Rajasthan HC Lays Down Binding Rules on Bank Account Freezing in Cyber-Crime Cases, Orders DGP Circular Within Four Weeks
Justice Anand Sharma disposed of 105 writ petitions challenging arbitrary account freezes, directing that restraints be confined to disputed amounts and that the DGP issue a standing order within four weeks.
The Rajasthan High Court, Bench at Jaipur, pronounced a common judgment on 20 August 2026 disposing of 105 writ petitions filed by individuals, proprietary firms, and companies whose bank accounts had been frozen, debit-frozen, or subjected to lien markings by investigating agencies in connection with alleged cyber financial frauds. Justice Anand Sharma, sitting singly, held that a blanket account freeze without regard to the identifiable disputed amount is arbitrary and disproportionate, and that the extraordinary financial consequences of such action must rest on objective material, lawful authority, and a legitimate investigative purpose only to the extent reasonably necessary. The judgment issues a set of binding principles for all cyber-crime account freezes within Rajasthan and directs both the Director General of Police and the Reserve Bank of India to take concrete institutional steps within prescribed timelines.
The Grievance Across 105 Petitions
All 105 petitions raised a common complaint: bank accounts had been rendered wholly inoperative on the basis of communications from investigating agencies without adequate disclosure of the legal authority, the FIR or NCRP complaint number, the specific transaction, or the amount allegedly connected with the cyber fraud. Petitioners ranged from a 22-year-old resident of Jaipur to proprietorship goat farms, trading firms, and packaging units spread across Rajasthan.
In several matters the disputed sum was less than Rs. 100, Rs. 1,000, or Rs. 5,000, yet the entire account — holding substantially larger balances — was frozen. In others, the disputed amount had not been crystallised at all. Some petitioners had already received a clean chit or closure report from the investigating agency, but their accounts remained frozen. In yet other cases the freeze had been imposed by a police unit in a different State, and the account holder was being required to travel to that State merely to ascertain the reason for the restraint.
A separate category involved banks that had independently placed restrictions for KYC deficiencies, unusual transaction patterns, or suspected mule-account activity, without any police direction. The court treated these as a distinct class governed by the banking regulatory framework rather than criminal procedure.
Legal Framework: Sections 106 and 107 of the BNSS
Justice Sharma identified the Bharatiya Nagarik Suraksha Sanhita, 2023 as the controlling statutory framework. Section 106 of the BNSS, which corresponds to the former Section 102 of the Code of Criminal Procedure, 1973, empowers a police officer to seize property found under circumstances creating suspicion of an offence. Critically, Section 106(3) requires the officer to forthwith report the seizure to the Magistrate having jurisdiction. The court held this requirement to be mandatory.
Section 107 of the BNSS, dealing with attachment, forfeiture, or restoration of property derived from criminal activity, requires the Investigating Officer to file an application with the approval of the Superintendent of Police or Commissioner of Police before the competent Court or Magistrate. Judicial supervision is built into the provision, and notice and an opportunity of hearing must ordinarily precede attachment, with an exception for emergent ex parte orders.
The court drew a sharp distinction between the two provisions. Seizure for investigation is accompanied by mandatory Magistrate reporting; attachment of proceeds of crime requires a judicial order. Investigating agencies, it held, cannot achieve the practical result of indefinite attachment merely by labelling their communication to the bank a “freeze”, “debit freeze”, “lien”, or “seizure” without following the procedure prescribed for each category.
The Central Government SOP of 2 January 2026
The Ministry of Home Affairs, through the Indian Cybercrime Coordination Centre (I4C), issued a Standard Operating Procedure on 2 January 2026 for the National Cybercrime Reporting Portal (NCRP) and the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS). The SOP provides mechanisms for placing amounts on hold, suspension of digital banking services, seizure of accounts, restoration of money, and time-bound grievance redressal. The Central Government informed the court that the Grievance Redressal Module and the Money Restoration Module became functional in April 2026.
Clause 10.1 of the SOP requires a bank, upon receiving a customer's grievance, to undertake Customer Due Diligence and Enhanced Due Diligence and submit the grievance through the CFCFRMS Grievance Redressal Module within seven calendar days. The Investigating Officer then has a prescribed window to verify and respond.
The court held that the SOP is not an alternative to constitutional fairness but a mechanism intended to operationalise it. Failure of an officer or bank to act within the prescribed framework cannot become a justification for continuing an indefinite freeze.
How the Bench Reasoned on Proportionality
Relying on the Delhi High Court's decision in Neelkanth Pharma Logistics Pvt. Ltd. v. Union of India & Another, 2025 SCC OnLine Del 1055, the court accepted the principle that where the disputed amount is identifiable, marking a lien upon that amount should ordinarily be explored before freezing the entire account. In that case the Delhi High Court had noted that a substantial balance was frozen because of a credit of only Rs. 200.
The court also relied on its own earlier ruling dated 30 June 2026 in Jinat Bano v. State Bank of India & Another (S.B. Civil Writ Petition No. 5036/2026), where applying the doctrine of proportionality it directed the bank to remove the debit freeze while continuing a lien only on the disputed amount. The present judgment held those directions to be correct but insufficient to address the full range of grievances arising across the batch.
Four requirements, the court laid down, must govern every exercise of freezing power: first, there must be lawful authority; second, there must be tangible material disclosing a prima facie nexus between the account or transaction and the offence; third, the Investigating Officer must identify, as far as reasonably practicable, the transaction and amount requiring protection; and fourth, the restraint must be proportionate to the investigative necessity and cannot continue mechanically after that necessity ceases.
Expressions such as “suspicious transaction”, “mule account”, or “Layer-1 account” cannot by themselves constitute adequate reasons for immobilising an entire account. They may justify investigation, but they cannot substitute the material underlying the conclusion of suspicion.
The court acknowledged that a blanket freeze can be justified in exceptional cases — where the account appears to be a deliberately operated mule account, where there are repeated suspicious credits and onward transfers, where the account holder is a named accused or has materially participated, where the entire balance is reasonably suspected to be proceeds of crime, or where multiple linked transactions make segregation presently impracticable. Even in such cases, reasons for the wider restraint must be recorded in writing and periodically reviewed.
Directions to Police, Banks, and the RBI
The judgment sets out fourteen principles (A through N) that shall govern freezing, lien, hold, and seizure of bank accounts in cyber financial crime investigations within Rajasthan. Key among them:
No account shall be subjected to an indefinite blanket debit freeze on a vague or cryptic communication. Where the disputed amount is identifiable, the ordinary course shall be to preserve that amount by lien or hold rather than freeze the entire account. Where wider restraint is adopted, specific reasons must be recorded. The statutory reporting requirement under Section 106(3) of the BNSS must be complied with forthwith. Where the restraint is in substance an attachment of proceeds of crime, the procedure under Section 107 of the BNSS must be followed and a judicial order obtained. A freeze cannot continue indefinitely merely because investigation is pending, and its necessity must be periodically reviewed by the Investigating Officer and a supervisory officer.
Every communication to a bank must, to the extent permissible, clearly identify: the name and designation of the Investigating Officer; the police station or agency and contact details; the FIR, crime, or NCRP/CFCFRMS reference number wherever available; the legal provision under which action is taken; the account number; the transaction ID, UTR, or date; the disputed amount or the basis for a wider restraint; and whether the communication is intended as a hold on a specified amount, a suspension of digital banking, an account seizure, or a request for judicial attachment.
Where a bank receives a communication that mentions a suspected transaction without identifying the disputed amount, the bank's designated nodal officer must seek clarification from the requisitioning authority rather than mechanically converting a transaction-specific alert into a blanket freeze.
Independent banking restrictions arising from KYC, Anti-Money Laundering, or fraud-risk management obligations remain governed by the applicable law and RBI directions. Banks must clearly distinguish such action from a police-directed cyber-crime restraint and communicate to the customer the nature of the restriction and the steps required for rectification.
On inter-State matters, the court directed that Rajasthan Police and the concerned bank must communicate with the requisitioning agency from another State and obtain necessary clarification, rather than requiring the citizen to travel to another State merely to learn why the account is frozen.
Institutional Directions: DGP Circular and RBI Advisory
The Director General of Police, Rajasthan is directed to issue a comprehensive General Circular or Standing Order within four weeks incorporating all the principles and directions in the judgment. The Circular must be circulated to all Commissioners of Police, Range IGs and DIGs, District Superintendents of Police, Cyber Crime Police Stations, and all Investigating Officers dealing with NCRP and CFCFRMS complaints.
The DGP must also designate a senior officer at State level to monitor complaints regarding prolonged or disproportionate bank-account freezes and to coordinate with the State Cyber Crime Wing, CFCFRMS, and participating banks. That officer's mechanism must maintain data on the number of accounts frozen, amounts placed on hold, grievances received and resolved, and cases where blanket freezes were converted into transaction-specific liens.
Separately, the Reserve Bank of India is directed to issue a General Circular or Advisory to all scheduled banks and other regulated banking entities requiring them to conduct periodical training and sensitisation programmes for officials dealing with cyber-fraud complaints and account freezing. The training must cover: the modus operandi of cyber financial crimes; circumstances warranting a transaction-specific hold versus a blanket freeze; the distinction between a hold on a disputed amount and freezing the entire account; the statutory and procedural requirements for seizure or attachment; the civil and financial consequences of indiscriminate freezing; the applicable CFCFRMS and NCRP provisions and the SOP of 2 January 2026; and prescribed timelines for processing grievances. Banks must also maintain an internal mechanism for periodic review of restraints and prompt compliance with directions for removal of freeze upon cessation of investigative necessity.
Outcome
All 105 writ petitions were disposed of on 20 August 2026 with the general directions set out in the judgment. The concerned respondent banks and Investigating Officers are directed to undertake a review of each petitioner's account restraint in light of the principles laid down. Where the only basis for restraint is a transaction-specific cyber complaint and the disputed amount is identifiable, the bank must confine the restraint to that disputed amount and permit operation of the remaining balance. Where the Investigating Officer has already concluded that the account or funds are not required for investigation, communication for removal of the restraint must be issued to the bank forthwith.
The directions operate as general directions for all similarly situated cases in Rajasthan and are not confined to the petitioners before the court. They remain subject to any contrary order passed by a competent court on the particular facts of an individual case.
The DGP, Rajasthan, the competent officer of the Cyber Crime Wing, and the Reserve Bank of India are directed to submit a compliance report before the Registrar General of the Rajasthan High Court within eight weeks, indicating that the Circular and Advisory have been issued and circulated and describing the supervisory review mechanism put in place. The Registrar (Judicial) is directed to send copies of the judgment to the DGP, the DIG Cyber Crimes, and the Regional Office of the RBI in Jaipur forthwith. All pending applications also stand disposed of.