Regulatory framework · Investigations, data and evidence
Criminal complaints and electronic evidence
When should the company go to the police, and how do we make our evidence stand up in court?
Spectra Forensics6 laws and regulators
Short answer
Go to the police once you can show the offence on documents, not before. Since 1 July 2024, fraud complaints are framed under the Bharatiya Nyaya Sanhita, filed and investigated under the Bharatiya Nagarik Suraksha Sanhita, and proved under the Bharatiya Sakshya Adhiniyam. Electronic records, which now carry most fraud cases, need a section 63 certificate signed by both a responsible person and an expert, with hash values, each time they are offered in evidence. Build that into collection from day one.
The landscape
Laws and regulators in play
- Bharatiya Nyaya Sanhita 2023
- Defines the offences: criminal breach of trust (s.316; IPC 405–409), cheating (s.318; IPC 415–420), cheating by personation (s.319), forgery (s.336), using forged documents (s.340), falsification of accounts (s.344; IPC 477A), criminal conspiracy (s.61) and organised crime, including economic offences (s.111).
- Bharatiya Nagarik Suraksha Sanhita 2023
- Governs the FIR, including zero FIR and electronic FIRs signed within three days (s.173), preliminary enquiry for offences carrying three to seven years (s.173(3)), the remedies when police refuse to register (ss.173(4), 175(3)), summons for documents and digital evidence (s.94), recorded search and seizure (s.105) and attachment of proceeds of crime (s.107).
- Bharatiya Sakshya Adhiniyam 2023 (ss.57, 61, 62, 63)
- Treats electronic records as documents and, in defined cases, as primary evidence, and requires a certificate in the Schedule form, in two parts with hash values, to accompany an electronic record each time it is submitted.
- Bharatiya Sakshya Adhiniyam 2023 (ss.132–134)
- Protect confidential communications with advocates and legal advisers, which matters when deciding what investigation material is shared with police.
- Information Technology Act 2000 (s.79A)
- Provides for notified Examiners of Electronic Evidence, whose opinion is relevant under s.39 of the BSA.
- Supreme Court, Arjun Panditrao Khotkar (14 July 2020)
- Held the certificate under the old Evidence Act s.65B(4) a condition precedent for secondary electronic evidence; the same logic applies to s.63 of the BSA.
Step by step
Decision framework
- 01
Decide whether criminal process helps
A complaint brings police powers to freeze accounts, summon records and arrest, but it also hands control of timing to the state. Weigh it against civil recovery, arbitration and regulatory routes.
- 02
Build the documentary case first
Investigate internally until the complaint can show each ingredient of the offence on documents: the entrustment, the deception, the false document or the falsified account, and the loss.
- 03
Collect electronic evidence forensically
Image devices and export mail and system records with hash values, maintain a chain of custody, and keep the people who did it available to sign the certificate.
- 04
Prepare the section 63 certificate
Part A by the person in charge of the device or the relevant activity; Part B by an expert. Both state the hash values, and the hash report is attached. It must accompany the record every time it is offered in evidence.
- 05
File the complaint
At the police station with jurisdiction, or any station as a zero FIR. For offences carrying three to seven years, police may run a preliminary enquiry of up to 14 days before registering.
- 06
If the police do not register
Send the complaint to the Superintendent of Police, and then apply to the Magistrate, with an affidavit, for an order directing investigation.
- 07
Support the investigation
Respond to summonses for documents, ask for proceeds of crime to be attached where assets are at risk, and keep the internal and police records consistent.
Duties and deadlines
Who must do what, and by when
| Who | Must do what | By when |
|---|---|---|
| Police | Register information about a cognizable offence, irrespective of where it was committed; an electronic complaint must be signed within three days.BNSS s.173(1) | On receipt |
| Police | For offences punishable with three years or more but less than seven, may hold a preliminary enquiry with a DSP’s permission.BNSS s.173(3) | Within 14 days |
| Complainant | If registration is refused, send the substance of the information to the Superintendent of Police; then apply to the Magistrate with an affidavit.BNSS ss.173(4), 175(3) | After refusal |
| Party producing an electronic record | Submit the s.63 certificate, Part A by the responsible person and Part B by an expert, with hash values.BSA s.63(4) and Schedule | Each time the record is submitted for admission |
| Police | Inform the informant or victim of the progress of investigation.BNSS s.193(3)(ii) | Within 90 days |
| Police | Record search and seizure by audio-video means and forward the recording to the Magistrate.BNSS s.105 | During search and seizure |
Police
Register information about a cognizable offence, irrespective of where it was committed; an electronic complaint must be signed within three days.
By whenOn receipt
BNSS s.173(1)
Police
For offences punishable with three years or more but less than seven, may hold a preliminary enquiry with a DSP’s permission.
By whenWithin 14 days
BNSS s.173(3)
Complainant
If registration is refused, send the substance of the information to the Superintendent of Police; then apply to the Magistrate with an affidavit.
By whenAfter refusal
BNSS ss.173(4), 175(3)
Party producing an electronic record
Submit the s.63 certificate, Part A by the responsible person and Part B by an expert, with hash values.
By whenEach time the record is submitted for admission
BSA s.63(4) and Schedule
Police
Inform the informant or victim of the progress of investigation.
By whenWithin 90 days
BNSS s.193(3)(ii)
Police
Record search and seizure by audio-video means and forward the recording to the Magistrate.
By whenDuring search and seizure
BNSS s.105
Analysis
How the regimes interact
Why this question matters
The criminal codes changed on 1 July 2024, and with them the section numbers, the complaint procedure and the rules on electronic evidence. Most corporate fraud cases now depend on email, ERP logs, chats and device data. Whether the company's complaint leads anywhere often turns on two things decided long before trial: whether the complaint was framed around the right offences, and whether the electronic evidence was collected so that it can be certified and proved.
How the regimes interact
Offence, procedure, proof. The BNS decides what the company must allege, the BNSS how the complaint is registered and investigated, and the BSA how the facts are proved. A good complaint is drafted backwards from proof: for each ingredient of each offence, which document or record proves it, and who can certify it.
Section 63 raised the bar. The old section 65B certificate could be signed by a responsible official. Section 63 of the BSA requires a certificate in a prescribed form with two parts: one by the person in charge of the device or activity and one by an expert, each stating hash values. The certificate must accompany the record every time it is submitted. Investigations that image devices, record hashes and keep custody logs from the start meet this easily; those that rely on screenshots do not.
Internal investigation and police investigation overlap. Police can summon documents and digital evidence under section 94 of the BNSS, and seize under recorded procedures. Material the company hands over will be read alongside its internal findings. Privileged communications with lawyers are protected under sections 132 to 134 of the BSA; keep them separate from the factual evidence pack.
Criminal process and data protection. Sharing personal data with police for the investigation of offences falls within the DPDP Act's exemption for preventing, detecting and investigating offences, but the security duty still applies. See our guide on personal data in investigations.
How Spectra Forensics can help
Our digital forensics team collects evidence to section 63 standard, and our litigation support team helps counsel build complaints and expert evidence. Speak to us in confidence.
Warning signs
Red flags
- Key emails exist only as printouts or screenshots.
- The person who exported the data has left and cannot sign Part A.
- Devices were examined directly without an image or hash value.
- The complaint describes ‘fraud’ without tying facts to a specific offence.
- Internal findings and the police complaint describe the same events differently.
- Privileged legal advice has been attached to the complaint by mistake.
Checklist
What good looks like
- A chain-of-custody record for every device and data source, from collection to court.
- Hash values recorded at acquisition and recalculated before production.
- Named individuals ready to sign Part A, and an expert ready to sign Part B, for each record.
- A complaint that maps facts to each ingredient of each BNS offence alleged.
- Old IPC references updated to BNS sections for conduct after 1 July 2024, with the right law applied to earlier conduct.
- A clear line between privileged legal advice and factual evidence shared with police.
Myths and corrections
Common misreadings
Misreading
Screenshots and printouts are enough.
Better reading
Electronic records are proved through s.63, with a certificate and hash values. Printouts without a proper certificate invite admissibility challenges.
Misreading
A single certificate covers the record for the whole case.
Better reading
Section 63(4) requires the certificate to accompany the record each time it is submitted for admission.
Misreading
The new codes apply to everything from 1 July 2024.
Better reading
They apply from that date. Conduct before 1 July 2024 is generally charged under the offences of the IPC, so complaints about older frauds may need both sets of references.
Misreading
Police must complete every investigation within 90 days.
Better reading
There is no general 90-day limit. Police must keep the informant updated on progress within 90 days; specific deadlines apply to certain offences and to further investigation.
For the board pack
Takeaways
- 01File when the documents prove the offence; a weak complaint is hard to strengthen later.
- 02Section 63 certificates need a responsible person and an expert; plan who will sign before you collect.
- 03Hash values and chain of custody are what make electronic evidence survive.
- 04Keep internal findings, the complaint and the evidence consistent, and keep privileged advice separate.
Questions we are asked
What is a zero FIR?
An FIR registered at any police station regardless of where the offence was committed. Section 173(1) of the BNSS requires police to register information about a cognizable offence irrespective of the area where the offence was committed.
Who signs the section 63 certificate?
Two people. Part A is signed by the party producing the record, typically the person in charge of the computer or device or of the relevant activities. Part B is signed by an expert. Each states the hash value of the record, and the hash report is attached.
Can an internal forensic report be used as evidence?
The report itself is opinion; the underlying electronic records must be proved through section 63, and the investigators may be examined as witnesses. Forensic work should be done to an evidential standard from the start.
Sources
This guide is general information on the law as stated above, not legal advice. Facts change outcomes; take advice on your own matter.
Go deeper
Further reading
Digital forensics14 Sept 2026
Electronic Evidence under the Bharatiya Sakshya Adhiniyam 2023: Section 63 Certificates Explained
How s. 63 of the Bharatiya Sakshya Adhiniyam governs electronic evidence, what the two-part certificate must contain and the mistakes that get records excluded.
Digital forensics20 Sept 2026
Preserving Digital Evidence in Internal Investigations: Imaging, Hashing and Chain of Custody
A practical guide to preserving laptops, phones, email and cloud data in an internal investigation so the evidence stays reliable, lawful and usable in court.
Litigation support17 Sept 2026
eDiscovery for Indian Litigation and Arbitration: A Practical Guide for Law Firms
How eDiscovery works in Indian commercial suits and arbitration: Order XI disclosure duties, electronic-record declarations, legal holds and the EDRM stages.
Confidential consultation
Facing this question on a live matter? Talk to us.
Tell us what has happened. A senior member of our team will help you work out who must do what, and in what order, in strict confidence.