One hundred and five writ petitions. One common judgment. And fourteen binding directions that now govern when — and how far — a citizen’s bank account may be frozen in a cyber financial crime investigation anywhere in Rajasthan.

Practice area: Cyber Law & Banking Reading time: ~9 minutes Updated: 20 August 2026

It is the first of the month. Salaries are due, GST has to be deposited, a school fee instalment is pending. You tap your card and the screen reads “Transaction Declined.” At the branch you learn that your entire account has been placed under a “debit freeze” on the strength of a letter from a cyber police station in another State. The disputed amount? ₹850, credited by a stranger who scanned your QR code. The ₹6 lakh sitting in the account — untouchable.

This is not a hypothetical. Over the last two years it has become an ordinary experience for shopkeepers, transporters, freelancers, homemakers and small companies across the country. The Rajasthan High Court has now examined the problem in detail and laid down binding law on it.

The judgment at a glance

Who the petitioners were, and what they complained of

The batch included individual account holders as well as proprietorship concerns, partnership firms and companies. Their grievance was identical in substance — bank accounts completely frozen, debit-frozen or lien-marked on the basis of communications issued by investigating agencies in connection with alleged cyber financial frauds. The Court identified five recurring patterns:

• A total absence of proportion. In several matters the disputed transaction was less than ₹100, ₹1,000, ₹5,000 or ₹10,000, while an entire account holding substantially larger sums was rendered inoperative.
• The amount was never crystallised. In some cases even the sum said to be connected with the offence had not been worked out — yet the account stood frozen.
• Neither accused nor suspect. There was no material demonstrating the account holder’s conscious involvement in the alleged fraud.
• Freezes surviving a clean chit. Investigation concluded, closure report filed, account holder exonerated — and the account still frozen.
• No FIR, no NCRP complaint. Only a letter, sometimes without the FIR or crime number, the nature of the offence, the disputed transaction, the amount involved, or the statutory provision under which the restraint was imposed.

A further grievance ran through the batch: the account holder approaches the bank and is sent to the police; the police point to an agency in another State; and representations remain unattended for months.

The rival submissions

For the petitioners

It was urged that in the present economic and technological environment a bank account is an essential instrument for receiving salary and business receipts, making payments, meeting statutory liabilities, paying employees and vendors, and maintaining day-to-day livelihood. The mere existence of a suspected transaction cannot justify depriving an account holder of access to his entire lawful balance; even assuming a particular credit is suspect, the restraint ought ordinarily to be confined to the identifiable disputed amount. Unless the investigation discloses a prima facie nexus between the account holder and the offence, a continuing blanket debit freeze amounts to punishment without trial. Several counsel appeared for the petitioners in this batch, among them Advocate Adarsh Singhal.

For the State and the investigating agencies

It was contended that cyber financial crimes are fundamentally different from ordinary offences because money moves rapidly through several layers and may disappear from the financial system before the investigation can trace it. In some matters the account holders were identified as Layer-1 recipients. At the stage of investigation, it was said, the Investigating Officer is not required to conclusively establish guilt — a reasonable basis for suspicion suffices, and the measure is preservative rather than punitive.

For the banks

The banks submitted that they ordinarily act upon lawful instructions from competent investigating agencies, and separately carry their own obligations under the applicable banking, KYC, anti-money-laundering and fraud-risk-management framework. They had no objection to operating the accounts in accordance with lawful and reasoned directions from a competent authority.

The Court’s approach: power measured against proportionality

The strength of this judgment lies in its balance. The Court began by accepting that the prevention and investigation of cyber financial crime is a matter of considerable public importance, and that the State has not merely the power but the duty to protect victims, prevent dispersion of the proceeds of crime and keep unlawfully diverted funds traceable. It then drew the line that had long been needed:

The existence of a legitimate investigative power does not mean that its exercise is immune from constitutional scrutiny… The seriousness of cyber-crime cannot justify abandoning the safeguards which protect an innocent citizen against arbitrary State action.— Judgment, paragraph 13

A bank account, the Court held, is undoubtedly “property” in the legal sense — but in contemporary life it is far more than a repository of money. It is the principal mechanism through which a person receives salary or business receipts and pays for food, education, medical needs, rent, taxes and utilities. For a business entity, a complete freeze may stop payment of employees, statutory dues, suppliers and creditors, and may effectively paralyse the enterprise. The civil consequences are therefore immediate, grave and disproportionate.

And then the illustration that captures the whole judgment: if the alleged cyber-fraud amount is ₹500 and the account contains ₹5 lakh, the object of the investigation is ordinarily achieved by preserving ₹500 — not by depriving the account holder of the remaining ₹4,99,500.

The label on the letter: Section 106 versus Section 107 of the BNSS

This is the most significant doctrinal contribution of the judgment. The Bharatiya Nagarik Suraksha Sanhita, 2023 contains two distinct schemes:

• Section 106 — seizure. Substantially corresponding to the former Section 102 CrPC, it empowers a police officer to seize property alleged or suspected to have been stolen, or found in circumstances creating suspicion of an offence. Significantly, sub-section (3) requires the officer to forthwith report the seizure to the Magistrate having jurisdiction.
• Section 107 — attachment. A new and specific provision dealing with attachment, forfeiture or restoration of property derived from criminal activity. It contemplates an application by the Investigating Officer, with the approval of the Superintendent or Commissioner of Police, to the competent Court; the Magistrate then applies a judicial mind and ordinarily issues notice and grants a hearing before attachment. In an emergent case an interim ex parte order may be passed.

The central principle

An investigating agency cannot be permitted to achieve, merely by labelling its communication a “freeze”, “debit freeze”, “lien” or “seizure”, a result which in substance amounts to indefinite attachment of a citizen’s property without following the procedure prescribed by law. What is in substance a seizure must be reported to the Magistrate; what is in substance an attachment must travel through Section 107. In the Court’s words, a bank cannot be used as a substitute for the statutory judicial process.

The authorities the judgment rests on

Neelkanth Pharma Logistics Pvt. Ltd. v. Union of India, 2025 SCC OnLine Del 1055. The Delhi High Court had noticed that an account with a substantial balance was frozen because of a credit of only ₹200. It observed that where the disputed amount is identifiable, marking a lien on that amount should ordinarily be explored as the appropriate interim measure rather than freezing the entire account, and that reasons must be furnished when a blanket freeze is sought.

Jinat Bano v. State Bank of India (S.B. Civil Writ Petition No. 5036/2026, decided 30.06.2026). In this earlier decision of the same Court, the doctrine of proportionality was applied to issue seven directions: lift the debit freeze forthwith; maintain a lien only to the extent of the disputed amount; the account holder to fully cooperate with the investigation; the account to be kept active and not closed without permission; the order not to be read as any expression on the merits; the investigating agency free to proceed in accordance with law; and, if involvement is ultimately established, the competent authority free to deal with the amount. The present judgment holds that the Jinat Bano directions shall be strictly followed — and that, being insufficient to cover the wider range of grievances in this batch, they needed to be supplemented.

The MHA / I4C Standard Operating Procedure dated 02.01.2026. Issued for the NCRP and the CFCFRMS, it deals with putting amounts on hold, suspension of digital banking services, seizure of accounts, restoration of money and grievance redressal. The Central Government has stated that the Grievance Redressal Module and the Money Restoration Module became functional from April 2026. The Court held that this mechanism is not an alternative to constitutional fairness but the means of operationalising it — and that the failure of an officer or bank to act within the framework cannot justify a continuing indefinite freeze.

Four requirements that must govern every restraint

The Court distilled the exercise of the power into four conditions — first, there must be lawful authority for the restraint; second, there must be tangible material disclosing a prima facie nexus between the particular account or transaction and the offence under investigation; third, the Investigating Officer must identify, as far as reasonably practicable, the transaction and amount requiring protection; and fourth, the restraint must be proportionate to the investigative necessity and cannot continue mechanically once that necessity ceases.

The judgment is equally blunt about vocabulary. Expressions such as “suspicious transaction”, “mule account”, “Layer-1 account” or “cyber fraud transaction” cannot by themselves constitute adequate reasons for indefinitely immobilising an entire account. They may justify investigation; they cannot substitute the material on which the conclusion of suspicion is founded.

So can an entire account ever be frozen?

Yes — as an exception, and with reasons recorded. The Court illustratively listed such cases: where the account itself appears to be a deliberately operated mule account; where there are repeated suspicious credits and onward transfers; where the account holder is a named accused or there is material showing conscious participation; where the entire balance is reasonably suspected to be proceeds of crime; where multiple linked transactions make segregation presently impracticable; or where partial operation would demonstrably defeat the investigation. Even then, the reasons for adopting the more restrictive measure must be recorded in writing and periodically reviewed.

The fourteen directions (A to N) for the entire State

1. No bank account shall be subjected to an indefinite blanket debit freeze merely on the basis of a vague, unverified or cryptic communication.
2. Before imposing or continuing a restraint, the Investigating Officer shall ascertain and record the material showing a prima facie nexus between the particular account or transaction and the offence.
3. Wherever the disputed amount is identifiable, the ordinary course shall be to preserve that amount by lien or hold rather than freeze the entire account — the directions in Jinat Bano to be strictly followed.
4. Where the entire account must be frozen, specific reasons for the wider restraint shall be recorded in the case diary or appropriate record and communicated to the bank.
5. Where the action constitutes seizure under Section 106 BNSS, the statutory requirement of forthwith reporting the seizure to the competent Magistrate shall be complied with.
6. Where attachment of proceeds of crime is sought, the procedure under Section 107 BNSS shall be followed and the matter placed before the competent Court.
7. A freeze shall not continue indefinitely merely because the investigation is pending; its necessity shall be periodically reviewed by the Investigating Officer and the supervisory officer.
8. If the investigation reveals no connection between the account holder and the offence, and the disputed amount need not be retained, the restraint shall be withdrawn forthwith.
9. On conclusion of investigation, filing of a closure report, exoneration, or a finding that the account is no longer required, defreezing instructions shall issue without avoidable delay.
10. Every communication to the bank shall, as far as permissible, carry sufficient particulars to identify the case, account, transaction and amount, and the legal basis of the action.
11. The bank shall not mechanically transform a transaction-specific request for holding a particular amount into a blanket freeze of the entire account.
12. Independent banking restrictions arising from KYC, AML or fraud-risk obligations remain governed by law and RBI directions, but must be clearly distinguished from a police-directed cyber-crime restraint.
13. The grievance redressal mechanism under Clause 10 of the SOP dated 02.01.2026 shall be strictly followed; a grievance shall not be left unattended merely because the underlying cyber complaint originated in another State.
14. Verification of a grievance should ordinarily be undertaken through electronic means or video conferencing; personal appearance shall not be insisted upon unless genuinely necessary and reasons are recorded.

What every letter to a bank must now contain

Under paragraph 34, and to the extent permissible without prejudicing the investigation, each communication must clearly indicate: (i) the name and designation of the Investigating Officer; (ii) the police station or agency and contact particulars; (iii) the FIR / crime / NCRP / CFCFRMS reference number, wherever available; (iv) the legal provision under which action is taken; (v) the account number and bank details; (vi) the transaction ID / UTR / date, wherever available; (vii) the disputed amount, or the basis for concluding that the entire account requires restraint; and (viii) whether the communication is intended as a hold or lien on a specified amount, a suspension of digital banking facilities, a seizure of the account, or a request for judicial attachment. Where a communication merely mentions a suspected transaction without identifying the amount, the bank must seek clarification through its nodal officer instead of converting a transaction-specific alert into an indefinite blanket freeze.

Institutional compliance: circular, monitoring officer and RBI training

• The Director General of Police, Rajasthan and the IG/DIG (Cyber Crime) shall, within four weeks of receipt of the judgment, issue a comprehensive General Circular / Standing Order incorporating these principles, to be circulated to all Commissioners of Police, Range IGs/DIGs, District Superintendents of Police, cyber crime police stations and Investigating Officers.
• The DGP shall designate a senior officer at the State level to monitor complaints of prolonged or disproportionate freezing, and to maintain data on accounts frozen, amounts held, grievances received and resolved, and cases where complete freezes were converted into transaction-specific liens.
• Investigating Officers are to be sensitised on five distinct concepts: a suspected transaction; a transaction-specific hold or lien; seizure under Section 106; attachment under Section 107; and independent banking restrictions under KYC/AML. The terminology used in letters to banks must correspond to the legal nature of the action actually intended.
• The Reserve Bank of India shall issue a General Circular / Advisory to all scheduled banks and regulated entities requiring periodical training and sensitisation of officials, in coordination with the State Cyber Crime Wing, and requiring banks to maintain an internal mechanism for periodic review of such restraints.
• The DGP, the Cyber Crime Wing and the RBI shall file a compliance report before the Registrar General within eight weeks. The Registrar (Judicial) is to forward copies of the judgment to the DGP, the DIG (Cyber Crimes) and the RBI’s Jaipur Regional Office.

The directions are not confined to these 105 petitioners

Paragraph 58 makes it explicit: the directions operate as general directions for all similarly situated cases concerning freezing, debit-freezing, lien marking, holding or seizure of bank accounts in cyber financial crime investigations within the State of Rajasthan — not merely for the petitioners before the Court. They remain, of course, subject to any contrary order passed by a competent Court in an individual case on its own facts.

On inter-State matters the Court was equally clear. Where the restraint has been imposed solely pursuant to an investigation outside Rajasthan, the Rajasthan police and the bank must themselves communicate with the requisitioning agency and obtain clarification, rather than requiring the citizen to travel to another State merely to learn why the account was frozen. Inter-State cyber investigation is a reality; the inter-State transfer of hardship to an innocent citizen cannot become its necessary consequence.

If your account is frozen: what to do now

1. Ask the bank in writingfor the basis of the restraint — whose letter, of what date, referring to which FIR or NCRP complaint, over what amount, and under which provision. This is now an entitlement, not a favour.
2. Establish the character of the restraint.Is it police-directed, or an independent KYC/AML action by the bank? The remedies and the route differ entirely.
3. Trigger the Clause 10 grievance.The bank must undertake Customer Due Diligence and Enhanced Due Diligence and, where justified, submit the grievance through the CFCFRMS Grievance Redressal Module at the earliest and not beyond seven calendar days, after which it is assigned to the concerned Investigating Officer for verification.
4. Build the documentary shield.Source of the disputed credit, invoices, GST and income tax returns, books of account, KYC records and the complete transaction trail. In most matters this is what decides how quickly the account is released.
5. Press the identifiable-amount point.If the disputed sum is ascertainable, the ordinary remedy under this judgment is a lien to that extent, with the undisputed balance left operable.
6. If representations go unanswered, move under Article 226.Where the prescribed timelines are ignored, the writ jurisdiction remains open — and there is now a clear, citable and binding precedent to rely on.

Frequently asked questions

Is a freeze illegal simply because the account holder is not named in the FIR?

No. The Court expressly declined to accept that broad proposition. Cyber financial frauds involve layers of transactions and an innocent intermediary account may receive proceeds without the holder’s knowledge; conversely, the absence of an FIR does not by itself preclude legitimate preliminary verification or urgent preservation. The decisive question is whether objective material shows a reasonable and proximate nexus between the account or transaction and the offence, and whether the extent and duration of the restraint are reasonably necessary. That said, an unverified or vague communication cannot alone sustain an indefinite freeze.Does the judgment tie the hands of investigating agencies?

No. Paragraphs 37 and 54 make clear that nothing prevents immediate action in an emergent situation to stop dissipation of suspected proceeds, and that the directions are not intended to interfere with a bona fide investigation or to compel disclosure of sensitive information. What is prohibited is the conversion of an urgent, temporary investigative measure into an indefinite and disproportionate deprivation without subsequent application of mind and compliance with statutory safeguards.What if the bank imposed the restriction on its own, for KYC or suspicious-transaction reasons?

Nothing in the judgment disables a bank from acting under RBI directions, KYC norms, the anti-money-laundering framework or other law. But such action must be clearly distinguished from a police-directed cyber-crime freeze, and the bank must communicate to the customer the nature of the restriction and the steps required for rectification — subject to restrictions on disclosure imposed by law.The investigation ended in a clean chit but the account is still frozen. What now?

Paragraph 39 addresses precisely this. Whenever an investigation is concluded, a closure report is filed, the account holder is exonerated, or the Investigating Officer forms the opinion that continuation is unnecessary, the officer shall forthwith communicate the decision to the bank and update the CFCFRMS/NCRP record. The bank shall then remove the police-directed restraint expeditiously — subject only to any independent statutory restraint lawfully existing for unrelated reasons.The judgment in one line?

Secure the money, not the person — where the disputed amount is identifiable, a lien is the ordinary remedy and a blanket freeze the exception, and even that exception requires written reasons and periodic review.

Conclusion

This judgment does not weaken the fight against cyber crime; it makes it more credible. As the Court itself put it, that fight will be strengthened, not weakened, when investigating agencies distinguish between a genuine mule account and an innocent account into which an isolated transaction has incidentally travelled. And the closing thought is worth carrying: effective measures against cyber fraud are essential, but protecting bona fide account holders from arbitrary or disproportionate restrictions is equally necessary — because a fair, transparent and time-bound mechanism for freezing and defreezing accounts safeguards property rights and reinforces citizens’ faith in digital transactions and the formal banking system alike.

About the author

Adarsh Singhal & Associates appears before the Supreme Court of India and the Rajasthan High Court in matters of cyber law, digital fraud and bank account freeze / lien litigation, and conducts cyber law training for police officers.

Chamber No. 109, E-Block, Rajasthan High Court, Jaipur
Office: LG-1, Shivam Enclave, Triveni Nagar, Jaipur — 302018
+91-8952090299  |  advadarshsinghal@gmail.com

Disclaimer: This article is published for general information and legal awareness only and does not constitute legal advice. The facts of every case differ; please consult a qualified advocate before acting. Passages have been paraphrased or condensed from the judgment — for any legal use, please refer to the original text of [2026:RJ-JP:33344].