From Bank Books to Digital Proof: The Bankers’ Books Evidence Act 2026

India’s banking system has moved from paper ledgers to Core Banking Systems (CBS), mobile applications, cloud infrastructure, Application Programming Interfaces (APIs) and increasingly automated processes. Yet the law governing the evidentiary use of bank records remained rooted in a paper-based era. The Bankers’ Books Evidence Act, 2026 therefore represents more than the replacement of an old statute. It addresses a fundamental question for digital banking: when the “bank book” is no longer a book, how should a bank prove that its digital record is genuine and reliable?

The legislation received Presidential assent on 13 August 2026. However, its commencement remains subject to notification by the Central Government under Section 1(2). The significance of the new framework lies not merely in recognising digital records, but in establishing how their authenticity, integrity and provenance can be demonstrated, who should certify them, and how sensitive customer information should be disclosed.

1. From Bank Books to Banking Data

The 1891 framework was designed around physical books and certified copies of entries. Banking, however, now generates records across interconnected systems. A single transaction may leave evidence across CBS, applications, APIs, cloud platforms, fraud-monitoring systems and disaster-recovery environments.

The 2026 Act adopts a technology-neutral approach by expressly bringing physical as well as electronic, digital, virtual and cloud-based records within the concept of bankers’ books, including records maintained in backup and disaster-recovery locations. It also recognises circumstances where multiple computer systems, networks, resources and intermediaries collectively constitute the system through which the relevant record was created or maintained.

This is important because the evidentiary record of a modern bank transaction is rarely confined to one database. The legal framework therefore moves closer to the technological reality of contemporary banking.

2. The Real Reform: Proving Digital Records

Digital evidence was already recognised under India’s general evidence framework. The Bharatiya Sakshya Adhiniyam, 2023 provides that electronic records cannot be rejected merely because they are electronic, subject to prescribed evidentiary requirements. The distinctive contribution of the new Bankers’ Books framework is therefore its banking-specific proof architecture.

For electronic records, Section 7 requires certification relating to matters such as regular use of the system, entry of information in the ordinary course, proper functioning, authorised operation, safeguards, system integrity and protection against cyber risks.

The underlying shift is significant. The question is no longer simply:

“Is this a record generated by the bank?”

It increasingly becomes:

“Can the bank demonstrate why this record should be trusted?”

This can strengthen the evidentiary position of banks in recovery proceedings, fraud investigations, insolvency matters, arbitration and customer disputes, where challenges may otherwise arise over the reliability of computer-generated statements and extracts.

3. Authenticity Is Not Accuracy

An important distinction must, however, be maintained between authenticity and accuracy.

A secure system can still contain incorrect information. If an erroneous customer detail is entered by an authorised employee, the system may preserve and reproduce that incorrect information perfectly. Similarly, a genuine system-generated record may accurately reflect what the system recorded without necessarily establishing that the underlying business event occurred exactly as recorded.

Authenticity therefore addresses the question: Was this record genuinely produced or maintained by the bank’s system?

Accuracy asks a different question: Does the record correctly represent what actually happened?

The distinction has practical implications. Banks may therefore consider strengthening transaction-level audit trails, maker-checker records, data lineage and tamper-evident logs. For high-value or disputed evidence, hash-based verification may also provide an additional layer of assurance, even where the statute does not expressly prescribe it.

The objective should be to establish not merely that a record exists, but that its origin, transformation, integrity and subsequent handling can be demonstrated.

4. The Certification Challenge

One of the most practical implementation issues concerns who should certify digital evidence.

Section 3 permits the branch head, office head or another authorised officer to authenticate the certificate. For a traditional paper record, this model was relatively straightforward. In a centralised digital bank, however, a branch official may not have direct control over the CBS/Oracle infrastructure, cloud environment, disaster-recovery systems or enterprise cyber-security architecture.

This can create a mismatch between responsibility and technical knowledge.

A more defensible approach may be a modular certification model. The branch or business official could certify the transaction and ordinary-course context; a designated technology function could certify system operation and integrity; and an information-security or forensic function could certify relevant cyber controls and evidence preservation. These components could then support the final legal certificate.

Such an approach would avoid turning certification into a routine formality while also ensuring that frontline officials are not expected to personally certify enterprise-level technology controls over which they have no operational control.

5. Fraud, Cyber Security and Evidence Quality

The importance of reliable digital evidence becomes clearer against the scale and nature of banking fraud. RBI reported 23,953 bank frauds involving ₹36,014 crore during 2024–25. Card and internet frauds accounted for 13,516 cases, making them the largest category by number, while advances-related frauds accounted for ₹33,148 crore, or about 92% of the amount involved.

These two categories create different evidentiary requirements. Digital-payment fraud may require rapid preservation of transaction trails, authentication records, device information and system logs. Credit-related fraud may require a much wider documentary chain covering application data, appraisal, sanction, disbursement, account operations, monitoring and communications.

The 2026 Act does not prevent fraud; rather, it strengthens the proof infrastructure needed after an event has occurred.

This makes cyber security an evidentiary issue as well. If a cyber incident compromises a system, the question may extend beyond service restoration to whether the bank can establish which records were original, which were restored, which were altered and which were reconstructed.

RBI’s supervisory agenda already reflects this connection. Its Annual Report 2024–25 highlights digital forensic readiness, operational resilience of digital channels, cyber-risk assessment and data governance, while recognising the growing role of third-party technology providers in banking infrastructure.

For banks, evidentiary readiness should therefore become part of cyber resilience. A record that cannot be traced through its creation, extraction, preservation and submission may become difficult to defend even when the underlying transaction itself is genuine.

6. Privacy and Responsible Disclosure

The evidentiary value of bank records must also be balanced against their sensitivity.

A bank statement rarely contains only the transaction relevant to a legal proceeding. It may reveal salary credits, investments, family transfers, travel expenditure, medical payments and other aspects of an individual’s private life. Digital records are also considerably easier to copy, search, combine and disseminate than physical documents.

The key distinction is therefore between two questions:

Can the record be admitted?

and

How much of the record should be disclosed?

The first is an evidentiary question; the second is a data-governance question.

This becomes increasingly relevant alongside India’s evolving privacy framework. The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data and recognises both individual data-protection interests and the need for lawful processing. The Digital Personal Data Protection Rules, 2025 further provide the implementation framework, with provisions coming into force in phases.

Banks may therefore consider adopting data minimisation as a standard for evidentiary disclosure: provide the relevant account, period, transactions and fields required for the stated legal purpose rather than automatically releasing an entire account history.

A disclosure register could further record what was provided, under whose authority, for what purpose and when. This would create an audit trail around the disclosure itself.

7. BFSI Impact and Implementation Priorities

The immediate statutory benefit is strongest for entities covered as banks, while broader application to other financial-sector entities depends on the relevant statutory and notification framework. The practical impact will therefore vary across the BFSI ecosystem.

Segment	Likely impact
Banks	Greater certainty and efficiency in presenting digital records, but higher certification and governance requirements
Co-operative Banks, RRBs and SFBs	Legal benefit, but relatively higher implementation burden because of limited technology and legal resources
NBFCs and Digital Lenders	Potential benefit subject to applicable extension/coverage; certification and third-party data issues will require clarity
Fintech and Payment Ecosystem	Greater evidentiary relevance as transaction records increasingly span partner banks, intermediaries and outsourced platforms
Insurance	Not within the core banking framework unless separately brought within the relevant statutory mechanism

For banks, the immediate priority should be to move from record availability to evidence readiness. A Digital Evidence Readiness Framework could include:

• Standardised evidence procedures: A central repository and Standard Operating Procedure (SOP) for court, police, regulatory and arbitration requests.
• Role-based certification: Clear separation between business-record certification, system-integrity certification and cyber-security/evidence-preservation certification.
• End-to-end data lineage: Ability to identify the source system, transformations, extraction process and final evidence package.
• Chain of custody: Documented control over extraction, preservation, transfer and submission, particularly where multiple systems or technology vendors are involved.
• Tamper-evident preservation: Hash-based or equivalent verification for high-value or high-risk evidence.
• Disclosure governance: A legal-disclosure matrix defining authority, scope, minimum data requirements and approval responsibility.
• Vendor readiness: Contracts with technology providers should address retention, audit trails, evidence preservation, incident reporting and cooperation in legal proceedings.
• Periodic testing: Mock exercises involving legal, operations, IT, cyber security, compliance, fraud-risk and records-management teams.

These measures can also reduce the risk of certification becoming a paper exercise. The objective should be to make evidence generation a controlled process embedded within the bank’s technology and governance architecture.

Conclusion: Beyond Digital Admissibility

The Bankers’ Books Evidence Act, 2026 is more than a transition from paper records to digital records. Its deeper significance lies in creating a bridge between banking technology and courtroom proof.

For banks, the potential benefits are considerable: faster production of records, more efficient recovery proceedings, stronger fraud investigations and greater certainty around the evidentiary use of digitally generated information. But the new framework also raises a broader governance challenge. The more valuable bank data becomes as evidence, the more carefully it must be protected against unauthorised alteration, inappropriate disclosure and loss of provenance.

The next phase should therefore focus on implementation quality. Digital evidence should be authentic, accurate, traceable, proportionate and secure, not merely available.

The institutions best prepared for the digital-evidence era will be those that treat legal evidence, cyber security, data governance, operational resilience and records management not as separate functions, but as components of one integrated control framework. In digital finance, the ability to prove a transaction is becoming almost as important as the ability to process it.

Annexure: Snapshot of Sector-wise Impact and Implications

Segment	Primary Effect of the Bill	Net Impact
Public Sector Banks (PSBs)	Digitally generated statements, CBS ledgers and cloud-based loan records gain direct statutory admissibility in DRT/SARFAESI recovery matters and PMLA/fraud prosecutions, reducing technical challenges from defaulting borrowers.	Positive, but compliance-heavy given legacy IT systems and high fraud-value exposure (PSBs accounted for ~71% of FY25 fraud value).
Private Sector Banks	Benefit similarly on admissibility; higher fraud case-count (card/internet fraud) makes the certification regime and Section 11 police-access route more frequently invoked in practice.	Positive for litigation efficiency; higher operational load from frequent law-enforcement requisitions.
NBFCs & Digital Lenders	Not automatically covered — the Act applies to “banks” and post office savings banks; NBFCs are covered only if and when the Central Government issues a Section 4 notification extending the Act to them.	Uncertain – until notified, NBFC records may still face admissibility disputes under the general evidence law.
Payment Aggregators, PPIs & Fintechs	Same notification-dependency as NBFCs; most fintech transaction data is generated on infrastructure jointly controlled with partner banks, raising certification-attribution questions.	Uncertain – a coverage and certification gap exists until specific notification and clearer cloud-attribution rules emerge.
Cooperative Banks, RRBs & Small Finance Banks	Covered as “banks” but typically lack the in-house legal/IT capacity of larger lenders to build compliant certification workflows and respond to Section 11 requisitions correctly.	Mixed – legal benefit is real, but compliance cost is proportionally higher for smaller, resource-constrained institutions.
Insurance Companies	Not covered at all unless separately notified under Section 4; insurers continue to rely on the Bharatiya Sakshya Adhiniyam’s general Section 63 certificate regime for their own electronic records.	Neutral to negative – the “I” in BFSI is effectively outside this Bill’s core framework for now, creating an evidentiary asymmetry within the sector.

Authored by:

 

Bahadur Singh,

Chief Manager (Research)

State Bank Staff College,

Hyderabad