The Madhya Pradesh High Court has clarified that financial institutions cannot unilaterally freeze bank accounts based solely on unverified cyber crime alerts from police units. In a significant ruling, the Court mandated that any freeze must be subject to judicial oversight under the Code of Criminal Procedure, reinforcing the principle that property rights cannot be suspended without due process.
Background & Facts
The Dispute
The petitioner, Bhupendra Upadhyay, is engaged in the lawful trading of cryptocurrency and virtual currencies. His bank accounts with HDFC Bank Ltd. (Respondent No. 1) and another financial institution (Respondent No. 2) were frozen without prior notice or formal charge. The freeze was initiated based on email directives from various State cyber crime cells, alleging that funds credited to his accounts were proceeds of cyber fraud.
Key Facts
- The petitioner has never received any notice, summons, or complaint from any police station regarding involvement in cyber fraud.
- The cyber crime cells of multiple States (including Karnataka, Maharashtra, and others) sent email-based directives to banks requesting account freezes.
- No formal FIR was registered against the petitioner, and no seizure memo under Section 102 of the CrPC was issued or communicated to him.
- The amounts in question were credited through legitimate cryptocurrency transactions, allegedly routed through intermediaries involved in fraud.
- The petitioner has consistently maintained that he is a lawful trader and not involved in any criminal activity.
- The banks acted solely on the cyber cell directives without independent verification or judicial authorization.
Procedural History
- Date of account freeze: Not explicitly stated, but occurred prior to filing of writ petition.
- 26.04.2024: Madhya Pradesh High Court delivered judgment in Malcolm Murayis & Ors. v. State Bank of India & Others (W.P. No. 1100 of 2024), establishing precedent on identical facts.
- 14.03.2024: This Court issued interim order in Malcolm Murayis directing banks to allow petitioners to withdraw Rs. 50,000 per month pending final hearing.
- 26.03.2026: Present writ petition (W.P. No. 9706 of 2026) filed by Bhupendra Upadhyay seeking unfreezing of accounts.
- 26.03.2026: Judgment delivered in the present case, relying on Malcolm Murayis.
The Parties' Positions
For the Petitioner:
- Argued that freezing of accounts without notice or judicial order violates Article 21 of the Constitution.
- Contended that cyber crime cells have not complied with Section 102 of the CrPC, which requires seizure to be reported to a Magistrate.
- Sought that disputed amounts be placed in fixed deposits rather than frozen outright, allowing lawful access to remaining funds.
- Emphasized that he is a victim of misuse of his account by third parties, not a perpetrator.
For the Respondents (Banks):
- Stated that they acted only on directives from cyber crime cells and are bound to comply with law enforcement requests.
- Claimed no independent authority to assess the validity of cyber cell notices.
- Argued that non-compliance with police directives could expose them to liability under anti-money laundering norms.
Relief Sought
- Immediate removal of hold/freeze/lien on the petitioner’s bank accounts.
- Direction to banks to permit normal operation of accounts.
- Alternative: Place disputed amounts in fixed deposits, accessible only upon judicial order.
- Costs and any other relief deemed fit in the interest of justice.
The Legal Issue
Can banks freeze a customer’s account based solely on an unverified email directive from a cyber crime cell, without compliance with Section 102 of the CrPC or a judicial order?
Arguments Presented
For the Petitioner
The petitioner relied on the precedent set in Malcolm Murayis v. State Bank of India, where this Court held that mere cyber cell notices do not constitute lawful seizure under Section 102 CrPC. He argued that the absence of a Magistrate’s order or formal seizure memo renders the freeze illegal. He further contended that freezing entire accounts violates the right to livelihood under Article 21, especially when the petitioner is not accused of any crime. The petitioner proposed a balanced solution: retain disputed amounts in fixed deposits pending judicial determination, while allowing access to the remainder.
For the Respondent
The banks maintained that they are intermediaries bound by statutory obligations under the Prevention of Money Laundering Act and RBI guidelines to comply with law enforcement directives. They argued that they lack the technical or legal capacity to verify the legitimacy of cyber cell requests and that non-compliance could lead to regulatory penalties. They did not dispute the petitioner’s innocence but claimed they had no discretion to act independently.
The Court's Analysis
The Court examined the precedent in Malcolm Murayis and found the facts and legal issues in the present case to be indistinguishable. It noted that cyber crime cells had issued freeze requests via email alone, without filing any formal application before a Magistrate, thereby bypassing the mandatory procedure under Section 102 CrPC.
"The cyber crime cells have not complied with Section 102 of the CrPC and have not informed the concerned Magistrate about such seizure."
The Court emphasized that Section 102 CrPC requires that any seizure of property by a police officer must be reported to a Magistrate without delay. Failure to do so renders the seizure illegal, regardless of the source of the directive. The Court further observed that banks, as private entities, cannot act as enforcement agents without judicial sanction.
The Court rejected the banks’ argument that they are mere conduits, holding that compliance with illegal directives does not absolve them of responsibility under constitutional law. It noted the systemic failure of cyber crime cells across States to respond to court notices, indicating a pattern of negligence and procedural arbitrariness.
The Court adopted the interim solution proposed in Malcolm Murayis and elevated it to a binding directive: disputed amounts must be transferred to fixed deposits, with access restricted until a Judicial Magistrate passes an order within three months. If no such order is passed, the funds must be released to the account holder.
The Verdict
The petitioner succeeded. The Court directed HDFC Bank Ltd. to unfreeze the petitioner’s bank account immediately. The disputed amount, as specified by the cyber crime agencies, shall be transferred to a fixed deposit account. This amount shall remain locked until a competent Judicial Magistrate passes an order within three months of the judgment date. If no such order is passed within this period, the petitioner shall be entitled to withdraw the entire amount from the fixed deposit upon intimation to the concerned cyber crime agency. The Court imposed no costs.
What This Means For Similar Cases
Banks Cannot Act as Unregulated Enforcers
- Financial institutions must refuse to act on cyber crime freeze requests lacking a Magistrate’s order under Section 102 CrPC.
- Banks may be held liable for violating constitutional rights if they freeze accounts based solely on police emails.
- Banks should adopt internal protocols requiring production of a formal seizure memo or court order before implementing freezes.
Cyber Crime Units Must Follow Due Process
- Cyber crime cells cannot bypass judicial oversight by using email directives to freeze accounts.
- Failure to file reports with Magistrates under Section 102 CrPC renders their actions legally void.
- Courts will treat non-response to judicial notices as evidence of procedural negligence, potentially leading to contempt proceedings.
Fixed Deposits as a Balanced Remedy
- Petitioners in similar cases may now routinely seek conversion of frozen balances into fixed deposits, not total freezes.
- This provides a middle path: preserving evidence while protecting the account holder’s right to access lawful funds.
- Practitioners should cite this judgment to oppose blanket freezes in crypto, forex, or digital asset-related cases.
