This week the rulebook itself was on trial. On 29 October 2026, the bench hearing India's suo motu digital-arrest fraud case paused before issuing its own directions — because the Reserve Bank of India is writing a rulebook for exactly this problem, and the court wants to read it first (Verdictum, 29 Oct 2026).
What changed
A bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V Mohana heard In Re Victims of Digital Arrest Related To Forged Documents [SMW(Crl) No. 3/2025], taken up suo motu in October 2025 after an elderly Haryana couple was defrauded using forged orders displayed over WhatsApp (Verdictum; suo motu notice, Oct 2025). With the amicus (14 October) and Attorney General's (28 October) notes on the record, the court held it is "inclined to issue certain directions" but will first examine the proposed Reserve Bank of India (Know Your Customer) Amendment Directions, 2026, "proposed to be notified by 30th November 2026 and to be operationalized by 31st December 2026" (Verdictum). The order then fixes the substance: RBI's measures "must mandate financial institutions to indemnify digital arrest or cyber fraud victims with suitable compensation not less than equivalent to the amount lost by the customer" where the fraud happened because the institution failed its due diligence (Verdictum). The bench also directed RBI to submit a list of all authorised financial institutions to be covered, so any directions apply sector-wide (The New Indian Express, 29 Oct 2026). The court recorded the economy's net loss from such fraud this year at almost ₹800 crore, named mule accounts as the major grey area, and issued strict instructions on closing new mule accounts; the CJI observed "soft-pedalling by the RBI, as it was consulting the banks while the Court was asking for action against them" (Verdictum; PTI, 29 Oct 2026). The draft under scrutiny is not new to this register: RBI released it on 11 September 2026, took comments until 2 October, and built it to implement the court's 4 August order for a standard operating procedure of temporary debit holds on funds and accounts linked to money-mule activity — covering commercial banks including small finance, payments, regional rural and local area banks, plus urban co-operative banks (RBI press release, 11 Sep 2026; Connect 2 Regulate).
Why it matters
The KYC directions are the operating manual for opening and monitoring every bank account in the country — and this edition is being written under a court deadline, with the court stating in advance what the final text must contain. The sequencing is itself the accountability mechanism: interim court order 4 August, public draft 11 September, comments closed 2 October, supervisory hearing 29 October, notification due 30 November, operation due 31 December (RBI press release, 11 Sep 2026; Verdictum). Every date is checkable. The court's stated fear was futility — the Attorney General asked for time so that directions "should not... prove ineffective" (Verdictum). The RBI register entry lists rule-writing powers as ordinary; for the rest of 2026, that power is exercised under supervision.
Who is affected
Victims of digital-arrest and cyber fraud gain the most concrete protection: once the directions operate, a bank found to have failed due diligence must pay compensation of at least the amount lost (Verdictum). The routes already exist: inform the bank immediately, report on the National Cyber Crime Reporting Portal at cybercrime.gov.in, and if the bank's response fails, escalate to RBI's Integrated Ombudsman at cms.rbi.org.in (RBI register entry). Every bank customer is affected a second way: the draft's debit-hold procedure lets banks temporarily freeze funds in accounts flagged for money-mule activity before any fraud is proven, so a wrongful hold needs its own complaint route through the bank and the Ombudsman (RBI press release, 11 Sep 2026; RBI register entry). Who pressed comments into that consultation is LobbyWatch's ledger; the industry bodies that borrow the resulting conduct rules are SROTrac's.
What to watch
- The 30 November notification test. Whether the final directions carry the compensation floor and mule-account duties exactly as the court stated them, or arrive softened (Verdictum).
- The next hearing's paperwork. RBI's list of covered institutions and the Union affidavit on the 9,400 blocked accounts are the court's follow-up deadlines (Verdictum).
- 31 December, twice over. The directions must be operational and the National Cyber Crime Reporting Portal build is expected complete by then, per the Attorney General (Verdictum).
- The consultation ledger. Which institutions commented on the KYC draft, and the draft-to-final diff is LobbyWatch exists to run (Connect 2 Regulate); the conduct rules the regulated community borrows back are SROTrac's.
Evidence
- 29 October 2026 order, bench, dates, compensation floor, ₹800 crore figure and mule-account instructions: Verdictum report of the order.
- Sector-wide list direction to RBI: The New Indian Express; loss figure and mule-account emphasis: PTI via Rediff.
- The draft under examination — release date, comment deadline, 4 August lineage, covered bank categories: RBI press release and Connect 2 Regulate.
- Origin of the case — October 2025 suo motu cognizance: Verdictum.
- Register entry updated this week: RBI.
Sources
- Verdictum (order report): https://www.verdictum.in/supreme-court/rbi-rules-must-banks-compensate-victims-not-less-amount-lost-due-diligence-fails-1624758
- Verdictum (suo motu, Oct 2025): https://www.verdictum.in/court-updates/supreme-court/in-re-victims-of-digital-arrest-related-to-forged-documents-supreme-court-takes-suo-motu-cognizance-1594905
- RBI press release (draft KYC Amendment Directions, 2026): https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=63587
- RBI Connect 2 Regulate (consultation): https://www.rbi.org.in/Scripts/Bs_Connect2RegulateDetails.aspx?prid=505
- The New Indian Express: https://www.newindianexpress.com/india/2026/Oct/29/banks-must-compensate-digital-fraud-victims-for-loss-if-due-diligence-failure-established-sc-2
- PTI via Rediff: https://money.rediff.com/news/market/supreme-court-mandates-bank-compensation-for-digital-fraud/57107320261029
- RBI Integrated Ombudsman: https://cms.rbi.org.in
- https://regtrac.cashlessconsumer.in/reg-rbi.html
Editorial swarm: tracker ✓ · evidence ✓ · advocate ✓ · institutional ✓ · skeptic ✓ · mapper ✓ · editor ✓ · gated by scripts/editorial.py on 2026-11-10 02:17 UTC.