1. Critical Information Infrastructure - CII

Legal Basis:

Section 70(1) IT Act, 2000: "The appropriate Government may, by notification in the Official Gazette, declare any computer resource which directly or indirectly affects the facility of Critical Information Infrastructure, to be a protected system."

Definition: "Critical Information Infrastructure means the computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety."

Framework:

• NCIIPC: National Critical Information Infrastructure Protection Centre established in 2014 under Section 70A is the nodal agency.
• RBI Cybersecurity Framework: RBI issued Cyber Security Framework in June 2016 for banks, replaced on 31 July 2026 by RBI (Commercial Banks – Cybersecurity, Technology Risk, Resilience and Assurance Framework) Directions, 2026. It mandates SOC, 6-monthly Vulnerability Assessment, annual Penetration Test, half-yearly DR drills.
• Declarations: Govt has declared IT resources of ICICI Bank, HDFC Bank, NPCI as CII under IT Act. On such declaration, unauthorized access is punishable with imprisonment up to 10 years under Section 70.

2. What are Cyber Reserve Accounts?

In banking parlance, when you hear "Cyber Reserve Account" / "Cyber Lien Account" / "Hold Account", it means:

An account in which a bank has marked a lien / debit freeze on the basis of a communication from Law Enforcement / Cyber Crime Cell / National Cyber Crime Reporting Portal (NCRP) under Section 106 BNSS (erstwhile Section 102 CrPC).

Mechanism:

1. Victim reports on 1930 / cybercrime.gov.in
2. Money trail is tracked via Citizen Financial Cyber Frauds Reporting and Management System (CFCFRMS) of I4C, MHA.
3. Investigating Officer issues notice to Nodal Officer of bank to freeze.
4. Bank marks lien.

New RBI Proposal 2025-26 to fix misuse: RBI has floated draft rules to standardise account blocking. Core principles:

• Freeze ONLY disputed amount of Rs 1,000 or more, not entire account
• AI-based monitoring for mule accounts
• Cap of 60 days freeze without statutory order

3. Detailed Case Laws on Freezing of Bank Accounts

This is where litigation is maximum.

A. FOUNDATIONAL CASE - Is Bank Account "Property"?

State of Maharashtra v. Tapas D. Neogy (1999) 7 SCC 685 - Supreme Court
Held: Bank account is "property" within meaning of Section 102 CrPC and police has power to seize / freeze bank account if it has direct link with commission of offence. This is the base of all cyber freeze powers.

B. PROCEDURE FOR FREEZE

Teesta Atul Setalvad vs State of Gujarat (2018) 2 SCC 372 - Supreme Court
Held: If officer concerned has followed procedure prescribed in Section 102 CrPC (present Section 106 BNSS) then freezing of account by bank is legally justified. Bank is bound to comply; requirement is reporting to Magistrate forthwith.

C. LIMITATION OF SECTION 106 BNSS vs ATTACHMENT

Recent shift after BNSS 2023 came into force on 1 July 2024:

1. Delhi High Court - Transition from CrPC to BNSS (2025)
Court observed that while power to freeze under Section 106 BNSS (Sec 102 CrPC) is valid during immediate investigations to track money trails via NCRP, any prolonged, indefinite freezing without formal application for attachment under Section 107 BNSS infringes upon Article 300A.
Logic: Sec 106 = Seizure for evidence (temporary). Sec 107 = Attachment of proceeds of crime (needs court order).

2. Headstar Technologies Pvt Ltd v. State of Kerala, 2025 LiveLaw (Ker) 339 - Kerala High Court
Held: CrPC's lacuna in providing for attachment of domestic proceeds of crime is what Section 107 BNSS was inserted to cure, retaining Section 102 CrPC as Section 106 BNSS for seizure alone.

3. Delhi High Court - Quashing of Debit Freeze Orders (2025)
"The law stands well-settled that under section 106, an investigating agency has no power to attach or debit freeze an account," the court said, quashing orders. Distinction between lien (seizure) and debit freeze (attachment).

D. PROPORTIONALITY & ENTIRE ACCOUNT FREEZE

1. Calcutta High Court - Entire Bank Account Cannot Remain Frozen for ₹2,253 Dispute
Facts: Notice dated 8 May 2025 from Cyber Crime Wing, Tamil Nadu under Section 106 BNSS directing bank to mark lien and debit-freeze account. Court held bank cannot freeze entire account for small disputed amount. Only lien to extent of disputed amount permissible.

2. Allahabad High Court - Frozen Salary Account During Cyber Crime Probe: 2025 Perspective
Court observed petitioner’s account was frozen pursuant to directions issued by investigating authority suspecting amount linked to cybercrime, and this satisfied threshold under Section 106 BNSS. But required compliance with reporting obligations under Section 102 (now 106). Bank acted lawfully.

3. Delhi Court on Illegal Freezing - CBI case
"Clearly, the CBI has the power to freeze bank accounts, but same has to be done as per law." Blanket freezing order cannot be passed even under Section 106 BNSS when defrauded amount has not been quantified and IO has not been able to link bank entries with offence.

Summary of Legal Tests for a Valid Cyber Reserve / Freeze:

1. Nexus: IO must have reason to believe amount is directly linked to crime (Tapas Neogy)
2. Procedure: Notice in writing + intimation to Magistrate without delay (Teesta Setalvad + Sec 106 BNSS)
3. Proportionality: Freeze only disputed amount, not whole account if balance > disputed amount (Calcutta HC + RBI Draft 2025)
4. Duration: Cannot be indefinite. If beyond initial investigation, must move to Sec 107 BNSS attachment before Magistrate with due process (Delhi HC, Kerala HC Headstar)
5. Remedy: Writ under Article 226 lies if freeze is illegal. Banks must also follow SOP under CFCFRMS published by I4C.