence and knew nothing about the bag his brother had handed him to carry. Both were found guilty.

The freeze comes first, and you cannot lift it

Long before any of that is argued, the account stops working. This is the part people are least prepared for, because it happens on suspicion rather than proof.

Section 110 of BAFIA 2073 lets NRB direct any bank, at any time, to freeze an account, either at an investigating officer's request or to prevent money laundering and banking offences. NRB's बैंक खाता रोक्का तथा फुकुवा सम्बन्धी विनियमावली, 2081, in force since 1 Asoj 2081 (17 September 2024), sets three grades: every account you hold, one named account, or a specific amount locked with the rest usable. A first amendment in October 2024 let the bank itself freeze for up to 48 hours on information that money arrived by mistake or through an offence, after which it must be re-imposed through NRB. A June 2026 circular then required banks to act on a verbal request from an investigating officer, run this capability 24/7, and publish a dedicated contact number.

Under section 18 of the laundering Act, the investigating officer can freeze property "in whosoever's name" it stands, and 18(3)(ख) permits an ex parte order with no notice to you. You get written notice within three days. Holding it beyond a year needs the court's permission, an outer limit added in 2024. Getting out is a court application under 18(8), and the court may release only if the property is yours, you are not seen to be involved in any laundering offence, and there is no reasonable ground to treat it as proceeds. Your branch manager cannot help, and neither can NRB.

How long that takes is not published. The one documented timeline is the Supreme Court's निर्णय नं. १०७५९ (यामकुमार श्रेष्ठ v. Nepal Rastra Bank, 2078 Poush 7), where accounts frozen nationwide on 2076/10/21 were released by interim order on 2076/11/30, roughly five to six weeks later, and only because a writ was filed. The Court's language is worth keeping: a freeze imposed this way must not be indefinite, arbitrary or prejudicial, and its justification has to be established.

No agency publishes how many Nepali accounts are frozen in a year. Not NRB, not the Cyber Bureau, not DMLI. If yours is one of them, you are reasoning from a statute and a handful of reported cases.

You repay what the victims lost, not what you earned

Section 34क of the laundering Act requires that where someone has suffered loss and the amount is established, it is recovered from the offender and paid to the victim. Section 34 confiscates laundered property regardless of whose name it stands in, so money sitting in your account goes whether or not you put it there. The Banking Offence Act separately orders बिगो भराई, recovery of the amount, in addition to the fine.

The clearest illustration is the F1Soft case. About Rs 3.4 crore was taken from the company's Citizens Bank account over four days in October 2024, and a case was filed at Kathmandu District Court in January 2025 against 22 defendants, nine of them arrested. Police said more than 500 bank and wallet accounts were used, and the people charged were the first tier that received the money. The Cyber Bureau's spokesperson, SP Deepak Raj Awasthi, told Setopati: "Those arrested are not people with much knowledge of technology. They are people whose accounts were used." Most were between 18 and 24. One was a Grade 12 student.

One of them, Trigunratna Bajracharya, had answered a Facebook advert, moved to a Telegram handle, received Rs 3 lakh, forwarded it in three tranches as instructed, and kept Rs 20,000 as his "salary". He was arrested after walking into the Cyber Bureau himself. Reporting on the chargesheet put his exposure at Rs 28.25 lakh in fines, roughly 140 times what he was paid. The same officer's summary of the whole group: they are low-level facilitators who rent out their bank accounts, while the masterminds sit outside Nepal Police's reach.

That asymmetry is the entire economics of the arrangement. The operator buys a few thousand rupees of your risk and keeps the crore.

What a conviction does afterwards

The blacklist question gets muddled, so it is worth being precise. NRB Unified Directive 12, clause 9(2)(ख), allows blacklisting where a person is proven to be involved in an offence relating to financial transactions, which means the CIB blacklist is not limited to loan default and bounced cheques the way most people assume. But it turns on proof. An arrest, an investigation or a frozen account does not by itself put you on it.

If it does happen, clause 20 stops you opening any account at any bank or financial institution in Nepal and restricts existing ones to deposits only, with narrow carve-outs for a living-expense limit, government grants and paying taxes. Clause 3(4) requires every bank to check the CIB register before opening an account, so it is enforced at the counter. Clause 8 allows a licensed institution to recommend, through NRB to the Government of Nepal, that a new passport not be issued and an existing one be confiscated.

A fraud conviction is also the sort of thing that surfaces years later in a police report for a foreign job or a visa. Australia's federal police, whose anti-mule campaign was translated into Nepali among seven languages, warn international students that a criminal record can affect employment, travel and the ability to keep a student visa. That warning is Australian, and no case of a Nepali losing a visa or PR specifically over muling appears in the public record, but the point about a criminal record travels.

Why banks got much stricter in 2025 and 2026

If a teller has recently asked you awkward questions about a deposit, this is why. Nepal was placed on the FATF grey list on 21 February 2025 and remains on it, with an Asia Pacific Group review in January 2026 finding meaningful progress on only nine of the fifteen action-plan items. Suspicious transaction reports jumped more than 30% after the grey-listing, to 9,565 in FY 2024/25 per FIU-Nepal's annual report.

NRB then named the problem in its own words. Paragraph 131 of the Monetary Policy for FY 2082/83 commits to an action plan to cut dormant accounts "considering the significantly high number of dormant accounts in the BFIs and the risk of their misuse by other individuals such as money mule". Circular 18 of 2082/83 made that binding in July 2026: every bank must run a dormant-account reduction plan by end of Poush 2083, monitor unusual activity in accounts that went dormant and were then reactivated, and produce public awareness material about money mule transactions. Nepal has roughly 63 million bank accounts against a population half that size, and a dormant one is what gets sold.

Two practical consequences. National ID became mandatory for new accounts from 1 Magh 2081 (14 January 2025), with existing accounts to be linked by end of Asoj 2083, so an account is harder to open anonymously and easier to trace back. And the monitoring reaches wallets: threshold reporting for payment service providers triggers at Rs 10 lakh in a month across a customer's wallets, against Rs 10 lakh in a single day for cash at a bank, while suspicious transaction reports have no threshold at all. eSewa's terms already state that assigning your account to a third party is strictly prohibited and that losses from unauthorised use of your credentials are yours, which is the same logic behind the wallet KYC tiers.

Notice who NRB asked to warn the public. Under Circular 18 that duty sits with the banks rather than the regulator, which is part of why the message has travelled so poorly.

If your account has already been used

Speed and self-reporting are the only two levers you have.

1. Kill the access. Ask your bank to block the account, the card and mobile banking. Change every password. Get the linked SIM back under your own control, and if it was registered in your name and given away, report that too.
2. Report before someone reports you. File with the Nepal Police Cyber Bureau: the online portal, the toll-free 16600141516, or cyberbureau@nepalpolice.gov.np with a copy of your ID. The Bureau's January 2026 notice tells people in exactly this position to close such accounts immediately and lodge a confidential complaint against whoever arranged them.
3. Preserve the recruitment trail. Screenshots of the advert, the Telegram or WhatsApp thread, the payment records, the courier receipt for the card. In a case built on your name and your account number, this is the only material that distinguishes you from the operator. The Rukum student had blocked contacts and deleted chats before the police call came, which left her with nothing.
4. Expect the freeze to outlast the explanation. Releasing a frozen account is a court application, not a conversation with your branch. Get legal advice early rather than after the first summons.
5. Do not accept a "settlement" from the recruiter. The laundering Act makes the government the plaintiff, so there is no complainant who can drop it, and taking further money makes the objective factual circumstances worse.

Reporting does not guarantee anything. Of 4,112 cyber-enabled fraud incidents recorded in FY 2023/24, FIU-Nepal notes that a case was filed in only 25. That cuts both ways: enforcement is thin, and when it does land it lands on the visible name, which is yours.

What you actually need to know

• The account is the evidence. Nothing in the Banking Offence Act or the laundering Act scales the punishment to your commission. It scales to the amount that passed through, so Rs 10,000 a month buys you a fine measured against Rs 3 crore.
• The freeze arrives long before the verdict, and only a court lifts it. Your bank can freeze for 48 hours on its own and NRB for as long as an investigating officer asks; getting released takes a court application under section 18(8), and nobody publishes how long that takes.
• Every version of the pitch asks for the card, the password or the SIM. That single request is the tell, whether it comes from a Facebook job advert, a Telegram group, or a relative who says he will fill an IPO in your name. A genuine employer needs your account number and nothing else.

Been offered something like this, or worried an account of yours is already in the wrong hands? Email parjanya57@gmail.com.

This post is part of the Nepal Money Basics guide — the protect-what-you've-saved section. For the fraud that feeds these accounts in the first place, see OTP and phishing fraud in Nepal, the QR payment scams hitting shopkeepers, and what happens with a wrong transfer when money lands where it should not.