Supreme Court: RBI rules due by 30 November must make banks at fault repay fraud victims
The Supreme Court order of 29 October, uploaded on 7 November: what it tells the RBI to write into its rules, what it does not order banks to pay now, and the dates to watch.
The Supreme Court has told the Reserve Bank of India (RBI) that its new rules must require banks and other financial institutions to pay victims of digital-arrest scams and other cyber frauds compensation “not less than the amount lost by the customer”, where it is established that the fraud happened because the institution failed to exercise due diligence in preventing or reporting it.1 The order, passed on 29 October and uploaded on 7 November, records that the RBI’s Know Your Customer (KYC) Amendment Directions are to be notified by 30 November and in force by 31 December. The next hearing is on 23 November.12
Rules the RBI drafted for April 2027 are now to take effect by 31 December
Dated steps in the Supreme Court's digital-arrest case and the RBI's rules, August to December 2026
Show tableHide table
| Date | Event | Detail |
|---|---|---|
| 4 Aug 2026 | Court orders an RBI procedure on mule accounts | |
| 11 Sept 2026 | RBI publishes its draft | Start date 1 April 2027 |
| 29 Oct 2026 | Hearing and order | |
| 7 Nov 2026 | Order uploaded | |
| 23 Nov 2026 | Next hearing | |
| 30 Nov 2026 | RBI to notify the Directions | |
| 31 Dec 2026 | Directions to be in force |
Source: Supreme Court record of proceedings, 29 October 2026; RBI press release, 11 September 2026 · as of 11 November 2026 · The last three dates are scheduled, not yet reached
01A direction to the regulator, not a refund order
The compensation paragraph opens “We reiterate and emphasize”: it tells the RBI what its rules must contain. It does not order any bank to pay any victim now, and it sets no amount in any case. The court said it would, “in the first instance”, examine the RBI’s Directions before issuing its own.1 It also listed safeguards it wants required of every institution: temporarily suspending transactions out of line with an account’s history, automatically informing the nearest police station, and physically verifying them.1
The RBI must file a list of all authorised financial institutions at the next hearing. Police chiefs in every state and union territory must report the status of digital-arrest cases and investigations, with copies to the Indian Cyber Crime Coordination Centre (I4C). WhatsApp LLC and “other concerned intermediaries” must tell the court what they propose to do to prevent these scams.1 MediaNama reports that this is the first time the court has asked platforms directly rather than through the government.2
02What today's rule covers, and what the draft adds
The RBI’s 2017 circular already gives a customer zero liability for an unauthorised electronic transaction caused by the bank’s “contributory fraud/ negligence/ deficiency”, and makes the bank credit the money within 10 working days of being told. Where a customer shared payment credentials, the customer bears the loss until reporting it.3 In a digital-arrest scam, people posing as officials pressure the victim into making the transfer, and MediaNama notes that the circular does not address payments a customer authorises after being deceived.4
The draft published on 11 September answers a different order, of 4 August, on mule accounts that receive stolen money.5 A bank’s systems, “including AI / ML-based tools”, flag a transaction of ₹1,000 or more; the bank puts a hold on it at once; the holder has 20 days to explain; and absent a police instruction the hold lasts at most 60 days. As drafted, it takes effect on 1 April 2027.6
Sources
- Supreme Court of India, record of proceedings, SMW(Crl) No. 3/2025, In Re: Victims of Digital Arrest Related to Forged Documents (copy hosted by MediaNama) — 29 October 2026, signed 7 November 2026
- MediaNama, Supreme Court asks WhatsApp to propose measures to stop digital arrest scams — 11 November 2026
- Reserve Bank of India, Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (RBI/2017-18/15) — 6 July 2017
- MediaNama, SC says RBI rules must make banks fully compensate digital arrest victims if banks fail due diligence — 30 October 2026
- Reserve Bank of India, press release: RBI invites comments on the Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 — 11 September 2026
- Reserve Bank of India, Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 — 11 September 2026
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
