Digital Arrest Supreme Court Order: Banks to Compensate Victims Under RBI KYC Rules

What happened

On Thursday, 29 October 2026 (as reported by LiveLaw and Verdictum that day), a Supreme Court bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V Mohana heard the suo motu case *In Re: Victims of Digital Arrest Related to Forged Documents*, SMW (Crl) No. 3/2025. According to LiveLaw and Verdictum, the Court said that the RBI's proposed measures must require financial institutions to compensate victims of digital arrest and other cyber frauds with an amount not less than the amount lost, where the fraud resulted from the institution's failure to exercise due diligence.

The Court said it was inclined to issue the directions proposed by both the amicus curiae and the Union, but would first examine the proposed Reserve Bank of India (Know Your Customer) Amendment Directions, 2026. As recorded by the Court, these are proposed to be notified by 30 November 2026 and made operational in December (Verdictum reports the date as 31 December 2026). The RBI must place a list of all authorised financial institutions before the Court at the next hearing.

*Note:* a separate article covers the ethics side of the same hearing: Digital arrest scams and senior citizens: ethics notes. This article covers the legal and banking order.

Background

• Suo motu case. As reported by Verdictum, the Court took up the matter on its own in October 2025, after a senior citizen couple in Haryana lost Rs 1,05,50,000 to a digital arrest scam.
• 4 August 2026 directions. The same bench directed the RBI to adopt and circulate, within four weeks, a standard operating procedure (SOP) for banks on short-term debit holds on accounts linked to cyber-enabled fraud, with a grievance redressal mechanism and a money restoration module. It also asked States and UTs to set up State Cyber Crime Coordination Centres within four weeks, and asked the authorities to examine a shared liability and victim compensation framework (LiveLaw).
• RBI draft of 11 September 2026. Following that order, the RBI released the draft KYC Amendment Directions, 2026. They update the money mule provisions in the KYC Directions, 2025 and set out steps for temporary debit holds. One consolidated draft covers commercial banks (including small finance, payments, regional rural and local area banks) and urban cooperative banks. Comments were invited till 2 October 2026 (RBI press release).

Key details

Oral remarks during the hearing, as reported:

• The net loss to the economy from such frauds this year was put at almost Rs 800 crore (LiveLaw attributes this to the CJI). The CJI also remarked that the bank "will compensate victim and suffer prosecution" where it fails in due diligence (LiveLaw).
• Justice Bagchi said strict liability would apply to financial institutions where their accounts or products are misused for such frauds (Verdictum).
• The amicus curiae, Senior Advocate NS Nappinai, cited a recent case in which a woman lost Rs 2.5 crore (LiveLaw).

How this differs from the existing rule. Under the RBI circular of 6 July 2017 on unauthorised electronic banking transactions, a customer has zero liability where the loss arises from the bank's contributory fraud, negligence or deficiency, and also where a third-party breach is reported within three working days. The bank must shadow-credit the disputed amount within 10 working days, and the burden of proving customer liability lies on the bank. But a customer who shares payment credentials bears the loss until reporting. In a digital arrest the victim usually authorises the transfer under fear, so it is not clearly an "unauthorised" transaction. The Court's approach targets the bank's own due diligence instead. Separately, the RBI's amended customer-liability framework, finalised on 24 June 2026, takes effect on 1 January 2027.

Why it matters

• Shifts risk to the stronger party. Banks control KYC, transaction monitoring and account opening. Tying liability to their due diligence gives them a reason to stop mule accounts and odd transfers.
• Prevention, not post-mortem. As Verdictum reports, the Court said a report alone would be a post-mortem and its concern is prevention. Holding unusual transactions for checks targets the moment of loss.
• Court and regulator in tandem. Instead of writing banking rules itself, the Court is waiting for the expert regulator's directions and will test them. This respects separation of functions while keeping oversight.
• Uniform coverage. Asking for a list of all authorised institutions aims to bring every regulated entity, not only large banks, within the rules.

Issues and criticism

• Who should fix liability. The Attorney General opposed the amicus's proposed directions and argued that bank liability should be set by the RBI (LiveLaw).
• Proving failure. "Failure of due diligence" must be defined clearly, or disputes may simply move from police stations to banks and courts.
• Customer friction. Suspending transactions that break an account's pattern may also delay genuine large payments, such as medical or property payments.
• Insider role. The CJI noted that the involvement of bank officials compounds the problem (LiveLaw); internal controls matter as much as customer alerts.
• Data gaps. The loss figure mentioned in court was an oral estimate, not an audited number.

Way forward

• Notify the KYC Amendment Directions on time, with clear tests of due diligence and a fixed timeline for compensation.
• Link transaction holds with automatic police alerts and the 1930 helpline so that money is frozen in the first hours.
• Strict action against bank staff who help open or run mule accounts.
• Public awareness that no agency arrests anyone over a video call.

Banking aspirants can revise RBI topics on the bank exams page.

Prelims pointers

• Case: *In Re: Victims of Digital Arrest Related to Forged Documents*, SMW (Crl) No. 3/2025, a suo motu case.
• Bench: CJI Surya Kant, Justices Joymalya Bagchi and V Mohana.
• Compensation standard: not less than the amount lost, where the institution's due diligence failed.
• RBI rules awaited: Reserve Bank of India (Know Your Customer) Amendment Directions, 2026; draft released 11 September 2026.
• Proposed timeline: notify by 30 November 2026; operational in December 2026 (31 December, per Verdictum).
• 4 August 2026 order: RBI SOP on temporary debit holds within four weeks.
• RBI customer-liability circular: 6 July 2017; amended framework effective 1 January 2027.

One-liners for SSC, Banking and Railways

• Chief Justice of India in this case: Surya Kant.
• Digital arrest: fake officials keep a victim on a video call under false "arrest" to extract money.
• Money mule account: an account used to route fraud money.
• Under the 2017 RBI framework, banks must shadow-reverse a disputed amount within 10 working days.
• Customer has zero liability if a third-party breach is reported within 3 working days.

Mains practice question

*"Placing liability on banks for cyber frauds that slip past their due diligence is the most effective form of prevention." Critically examine in the light of the Supreme Court's recent approach to digital arrest scams. (250 words)*

Points to cover:

• The Court's standard: compensation not less than the loss where due diligence failed; preventive holds and police alerts.
• Gap in the 2017 customer-liability framework for transactions made by the victim under fear.
• Concerns: defining due diligence, customer friction, regulator's domain (AG's stand).
• Way forward: timely RBI directions, mule account crackdown, faster freezing, awareness.