I. Sector-wise Enforcement Framework

A. E-Money / PPI - RBI Enforcement under Payment and Settlement Systems Act, 2007

Enforcer: RBI Department of Payment and Settlement Systems

Powers under Sec 26(6) and Sec 30(1) PSS Act:

• Inspection of PPI issuer
• Issue show-cause
• Impose monetary penalty
• Cancel authorization

2025-2026 Live Enforcement Cases:

• RBI vs PhonePe Ltd - Order 10 Sept 2025 - Penalty Rs 21 Lakh for PPI non-compliance. Inspection Oct 2023-Dec 2024 found end-of-day outstanding balance in escrow not matching PPI liability. Violated Master Directions on PPI escrow parity. Penalty under Sec 30(1) r/w 26(6) PSS Act.
• RBI vs Appnit Technologies Pvt Ltd - Order 11 May 2026 - Rs 5.80 Lakh for KYC + PPI violation. Allowed Aadhaar OTP e-KYC PPI accounts to remain active beyond 1 year without doing full KYC as per KYC Directions. Also Pine Labs Ltd - Rs 3.10 Lakh March 2026 for issuing full-KYC PPIs without completing KYC.
• PhonePe case press note: RBI clarified penalty is for regulatory deficiency, not questioning validity of customer transactions.

Process: RBI issues SCN, considers written reply + personal hearing, then penalty. Amount depends on gravity. Can also impose business restriction - RBI barred Paytm Payments Bank, Razorpay, PayU from onboarding new customers in 2022-23 for same escrow/KYC lapses - more severe than fine.

B. Encryption Export Control - BIS / DGFT Enforcement

US - BIS under EAR:

• Civil: Up to $300k per violation or twice transaction value, denial of export privileges
• Criminal: Up to 20 years under IEEPA
• Enforcement Cases:
  • JPMorgan Chase Bank NA - $19,125 (2010) - exported encryption software for banking to restricted end-user without license
  • Bank of America - $44,625 (2017) - exported payment processing HSM without classification
  • Bank of New York Mellon Shanghai Branch - $30,000 (2011) - re-export of funds transfer auth system from China
  • Shows re-export liability - US parent liable for foreign branch

India - DGFT under Foreign Trade (Development & Regulation) Act 1992 Sec 11:

• Failure to fulfill export obligation under EPCG or SCOMET license = penalty up to Rs 5 lakhs + forfeiture of license
• Supercom India Ltd. v. DGFT Delhi HC 2002: Company granted import license conditional on export obligation, failed to export. DGFT imposed Rs 5 lakh penalty. HC upheld - enforcement of export obligation is strict, force majeure must be proved.
• Dencap Electronics v. Addl. DGFT Delhi HC 2005: Limits penalty provisions - cannot impose penalty beyond Sec 11(2) FTDR Act, must be proportionate.

C. Endpoint Security / Data Protection - DPDP, GDPR, FTC

India - DPDP Act 2023 Sec 33:
Data Protection Board can impose penalty up to Rs 250 crore per breach for failure to implement reasonable security safeguards under Sec 8(5). Enforcement: Inquiry, hearing, penalty order, appeal to TDSAT.

EU - GDPR Art 83:

• Art 32 failure - endpoint encryption, MFA not implemented = up to €10M or 2% turnover
• British Airways ICO 2020 - £20M (initially proposed £183M): No MFA on remote access endpoint, unencrypted card data, no logging - violation of Art 32. Demonstrates endpoint compliance is directly penalized.

US - FTC Act Sec 5:
FTC v. Wyndham Worldwide Corp, 799 F.3d 236 (3rd Cir. 2015): FTC enforced endpoint security as unfair practice. Wyndham failed to use firewall, encrypt, patch. 3 breaches 619k cards. Court held FTC has authority to regulate cybersecurity without specific statute. Settlement $75M + 20 years audit. This is foundation for all FTC endpoint cases.

US - HIPAA: HHS OCR fined Hospital Sisters Health System - $7.6M settlement 2025 - failure to implement endpoint safeguards for ePHI.

D. Employee Misconduct - Labour Law Enforcement

Enforcement is domestic but backed by Labour Court / Tribunal under ID Act 1947.

• If enquiry not as per natural justice, Labour Court can set aside dismissal and order reinstatement with back wages.
• M.P Electricity Board v. Jagdish Chandra Sharma (2005) 2 SCC 413: Supreme Court held courts should not interfere with punishment unless shockingly disproportionate. Assault on superior = dismissal justified.
• Surekha Domaji Bele v. MSEDCL 2026 INSC 639: Supreme Court set aside dismissal as disproportionate despite misconduct proved - enforced second show-cause on punishment as mandatory.

For listed companies, failure to have Vigil Mechanism under Companies Act Sec 177(9) = penalty on company and officers under Sec 178 - Rs 1 lakh to Rs 5 lakh. MCA case Vatan Textiles v. ROC Mumbai Jan 2025: Penalty Rs 4,15,500 for delayed filings, shows tiered penalty system under Companies Act 2025 amendments.

E. Carbon Credit / Environmental - CERC Enforcement

CERC (Terms and Conditions for Purchase and Sale of Carbon Credit Certificates) Regulations 2026:

• Trading only of credits in registry account - GRID-INDIA
• Non-compliance: Suspension from trading for repeated defaults, financial penalty, cancellation of registration
• BEE as Administrator can de-register obligated entity
• Under Energy Conservation (Amendment) Act 2022 Sec 26: Penalty up to Rs 10 lakh + additional per tonne for non-compliance with carbon intensity target, plus equivalent to market value of CCCs shortfall.

F. General Regulatory Penalty Principles - Key Supreme Court Case Laws

1. SEBI v. Shriram Mutual Fund (2006) 5 SCC 361 / 2006 INSC 353 - Mens Rea Not Required
Facts: SEBI imposed Rs 5 lakhs + Rs 2 lakhs penalty under Sec 15-E and 15-D(b) SEBI Act for violating mutual fund regulations.
Held: Supreme Court held for regulatory penalties, mens rea is not essential. Mandatory penalty on mere breach. Purpose is to enforce discipline, not to punish criminal intent. This principle now applied by RBI, CERC, BIS.
Ratio cited in all PPI penalty orders.

2. M/S P.V Mohammad Barmay Sons v. Directorate of Enforcement (1992) 2 SCC 704
FERA violations - unauthorized payments for vessels. Supreme Court upheld penalties post-repeal of FERA 1947 - penalties preserved under Sec 49 FEMA. Principle: Enforcement survives repeal if saving clause present. Relevant now as Companies Act 2025 and DPDP repeal older laws.

3. Chairman, SEBI v. Shriram Mutual Fund Affirmed in Competition Law:
Ulink Agritech v. Agro Input Dealers Association Case No. 06 of 2023 - CCI: CCI found cartelization under Sec 3(3)(b) Competition Act 2002, imposed Rs 80,889 and Rs 3,92,269 on associations + individuals Rs 4,98,903 etc. Also directed competition compliance training. Shows penalty + corrective direction.

4. Moratorium Does Not Shield Regulatory Penalties - SARANGA ANILKUMAR AGGARWAL v. BHAVESH DHIRAJLAL SHETH (SC 2024)
Held moratorium under Sec 96 IBC does not extend to regulatory penalties for non-compliance with consumer protection orders. Regulatory penalties are excluded debts, not stayed. Means even if company goes bankrupt, RBI/BIS/CERC penalties continue - enforcement not halted by IBC.

II. How Enforcement Proceeds - Common Procedure

1. Detection: Inspection (RBI PSS inspection, BIS OEE audit, CERT-In audit, CERC market monitoring, internal whistleblower)
2. Show Cause Notice: Must mention exact provision violated, date, evidence
3. Opportunity of Hearing: Written reply + personal hearing - natural justice
4. Adjudication Order: Reasoned order with penalty quantum - must consider: gravity, duration, gain from violation, loss to system
5. Appeal:
   - RBI PSS penalty - appeal to Finance Ministry? Actually to Appellate Authority under PSS Act
   - BIS - to Secretary Commerce
   - SEBI - to SAT
   - GDPR - to National DPA then Court
   - DPDP - to TDSAT
6. Recovery: Under PSS Act, as arrears of land revenue. Under Competition Act - demand notice mandatory before interest - CCI v. Geep Industries Delhi HC 2025: Demand notice under Penalty Recovery Regulations 2011 mandatory before levying interest.

III. Practical Penalty Matrix

Bottom Line: Modern enforcement is strict liability + heavy documentation. RBI's 2025-26 orders show even Rs 3-5 lakh penalties for KYC lapse - not about amount, but about public naming and audit scrutiny that follows.