Bank Records Go Digital: Is India Ready for AI Evidence?

Parliament has enacted a modern replacement for a law first passed in 1891, but there is an important legal distinction at the outset.

The Bankers’ Books Evidence Bill, 2026 was introduced in the Lok Sabha on August 3, passed by the Lok Sabha on August 5 and passed by the Rajya Sabha on August 10. It received Presidential assent on August 13 as the Bankers’ Books Evidence Act, 2026, Act No. 15 of 2026. The legislative timeline can be checked through PRS Legislative Research and the Digital Sansad Bills database.

Assent, however, is not the same as commencement. Section 1 states that the Act will come into force on a date separately notified by the Central Government. Section 16 repeals the Bankers’ Books Evidence Act, 1891, but that repeal operates when the new statute commences. It is therefore more accurate to say that Parliament has enacted a replacement framework, not that the 1891 law was automatically displaced on the date of assent.

At first glance, the reform looks straightforward. Courts no longer operate in a world where the most important financial evidence sits inside a leather-bound ledger at a bank branch. Transactions now exist as database entries, server logs, electronic instructions and records stored across networked systems.

The harder policy question is whether India has modernised the safeguards around those records as effectively as it has modernised their legal recognition.

That question becomes even more important as automated and artificial intelligence systems enter banking operations.

What the 2026 Act Changes

The stated purpose of the legislation is to govern evidence contained in bankers’ books and to:

“align it with contemporary digital banking practices”

The definition of bankers’ books now expressly covers records kept in written or physical form as well as records stored electronically or digitally. It includes records held onsite, offsite, virtually, in the cloud, and at backup or disaster recovery locations. The PRS-hosted text of the Bill provides a stable copy of these provisions.

The Act also allows certificates to be signed or authenticated manually or through digital or electronic signatures. Section 6 provides that an electronic or digital bank record cannot be denied admissibility merely because it exists in electronic or digital form, although it must still satisfy the conditions set out in Section 7.

There is also an important historical correction.

The 1891 law was no longer wholly confined to paper by the time the new legislation was enacted. Amendments made in 2000 and 2002 had already expanded bankers’ books to include microfilm, magnetic tape and other forms of mechanical or electronic data retrieval. The earlier law also recognised computer printouts through certification requirements and required information about safeguards against unauthorised changes, data transfer and storage.

The official India Code text of the 1891 Act makes this clear.

The 2026 reform is therefore best understood as an expansion and restructuring of an already partly digitised framework. Its major contribution is not the first recognition of electronic bank records. It is the express inclusion of virtual and cloud environments, a more detailed admissibility framework and updated certification rules.

Are Screenshots and Blockchain Records Automatically Admissible?

No. The Act does not say that every screenshot from a banking application or every blockchain transaction log automatically becomes admissible evidence.

The legislation uses technology-neutral language. A record stored electronically, digitally, virtually or in the cloud may fall within the definition of bankers’ books when it is used in the ordinary course of the bank’s business. Its admissibility under the specialised framework still depends on certification and the integrity conditions prescribed by the Act.

A screenshot taken by a customer may be relevant and may be proved under general evidence law, depending on the facts. It is not automatically the certified copy produced by a bank that Sections 2 and 3 of this Act contemplate.

The legislation also does not specifically mention blockchain. A blockchain-based record maintained by a regulated financial institution could potentially fit within the broad definition of a digital banking record. That is an inference from the technology-neutral wording, not an express rule in the Act. Its evidentiary use would still depend on proof of origin, certification, system reliability and compliance with the applicable evidence law.

This distinction matters for UPSC analysis. Legal recognition of a category of digital evidence is not the same as automatic acceptance of every digital representation of that evidence.

The Act Contains Real Digital Safeguards

It would be inaccurate to suggest that the new framework ignores data integrity.

Section 7 lays down several conditions for records maintained in electronic or digital form. Among other things, it requires that:

• The computer system or communication device was regularly used to create, store or process the information.
• The information was entered into the system in the ordinary course of activity.
• The system operated properly during the relevant period, or any malfunction did not affect the record or its accuracy.
• The copy correctly represents or is appropriately derived from the underlying records.
• Data entry and other operations were performed only by authorised persons.
• Adequate safeguards existed against unauthorised alteration.
• Transfer to identifiable media was accurate and followed by safe storage and custody.
• No tampering affecting system integrity or accuracy was detected.
• Networks, devices and stored data were secured against cyber risks or threats.

These are meaningful protections. They move the law beyond a simple declaration that digital records are acceptable.

The limitation is that several requirements are framed as outcomes rather than precise technical standards. The Act requires adequate safeguards, secure systems and an absence of detected tampering, but it does not itself prescribe a mandatory cryptographic method, a standard forensic imaging process or a universal end-to-end logging protocol.

Much will therefore depend on commencement notifications, amendments to the certificate formats, banking procedures, forensic standards and judicial interpretation.

The Missing Hash Value Problem

One of the strongest comparisons comes from India’s general evidence law.

Sections 61 to 63 of the Bharatiya Sakshya Adhiniyam, 2023 govern electronic and digital records. Section 61 gives an electronic record:

“the same legal effect, validity and enforceability as other document.”

The statutory certificate attached to the Adhiniyam asks for the hash value of the electronic or digital record and provides fields for algorithms such as SHA1, SHA256, MD5 or another legally acceptable standard. The official Ministry of Home Affairs text contains the certificate format.

A hash value functions like a digital fingerprint. A change to the underlying file will usually produce a different hash. Investigators, banks and courts can therefore compare the recorded fingerprint at different stages to check whether the file has changed.

The Bankers’ Books Evidence Act requires authorised access, accurate transfer, secure networks, a true copy and the absence of detected tampering. Its Second Schedule, however, does not expressly require the bank to state the record’s hash value.

The Indian Express reported expert concern that a hash-based verification mechanism could have strengthened confidence in the integrity of electronic banking evidence.

This creates an avoidable mismatch. India’s general evidence law contains an explicit field for the digital fingerprint of electronic evidence, while the specialised banking statute relies more heavily on certification and broad statements about system integrity.

The gap is not necessarily permanent. Section 12 allows the Central Government to modify the certificates in the Schedules through notification. A hash field, extraction timestamp, source identifier and audit-log reference could therefore be added without waiting for Parliament to enact an entirely new statute.

Why Chain of Custody Matters

Digital evidence can be copied perfectly and moved between systems without producing the obvious physical signs associated with handling a paper document or physical object.

A bank record may travel from a core banking server to an employee terminal, an investigation platform, removable storage, a forensic laboratory and eventually a courtroom. It may also move directly between cloud systems.

The relevant question is not only whether the record looks genuine. Courts may need to know where it originated, who extracted it, who accessed it, when it was copied, whether its metadata changed and whether the courtroom version is identical to the original extraction.

That is the function of chain of custody.

The 2026 Act requires safeguards for accurate transfer to identifiable media and safe storage and custody of that media. It also requires that no tampering affecting system integrity or accuracy be detected.

What it does not establish is a detailed, universal forensic protocol covering every later stage of handling. It does not prescribe one standard format for access logs, evidence transfer records, cloud-to-cloud extraction or the preservation of native metadata.

The statute creates a foundation. A complete chain-of-custody system will still require technical rules, institutional procedures and consistent forensic practice.

The Privacy Question Is Bigger Than Admissibility

Financial records are among the most revealing forms of personal data.

A bank account may reveal where a person travels, which hospital they visited, what organisations they support, what services they purchase and, in some cases, whom they associate with.

Making digital financial evidence easier to reproduce and transmit therefore creates a privacy question alongside the evidentiary question.

Section 11 has received particular attention. In investigations covered by the Act, references to certain court orders may operate as references to an order made by an officer not below the rank of Superintendent of Police or by another officer specified by the appropriate government.

This power is not new. Section 8 of the 1891 Act contained a substantially similar mechanism. Describing Section 11 as a newly created police power would therefore be misleading.

What has changed is the technological environment.

A physical ledger is difficult to duplicate and distribute instantly. A digital financial record can be copied, searched, combined with other datasets and transmitted with almost no friction. The scale and speed of possible processing change the privacy consequences of an older investigative power.

One expert quoted by The Indian Express argued:

“It should be the court which can allow it.”

The debate is therefore not simply about whether investigators ever need financial records. It is about whether access safeguards designed for an earlier technological environment remain proportionate when the information can be duplicated and analysed at scale.

Where the DPDP Act Enters the Debate

The Digital Personal Data Protection Act, 2023 contains an important security principle. Section 8(5) requires a data fiduciary to use:

“reasonable security safeguards to prevent personal data breach”

Section 17 also creates exemptions for certain processing connected with legal claims, judicial or regulatory functions, and the prevention, detection, investigation or prosecution of offences. Even within several of those exemptions, Sections 8(1) and 8(5) remain applicable.

There is, however, a crucial timing correction.

As of August 2026, these substantive provisions are enacted but not yet in force. The commencement note in the official India Code text of the DPDP Act schedules Sections 3 to 17 to commence 18 months after November 13, 2025. That places their commencement on May 13, 2027.

The draft should therefore not describe Sections 8 and 17 as if they are already operational law in August 2026.

Once they commence, they will reinforce an important principle. Lawful access does not automatically remove the obligation to handle personal data securely.

Investigators may have a legitimate basis for obtaining financial records. The legality of access and the security of the data after access remain separate questions.

India’s evidence law, data protection framework and investigative procedures will ultimately need to function as one coherent system rather than as separate legal silos.

The Information Technology Act Still Matters

The Information Technology Act, 2000 supplies much of the legal architecture for electronic transactions and records in India. It recognises electronic records and electronic signatures and provides concepts relating to authentication and secure electronic records.

Section 2(2) of the Bankers’ Books Evidence Act expressly states that undefined terms used in the statute will carry the meanings assigned to them in the Arbitration and Conciliation Act, 1996, the Information Technology Act, 2000, the Bharatiya Nagarik Suraksha Sanhita, 2023 and the Bharatiya Sakshya Adhiniyam, 2023.

The updated India Code text of the Information Technology Act is therefore directly relevant to the new banking evidence framework.

This produces a layered legal architecture:

• The Information Technology Act supplies legal recognition and technical concepts for electronic records and signatures.
• The Bharatiya Sakshya Adhiniyam provides the general framework for electronic evidence.
• The Bankers’ Books Evidence Act creates a specialised route for proving bank records.
• The DPDP Act will govern relevant personal-data processing when its substantive provisions commence.

The challenge is to ensure that these layers reinforce one another rather than generate inconsistent certification and integrity standards.

AI-Generated Financial Evidence Is the Next Frontier

The most interesting future question may not concern an ordinary digital bank statement. It may concern an output produced by an automated or artificial intelligence system.

Suppose a bank’s system generates a fraud alert that later becomes relevant in a criminal proceeding. What exactly constitutes the evidence?

Is it the final alert, the transaction data used by the system, the model output, the system logs, the version of the model operating at the time, or the rules and parameters that produced the conclusion?

Traditional electronic evidence law often assumes that the important object is a stored record whose integrity can be tested. AI complicates that assumption because the contested material may be the output of a computational process rather than a simple database entry.

A perfectly preserved AI-generated document can still contain a false or unreliable conclusion.

Hash verification can show that a file has not changed. It cannot establish that the algorithm which produced the file was accurate, unbiased or appropriately used.

Future evidence standards may therefore need to distinguish among three separate questions:

• Integrity: Has the record changed since it was created or extracted?
• Provenance: How, when and from which system was it produced?
• Reliability: Can the process that generated the conclusion be trusted?

The 2026 Act addresses integrity and provenance to some extent through certification, system-operation requirements and safeguards against tampering. It does not create a detailed framework for testing the substantive reliability of algorithmic outputs.

That could become one of the defining legal questions of AI-enabled banking.

What Policymakers Should Do Next

India does not need to choose between digital efficiency and evidentiary safeguards. It can design both into the implementation framework.

Before the Act is brought into force, the government should use the notification and Schedule-amendment powers to strengthen technical requirements.

Important banking records should carry a cryptographic hash, extraction timestamp, source-system identifier and a tamper-evident audit-log reference. Procedures should preserve native metadata and record every material transfer, copy or transformation.

Rules should also address cloud-native evidence rather than focusing only on transfer to removable media. Banks and investigating agencies need clear standards for cloud extraction, secure transmission, access control, retention and deletion.

Sensitive records obtained during investigations should be governed by purpose limitation and role-based access. Every person or system that views, copies or exports the data should leave an auditable trail.

Certification requirements should be harmonised with the Bharatiya Sakshya Adhiniyam so that specialised banking evidence does not operate with a weaker integrity marker than general electronic evidence.

Finally, India should develop standards for algorithmically produced financial evidence before such disputes become routine. These standards should cover model versioning, input data, decision logs, human review and the limits of automated conclusions.

The UPSC Takeaway

The Bankers’ Books Evidence Act, 2026 is not merely a banking law reform. It sits at the intersection of judicial administration, privacy, cybersecurity, financial technology and artificial intelligence.

For GS Paper II, it raises questions about judicial safeguards, investigative powers, privacy, proportionality and institutional accountability.

For GS Paper III, it connects banking modernisation with digital infrastructure, cybersecurity, data governance and emerging technology.

For Prelims, remember the core facts:

• The Bill was introduced in the Lok Sabha on August 3, 2026.
• It passed the Lok Sabha on August 5 and the Rajya Sabha on August 10.
• It received Presidential assent on August 13 as Act No. 15 of 2026.
• The Act has deferred commencement and will take effect on a date notified by the Central Government.
• It expressly covers digital, virtual and cloud-based banking records.
• Electronic records are admissible subject to the conditions in Section 7.
• The Second Schedule does not expressly ask for a hash value, unlike the certificate under the Bharatiya Sakshya Adhiniyam.

For Mains, the stronger argument is conceptual.

Technological neutrality helps a statute survive changes in storage systems. It does not, by itself, guarantee evidentiary trust. Trust requires verifiable integrity, traceable provenance, secure handling and, in the case of AI outputs, a method for testing substantive reliability.

Conclusion

The Bankers’ Books Evidence Act, 2026 deserves credit for recognising how dramatically banking has changed. Cloud systems, remote infrastructure and electronic transactions cannot be governed indefinitely through language centred on physical books.

Yet assent should not be confused with commencement, and digital recognition should not be confused with digital trust.

The Act contains meaningful safeguards. It requires reliable systems, authorised operations, accurate copies, safe transfer, secure networks and an absence of detected tampering. Its main weakness is that it leaves several technical details to later implementation and does not expressly require the hash value used in India’s general electronic-evidence certificate.

That gap can still be corrected through the government’s power to modify the certificate Schedules before or after commencement.

As banking moves from ledgers to databases and from databases to algorithmic decision systems, courts will need more than a readable digital document. They will need a defensible explanation of where the record came from, whether it changed and why the process that produced it should be trusted.

Sources and Further Reading

Official legislative status and passage record: Digital Sansad Bills database

Bill summary and parliamentary timeline: PRS Legislative Research

Stable full text of the Bankers’ Books Evidence Bill, 2026: PRS-hosted Bill text

Bankers’ Books Evidence Act, 1891: India Code official text

Bharatiya Sakshya Adhiniyam, 2023: Ministry of Home Affairs official text

Information Technology Act, 2000: India Code updated text

Digital Personal Data Protection Act, 2023: India Code official text

Expert discussion of privacy and digital safeguards: The Indian Express explainer