As per a report by MediaNama, a bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana on October 29 told the Reserve Bank of India (RBI) that its rules on digital arrest and cyber fraud must make financial institutions compensate victims. Verdictum, reporting the written order in In Re Victims of Digital Arrest Related To Forged Documents (SMW(Crl) No. 3/2025), says the RBI's proposed measures must require institutions to indemnify victims with compensation "not less than equivalent to the amount lost by the customer" where the fraud resulted from a failure of due diligence by the institution. The RBI's Know Your Customer Amendment Directions, 2026 are to be notified by November 30 and operationalised by December 31. The RBI had invited comments on its draft of those directions on September 11, 2026, in response to the Court's order of August 4, 2026, and the draft proposes a standard operating procedure for temporary debit holds on amounts or accounts linked to money-mule activity and cyber-enabled fraud.

MediaNama reports that the Court took up the matter on its own motion in October 2025, after a senior-citizen couple in Ambala lost Rs 1.05 crore. It says the bench indicated it would put strict liability on financial institutions, with "zero debit" in victims' accounts, that Chief Justice Kant described the RBI as "soft-pedalling" by consulting banks, and that every institution should suspend transactions inconsistent with an account's history, alert the nearest police station and physically verify a transaction before releasing it. Verdictum records losses of about Rs 800 crore this year and 9,400 accounts blocked through coordination involving WhatsApp, MeitY and the Department of Telecommunications. MediaNama adds that the Court asked the RBI to consider a one-hour delay on payments above Rs 10,000 and a payment kill switch, and told the Centre to file an affidavit and complete the National Cybercrime Reporting Portal by December 31; Verdictum's account of the written order does not mention the delay or the kill switch. The Court left open whether automatic police reporting fits the Digital Personal Data Protection Act, how to compensate customers whose transactions are wrongly held, and whether payment apps and wallets are covered. A next hearing date was not reported.