Guiding Principles of the Standard Operating Procedure (SOP) for NCRP-CFCFRMS

Introduction: The Need for Standardization

Since its launch in April 2021, the CFCFRMS has successfully prevented crime proceeds amounting to ₹7,647 Crore out of the reported ₹52,969 Crore from reaching cybercriminals' hands. However, restoration efforts have recovered only ₹167 Crore—approximately 2.18% of the total money saved. This disparity underscores the critical need for a standardized procedure that balances victim protection with the rights of account holders.

Core Objectives of the SOP

The SOP seeks to establish a fair and transparent system that:

• Prescribes uniform processes for all Participating Entities (PEs)
• Prevents misuse of the system for holding amounts and seizing accounts
• Facilitates interim custody and restoration of defrauded amounts to victims
• Ensures accountability for all participants' actions and inactions
• Provides time-bound grievance redressal mechanisms
• Safeguards fundamental rights including Right to Livelihood and Right to Privacy

The 13 Guiding Principles

1. Legal Authority for Holding Transactions

All requests to put suspicious transactions on hold must be executed under Section 168 read with Section 94 BNSS and Section 106 BNSS. Every request escalated through CFCFRMS must be accompanied by notices delivered electronically under these provisions. This principle establishes the legal foundation for all intervention actions.

2. Due Diligence by Law Enforcement Agencies

Law Enforcement Agencies (LEAs) must exercise due diligence while pushing complaints received on NCRP or the National Cyber Crime Helpline (1930) to CFCFRMS. Only cases where a prima facie offence of Cyber-Enabled Financial Crime is established should be immediately escalated. Supporting material must be secured and uploaded without delay, and officers must be vigilant against motivated or frivolous complaints.

3. Exclusive Use for Reported Cases

The CFCFRMS mechanism is exclusively for Cyber-Enabled Financial Crimes reported through 1930 or NCRP (cybercrime.gov.in). Any abuse of this system is strongly discouraged. The Indian Cyber Crime Coordination Centre (I4C) reserves the right to suspend accounts noticed for abuse and recommend actions against the concerned persons.

4. Seizure Powers and Requirements

Orders for seizure of accounts or property must be issued under Section 106 BNSS, Section 31 of the Banning of Unregulated Deposit Schemes Act, 2019 (BUDS Act) where applicable, or other extant law. Critically, such orders should be issued only with respect to an FIR, including an e-FIR, and a copy must accompany such orders.

5. Real-Time Action Requirements

Participating Entities must take real-time action to put reported transactions on hold. Banks are required to effect API integrations with the NCRP Portal as suggested by the Department of Financial Services and the Reserve Bank of India (RBI). This technological integration is crucial for preventing the rapid movement of defrauded funds.

6. AML/CFT Compliance

All Participating Entities must follow prescribed Anti Money Laundering (AML) and Combating the Financing of Terrorism (CFT) norms. This includes:

• Suspension of digital banking services pending verification
• Enhanced Due Diligence (EDD) measures for reported accounts
• Compliance with RBI circulars and master directions
• Actions prescribed under Section 12AA of the Prevention of Money Laundering Act, 2002

7. Grievance Redressal Framework

Account holders affected by put-on-hold, suspension of digital banking services, or seizure may raise grievances through their respective banks or Financial Intermediaries (FIs). Such grievances must be addressed within a prescribed timeframe, ensuring that innocent account holders are not unduly harmed by preventive measures.

8. Pre-Seizure Verification

Before issuing an order under Section 106(3) BNSS, Investigating Officers (IOs) may conduct verifications with the account holder and their bank. Account holders must be given a reasonable opportunity to submit an explanation for disputed transactions—a vital safeguard against wrongful freezing of legitimate accounts.

9. Judicious Platform Use and Accountability

LEA officers must ensure judicious use of the platform through continuous monitoring of orders issued and grievances raised. Unwarranted account freezing orders are strongly discouraged, and accountability measures must be established for improper use of the system.

10. Multiple Pathways for Restoration

Money lost in Cyber-Enabled Financial Crimes can be released to victims through any of the following processes:

• Section 106(3) BNSS (previously Section 102(3) of CrPC)
• Competent court orders under Sections 107, 497, 498 of BNSS (previously Sections 451, 452 CrPC) or Section 503 of BNSS (previously Section 457 CrPC)
• Any process prescribed by jurisdictional High Courts

"All possible measures should be taken to ensure that the victim is not put to undue hardship in the process. All stakeholders involved in the interim release of the defrauded amount are expected to rely on CFCFRMS and associated banks' statements of respective account holders. Wherever ambiguities are anticipated, safeguards and judicial interventions are contemplated."

11. Handling Zero Balance Accounts

When the balance in a reported account is zero or less than the disputed amount, banks must conduct prescribed Enhanced Due Diligence (EDD) and take measures to prevent further loss through the account. However, the bank is not expected to release money to the original victim whose funds have been transferred further. Instead, amounts put on hold in subsequent accounts may be released to appropriate victims following due process.

12. Consideration of Mule Accounts

Investigating Officers must take into account the possibility that reported accounts may be operated without the knowledge, connivance, or consent of the account holder. This principle recognizes the reality of "money mule" scenarios where innocent individuals' accounts are compromised or coerced into use by criminals.

13. Attribution and Pro-Rata Distribution

When deciding which victim should receive amounts put on hold or under seizure, the following principles apply:

• Direct Attribution: Whenever the amount can be reasonably attributed to an actual victim, interim custody may be given through prescribed procedures
• Pro-Rata Distribution: When attribution is not possible due to commingling of amounts belonging to different victims, the principle of equitable or pro-rata distribution will be adopted (in accordance with case laws detailed in Annexure III)

Integration with Police Stations

An important additional principle states that crimes directly reported at Police Stations by victims should be escalated to NCRP-CFCFRMS for action by LEAs and PEs. This ensures that all cyber-enabled financial crimes benefit from the coordinated response mechanism, regardless of the initial reporting channel.

Scope and Applicability

The SOP's guiding principles apply to:

• Putting on hold, interim custody, and restoration of amounts related to flagged transactions
• Suspension and restoration of digital banking services
• Seizure and release of bank accounts or property
• Five alternative processes for interim custody and restoration
• Disposal of unclaimed proceeds of cybercrime
• Grievance redressal mechanisms

Critical Note: This SOP is valid only for cybercrime complaints reported on NCRP including 1930 and escalated to CFCFRMS.

Participating Entities

The SOP applies to all Participating Entities, including:

• Police agencies
• Banks and Non-Banking Financial Companies (NBFCs)
• Payment System Operators (PSOs)
• Payment Gateways (PGs) and Payment Aggregators (PAs)
• Business Correspondents (BCs)
• Lending Service Providers
• Stock Trading Companies and Mutual Fund Companies
• E-commerce companies
• Cryptocurrency Exchanges
• Other Financial Intermediaries offering similar services

Balancing Rights and Security

These guiding principles embody the SOP's commitment to the principles of proportionality, transparency, fairness, and safeguarding fundamental rights. The framework explicitly recognizes that while cyber-enabled financial crimes must be combated vigorously, the essential rights of citizens—including the Right to Livelihood and Right to Privacy—must be protected.

Practical Implementation

For successful implementation, States and Union Territories must work closely with other Participating Entities to follow the SOP. The goal is threefold:

1. Prevent defrauded money from leaving the financial system
2. Facilitate interim custody and restoration of amounts to victims
3. Create a cybercrime-resilient financial ecosystem

Conclusion: A Comprehensive Framework

The Guiding Principles of the NCRP-CFCFRMS SOP represent a carefully balanced approach to combating cyber-enabled financial crimes. By establishing clear legal authority, requiring due diligence, providing multiple pathways for restoration, and safeguarding the rights of both victims and account holders, the SOP creates a comprehensive framework that addresses the complex realities of modern cybercrime.

The success of this framework depends on the diligent application of these principles by all Participating Entities, continuous monitoring, and a commitment to both preventing crime and protecting fundamental rights. As cyber threats evolve, these guiding principles provide a stable foundation for adaptive and effective response mechanisms.

← Back to Legal Analysis