1. Appeals under PMLA challenging attachment order in money laundering case arising from loan app fraud and harassment. (Para 2 , 3 , 4 , 5 , 6 , 7 )
Back
APPELLATE TRIBUNAL FOR FORFEITED PROPERTY
Munishwar Nath Bhandari, Chairman, G. C. Mishra, Member
M/s X10 Financial Services Ltd. – Appellant
Versus
The Deputy Director Directorate of Enforcement Bangalore – Respondent
FPA-PMLA-4559/BNG/2022
(A) Prevention of Money Laundering Act, 2002 - Section 26 - Indian Penal Code, 1860 - Sections 384, 385, 419, 420, 504, 506 - Information Technology Act, 2000 - Sections 72A and 66 - RBI Master Direction on Non-Banking Financial Company (Systemically Important Non-Deposit taking Company and Deposit taking Company) Directions, 2016 - RBI Outsourcing of Financial Services Directions, 2017 - Fair Practices Code - NBFC cannot outsource core management functions including KYC compliance, loan sanction, and management of investment portfolio - Effective interest rate exceeding 1500% per annum due to processing fees is not in conformity with fair practices - Service agreement that gives fintech companies complete control over lending and recovery, while NBFC receives a fixed percentage without any investment, constitutes outsourcing of core activities in violation of RBI guidelines - Proceeds of crime generated from scheduled offences (harassment, extortion, cheating) through such illegal lending model - NBFC cannot shift liability to service providers by relying on contractual terms. (Paras 16, 17, 21-30)
(B) Appeal - Scope - The Tribunal rejected the appellant’s argument that it had no role in the misconduct of service providers, holding that the agreement effectively handed over core lending functions and the NBFC retained ultimate control and liability. (Paras 22, 30, 31)
Facts of the case:
FIRs were registered by Cyber Crime Police Station, Bengaluru for offences including extortion, cheating, and harassment of borrowers through mobile loan apps. The complainants alleged that after installing apps, their personal data was misused, obscene messages were circulated, and they were threatened with abusive language. An ECIR was recorded under PMLA. Investigation revealed a business model where fintech companies (service providers) entered into MOUs with NBFCs, deposited funds as ‘Performance Guarantee’, and used the NBFC’s license to lend through mobile apps. The NBFC received a share of 0.4% to 1.5% of total disbursements without investing any money. The effective interest rate, after deducting 30-40% processing fees, reached up to 2233% per annum. The NBFC argued that it had outsourced only non-core activities as permitted by RBI guidelines. The Adjudicating Authority confirmed the provisional attachment of proceeds of crime amounting to Rs.37,01,92,431/- and Rs.2,18,51,846/- lying in bank accounts. (Paras 2-7, 17-18)
Findings of Court:
The Tribunal examined the service agreement and found that the fintech companies were given complete control over loan origination, data collection, and recovery, including access to sensitive borrower information. The agreement violated RBI Outsourcing Directions which prohibit outsourcing of core functions like KYC compliance, loan sanction, and investment portfolio management. The effective interest rate was exorbitant and contrary to the Fair Practices Code. The NBFC’s claim of adhering to RBI guidelines was rejected. The proceeds of crime were generated through the commission of scheduled offences (extortion, cheating, harassment) using the mobile apps. The Tribunal noted that 64 suicides were reported due to the harassment by recovery agents. The appeal was dismissed. (Paras 21-31)
Issues: 1. Whether the NBFC violated RBI guidelines by outsourcing core lending activities to fintech companies? (Para 21-30) 2. Whether the appellant is liable for the proceeds of crime generated through the illegal lending model? (Paras 16-18, 30-31)
Ratio Decidendi: The NBFC outsourced core functions such as loan sanction, KYC verification, and recovery, which are not permissible under RBI Outsourcing Directions. The service agreement effectively transferred control of lending to fintech companies, and the NBFC cannot avoid liability by claiming ignorance of the service providers’ misconduct. The proceeds of crime are directly attributable to the appellant’s business model, making the attachment valid. (Paras 22, 30-31)
Result : Appeal dismissed. (Para 31)
1. Appeals under PMLA challenging attachment order in money laundering case arising from loan app fraud and harassment. (Para 2 , 3 , 4 , 5 , 6 , 7 )
2. Appellant argued outsourcing compliant with RBI guidelines; respondent argued NBFC violated guidelines and facilitated money laundering. (Para 8 , 9 , 10 , 11 , 12 , 13 , 14 , 15 )
3. Appeal dismissed; provisional attachment order confirmed. (Para 31 )
No, RBI guidelines prohibit outsourcing of core management functions; NBFC must retain ultimate control over lending decisions. (Para 16 , 17 , 19 , 20 , 21 , 22 , 23 , 24 , 25 , 26 , 27 , 29 , 30 )
Yes, such rates are exorbitant and cannot be considered fair practices, despite RBI not prescribing an upper cap. (Para 17 , 28 )
Yes, if the NBFC knowingly allows misuse of its license and receives share of profits, it is liable under PMLA; proceeds include amounts collected through cheating and extortion. (Para 5 , 6 , 18 , 26 , 27 )
ORDER
18.11.2025
The batch of appeals have been filed under Section 26 of the Prevention of Money Laundering Act, 2002 (‘the Act of 2002’) challenging the order dated 26.12.2022 passed by the Adjudicating authority confirming the provisional attachment order. The impugned order was passed against defendants before the Adjudicating Authority however the appeal has been filed by the appellant company before us and accordingly, we would be dealing with the issues raised by it.
Brief facts of the case:
2. It is a case where FIRs were registered by Cyber Crime police station, CID, Bengaluru. One Pavitra registered a complaint alleging that under the guise of collection of loan amount, she has been harassed with all kinds of abuses such as “sexual overtones” and circulating her images over WhatsApp groups tagging her “CHOR.” A similar complaint was registered by one Kum. Vinditha who had also taken loans through the mobile apps, after the installation all the necessary information taken from her phone and by using her contact details, a WhatsApp group was created to circulate obscene words maligning the character.
3. A letter dated 30.12.2020 was received by DGP, CID, Special units and economic offences, Bengaluru wherein it was stated that FIR Nos. 0018/2020 and 0019/2020 have been registered by Cybercrime police station, CID, Bengaluru under sections 384, 385, 419 and 420 of the Indian penal code., 1860 and section 72A of the information technology act, 2000. It was alleged that the complainant installed the app for availing a loan of a small amount and on installation the basic details such as PAN, Aadhar card and bank details were provided as prompted in the app. The details were later misused to harass by way of obscene words to circulate over WhatsApp. For each loan, exorbitant processing charges were deducted and the interest rate had gone up to 36% per annum on the loan amount. The loan period was generally about 5 to 7 days and on first attempt, warning was given to the borrower to repay the amount and on failure, the borrowers were harassed by the recovery agents till the repayment of loan amount.
4. An ECIR was recorded finding a case of money laundering. The proceeds of crime were generated out of scheduled offences.
5. Investigation was conducted and it was found that the applications through which loans were taken by the complainants were associated with NBFC (Non- Banking Finance Companies). The NBFC were approached by fintech companies (service providers) and offered to do lending business through mobile apps. As a result, NBFC entered into service agreement with the service providers to enable them into lending business in exchange of marginal profits. The personal data of the borrower was misused by the service providers who threatened and harassed the borrowers.
6. The mobile applications were used to lend and recover the loans through merchant IDs with the payment gateways such as Paytm, Cashfree and Razorpay all pay-in and pay-out. The fintech companies/service providers misused the license issued to NBFC by the RBI and acted as de-facto NBFC. For each loan, 30-40% of the sanctioned amount to the borrower was deducted in the guise of processing charges. The complaints were lured into availing unsecured loans at high interest rates and processing charges. The NBFC was used for lending over and above 5 times to limit of their Net owned Funds (NOF) in violation of the RBI regulations. The respondent has attached the bank accounts linked to the Merchant IDs to secure the proceeds of crime.
7. The appellant is a NBFC and allegations are that it had entered into service agreement without due diligence and further allowed the fintech companies to misuse the data of the borrowers. The fintech companies/ service providers took all the control of the lending business through mobile application and accessed vulnerable data of the borrowers to harass and charge exorbitant interest rates and processing charges.
Arguments of the counse
An indispensable Tool for Legal Professionals, Endorsed by Various High Court and Judicial Officers
Please visit our Training & Support
Center or Contact Us for assistance
Scan Me!
India’s Legal research and Law Firm App, Download now!
For Daily Legal Updates, Join us on :
Back to top