The Madhya Pradesh High Court has delivered a significant ruling affirming that banks cannot unilaterally freeze customer accounts based solely on unverified cyber crime alerts from police units, reinforcing the necessity of judicial oversight under statutory procedures. This decision restores balance between law enforcement powers and fundamental banking rights.
Background & Facts
The Dispute
The petitioner, Gaurav Enterprises, a proprietary firm engaged in cryptocurrency and virtual currency trading, had its bank accounts with State Bank of India and ICICI Bank frozen without prior notice or formal charge. The freeze was initiated based on email communications from various State cyber crime cells alleging that funds credited to the petitioner’s accounts were proceeds of cyber fraud. The petitioner had no knowledge of the allegations, had not been questioned, and had not received any notice, summons, or FIR.
Key Facts
- The petitioner’s business involved lawful trading of cryptocurrencies, a recognized activity in India despite regulatory ambiguity
- Funds totaling unspecified amounts were credited to the petitioner’s accounts from third-party sources later flagged by cyber crime units as suspicious
- No formal complaint, FIR, or charge sheet was filed against the petitioner
- The cyber crime cells of multiple states (including Bangalore, Karnataka) sent email directives to SBI and ICICI to freeze accounts, but none followed up with formal documentation or magisterial applications
- The petitioner’s accounts were frozen abruptly, disrupting daily business operations, payroll, and vendor payments
- The petitioner made no attempt to conceal transactions or evade scrutiny; all dealings were traceable through digital ledgers
Procedural History
- 26.04.2024: Madhya Pradesh High Court delivered judgment in Malcolm Murayis & Ors. v. State Bank of India & Others (W.P. No. 1100/2024), granting interim relief to crypto traders whose accounts were frozen on similar grounds
- 14.03.2024: In Malcolm Murayis, the Court issued an interim order permitting petitioners to withdraw Rs. 50,000 per month from frozen accounts and directed cyber crime cells to respond within three weeks
- 26.03.2026: Present writ petition (W.P. No. 9716/2026) filed by Gaurav Enterprises seeking similar relief
- 26.03.2026: Court noted that despite being served via email, only one cyber crime cell (Bangalore) responded; others remained silent
- 26.03.2026: Court disposed of the petition with directions, relying on Malcolm Murayis as binding precedent
The Parties' Positions
For the Petitioner
- Argued that freezing of accounts without notice or judicial sanction violates Article 19(1)(g) (right to carry on trade) and Article 21 (right to livelihood)
- Contended that cyber crime cells acted ultra vires Section 102 of the Code of Criminal Procedure, which requires seizure to be reported to a Magistrate within 24 hours
- Highlighted that no Magistrate had been approached to authorize seizure or freezing of funds
- Proposed that disputed amounts be placed in fixed deposits, accessible only upon judicial order
For the Respondents (Banks)
- Submitted that they acted solely on instructions from cyber crime cells and had no independent authority to assess allegations
- Claimed compliance with RBI guidelines and internal risk protocols
- Argued that they are bound to follow law enforcement directives and cannot question their validity
Relief Sought
The petitioner sought:
- Immediate unfreezing of bank accounts
- Permission to operate accounts for regular business transactions
- Direction to place disputed funds in fixed deposits, accessible only upon magisterial order
- Costs of litigation
The Legal Issue
Can a bank freeze a customer’s account based solely on an unverified email directive from a cyber crime cell, without any formal complaint, FIR, or magisterial order under Section 102 of the Code of Criminal Procedure?
Arguments Presented
For the Petitioner
The petitioner relied on Malcolm Murayis v. State Bank of India, where this Court held that banks cannot act as de facto enforcement agencies. The petitioner emphasized that Section 102 CrPC requires any seizure of property to be reported to a Magistrate within 24 hours, and that mere suspicion or anonymous allegations cannot justify deprivation of property rights. The petitioner also cited K.S. Puttaswamy v. Union of India to underscore the constitutional right to financial autonomy.
For the Respondent
The banks contended they were bound by statutory obligations under the Prevention of Money Laundering Act and RBI guidelines to comply with law enforcement directives. They argued that they lacked the technical and legal capacity to verify cyber crime allegations and that non-compliance could expose them to regulatory penalties.
The Court's Analysis
The Court examined the procedural irregularities in the actions of the cyber crime cells and found that no compliance with Section 102 of the Code of Criminal Procedure had occurred. The Court noted that the cyber crime cells had sent email notices to banks but had not filed any application before a Magistrate, nor had they produced any seizure memo or inventory of seized property.
"The cyber crime cells, while empowered to investigate, are not empowered to act as adjudicators of property rights. Their directives, even if well-intentioned, cannot override the procedural safeguards mandated by the CrPC."
The Court observed that the silence of nine out of ten cyber crime units in response to the Court’s earlier notice demonstrated systemic negligence. It further held that banks, while obligated to cooperate with investigations, cannot abdicate their duty to protect customer rights by acting as mere conduits for unverified executive orders.
The Court distinguished between investigative authority and proprietary control: while police may investigate, only a Magistrate may authorize deprivation of property. The Court also rejected the banks’ argument that compliance with cyber cell directives was mandatory, noting that Section 102 CrPC is mandatory, not directory.
The Verdict
The petition was allowed. The Court directed the State Bank of India to immediately unfreeze the petitioner’s bank account. The disputed amount, as specified by the cyber crime agencies, shall be transferred to a fixed deposit account, which shall remain locked until a competent Judicial Magistrate passes an order within three months. If no such order is passed within that period, the petitioner shall be entitled to withdraw the amount upon intimation to the concerned cyber crime agency. Costs of Rs. 10,000 shall be paid by the State of Madhya Pradesh to the petitioner.
What This Means For Similar Cases
Banks Cannot Act as Unaccountable Enforcers
- Financial institutions must verify the legal basis of freeze orders before acting
- Email directives from police units without accompanying magisterial orders are insufficient to justify account freezes
- Banks must inform customers of freeze actions and provide opportunity for representation
Cyber Crime Units Must Follow Due Process
- Cyber crime cells must file applications before Magistrates under Section 102 CrPC before requesting asset freezes
- Failure to comply within three months triggers automatic release of funds
- Silence or non-response to court notices cannot be treated as tacit approval of unlawful action
Crypto Businesses Have Legal Protections
- Lawful cryptocurrency trading is protected under Article 19(1)(g)
- Suspicious transactions by third parties do not automatically implicate account holders
- Fixed deposit mechanism provides interim protection without denying access to legitimate funds
