A restricted account is a decision the bank still owes an answer on

I want to begin by saying what this essay is not. It is not an argument for loosening the controls that Chinese banks now apply to accounts used in telecom and online fraud. Those controls were overdue. For years rented and sold accounts carried the proceeds of scams that emptied the savings of older people, and since the anti-telecom and online fraud law took effect at the end of 2022 banks have had clear duties to find such accounts and limit what they can do. My bank takes those duties seriously, and so do I.

My argument is narrower. When a bank restricts an account because one of its own monitoring rules has fired, it has made a judgement about a customer on incomplete evidence. That judgement should be treated as an open decision, with an owner, a time limit and a release route the customer can actually use. And the board committee that oversees fraud risk should see how long the bank takes to release legitimate customers alongside how much fraud it has stopped, because either number on its own tells a flattering story.

Who was behind the restrictions

When eleven rural banks and credit cooperatives merged into Xuantang Rural Commercial Bank in November 2023, we inherited their monitoring rules along with their customers. By early 2024 we had 23,600 personal accounts under restrictions created by those rules, mostly suspensions of mobile and non-counter payments. Nobody had looked at them as a population. Each restriction had been justified when it was applied, and each sat in a queue belonging to the outlet where the account had been opened.

My team sampled 600 of them. In 71% of cases the customer had an ordinary explanation that a short conversation would have established. Migrant workers paid by several employers in a month looked like accounts collecting from many victims. Older people receiving small transfers from children and grandchildren in different cities looked the same. So did vegetable traders who collected from dozens of buyers before dawn. The rules were not foolish. They were written to catch patterns that fraud does produce, and they caught many innocent people producing the same patterns for innocent reasons.

What turned a reasonable rule into harm was the release process. A customer had to return to the outlet that opened the account, with identification and an explanation. For a migrant worker in a coastal city, that meant a journey of a thousand kilometres. The median time from restriction to decision was nineteen days, and restrictions were the largest single category of complaint we received, with 3,900 in 2023. Behind each complaint was usually a wage that could not be spent, a pension that could not be moved or a stall that could not take payments.

A clock, an owner and a counter that can act

The changes we made in 2024 were not technically difficult. Every restriction created by our own rules now has a named owner in a central review team of forty-six people and a clock of three working days from the customer's first contact. Any of our outlets can verify the customer, not only the one that opened the account. Customers who are far away can be verified by video. And every restricted customer receives a letter saying why the account has been limited and how to have it reviewed, which we rewrote after six older customers told us the first version was unreadable.

We did not touch restrictions instructed by the public security organs. Those follow a legal process of their own, and a bank that second-guesses them is making a different kind of mistake. Nor did we promise to release anyone. A review can confirm a restriction, and about one in five do.

The objection came from our head of legal, compliance and anti-fraud, and it deserved a careful answer. The bank's exposure, he argued, was asymmetric. If we released an account and it later carried stolen money, the bank could face penalties and a supervisory finding. If we kept an innocent customer waiting, the cost fell on the customer. He was right about the asymmetry. I argued that this was exactly why the bank should not leave the decision to whatever default the queue produced, because a default that always favours the bank is itself a choice the bank is responsible for.

We agreed two safeguards. Accounts receiving funds from several unrelated sources get a second review before release. And a quarterly sample of released accounts goes to the board's risk management committee, with any that were later misused described individually. That figure has stayed at about 0.4%. The review team costs about RMB 21 million a year, which our chief financial officer reminds me of each budget round.

What a risk committee should read beside the fraud figure

Most fraud reports that reach a bank's board describe what was stopped: losses reported by customers, transactions intercepted, accounts restricted, referrals to the police. Those are the right numbers to watch, and ours have improved. Customer-reported telecom fraud losses fell from RMB 38.6 million in 2023 to RMB 14.2 million in 2025, mostly because counter staff learnt to recognise an older customer being coached by telephone to move savings into a so-called safe account.

But a report that counts only what was stopped rewards a bank for restricting more. Under such a report, a rule that catches one fraudster and freezes a hundred honest customers looks like a success. Our board now receives, beside the loss figures, the number of accounts under bank-originated restriction, the median and longest release times, the share of reviews that confirm the restriction and the misuse rate among released accounts. Once those numbers sat on the same page, we retired fourteen of thirty-seven overlapping rules within a year, and the population of restricted accounts fell to 9,800. I should have proposed that before building the review team. It would have spared several thousand customers a wait.

I do not claim our standard suits every bank. A bank whose customers are mainly urban salary earners will see different patterns, and a three-day clock may be too slow or too generous for it. I would only ask a board to request three things. How many accounts has the bank restricted on its own initiative, and how long have they been restricted? Who is responsible for each one? And how would a customer two provinces away have the decision reviewed? If nobody can answer those questions, the bank has controls but has not yet taken responsibility for them.