I. WHAT IS DIGITAL BANKING COMPLIANCE?

Obligation of a bank to ensure that all electronic channels - Internet Banking, Mobile Banking, UPI, PPI, Cards, Digital Lending Apps - operate with:

1. Security by Design
2. Zero/Negligible Customer Liability for system breaches
3. Time-bound grievance redressal
4. Data protection

Governing Laws:

• Banking Regulation Act, 1949 - Sec 35A, Sec 47A (penalty power)
• RBI Cyber Security Framework for Banks - 2 June 2016
• RBI Circular on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions - 06 July 2017 (Revised 2025 & 2027)
• RBI Digital Lending Guidelines 2022 + Directions 2025
• RBI Master Direction on Digital Payment Security Controls 2020
• IT Act 2000 + DPDP Act 2023 - Sec 8(5), 8(6), 33
• Consumer Protection Act 2019

II. 7 MANDATORY COMPLIANCE OBLIGATIONS

1. Zero Liability Obligation [Most Litigated]
If customer reports unauthorized transaction:

• Within 3 working days = Zero Liability - bank must credit within 10 days
• Within 4-7 days = Liability max Rs. 25,000
• Beyond 7 days = As per bank's Board approved policy

Bank must prove customer negligence, not other way around. Auto-reversal with Rs.100/day penalty for failed transactions.

2. Breach Notification Obligation
RBI Cyber Security Framework mandates report to RBI within 2-6 hours of detection. Failure = Penalty under Sec 47A(1)(c) r/w Sec 46(4)(i).

DPDP Act Sec 8(6) adds - notify Data Protection Board + affected customers. Penalty up to Rs.250 crore for failure to take reasonable security safeguards under Sec 33.

3. Strong Authentication Obligation
RBI 2027 directions: If any loss arises out of transactions effected without complying with authentication directions, issuer shall compensate customer for loss in full without demur. Device-based biometrics and tokenisation now mandatory.

4. Digital Lending Compliance

• Loan must disburse directly from Regulated Entity account to borrower - no LSP handling
• Key Fact Statement with APR in regional language
• Cooling-off / look-up period - borrower can exit
• No auto-debit without consent
• Violation = fine, license revocation under Sec 35A of RBI Act.

5. Grievance Redressal Obligation
One Nation One Ombudsman portal. Resolve within 90 days. From auto-reversal to compensation.

6. Accessibility Obligation
After Supreme Court order 2025, RBI Circular 14 Aug 2025 (RBI/2025-26/75) mandates accessible KYC, home visits for disabled, screen-reader apps. Failure attracts supervisory action.

7. Vendor & IT Governance Obligation
Master Direction on IT Governance 2023 requires secure SDLC, SOC, Privileged Access Management, Third-party risk management for Cloud, FinTech partners.

III. LANDMARK CASE LAWS - SUPREME COURT & HIGH COURTS

Case 1: State Bank of India vs Pallabh Bhowmick & Ors - Supreme Court 2024 - THE LEADING CASE
Facts: Series of online fraudulent transactions on 18.10.2021. SBI claimed customer negligence for sharing OTP.
Held: Supreme Court upheld High Court - transactions were entirely unauthorized and fraudulent, no negligence established. Bank held liable.
Ratio you can cite: It is responsibility of bank to avoid unauthorized transactions. Failure may amount to deficiency in service, weakening bank's defence. This case is now cited by Consumer Courts to impose liability.

Case 2: Punjab National Bank vs Anil Kumar (2021) SC
Landmark decision - Banks cannot disclaim liability for unauthorized digital transactions by attributing fault to customer negligence. Financial institutions bear primary responsibility for implementing adequate cybersecurity. Set foundation for Zero Liability.

Case 3: Supreme Court Digital Arrest Scam Suo Moto - Feb 2026 - Rs.52,000 Crore Case
Supreme Court flagged bank lapses in cyber fraud cases, called digital arrest frauds "robbery and dacoity".
Chief Justice noted more than Rs.52,000 crore siphoned off April 2021 to Nov 2025. Held: Laxity by banks resulting in siphoning of money due to cyber fraud counts as deficiency of service. Emphasized govt and regulators must devise alarm system when scammers attempt to con account holders. Issued binding directions to MHA to implement SOP drafted by RBI.
Impact: Banks now required to have transaction anomaly detection - "alarm goes off".

Case 4: Bombay High Court - Unauthorized Transaction Refund Case 2024
Clarified RBI Circular 06.07.2017 - Customer has zero liability in cases of unauthorized electronic banking transactions arising out of third-party breach where deficiency lies neither with bank nor customer but elsewhere in system, provided customer notifies bank within 3 working days.

Case 5: ICICI Bank vs Singh - Automated Error Liability
Supreme Court examined whether bank liable for automated errors in digital banking systems. Ruled ICICI Bank liable for deficiency in services and directed compensation + ensure complete transparency in digital banking transactions.

IV. RBI PENALTY CASE LAWS - Enforceable Precedents

• Union Bank of India - 23 March 2026 - Rs.95.40 Lakh for non-compliance with Limiting Liability directions and Automation of Income Recognition, Asset Classification.
• Central Bank of India - 11 June 2024 - Rs.1,45,50,000 for Customer Protection - Limiting Liability violation.
• Central Bank of India - 18 April 2022 - Rs.36 Lakh for same.
• Yes Bank - 23 Oct 2017 - $1 Million (Rs.6.4 Cr then) - First penalty for failure to report data breach within 2-6 hours under Cyber Security Framework.
• HDFC Bank - Aug 2025 - Rs.1.50 Crore for non-compliance with cyber security and customer grievance redressal norms.
• ICICI Bank - 29 April 2025 - Rs.97.80 Lakh for Cyber Security Framework, KYC, card-issuance violations.
• Appnit Technologies Pvt Ltd - 11 May 2026 - Rs.5.80 Lakh for KYC & PPI non-compliance under PSS Act, 2007.

All penalties imposed under Sec 47A of Banking Regulation Act - principle: Regulatory lapse does not invalidate transaction but attracts penalty.

V. HOW COURTS DECIDE TODAY

1. Did bank have Board-approved Limited Liability policy displayed?
2. Did bank credit within 10 days?
3. Did bank prove customer shared credentials? (Burden on bank after Pallabh Bhowmick)
4. Did bank report breach within 2-6 hours?
5. Did bank have anomaly detection alarm?