Digital Banking: formula sheet

Key formulas

Electronic funds transfer (PSS Act, section 2(1)(c))

EFT = transfer initiated by instruction, authorisation or order to a bank to debit or credit an account, through electronic means

Includes POS transfers, ATM transactions, direct deposits or withdrawals, and transfers by telephone, internet and card payment.

Payment system (PSS Act, section 2(1)(i))

Payment system = system enabling payment between a payer and a beneficiary, involving clearing, payment or settlement service or all of them; excludes a stock exchange

Includes systems for credit card, debit card, smart card and money transfer operations.

System provider and participant (section 2(1)(p), (q))

System provider = person who operates an authorised payment system; system participant = a bank or any other person participating in a payment system, including the system provider

Note that the provider is also a participant.

Compensation for failure to protect data (IT Act, section 43A)

Body corporate + sensitive personal data in a computer resource it owns, controls or operates + negligence in reasonable security practices + wrongful loss or gain to a person = liability to pay damages by way of compensation

Body corporate includes any company, firm, sole proprietorship or other association engaged in commercial or professional activities. All four elements must be shown.

Reach of the IT Act (section 75)

Act applies to offence or contravention outside India if the act involves a computer, computer system or computer network located in India

Applies irrespective of the person's nationality.

Section 4: electronic records

Law requires writing, typewritten or printed form → satisfied if the information is (a) rendered or made available in electronic form AND (b) accessible so as to be usable for a subsequent reference

Both conditions must be met. Accessibility for later reference is the one students forget.

Section 5: electronic signatures

Law requires authentication by signature → satisfied if authenticated by electronic signature affixed in the manner prescribed by the Central Government

The Explanation says 'signed' means affixing a handwritten signature or any mark, and 'signature' is read accordingly.

Section 6(1): e-governance

Filing of forms or documents, issue of licence, permit, sanction or approval, and receipt or payment of money → satisfied if done by the electronic form prescribed by the appropriate Government

Applies to offices, authorities, bodies or agencies owned or controlled by the appropriate Government.

Section 6(2): rule-making

Appropriate Government may prescribe (a) manner and format of electronic records filed, created or issued; (b) manner or method of payment of fees or charges

Section 10 separately lets the Central Government prescribe the type, manner and format of electronic signatures.

Section 3: digital signature authentication

Subscriber affixes digital signature using asymmetric crypto system + hash function; any person can verify with the subscriber's public key

Private and public key are unique to the subscriber and form a functioning key pair.

Section 1(4): exclusions

Act does not apply to documents or transactions specified in the First Schedule

Central Government may add or delete entries by notification, laid before each House of Parliament.

Section 36 representations (a) to (f)

(a) compliance with Act; (b) published and accepted; (c) subscriber holds private key; (ca)+(cb) key can sign and verify; (d) functioning key pair; (e) information accurate; (f) no knowledge of adverse material fact

Clauses (ca) and (cb) were inserted in 2009. Clause (f) protects only the reliability of clauses (a) to (d).

Licence to issue certificates (Section 21)

Application to Controller; prescribed requirements met; licence valid for prescribed period; not transferable or heritable

Licence terms and conditions are as specified by regulations.

Application for certificate (Section 35)

Prescribed form + fee ≤ ₹25,000 + certification practice statement; grant, or reject with written reasons after reasonable chance to show cause

Different fees may be prescribed for different classes of applicants.

Certifying Authority procedures (Section 30)

Secure hardware, software and procedures; reasonable reliability; secrecy and privacy of signatures; be repository of certificates; publish practices, certificates and status; follow specified standards

Use this with Section 36 when asked for duties of a Certifying Authority.

Deemed acceptance (Section 41(1))

Acceptance = publishes OR authorises publication (to one or more persons / in a repository) OR otherwise demonstrates approval in any manner

Any one route is enough. No formal written acceptance is required.

Certification by subscriber (Section 41(2))

(a) holds the private key and is entitled to it; (b) all representations to the CA and all material facts are true; (c) all information in the certificate within his knowledge is true

Made to all who reasonably rely on the certificate.

Related duty: control of private key (Section 42)

Reasonable care to retain control of private key; on compromise, inform the CA without delay; liable until he informs the CA

Follows from acceptance; use it as the next step in your answer.

Related penalty (Section 73)

Publishing a certificate knowing the subscriber has not accepted it: imprisonment up to 2 years, or fine up to ₹1,00,000, or both

Also covers knowledge that the CA did not issue it, or that it is revoked or suspended (unless publishing is to verify an earlier signature).

Who can request suspension (Section 37(1)(a))

Subscriber listed in the DSC, or a person duly authorised to act on the subscriber's behalf

Only the CA that issued the certificate can suspend it.

Suspension in public interest (Section 37(1)(b))

CA is of opinion that suspension is needed in public interest

No request from the subscriber is needed here.

Limit on suspension (Section 37(2))

Suspension beyond 15 days ⇒ subscriber must be given an opportunity of being heard

Fifteen days or less does not require a hearing under this sub-section.

Communication on suspension (Section 37(3))

CA must communicate the suspension to the subscriber

Applies on every suspension.

Revocation on request or event (Section 38(1))

Subscriber or authorised person requests; or subscriber dies; or firm dissolved or company wound up

Revocation is by the CA that issued the DSC.

Revocation by CA's opinion (Section 38(2))

Material fact false or concealed; issue requirement not satisfied; CA's private key or security system compromised materially; subscriber declared insolvent or dead, or firm or company dissolved, wound up or ceased to exist

Subject to Section 38(3).

Hearing before revocation (Section 38(3))

No revocation unless subscriber has been given an opportunity of being heard

Applies to revocation under Section 38(2).

Communication on revocation (Section 38(4))

CA must communicate the revocation to the subscriber

Mirrors Section 37(3).

Publication of notice (Section 39)

Notice in the repository specified in the DSC; in all repositories if more than one

Duty of the CA for both suspension and revocation.

Penalty for publishing a suspended or revoked certificate (Section 73)

Imprisonment up to 2 years, or fine up to ₹1,00,000, or both

Exception: publication to verify a signature created before the suspension or revocation.

Section 43 – compensation for damage

Act without permission of owner/person in charge + listed act (access, download, virus, damage, disruption, denial of access, etc.) ⇒ liable to pay damages by way of compensation

Civil liability. Permission is the key condition. The Act has no fixed ceiling in the text supplied.

Section 43A – failure to protect data

Body corporate + sensitive personal data in computer resource it owns/controls/operates + negligent in reasonable security practices + wrongful loss or gain ⇒ compensation

All four elements must be present. Negligence is the trigger, not intent.

Section 66C – identity theft

Fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature ⇒ imprisonment up to 3 years and fine up to ₹1,00,000

Imprisonment of either description. The fine is 'may extend to', so it is a maximum.

Section 66F – cyber terrorism

Clause (A): intent to threaten the unity, integrity, security or sovereignty of India, or to strike terror + a listed act (denying access to an authorised person, unauthorised penetration or access, or introducing a computer contaminant) + the conduct causes or is likely to cause death or injury, damage to or destruction of property, disruption of supplies or services essential to the life of the community, or harm to critical information infrastructure. Clause (B): knowing or intentional unauthorised access that obtains restricted information (State security or foreign relations) with reason to believe it may be used to cause injury to the interests listed in the section. Either clause ⇒ imprisonment which may extend to life

Intent alone is not enough under clause (A). The harmful result, or the likelihood of it, must also be present. Conspiracy to commit cyber terrorism is also punishable.

Section 72A – disclosure in breach of lawful contract

Person (including intermediary) with access to personal information under a lawful contract + intent or knowledge of likely wrongful loss or gain + disclosure without consent or in breach of contract ⇒ penalty up to ₹25,00,000

The section as supplied provides a penalty up to twenty-five lakh rupees.

Section 69B – monitoring of traffic data

Central Government authorises an agency to monitor and collect traffic data for cyber security; the intermediary or person in charge of the computer resource must give technical assistance under s.69B(2); an intermediary who intentionally or knowingly contravenes s.69B(2) ⇒ imprisonment up to 1 year or fine up to ₹1 crore, or both (s.69B(4))

The duty to assist under sub-section (2) is on the intermediary or person in charge of the computer resource. The punishment in sub-section (4) is on the intermediary only. It does not apply to the ordinary customer.

Section 77 – other laws not barred

Compensation, penalty or confiscation under the IT Act ⇏ bar on other penalty or punishment under any other law

Use it to say that civil and criminal action can run together.

Quick revision

• Section 4: a legal requirement for writing or print is met if the information is in electronic form and accessible for later reference.
• Section 5: a signature requirement is met by an electronic signature affixed in the manner prescribed by the Central Government.
• Section 36: the Certifying Authority certifies it complied with the Act, published the certificate, and that the subscriber holds a functioning key pair.
• Section 36 also requires the Certifying Authority to certify that the information in the certificate is accurate.
• Section 41: a subscriber is deemed to accept a certificate by publishing it or authorising publication, or by otherwise showing approval.
• By accepting, the subscriber certifies to those who reasonably rely that he holds and is entitled to hold the private key, and that the information within his knowledge is true.
• Section 37: suspension on request of the subscriber or his authorised person, or in public interest.
• Section 37(2): no suspension for more than fifteen days without giving the subscriber a hearing.
• Section 38: revocation on request, death, or dissolution or winding up; also for false facts, unmet requirements or compromised keys.
• Section 38(3): no revocation without a hearing for the subscriber. Section 39 requires notice in the repository.
• Section 73: publishing a certificate knowing it is not issued, not accepted, or is revoked or suspended is punishable, except to verify an earlier signature.
• Section 15: a signature is secure if the creation data was under the signatory's exclusive control; for a digital signature it is the private key.

Common mistakes

• Treating internet banking and mobile banking as identical. Fix: State the difference in the access medium: browser on a computer versus app or phone-based service on a mobile device.
• Calling UPI a bank or a type of account. Fix: Describe UPI as a real-time payment system accessed through apps that links bank accounts.
• Using 'electronic signature' and 'digital signature' as the same thing. Fix: Say that electronic signature is the wider legal term in Section 5, while digital signature is the asymmetric crypto and hash function method in Section 3.
• Omitting the 'accessible for subsequent reference' condition in Section 4. Fix: Write both limbs: (a) electronic form and (b) accessible so as to be usable for a subsequent reference.
• Listing only five or six points and missing clauses (ca) and (cb). Fix: Remember the key-pair group: holds private key, can sign, public key can verify, functioning pair.
• Saying the subscriber gives the Section 36 representations. Fix: Section 36 is by the Certifying Authority; Section 41 is by the subscriber.
• Saying acceptance needs a written, signed acknowledgement. Fix: Section 41(1) deems acceptance from publication, authorised publication or approval shown in any manner.
• Mixing up what the Certifying Authority certifies with what the subscriber certifies. Fix: Section 36 is the CA's representations at issue. Section 41(2) is the subscriber's certification on acceptance.
• Saying a DSC can never be suspended without a hearing. Fix: Suspension up to fifteen days needs no hearing. Only a longer suspension needs one. Revocation always needs a hearing.
• Saying the fifteen-day limit is an absolute cap. Fix: The limit applies 'unless the subscriber has been given an opportunity of being heard'. With a hearing, suspension can continue.

Exam tips

• Begin with a precise definition. Examiners reward the exact definitions of electronic funds transfer and payment system.
• Use a short comparison list for channel questions rather than a long paragraph.
• For case questions, follow provision, analysis, conclusion, and name the section only when sure.
• Add a practical compliance point, such as security practices and customer authentication, to earn extra marks.
• Write section numbers with their conditions; examiners reward the exact limbs of Sections 4, 5 and 6.
• In case questions, follow provision, analysis, conclusion, and end with a practical point such as keeping records retrievable.
• Keep a one-line contrast ready: electronic signature (Section 5, wider) versus digital signature (Section 3, crypto-based).
• Mention the Section 1(4) First Schedule exclusion as a closing line when the question asks about limits.