Reference · updated as the law changes
Who will ask, what they can do, and what they expect.
Every Indian regulator and forum that touches an investigation, on one page, with the section numbers and the primary source. Filter by the kind of matter you are in. Nothing here is legal advice; it is where to look before you call counsel.
Kind of matter
14 forums shown
SEBI
Securities and Exchange Board of India
Listed companies, their promoters, directors and KMP, and every intermediary or person associated with the securities market.
- Fraud inside the company
- Visit, search or summons
- Deal, lender or hire
What it can do
- Order an investigation and require every manager, officer and employee to preserve and produce books and records (SEBI Act, s.11C(1)-(3))
- Examine managers, officers and employees on oath; notes signed by the person can be used in evidence against them (s.11C(5), (7))
- Apply to the designated Magistrate for seizure of books and records it believes may be destroyed, altered or secreted (s.11C(8))
- Non-cooperation with the Investigating Authority: imprisonment up to one year or fine up to Rs 1 crore, plus up to Rs 5 lakh per day (s.11C(6))
What it expects as evidence
- Disclosure to the exchanges of the initiation of any forensic audit, naming the initiating entity and reasons, and of the final report with management comments unless initiated by a regulator or enforcement agency (LODR, Sch. III, Part A, Para A, cl.17)
- Diversion, misutilisation or siphoning of a listed company's assets or earnings, and manipulation of its books, is a deemed fraudulent and unfair trade practice (PFUTP Regulations 2003, reg. 4; SEBI Act, s.12A)
- Written-up examination notes and documentary record produced to the Investigating Authority; certified copies must be given back on request (s.11C(4), (7))
WindowReg. 30(6): material events disclosed within 12 hours if they emanate from within the listed entity, 24 hours otherwise, 30 minutes after a board meeting; forensic-audit initiation within 12 hours (entity-initiated) or 24 hours (external agency)
RBI
Reserve Bank of India
Banks, all-India financial institutions and larger NBFCs and housing finance companies, and through them every borrower, promoter and director who can be classified as a fraud.
- Fraud inside the company
- Visit, search or summons
- Deal, lender or hire
- Insolvency and recovery
What it can do
- Directions issued under ss.21 and 35A of the Banking Regulation Act 1949 and Chapters III-A and III-B of the RBI Act 1934 (Master Directions on Fraud Risk Management in Commercial Banks, July 2024)
- Banks must run an Early Warning Signals and Red Flagged Accounts framework overseen by the Risk Management Committee of the Board (banks MD, paras 3.1-3.5)
- Before classifying an account as fraud, the lender uses an external or internal audit under its Board-approved policy; loan agreements should carry audit clauses (banks MD para 4.1; NBFC MD paras 4.1-4.1.2)
- Frauds must be reported to law enforcement: private and foreign banks to State Police below Rs 1 crore and also to SFIO at Rs 1 crore and above; public sector banks to CBI at Rs 6 crore and above (banks MD para 5.1)
What it expects as evidence
- A detailed show-cause notice to the persons or entities under examination, a reasoned order, and natural justice before any fraud classification (banks MD paras 2.1.1, 4.1.4; NBFC MD paras 2.1.1-2.1.4)
- A Fraud Monitoring Return for every fraud case regardless of amount (banks MD para 6.3.1; NBFC MD para 6.2.1)
- Disclosure of the amount of fraud reported during the year in the notes to the financial statements (NBFC MD para 2.7)
WindowFMR to RBI within 14 days of classification as fraud; at least 21 days for the person to reply to the show-cause notice before classification
ED
Directorate of Enforcement (Prevention of Money-laundering Act 2002)
Anyone alleged to be connected with proceeds of a scheduled offence, including companies, directors, bankers and professionals who handled the money.
- Fraud inside the company
- Visit, search or summons
- Insolvency and recovery
What it can do
- Search any building, vehicle or aircraft, break open lockers and safes, seize or freeze records and property, and examine on oath any person found in possession, on reasons recorded in writing (s.17(1), (1A))
- Arrest on reasons recorded in writing; the arrested person must be produced before the Special Court or Magistrate within 24 hours (s.19(1), (3))
- Summon any person to give evidence or produce records; the person is bound to attend and state the truth, and the proceeding is a judicial proceeding (s.50(2)-(4))
- Impound and retain records produced; an Assistant or Deputy Director needs recorded reasons and Joint Director approval to hold them beyond three months (s.50(5))
What it expects as evidence
- Statements recorded under s.50 are given on oath in a deemed judicial proceeding, so written answers and the documents produced should be accurate and complete (s.50(3), (4))
- Reasons for search, seizure or freezing go to the Adjudicating Authority in a sealed envelope, and an inventory or note of seized records and property is prepared (s.17(1)(e), s.17(2))
- Property can be frozen rather than physically seized where seizure is not practicable; dealing with it then needs the officer's prior permission (s.17(1A))
WindowED must apply to the Adjudicating Authority within 30 days of a seizure or freezing order to retain it (s.17(4)); an arrested person goes before the court within 24 hours (s.19(3))
SFIO / MCA
Serious Fraud Investigation Office and Ministry of Corporate Affairs (Companies Act 2013)
Any company, its officers and auditors, once the Central Government assigns the investigation to SFIO on a Registrar or inspector report, a special resolution, public interest, or a government request.
- Fraud inside the company
- Visit, search or summons
What it can do
- Central Government may assign investigation of a company's affairs to SFIO; investigation proceeds under Chapter XIV (s.212(1), (3))
- SFIO officers of Assistant Director rank and above, when authorised, may arrest a person they believe guilty of an offence under s.447, with reasons recorded in writing (s.212(8))
- Fraud of Rs 10 lakh or 1 per cent of turnover, whichever is lower, or involving public interest: imprisonment of six months to ten years and fine of one to three times the amount; three-year minimum where public interest is involved (s.447)
- Fraud is defined to include any act, omission, concealment or abuse of position intended to deceive or gain undue advantage, whether or not there is wrongful gain or loss (s.447, Explanation)
What it expects as evidence
- Statutory auditors who have reason to believe an officer or employee is committing fraud must report it; above the prescribed threshold the report goes to the Central Government in Form ADT-4, below it to the Audit Committee or Board (s.143(12); Audit and Auditors Rules 2014, rule 13)
- Auditors state in the CARO report whether any fraud by or on the company was noticed or reported, whether a s.143(12) report was filed in Form ADT-4, and whether whistle-blower complaints were considered (CARO 2020, para 3(xi))
- Frauds reported to the Audit Committee or Board but not to the Central Government must still be disclosed in the Board's report (rule 13(4))
WindowRule 13: for suspected fraud of Rs 1 crore or more the auditor reports to the Board or Audit Committee within 2 days, allows 45 days for a reply, and forwards ADT-4 to the Central Government within 15 days of receiving it
Police / CBI
Police, Economic Offences Wings and CBI under the Bharatiya Nyaya Sanhita, Nagarik Suraksha Sanhita and Sakshya Adhiniyam 2023
Any person or company that is the complainant, accused or custodian of evidence in a criminal breach of trust, cheating or forgery case, and anyone holding a device that may contain digital evidence.
- Fraud inside the company
- Visit, search or summons
What it can do
- Criminal breach of trust by a person entrusted with property, including clerks, servants, bankers, merchants and agents (BNS s.316); cheating and dishonest inducement to deliver property (BNS s.318); forgery including false electronic records (BNS s.336)
- A court or officer in charge of a police station may summon production of any document or electronic communication, including communication devices likely to contain digital evidence (BNSS s.94(1))
- An investigating officer may search any place for a thing needed for the investigation after recording grounds in the case diary; the search is recorded on audio-video, preferably a mobile phone (BNSS s.185(1), (2))
- Persons in charge of a closed place must allow free ingress on production of the warrant; searches happen before two or more independent witnesses, who sign the list of things seized (BNSS s.103(1), (4), (5))
What it expects as evidence
- Electronic records are admissible only with a certificate identifying the record, describing how it was produced and the device involved, signed by the person in charge of the device or management and by an expert (BSA s.63(4))
- The Schedule certificate (Part A by the party, Part B by the expert) states the hash value of the record and the algorithm used, with the hash report enclosed (BSA Schedule)
- The occupant is entitled to attend the search and receive a copy of the witnessed seizure list; the search and seizure are video-recorded and forwarded to the Magistrate (BNSS s.103(6), s.105)
WindowBSA s.63(4): the certificate must be submitted along with the electronic record at each instance it is tendered for admission
NCLT / IBC
National Company Law Tribunal and resolution professionals under the Insolvency and Bankruptcy Code 2016
Corporate debtors, their promoters, directors and personnel, creditors who received preferences, counterparties to undervalued deals, and prospective resolution applicants.
- Insolvency and recovery
- Fraud inside the company
- Deal, lender or hire
What it can do
- The resolution professional or liquidator must apply to the Adjudicating Authority to avoid preferential transactions (s.43(1)), undervalued transactions (s.45(1)) and extortionate credit transactions (s.50(1))
- Where business was carried on with intent to defraud creditors, the Adjudicating Authority may order any person knowingly party to it to contribute to the debtor's assets (s.66(1)); directors who failed to minimise loss can be made to contribute (s.66(2))
- Personnel, promoters and anyone associated with management must assist and cooperate with the interim resolution professional, failing which the Adjudicating Authority can direct compliance (s.19)
- An officer who fails to disclose property or transactions, withholds books or accounts for property by fictitious losses faces three to five years imprisonment and a fine of Rs 1 lakh to Rs 1 crore (s.70(1))
What it expects as evidence
- Resolution applicants are ineligible if, among other grounds, they are undischarged insolvents, wilful defaulters, hold an NPA account for a year or more, or have relevant convictions (s.29A)
- The resolution professional's duties include filing applications for avoidance of transactions under Chapter III (s.25(2)(j)); the Adjudicating Authority may require an independent expert to assess value in undervalue cases (s.46(2))
- Transfers in the ordinary course of business and security for new value are not preferences, so transaction-level evidence of purpose and timing matters (s.43(3))
WindowLook-back of 2 years before the insolvency commencement date for related-party preferences and undervalued transactions, 1 year for others (ss.43(4), 46(1)); extortionate credit transactions within 2 years (s.50(1))
CCI
Competition Commission of India and its Director General
Enterprises and their officers in cartel, abuse of dominance and combination matters, including the persons in charge of a company when the contravention occurred.
- Visit, search or summons
- Deal, lender or hire
What it can do
- The Director General investigates contraventions when directed by the Commission and holds the Commission's civil-court powers (s.41(1), (2))
- Civil-court powers: summoning and examining on oath, discovery and production of documents, evidence on affidavit, requisitioning public records (s.36(2))
- Search and seizure: the Companies Act inspector provisions apply to the Director General, with the warrant issued by the Chief Metropolitan Magistrate, Delhi (s.41(3) and Explanation)
- Where a company contravenes, every person in charge of and responsible for its business is deemed guilty unless they prove lack of knowledge or due diligence (s.48(1))
What it expects as evidence
- Failure to comply with a Director General direction is itself penalised, per day of default (s.43)
- Knowingly false statements, omission of a material fact, or wilful alteration, suppression or destruction of a required document are penalised (s.45(1))
- Proceedings before the Commission are deemed judicial proceedings, so statements and documents carry perjury consequences (s.36(3))
DRI / Customs
Directorate of Revenue Intelligence and Customs officers (Customs Act 1962)
Importers, exporters, customs brokers and anyone holding goods or documents relevant to a customs proceeding, including under-invoicing and mis-declaration cases.
- Visit, search or summons
- Fraud inside the company
What it can do
- Search any premises where goods liable to confiscation, or relevant documents or things, are believed to be secreted (s.105(1)); the criminal-procedure search rules apply (s.105(2))
- Summon any person to give evidence or produce documents in an inquiry; the person must attend, state the truth and produce what is required, and the inquiry is a judicial proceeding (s.108(1), (3), (4))
- Seize goods liable to confiscation and any documents or things useful to a proceeding (s.110(1), (3))
- Arrest for offences including evasion of duty or prohibitions under s.135, with grounds informed and production before a magistrate without unnecessary delay (s.104(1), (2))
What it expects as evidence
- Persons from whose custody documents are seized are entitled to copies or extracts in the presence of a customs officer (s.110(4))
- Computer printouts and facsimile copies are admissible as documents if the s.138C conditions on regular use and proper operation of the computer are met (s.138C(1), (2))
- Statements under s.108 are given in a deemed judicial proceeding (s.108(4))
WindowSeized goods must be returned if no show-cause notice issues within 6 months of seizure, extendable by a further 6 months on recorded reasons (s.110(2))
DGGI / CGST
Directorate General of GST Intelligence and central tax officers (CGST Act 2017)
Taxable persons, transporters and warehouse operators suspected of suppressed supplies, excess input tax credit or other evasion, and their accounts and electronic devices.
- Visit, search or summons
- Fraud inside the company
What it can do
- An officer not below Joint Commissioner may authorise inspection of any place of business on reasons to believe tax is being evaded (s.67(1))
- Search and seize goods, documents, books or things believed to be secreted; where seizure is impracticable, an order not to remove or deal with the goods (s.67(2))
- Seal or break open doors, almirahs, electronic devices, boxes or receptacles where access is denied (s.67(4))
- Summon any person to give evidence or produce documents as a civil court would; the person must attend and state the truth, and the inquiry is a judicial proceeding (s.70(1), (1A), (2))
What it expects as evidence
- The person from whose custody documents are seized may make copies or extracts before an authorised officer, unless the proper officer thinks this would prejudice the investigation (s.67(5))
- Seized documents are retained only as long as needed for examination and proceedings (s.67(2), second proviso)
- Criminal-procedure search and seizure provisions apply, with the Commissioner in place of the Magistrate (s.67(10))
WindowDocuments not relied on for a notice are returned within 30 days of the notice (s.67(3)); seized goods are returned if no notice issues within 6 months, extendable by 6 months (s.67(7))
Income-tax
Income-tax Department (Investigation Wing) under the Income-tax Act 2025
Any person believed to hold undisclosed income or assets, or who has not produced books, documents or electronic information when summoned; from 1 April 2026 the 1961 Act's ss.131 and 132 are replaced by ss.246 and 247 of the 2025 Act.
- Visit, search or summons
- Fraud inside the company
What it can do
- Civil-court powers of discovery and inspection, enforcing attendance and examining on oath, compelling production of books, and issuing commissions; also exercisable by investigation officers before or during a search (s.246(1), (2))
- Search any building, place, vessel, vehicle or aircraft where assets, books or electronic information are suspected to be kept (s.247(1)(i))
- Require any person in control of electronic records or a computer system to give technical assistance including access codes; break open locks or override access codes to computer systems (s.247(1)(ii), (iii))
- Search persons entering or leaving the premises, mark and copy records including from computer systems, inventory assets and seize books, computer systems and assets other than stock-in-trade (s.247(1)(iv)-(vii))
What it expects as evidence
- A search can be triggered by failure to produce books, documents or electronic information in response to a summons or notice, so the response record to notices matters (s.247(1)(a))
- Computer system is defined to include remote servers, cloud servers and virtual digital space, so cloud-hosted records are within the search power (interpretation clause of the search and seizure chapter)
- Books and documents produced can be impounded; the Assessing Officer or Assistant Director records reasons and may retain them up to 15 days excluding holidays without higher sanction (s.246(3), (4))
WindowImpounded books may be retained up to 15 days (exclusive of holidays) without the approving authority's sanction (s.246(4))
DPB
Data Protection Board of India (Digital Personal Data Protection Act 2023 and Rules 2025)
Every data fiduciary processing digital personal data in India, and offshore processing connected with offering goods or services to people in India (s.3).
- Personal data
What it can do
- On a breach intimation, direct urgent remedial or mitigation measures, inquire into the breach and impose penalty (s.27(1)(a))
- Civil-court powers to summon and examine on oath, require discovery and production of documents, and inspect data, books, documents and registers (s.28(7))
- Inquiries follow natural justice with reasons recorded; proceedings are digital by design (s.28(1), (6))
- Penalties up to Rs 250 crore for failing to take reasonable security safeguards and up to Rs 200 crore for failing to notify a breach (s.33, Schedule)
What it expects as evidence
- Reasonable security safeguards including encryption or masking, access control, logs and monitoring to detect and investigate unauthorised access, backups, and retention of logs and personal data for one year (Rules 2025, rule 6)
- Breach notice to each affected data principal without delay describing the breach, its consequences, mitigation and a contact person (rule 7(1))
- Breach notice to the Board without delay, followed by updated facts, causes, findings on who caused the breach, remedial measures and a report on notices to individuals (rule 7(2))
WindowDetailed breach report to the Board within 72 hours of becoming aware, or a longer period the Board allows on written request (rule 7(2)(b)); rules 3, 5-16, 22 and 23 commence 18 months after publication on 13 November 2025 (rule 1(4))
PoSH IC
Internal Committee under the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act 2013
Every employer and workplace, the Internal Committee it must constitute, the respondent, the complainant and witnesses.
- Workplace and whistleblowing
What it can do
- Every employer must constitute an Internal Committee by written order, with a senior woman employee as Presiding Officer (s.4(1), (2))
- The Committee has civil-court powers to summon and examine any person on oath and to require discovery and production of documents (s.11(3))
- During the inquiry it may recommend transfer of either party or up to three months' leave for the complainant (s.12(1))
- Employer failing to constitute a Committee or act on its recommendations: fine up to Rs 50,000, doubled on repeat conviction (s.26)
What it expects as evidence
- A written complaint from the aggrieved woman, with Committee members assisting if she cannot write it (s.9(1))
- A report of findings to the employer, made available to the parties, which the employer must act on (s.13(1), (4))
- Strict confidentiality: complaint contents, identities, inquiry proceedings and recommendations may not be published or made known to the public or media (s.16); the employer must assist in securing attendance of the respondent and witnesses (s.19(e))
WindowComplaint within 3 months of the incident or last incident (s.9(1)); inquiry completed within 90 days (s.11(4)); report within 10 days of completion (s.13(1)); employer acts within 60 days (s.13(4))
PC Act
Anti-corruption agencies under the Prevention of Corruption Act 1988 (as amended 2018)
Commercial organisations incorporated or doing business in India, their directors, managers and officers, and any employee, agent or subsidiary who performs services for them.
- Fraud inside the company
- Deal, lender or hire
- Visit, search or summons
- Workplace and whistleblowing
What it can do
- A commercial organisation is punishable with fine if any person associated with it gives or promises an undue advantage to a public servant to obtain or retain business or an advantage in business (s.9(1))
- Persons associated include anyone performing services for or on behalf of the organisation, whether employee, agent or subsidiary (s.9(3)(c) and Explanations)
- Where the s.9 offence was committed with the consent or connivance of a director, manager, secretary or other officer, that person faces three to seven years' imprisonment and fine (s.10)
- Police may not inquire into a public servant's official recommendations or decisions without prior approval of the relevant Government (s.17A(1))
What it expects as evidence
- It is a defence for the organisation to prove it had adequate procedures, in compliance with prescribed guidelines, to prevent associated persons from such conduct (s.9(1), proviso)
- Documented anti-bribery procedures covering agents, intermediaries and subsidiaries are therefore the organisation's evidence in a s.9 case (s.9(3))
- A person compelled to give an undue advantage is outside the s.8 offence only if they report it to law enforcement within 7 days (s.8(1), proviso)
WindowA coerced bribe-giver must report to the police or investigating agency within 7 days of giving the undue advantage to rely on the s.8 exception
CVC
Central Vigilance Commission (Central Vigilance Commission Act 2003)
Central Government departments, public sector banks, government companies, corporations and societies under Central control, and the CBI's corruption investigations.
- Fraud inside the company
What it can do
- Superintendence over the Delhi Special Police Establishment (CBI) in investigating offences under the Prevention of Corruption Act (s.8(1)(a))
- Directions to the CBI for discharging its investigative responsibility, but not on how a particular case is investigated or disposed of (s.8(1)(b))
- Inquiry or investigation on a reference from the Central Government into alleged corruption offences by employees of Central bodies, government companies, societies and local authorities (s.8(1)(c), (d))
- Superintendence over the vigilance administration of Central ministries, government companies and corporations (s.8(1)(h))
What it expects as evidence
- Civil-court powers for inquiries: summoning and examining on oath, discovery and production of documents, and requisitioning public records (s.11)
- Advice to the Central Government and its organisations on matters referred to it (s.8(1)(g))
NARADism is an intelligence, forensic and compliance advisory firm, not a law firm. Nothing on this site is legal advice. Section references are to the Acts and directions as published at the linked sources on the date shown; always check the current text. Where a regulator’s practice differs from the letter of a provision, the practice is not recorded here.
How an engagement starts
Facing one of them this week?
Say which forum and what has happened. A partner reads it the same day.
- 01
A 30-minute call
To align on the question, the team and the sites involved.
- 02
A fixed-scope proposal
A tailored scope and fee note within five working days.
- 03
Discreet execution
Small senior teams, conflict-checked, DPDP and GDPR compliant handling.