New Delhi: The Supreme Court has reiterated that the RBI’s proposed Know Your Customer (KYC) rules must make financial institutions indemnify victims of digital arrest scams and other cyber frauds, and pay compensation “not less than the amount lost by the customer”, where the fraud occurred due to the institution’s failure to exercise due diligence in preventing or reporting it.
A Bench of the Chief Justice of India, Justice Joymalya Bagchi and Justice V. Mohana passed the order on 29 October 2026 in the suo motu case “In Re: Victims of Digital Arrest Related to Forged Documents” (Suo Motu W.P. (Crl.) No. 3 of 2025).
The Court allowed an intervention application (I.A. No. 167477/2026) and noted that the Amicus Curiae, Ms. N.S. Nappinai, Senior Advocate, had made suggestions and proposed directions in her Note of 14.10.2026, and that the Attorney General for India had placed on record a Note of 28.10.2026 suggesting directions on behalf of the Union of India. The Court said that, though it was inclined to issue appropriate directions, it would in the first instance examine the Reserve Bank of India (Know Your Customer) Amendment Directions, 2026, which are proposed to be notified by 30 November 2026 and operationalised by 31 December 2026.
The Court emphasised that the regulatory measures proposed by the RBI must mandate suitable provisions requiring financial institutions to indemnify victims of digital arrest scams and other cyber frauds. Compensation, it said, must be not less than the amount lost by the customer, but only where it is established that the fraud or crime occurred because of a failure by the financial institution to exercise due diligence in preventing or reporting the act.
The Court also recalled the preventive safeguards it had emphasised in the past for every financial institution, which may include temporarily suspending unusual or suspicious transactions inconsistent with the account’s past transaction history, automatically intimating such transactions to the nearest police station, and then physically verifying the reported transactions to ascertain their genuineness.
To ensure effective implementation, the Court directed the RBI to submit a list of all authorised financial institutions on the next date of hearing. It also directed all law enforcement agencies in the States and Union Territories to submit the status of the FIRs registered so far in digital arrest scam cases and the investigation undertaken, and to suggest measures for the prevention, detection and prosecution of such cases. The Directors General of Police of all States and Union Territories must ensure compliance, and the information is to be forwarded simultaneously to the Indian Cyber Crime Coordination Centre (I4C).
The Court further directed WhatsApp LLC (a Meta company) and other concerned intermediaries to apprise it of the measures they propose to take to prevent digital arrest scams and related cybercrimes, and to submit their proposals to the I4C at the same time.
The Court did not issue final directions on compensation, and has posted the matter for further consideration on 23 November 2026. The order was passed in a batch of matters that includes W.P. (Crl.) No. 15 of 2026, SLP (Crl.) No. 4942 of 2026, SMW (Crl.) No. 3 of 2026 and W.P. (Crl.) No. 276 of 2026, along with a large number of intervention and other applications.
Case Title: In Re: Victims of Digital Arrest Related to Forged Documents, Suo Motu Writ Petition (Criminal) No. 3 of 2025, with W.P. (Crl.) No. 15 of 2026 and connected matters
