A compensation floor tied to bank conduct
On 29 October 2026, a bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V Mohana, hearing the digital arrest scam case it took up on its own motion, said the Reserve Bank of India's forthcoming rules must require financial institutions to pay victims "suitable compensation not less than equivalent to the amount lost by the customer" where the fraud occurred "as a result of the failure of due diligence" by the institution. MediaNama reports that the court wants the RBI's KYC Amendment Directions, 2026 notified by 30 November and in force by 31 December.
The court did not make banks insurers against every scam. The trigger is the bank's own failure, and the amount is a floor ("not less than"), not a cap. In court, Justice Bagchi said the court would "put up a strict liability on the financial institutions". That was an oral remark, as MediaNama records it, not order text, so the operative standard is due diligence, and it is not yet defined.
The case for the court's approach
The strongest argument for this ruling is about incentives. Digital arrest victims are told they are under "arrest" and are pressured into moving money themselves. MediaNama notes that the RBI's existing framework, built around unauthorised transactions, fits these cases poorly. That framework is the RBI's 6 July 2017 circular on limiting customer liability. It gives zero liability where a loss stems from bank-side negligence or from a third-party breach reported within three working days, and it puts "the burden of proving customer liability" on the bank. A victim who authorises the transfer under duress falls outside both.
Banks, meanwhile, are the only party that can see an account's behaviour in real time. The court's scale concern is real. Describing losses of over ₹54,000 crore to digital fraud as "robbery or dacoity" on 9 February 2026, the bench noted that the sum exceeds the budgets of many small states. Against that, the August 2026 status report shows ₹18.05 crore restored across 36,290 cases. Putting the cost on the party best placed to prevent the loss is a sound principle, and the restoration gap shows why voluntary recovery has not been enough.
What banks are being asked to do
According to MediaNama's summary of the order, every financial institution must be required to:
- temporarily suspend transactions that are out of line with an account's past activity;
- automatically inform the nearest police station about them;
- physically verify that the transaction is genuine before releasing it.
The first duty is not new in principle. The RBI's Master Direction on KYC, last updated 14 August 2025, already defines on-going due diligence as "regular monitoring of transactions in accounts to ensure that those are consistent with RE's knowledge about the customers." The court is converting a supervisory expectation into a liability trigger. That is a significant change, because a bank that monitored badly now faces a direct financial penalty and not only a supervisory finding.
Where proportionality gets tested
A pro-innovation reading should not oppose the liability rule. Clear liability is often what pushes firms to build better fraud controls. The risk is in the implementation, in three places.
First, the definition of "failure of due diligence". MediaNama flags that it is unclear who decides it. If the standard is vague, banks will protect themselves by treating every unusual payment as suspect. Honest customers pay for that in delayed rent, medical bills and business payments. A workable rule would state objective, auditable benchmarks: documented alert thresholds, response times, and an escalation record. A bank that met them would have a safe harbour. A bank that ignored its own alerts would not.
Second, holds without a remedy. The RBI's draft on mule accounts, as MediaNama describes it, would flag suspected transactions of ₹1,000 or more and allow holds "for up to 60 days, unless the police direct otherwise." It reportedly carries no compensation for wrongful holds. If banks are strictly liable for fraud that gets through, but customers cannot recover from a hold that proves wrong, the incentive points one way. Banks will freeze first and ask questions later. The August order already points to the fix: the RBI's SOP on debit holds must include "a grievance redressal mechanism" and a money-restoration module. A time limit on holds and a duty to release them promptly should come with the liability rule.
Third, physical verification. Requiring it for every flagged transaction would be disproportionate in a country where payments run at scale. Verification should be risk-tiered: a call-back or branch check for high-value or high-anomaly transfers, and automated checks for the rest.
Why the timeline matters
The court's calendar is tight. The RBI has about a month to notify and two months to bring the rules into force. MediaNama reports that the mule-account draft would otherwise have taken effect only on 1 April 2027, so the order accelerates the rules. Speed is useful when losses are running high (the Centre told the court that net losses this year were still almost ₹800 crore), but rushed drafting is how vague standards get written. The court has said it wants to examine the directions before issuing its own, which leaves room to correct them.
What to watch
Three things will show whether this becomes a model or a blunt instrument. The first is whether the final text defines due diligence in objective terms. The second is whether wrongful holds get a remedy. The third is whether the liability sits on the institution, as the chief justice insisted, "not just the officer involved". If the RBI gets these right, India will have a fraud-liability regime that rewards good controls and still lets legitimate payments move. If it gets them wrong, the cost of every false alarm will fall on ordinary customers.