Supreme Court Seeks Cyber Fraud Compensation Where Financial Institutions Fail Due Diligence
In an order dated 29 October 2026, the Supreme Court said proposed RBI safeguards must provide compensation of at least the amount lost by digital arrest and other cyber fraud victims where a financial institution's due diligence failure is established. The court also sought investigation updates from states and Union Territories and prevention proposals from WhatsApp and other intermediaries.
The Supreme Court has reiterated that proposed Reserve Bank of India (RBI) regulations must require financial institutions to compensate digital-arrest and other cyber-fraud victims where an established failure of due diligence caused the fraud.
In an order dated 29 October 2026, the court said compensation in such cases must not be less than the amount lost by the customer.
The compensation requirement is linked to proven institutional failure, not automatic reimbursement for every cyber-fraud victim.
Compensation for failures to prevent or report fraud
The order came in the suo motu proceedings titled “In Re: Victims of Digital Arrest Related to Forged Documents”, Suo Motu Writ Petition (Criminal) No. 3/2025.
The court said the RBI’s proposed regulatory measures must include provisions requiring financial institutions to indemnify victims where the fraud occurred because the institution failed to exercise due diligence in preventing or reporting the incident.
The court considered suggestions submitted by amicus curiae N.S. Nappinai and the Union government. Before issuing further directions, it said it would examine the proposed RBI Know Your Customer Amendment Directions, 2026.
The order records that the amendments were proposed to be notified by 30 November 2026 and operationalised by 31 December 2026. These are proposed timelines recorded by the court, not confirmation that the framework is already in force.
Suspicious transactions and preventive safeguards
The court outlined safeguards that financial institutions could be required to adopt.
These “may include”:
- temporarily suspending unusual or suspicious transactions inconsistent with an account’s transaction history,
- automatically informing the nearest police station and subsequently physically verifying the transactions’ genuineness.
The order describes these as possible safeguards; it does not impose a blanket requirement to suspend every unusual transaction.
The RBI was also directed to submit a list of all authorised financial institutions at the next hearing.
States must report FIRs and investigation progress
Law enforcement agencies across all states and Union Territories were directed to submit the status of FIRs registered in digital-arrest cases and the resulting investigations.
They must also suggest measures to improve prevention, detection and prosecution. Directors General of Police must ensure compliance, and the information must simultaneously be forwarded to the Indian Cyber Crime Coordination Centre (I4C).
WhatsApp and other intermediaries must submit proposals
The court directed WhatsApp LLC, identified in the order as a Meta company, and other concerned intermediaries to explain the measures they propose to prevent digital-arrest scams and related cybercrimes.
Their proposals must also be submitted to I4C.
The matter is scheduled for further consideration on 23 November 2026.