1. What Does It Mean?

In LOS/LMS and CBS, once a credit facility is sanctioned by the Competent Authority, certain fields become immutable and must be system-locked.

Critical Fields = Sanctioned Amount, Interest Rate / ROI, Repayment Tenor, Moratorium, Margin, Security/Collateral Code, Guarantor, Disbursement Account, Sanction Validity, Risk Rating, Pricing linked to EBLR/MCLR.

Locking = Making field non-editable after sanction event, editable only through a Maker-Checker amendment with audit trail, re-sanction authority and version control.

Failure to Lock = System allows Relationship Manager / Credit Officer to edit ROI from 11% to 8%, Amount from 50L to 75L, or Tenor from 60M to 120M AFTER sanction letter generation without fresh approval.

This violates:

• RBI Circular on Cyber Security Framework for Banks – Requirement of maker-checker for authorisation in information systems, so that transactions are completed only after independent verification
• RBI principle of Maker-Checker (Dual Control) – Best security practice dictates LO enters change and BM authorizes it
• RBI direction on cryptographic binding between stages, maker-checker approval for fund movements
• Indian Contract Act + Bankers' duty as Bailee u/s 151, 152

2. Legal Consequences

a) Gross Negligence and Vicarious Liability of Bank

In Punjab National Bank v. K.B. Shetty (1991) Supreme Court laid down contours of negligence and duty of care owed by banks. Where losses occur due to negligent acts of bank employees acting in course of employment, bank may be held vicariously liable

In Amitabha Dasgupta vs United Bank of India (2021) – Civil Appeal 3966/2010, SC held:

Banks as service providers owe a separate duty of care to exercise due diligence... Bank is under separate obligation to ensure proper procedures are followed
We find that record itself proves gross negligence and deficiency in service

Failure to lock fields is now interpreted as gross negligence under Amitabha Dasgupta test.

In Central Bank of India Ltd. Vs Karunamoy Banerjee – Appeal (civil) 440 of 1966 – Employee charged with issuing unauthorised overdrafts without obtaining sanction was held guilty of misconduct

In State Bank of India and Ors disciplinary case, Bank manager chargesheeted for sanctioning loans without adequate security and without prior approval / contrary to departmental instructions held as gross misconduct under Para 22

b) Criminal Liability – Prevention of Corruption Act + IPC 420/409

Patna High Court 2025 – Bank Manager's Conviction for Loan Irregularities:

serious financial irregularities were detected... related to sanctioning of different types of loans... no proper documents regarding address and parentage obtained, loans shown in names of fake persons

Court held if system allows post-sanction alteration without lock, it is evidence of criminal conspiracy and intent to defraud.

Telangana High Court in Dr. V. Raja Gopal Reddy (17 Sep 2024) laid opposite threshold:

merely processing or forwarding loan proposals cannot establish criminal conspiracy in absence of material showing knowledge, dishonest intention
CBI alleged Reddy failed to properly verify documents

Distinction: If failure to lock is due to system design flaw → bank liable civilly. If officer deliberately keeps fields unlocked to alter after sanction → criminal intent under PC Act Sec 13(1)(d).

c) Regulatory – Declaration as Fraud Account

Under RBI Master Directions on Fraud – SBI v Rajesh Agarwal (2023) SC – SC held fraud declaration requires natural justice hearing. The 8 illustrative deficiencies flagged by Advisory Board on Bank, Commercial and Financial Frauds (ABBCFF) include:

Deficiencies at the stage of sanction and monitoring of advances... illustrative list observed by ABBCFF

RBI inspection treats unlocked critical fields as "Ineffective control over sanction" – leads to penal action, business restriction, and higher risk weight.

3. Why Courts Treat It Seriously – The Fraud Triangle

1. Opportunity: Unlocked fields create opportunity to change ROI/Amount after sanction without audit
2. Concealment: Borrower gets higher amount at lower rate than sanctioned, causing loss = breach of trust
3. Systemic Risk: In CBS, if sanction screen not locked, disbursing officer can disburse beyond sanction – leads to NPA evergreening

Under SARFAESI, fraud vitiates civil court bar. In Sadanand Properties Pvt Ltd v. Punjab National Bank (Delhi HC 6 Feb 2015), fraudulent mortgage to secure loan for third party – court allowed civil suit despite SARFAESI bar

4. Correct Control Required by RBI/CVC

For compliance closure, implement:

1. Technical Lock: After Sanction_Status = Approved, trigger Field_Lock = Y for critical fields at DB level. Any edit requires Amendment Workflow with fresh Sanction ID versioning.

2. Maker-Checker: LO – Maker for amendment request, Credit Manager / BM – Checker, Sanctioning Authority – Authorizer. No self-authorization.

3. Audit Trail: As per RBI Cybersecurity Directions 31 July 2026 for Commercial Banks – maintain immutable log of who changed what, when, before/after value.

4. Exception Report: Daily exception for "Critical field edited post sanction without amendment".

If you are defending a vigilance case, argue:

• If bank did not provide system lock, individual officer cannot be held solely liable – State Bank of India service code says gross misconduct requires violation of instructions – if no instruction to lock, negligence shifts to IT department.
• If lock was bypassed using supervisor ID, it becomes collusion.

If you are prosecuting/inquiry officer, argue:

• Failure to lock is breach of duty of care under Punjab National Bank v K.B. Shetty and gross negligence under Amitabha Dasgupta.
• Amounts to unauthorized overdraft / excess disbursement as in Karunamoy Banerjee.