A partner of a prominent Kochi based architecture firm called me last March seeking immediate help. The bank had placed a lien hold for over Rs 13.5 lakh on two of the firm's bank accounts without any prior notice. Enquiries from the bank only yielded vague replies that the amounts had been blocked as per directions received from Cyber Cell, Mumbai pursuant to a complaint regarding cyber fraud filed by a gentleman from Gujarat. The bank officials provided the contact details of the concerned investigating officer; however, that was the end of their cooperation. Requests to share the specific order under which these particular bank accounts were marked were met with vague assertions that it is not the bank's mandate to share it. Then there was silence. Calls, and emails, to the phone number of the police officials went unanswered. Even an RTI seeking details of the complaint and link to the firm's accounts yielded no response for months. Meanwhile, that same Rs 13.5 lakh of the firm's capital remained inaccessible to them.
Eventually it turned out that the accounts were marked automatically by the Citizen Financial Cyber Fraud Reporting and Management System, an integrated digital platform under the Indian Cybercrime Coordination Centre (I4C) that unites Law Enforcement Agencies, banks and major financial intermediaries to prevent fraudsters from siphoning off stolen funds. The problem? The flagged transactions fell under layers 9 and 10 of the transaction trail, one was an advance received from a bona fide client and another was a transfer from the firm's own account.
This happens every time a complainant registers a cyber-fraud-related complaint. An automated money hunt is initiated, crawling from account to account and marking as much of the disputed amount as it can trace back to the fraudulent transaction. It is admirable that such an effective system even exists in India, and even more so that it is functional to such an extent. However, machines can only go so far. Once the transactions are flagged, the money placed under lien and the accounts frozen, all the urgency of the system ends. There is no human intervention, no official supervision, hardly any application of mind or due diligence from the police authorities' end. Thousands of unsuspecting account holders, with no nexus whatsoever to the crime, get their accounts frozen every day by order of police authorities from another corner of the country and with no one to help them. The bank lifts its hands in helplessness. The Investigating Officer rarely, if ever, responds to phone calls. And when they do, the default response is to call the aggrieved person physically to the police station, where they refuse to provide NOC clearance anyway. On the other hand, this is no comfort to the complainants either. Although they are made aware that a portion of their fraudulently lost money has been recovered and placed under lien, they are unable to access it. It is a system where everyone is a victim and nobody is accountable.
This is the everyday reality the Ministry of Home Affairs sought to address by issuing, on 2 January 2026, a new Standard Operating Procedure for cyber-financial-fraud enforcement under the I4C / NCRP framework. The SOP is a meaningful document. It is also, in the way of all SOPs, a document whose value depends almost entirely on whether the people instructed to follow it actually do, and whether the people instructed to enforce it actually can. Five months in, the practitioner's view is mixed. There is real progress. There is also a clear set of gaps that anyone who has tried to obtain an order of de-freezing or an NOC to release lien will recognize.
What the SOP gets right
The SOP's central correction is the one that has been the most damaging aspect of the NCRP system since it became operational. Earlier, a disputed amount of as little as Rs 10 routinely resulted in a freeze on the entire account holding lakhs of rupees. The new framework requires that, where a lien is to be placed, it be limited to the disputed sum. Account-level freeze is now positioned as the exception, not the default. For a small business or salaried customer whose entire month sits in a single account, this is the difference between an inconvenience and a livelihood crisis.
A second improvement is the grievance redressal architecture. District-level officers of the rank of Additional or Deputy Superintendent of Police are now nominated as the first-line redressal point. A failure to respond within 15 days escalates the complaint automatically to a District Grievance Redressal Officer. State-level oversight has been allocated to officers of DG or IG rank. On paper, this is the first time an account holder facing an enforcement-driven freeze has a documented administrative ladder; previously, the only available remedy was the magistrate's court or a writ petition.
A third improvement is that for frauds below Rs. 50,000 the SOP contemplates refund processing without a court order, and instructs banks to lift any fund freeze within 90 days if no judicial order is in place. The smaller-value cases, which are also the cases where litigation costs make any remedy unaffordable, are now meant to move through an administrative channel.
Where the SOP runs into the ground
The first gap is the one between text and practice. SOPs do not have statutory force. They are administrative instructions to police personnel and, indirectly, to scheduled banks. A bank that receives a lien instruction from a cyber cell in another state, drafted in a form that pre-dates the SOP and does not mention the disputed sum, has not historically refused that instruction on the ground that it is non-compliant with an MHA circular. It has acted on it. The practitioner's working assumption in May 2026 is that compliance is improving but uneven.
The second gap is the absence of a meaningful service-of-notice requirement on the affected account holder. The SOP improves what happens once a complaint has been filed with the grievance officer, but it does not change the fact that the customer normally finds out about the freeze by discovering that a transaction has failed. There is no prior intimation, no opportunity to be heard, and no contemporaneous explanation of the basis for the action. Whatever one's view on whether such notice is feasible in fraud investigations, the fact that the account holder is treated as a third party to a process which directly affects his or her property rights is a structural problem the new SOP leaves untouched.
The third gap, and the most consequential in litigation, is jurisdictional. The cyber-fraud complaint is typically registered where the complainant resides. The lien is placed on an account that may be held in a different state, sometimes thousands of kilometres away. The magistrate competent to entertain an application for release frequently sits in the state of the complaint, not the state where the account is maintained. The investigating officer who issued the lien instruction also sits in the state of the complaint. The customer, who simply wants the lien lifted, is left navigating two parallel procedural geographies. The SOP improves grievance redressal within a state. It does very little for the inter-state customer caught between two of them.
The fourth gap is the absence of a meaningful timeline for cases where the disputed amount is above Rs. 50,000. The 90-day rule applies to lower-value matters. Above that threshold, the SOP relies on the general criminal-procedure framework, in which the lien continues until investigation is completed or a court orders otherwise. There is no comparable obligation to revisit the lien at fixed intervals, even where the account holder is not the suspected fraudster. The investigation can remain "active" for years while the customer's working capital remains immobilised. Bail-style time limits would be a sensible structural addition.
The fifth gap is the bank itself. A great deal of the daily harm in these matters arises not from the police action but from bank communication. Customers learn about freezes through inconsistent or unintelligible SMS messages. Branches are unable, or unwilling, to identify which authority instructed the action. Written representations to nodal officers go unanswered for weeks. The SOP places obligations on enforcement agencies but largely leaves the bank's customer-facing duties to the existing Reserve Bank of India framework. This is a logical division of executive functions but a gap from the account holder's point of view. A customer cannot defend himself against an instruction he cannot identify.
The path forward: concrete recommendations for systemic reform
While the MHA's SOP provides a foundation, closing the functional gaps requires concrete, structural reforms driven by the bureaucracy and the legislature. The following interventions would significantly improve the mechanism:
1. Mandatory 48-Hour Bank Communication SLA: The RBI must institute a uniform communication protocol across all scheduled banks. Banks should be required to serve a standardized written notice within 48 hours of any freeze or lien, explicitly detailing the issuing authority, state, reference number, disputed amount, and the designated grievance officer.
2. Inter-State Grievance Clearing House: To resolve the jurisdictional nightmare, the I4C must establish a centralized, inter-state appellate nodal mechanism. An account holder residing in Delhi facing a freeze from Telangana should not have to navigate Telangana's internal police hierarchy. A centralized desk is a must to facilitate cross-jurisdictional clearing and communication.
3. Bail-Style Time Limits for All Disputed Amounts: The 90-day auto-lift rule currently applicable to amounts below Rs. 50,000 should be expanded. For any lien extending beyond 90 days, especially for very large amounts, investigating agencies should be required to obtain a judicial extension to maintain the hold, forcing periodic review and preventing working capital from being indefinitely immobilized.
The January 2026 SOP is a genuine and overdue corrective measure, but it remains an administrative instruction layered over a system that still treats the innocent account holder as collateral rather than a stakeholder. Its promise will be realised only if compliance is enforced as rigorously as the freezes themselves, and if the gaps in notice, inter-state redressal and long-pending liens are closed by binding norms rather than goodwill. Until then, the distance between a well-drafted SOP and a customer staring at a failed transaction will remain the truest measure of reform.
Author is an advocate practicing at Supreme Court of India and Delhi High Court. Views are personal.