Introduction
Banking fraud has always evolved with new technologies, but the evolution under way since 2023 is of another order. A few seconds of audio are enough to clone the voice of a victim’s relative, a video call can be manufactured to present a convincing likeness of a bank official or a law-enforcement officer, and identity documents can be fabricated wholesale, all with generative artificial intelligence.1 Three distinct uses of this technology recur across the disputes it has created: AI can make a conventional social-engineering fraud far more convincing through a cloned voice or a deepfake video; AI can be used to manufacture the identity documents or credit history on which a fraud is built; and AI can be used to run a single fraud scheme at a scale and speed that no human-operated equivalent could match.
This change has prompted comparative legal scholarship that largely maps how each country’s banking, data-protection and cybercrime laws, and the regulatory instruments issued under them, apply to each of these three modalities.2 That literature is useful, but it rests on a structural limit: a statute or regulation states what a legal system permits or prohibits in the abstract, not what a court or adjudicating body actually does when a named customer sues a named bank over a particular fraudulent transfer. Two cases governed by identical statutory language may be decided differently depending on how a court reads the statute’s silences, how it characterises the customer’s own conduct, and which of several possible causes of action it treats as available at all. That difference cannot be shown by comparing texts; it can be demonstrated only through an analysis of the cases themselves.
This article supplies that analysis. Rather than surveying the entire body of banking-fraud litigation in each jurisdiction, which is neither internally comparable nor, on the AI-specific question addressed here, especially large, it identifies the decision in each of India, the United States and the United Kingdom that most closely resembles the fact pattern created by AI-enabled social engineering, in which a customer was “induced”, but not “required”, to authorise a payment personally. Read together with other decisions from the three jurisdictions, and with the administrative and legislative forums that supplement or stand in for the courts, these decisions suggest that the three jurisdictions occupy very different procedural relationships to the same underlying liability question (one decided and narrowing, one pending and contested, one never squarely posed at all) and that none of them has yet faced a case that puts AI-generated evidence before the court. The article first sets out the method and the case-selection criteria, then examines each of the three jurisdictions in turn before bringing them together, and closes with its conclusions and jurisdiction-specific recommendations.
Materials and methods
This article adopts a doctrinal, case-based comparative method. The judgments, statutes and regulatory instruments analysed below are the primary sources. The professional and academic commentary cited alongside them is treated as a secondary source, used to establish the significance of each judgment and to trace its subsequent procedural history.
Three decisions, each from a different jurisdiction, are selected against three criteria and compared. First, each is the most authoritative statement its legal system has issued to date on whether a bank, or the banking system generally, is liable for a fraud in which the customer, though fraudulently induced, personally gave the instruction the bank acted upon, as distinct from a fraud committed by an unauthorised third party or a fraudulent agent. Second, the three decisions together span the available range of procedural posture: a final, fully reasoned appellate decision (United Kingdom); a claim that has been extinguished, considered alongside a formally distinct claim that remains pending (United States); and a decision that restricts, but does not resolve, the forum in which such a claim could be heard, against a background of complete doctrinal silence on the AI-specific question itself (India). Third, each decision has attracted professional commentary confirming that it is read, within its own jurisdiction, as the leading authority on the point it addresses.
This approach has two acknowledged limits. First, no dataset in any of the three jurisdictions breaks down fraud outcomes by whether the fraud was AI-mediated, and no case identified in this research squarely involves AI-generated evidence; the analysis therefore identifies the decisions that would govern such a dispute if it were litigated. Second, a three-case, one-per-jurisdiction design is illustrative rather than statistically representative. It is justified on the basis that each case is the most significant available data point for the specific liability question addressed here, not on any claim that it represents a comprehensive sample of each jurisdiction’s fraud litigation.
Data analysis
A. United Kingdom: Philipp v. Barclays Bank UK plc [2023] UKSC 25
The starting point for the British position is Barclays Bank plc v. Quincecare Ltd., in which Steyn J held that a bank must refrain from executing a payment instruction if it has reasonable grounds for believing that the instruction is an attempt to defraud the bank’s own customer.3 For decades Quincecare was applied to a fact pattern materially different from the one AI-generated fraud typically produces, namely one in which the disputed instruction was given by a fraudulent agent of the customer, typically a company director, and not by the customer personally.
Philipp v. Barclays Bank UK plc tested whether that duty could go further and bind the bank even where no agent stood between the customer and the instruction. In 2018 Mrs Philipp and her husband were deceived by a fraudster who claimed to be working for the Financial Conduct Authority in conjunction with the National Crime Agency, and Mrs Philipp personally instructed Barclays to transfer £700,000, in two payments, to accounts in the United Arab Emirates.4 The High Court granted the bank summary judgment, the Court of Appeal allowed Mrs Philipp’s appeal on a wider reading of Quincecare, and Barclays appealed to the Supreme Court, which unanimously allowed the appeal. In a judgment given by Lord Leggatt, the Court held that the Quincecare duty is simply an application of a bank’s general duty of care to interpret, ascertain and act in accordance with its customer’s instructions, engaged where the authority of an agent giving an instruction is in doubt, and that it has no application where the instruction is clear and is given by the customer personally, however the customer came to give it. The Court treated the question of who should bear the loss from this kind of fraud as one of social policy for regulators, government and ultimately Parliament rather than for judges, and noted that the Financial Services and Markets Act 2023, which had received Royal Assent on 29 June 2023, already provided for a mandatory reimbursement scheme.5
The narrowing effected by Philipp is not, however, complete. The Court refused summary judgment on a further claim by Mrs Philipp that Barclays had failed to take adequate steps to recover the money after she reported the fraud on 27 March 2018, leaving that claim to proceed to trial, so that a duty of reasonable care and skill may continue to govern a bank’s conduct after a fraud comes to light even where it does not govern the decision to act on the customer’s own clear instruction.6 A later claim testing this narrower retrieval-duty theory, CCP Graduate School Ltd. v. National Westminster Bank plc, showed the route to be real but narrow. At first instance Master Brown refused the claimant permission to plead a retrieval claim against its own bank, because the new claim was time-barred and did not arise out of the same facts as the existing claim, but declined to strike out a retrieval claim against the receiving bank. On appeal, in Santander UK plc v. CCP Graduate School Ltd., Eady J struck that claim out as well, holding that implying such a duty in favour of a party with whom the bank had no contractual relationship would “cross the line between the proper role of the courts and that of the legislator and regulator”.7
Together, Philipp and its subsequent application supply the most fully reasoned judicial treatment of bank liability for induced fraud available in any of the three jurisdictions examined in this article. As the Court’s own reasoning suggests, however, the primary route to compensation now lies in the mandatory reimbursement scheme that the Payment Systems Regulator introduced under the Financial Services and Markets Act 2023, which took effect on 7 October 2024 and which the Court treated as the legislature’s own answer to the loss-allocation question that an extension of Quincecare would otherwise have left the courts to resolve case by case.8
B. United States: New York v. Citibank, N.A. and the Zelle dismissal
The underlying liability question is the same in the United States, but its procedural posture is different: the question is not settled, but is being pursued, so far inconsistently. In January 2024 the Attorney General of the State of New York sued Citibank, N.A., alleging that it had failed to implement adequate safeguards against fraudulent wire transfers, had responded inadequately to red flags of potential fraud and had wrongfully denied reimbursement to defrauded customers, and pleading these failures, among other claims, as violations of the Electronic Fund Transfer Act and its implementing Regulation E.9
Citibank argues that the statute’s own terms exclude wire transfers from the definition of an “electronic fund transfer”, and that such transfers are governed instead by Article 4A of the Uniform Commercial Code, under which a payment order binds the customer if the bank shows that it accepted the order in good faith and in compliance with a commercially reasonable security procedure, a materially less protective standard than Regulation E’s investigation-and-reimbursement requirements.10 In January 2025 Judge J. Paul Oetken of the United States District Court for the Southern District of New York granted Citibank’s motion to dismiss in part but allowed the core EFTA claims to proceed, ruling that the statutory exclusion covers only the interbank leg of a wire transfer and not the consumer-facing leg, in which a payment order debiting the consumer’s account is placed through the bank’s own online-banking interface. That reading would, for the first time in any of the three jurisdictions examined here, bring a meaningful share of AI-enabled social-engineering transfers within Regulation E’s protection.11
That ruling remains open to challenge. The district court authorised an interlocutory appeal, the Second Circuit accepted Citibank’s appeal, and oral argument was heard on 6 April 2026; at the time of writing, whether Regulation E applies to this type of wire transfer at all remains formally unresolved, although the district court’s ruling stands unless and until it is overturned.12
A parallel attempt to press the same claim was made and extinguished. In December 2024 the Consumer Financial Protection Bureau sued Early Warning Services, LLC, the operator of the Zelle payment network, and three of its bank owners, alleging that the network’s design made fraud easier to commit through it and that customers who reported fraud had been wrongfully denied reimbursement under the same Act.13 In March 2025, following a change in the Bureau’s leadership earlier that year, the Bureau voluntarily dismissed the action against all four defendants with prejudice, before any court could rule on the Regulation E question the complaint had raised.14 The two actions were pursued through different institutional vehicles, a State Attorney General exercising independent enforcement authority in the Citibank action and a federal agency whose institutional priorities changed in the Zelle action, and it is this difference in vehicle, not any difference in the merits of the underlying legal theory, that explains why the Citibank action survives while the Zelle action does not.
C. India: City Union Bank Ltd. v. R. Chandramohan and the Ombudsman scheme’s administrative silence
In India, the position differs from both. Although the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023 address identity theft, cheating by personation and forgery, no reported decision traced in this research, at any level of the Indian judicial system, has tested whether these provisions extend to an AI-generated impersonation or a fabricated document, and no civil claim has produced a reasoned ruling on a bank’s liability for an AI-enabled induced transfer comparable to Philipp or the Citibank litigation.15 The closest the Supreme Court of India has come to the question, in City Union Bank Ltd. v. R. Chandramohan, narrows rather than widens the path such a claim would take.
City Union Bank arose from a complaint under the Consumer Protection Act, 1986 that a bank had credited two demand drafts to the wrong account. The Court held that, because proceedings before the consumer commissions are summary in nature, complaints involving highly disputed questions of fact, or cases involving tortious acts or criminality such as fraud or cheating, cannot be decided by them; the 1986 Act has since been replaced by the Consumer Protection Act, 2019.16 Because the kind of dispute that a textual reading of the consumer-protection legislation would otherwise route to that summary and comparatively accessible forum is almost by definition the kind of factually complex dispute that City Union Bank places beyond the forum’s reach, the practical effect is to close off precisely the accessible route that such a reading would have opened.
What remains is a path that is strong in administration but weak in doctrine. The Reserve Bank – Integrated Ombudsman Scheme, 2021 handles complaints about banking fraud, including unauthorised electronic transactions, against the RBI’s 2017 circular on customers’ zero and limited liability, and does so at very high volume: in 2023-24, according to the RBI’s own data, the Offices of the RBI Ombudsman disposed of 2,84,355 complaints, a disposal rate of 95.10 per cent.17 This efficiency does not, however, produce a reasoned, citable determination on which a later complainant or court could rely, since, unlike a court’s decision, an Ombudsman award is not published as a reasoned judgment. A hint of a more searching approach appears in State Bank of India v. Pallabh Bhowmick, in which the Supreme Court declined to interfere with a High Court judgment directing a bank to refund a customer for a fraudulent transaction that had been promptly reported, observing that “[t]he Bank should remain vigilant”, that it “has the best of the technology available today to detect and prevent such unauthorized and fraudulent transaction”, and that clauses 8 and 9 of the RBI’s 2017 circular make the position “further clear”.18 The same silence has a criminal-enforcement dimension. The Ministry of Home Affairs has publicly warned against “digital arrest” scams, in which fraudsters impersonating police, CBI or RBI officials hold victims on video calls from studios modelled on police stations,19 yet no reported decision traced in this research has tested the identity-theft or forgery provisions against AI-generated evidence of impersonation in such a case.
The net result is that India, unlike the United Kingdom or the United States, has no landmark judgment to study on banking fraud committed with the aid of AI. The one directly relevant intervention of its Supreme Court narrows the widest available civil forum for such a dispute without resolving it, and its most viable and effective remedy is, by design, devoid of precedent.
D. Comparative synthesis: verdicts and vacuums
Placed side by side, the three jurisdictions differ less in their ultimate degree of protectiveness (none offers a complete answer to the liability question AI-enabled fraud raises) than in their procedural posture. The United Kingdom has a verdict: Philipp, reasoned and tested in an adversarial setting, is narrow, but it leaves in place a viable statutory alternative. The United States has a contest: a favourable first-instance ruling that remains subject to appellate review, set against a parallel claim that was extinguished by institutional withdrawal before any court could rule on it. India has neither: there is no substantive ruling on the matter at all, and the one Supreme Court decision on point restricts the forum best suited to produce one.
A single finding cuts across verdicts and vacuums alike. None of the decisions examined in this article, in the United Kingdom, the United States or India, turns directly on AI-generated evidence. Philipp arose from an impersonation fraud with no generative-AI element in its facts; the Citibank and Zelle actions concern the statutory characterisation of a “wire transfer”, not any AI-specific question; and City Union Bank concerns a consumer forum’s jurisdiction, not any AI-related question at all. Each jurisdiction’s courts have accordingly developed a consensus, or a disagreement, about the general contours of the liability framework into which an AI-generated deepfake or cloned voice would fall, without yet having to confront the narrower questions such a deepfake or clone is likely to raise.
That the tools to decide such questions exist is suggested by a separate, unrelated line of authority. In Mata v. Avianca, Inc. in the United States, and in Harber v. Commissioners for His Majesty’s Revenue and Customs and R (Ayinde) v. London Borough of Haringey in the United Kingdom, courts and tribunals have, since 2023, cautioned against reliance on fabricated case citations generated by large language models,20 and in India the Delhi High Court held in 2023 that the responses of an AI chatbot cannot form the basis for adjudicating legal or factual issues.21 These decisions show that judges in all three jurisdictions are capable of engaging critically with AI-generated material once it is placed before them; what is missing, in every jurisdiction examined here, is a banking-fraud case that requires them to do so.
Conclusion
This article has examined the most authoritative decision that each of India, the United States and the United Kingdom has produced on institutional liability for a bank customer’s induced, rather than compelled, authorisation of a fraudulent transfer, the fact pattern that AI-enabled social-engineering fraud overwhelmingly produces. It has found a picture more differentiated than a simple “reactive India, proactive comparators” framing would suggest. Britain’s position is settled but narrow: Philipp forecloses the common-law route, and a statutory scheme substitutes for it, imperfectly but largely as intended. America’s position is unsettled: a favourable district-court ruling in the Citibank litigation is on appeal, while a parallel federal claim was extinguished before any ruling was reached, which suggests that the durability of the institution pursuing a legal theory can matter as much as the strength of the theory itself. India is the least advanced of the three: no court has yet ruled on the underlying liability question at all, and the only relevant recent decision of the Supreme Court of India restricts the forum most likely to give a meaningful ruling on that question, leaving a high-volume but unreasoned administrative mechanism as the more practical avenue to redress.
The single most important finding of this article, however, runs contrary to the view that this is merely the story of one jurisdiction lagging behind two more advanced comparators. No case before a court in any of the three jurisdictions has involved AI-generated evidence, whether an AI-cloned voice, an AI-generated deepfake video call or an AI-generated identity document, in a banking-fraud dispute. The differences between the three jurisdictions lie not in how far each has come in answering that question, but in the route each would take once a case presenting it arrives: in the United Kingdom, the case would be tested against the narrow common-law duties that survive Philipp; in the United States, it would turn on the reading of the Electronic Fund Transfer Act that the Second Circuit adopts; and in India, it would come before a forum that does not yet clearly exist.
Recommendations
The most significant shortcoming this article has identified is India’s, and the most direct response to it is legislative rather than judicial. A statutory reimbursement regime, similar in structure, if not necessarily in detail, to the United Kingdom’s Payment Systems Regulator scheme, would give Indian consumers a clear path to redress that depends neither on the consumer-forum jurisdiction narrowed by City Union Bank nor on a civil action few defrauded customers can afford to pursue. Such a scheme should be coupled with a requirement that the RBI Ombudsman issue reasoned determinations, at least for complaints above a defined value or raising a genuinely contested question of liability, so that the scheme begins to generate the citable, AI-specific precedent that its current, unreasoned form cannot produce.
In the United States, the Citibank and Zelle sequence suggests that the durability of an enforcement theory’s institutional vehicle deserves as much scrutiny as its substantive content. As federal agencies’ enforcement priorities have proved more susceptible to change than those of State Attorneys General, state-level enforcement is the more enduring pathway by which a Regulation E theory for AI-enabled wire fraud is likely to be tested to a final appellate ruling. Litigants and advocacy groups pursuing this theory should treat state enforcement not as a replacement for federal enforcement but as a complement to it.
In the United Kingdom, the Payment Systems Regulator’s reimbursement scheme should be reviewed, in particular to examine whether it leaves unprotected the victims of high-value or cross-border AI-enabled fraud, a category such fraud may disproportionately produce. The Financial Ombudsman Service should also be encouraged to publish determinations addressing, in terms, whether an AI-generated element of a deception affects the application of the gross-negligence exception, a gap this research identified in the published determinations available at the time of writing.
Finally, all three jurisdictions would be well advised to treat the judicial caution already shown towards AI-generated material in other litigation (Mata v. Avianca, Harber and Ayinde, and the Delhi High Court’s own 2023 decision22) as a resource rather than as a separate source of authority. A first step in this direction in India is the draft Regulations for Use of Artificial Intelligence in Courts, 2026, published for consultation by the Supreme Court of India’s AI Committee on 3 June 2026, which would require a party to disclose the AI-assisted character of any document, pleading or evidence it submits to a court and would establish a dedicated AI Content Verification Authority to set verification standards for AI-generated content in court processes.23 Their underlying principle, that AI-generated content should be verified before a court relies on it, applies directly to the banking-fraud context this article has explored. Extended so that the standard of verification expected scales with the sophistication and resources of the party relying on an AI system, it would place that burden on the bank, which, rather than the individual customer, is ordinarily the party best equipped to verify the AI systems it uses.
*****
Footnotes
1. See Juan Carlos Crisanto, Cris Benson Leuterio, Jermy Prenio & Jeffery Yong, Regulating AI in the Financial Sector: Recent Developments and Main Challenges 6 n.4, 19 (FSI Insights on Policy Implementation No. 63, Bank for International Settlements, Dec. 2024), https://www.bis.org/publications/fsi-insight-63-regulating-ai-financial-sector-recent-developments-and-main-challenges.pdf.
2. See OECD, Regulatory Approaches to Artificial Intelligence in Finance (OECD Artificial Intelligence Papers, OECD Publishing, Paris, Sept. 5, 2024), https://doi.org/10.1787/f1498c02-en.
3. Barclays Bank plc v. Quincecare Ltd., [1992] 4 All ER 363 (QB) (Eng.) (Steyn J); see also Philipp v. Barclays Bank UK plc, [2023] UKSC 25, [2024] AC 346, ¶ 5 (appeal taken from Eng.).
4. Philipp, [2023] UKSC 25, ¶¶ 1, 10–15.
5. Id. ¶¶ 2–3, 6, 21–25, 64, 97, 100 (Lord Leggatt); Financial Services and Markets Act 2023, c. 29, § 72 (UK).
6. Philipp, [2023] UKSC 25, ¶¶ 115–120.
7. CCP Graduate School Ltd. v. National Westminster Bank plc, [2024] EWHC 581 (KB), ¶¶ 40–48, 86 (Eng.) (Master Brown, Mar. 14, 2024); Santander UK plc v. CCP Graduate School Ltd., [2025] EWHC 667 (KB), ¶¶ 44, 51–52 (Eng.) (Eady J, Mar. 25, 2025).
8. Payment Systems Regulator, PS23/3: Fighting Authorised Push Payment Fraud: A New Reimbursement Requirement ¶¶ 1.1–1.5 (June 2023); Santander UK plc, [2025] EWHC 667 (KB), ¶ 48 (scheme reimbursing APP fraud victims from Oct. 7, 2024, up to £85,000); Philipp, [2023] UKSC 25, ¶¶ 6, 21.
9. Complaint, New York v. Citibank, N.A., No. 1:24-cv-00659 (JPO) (S.D.N.Y. Jan. 30, 2024).
10. 15 U.S.C. § 1693a(7)(B); 12 C.F.R. § 1005.3(c)(3); U.C.C. § 4A-202(b) (2022); see generally Electronic Fund Transfer Act, 15 U.S.C. § 1693 et seq.; 12 C.F.R. pt. 1005 (Regulation E).
11. New York v. Citibank, N.A., No. 24-cv-659 (JPO) (S.D.N.Y. Jan. 21, 2025) (opinion and order granting in part and denying in part motion to dismiss); see also Press Release, N.Y. State Attorney General, Attorney General James Announces Court Win Allowing Lawsuit Against Citibank to Continue (Jan. 21, 2025), https://ag.ny.gov/press-release/2025/attorney-general-james-announces-court-win-allowing-lawsuit-against-citibank.
12. New York v. Citibank, N.A., No. 25-2105 (2d Cir. argued Apr. 6, 2026).
13. Complaint, Consumer Financial Protection Bureau v. Early Warning Services, LLC, No. 2:24-cv-03652 (D. Ariz. Dec. 20, 2024).
14. Notice of Voluntary Dismissal, Consumer Financial Protection Bureau v. Early Warning Services, LLC, No. 2:24-cv-03652 (D. Ariz. Mar. 4, 2025) (dismissal with prejudice).
15. The Information Technology Act, 2000, No. 21, Acts of Parliament, 2000 (India), §§ 66C, 66D; The Bharatiya Nyaya Sanhita, 2023, No. 45, Acts of Parliament, 2023 (India), §§ 318, 336.
16. Chairman & Managing Director, City Union Bank Ltd. v. R. Chandramohan, 2023 INSC 300, ¶¶ 7, 10–12 (India) (Civil Appeal No. 7289 of 2009, decided Mar. 27, 2023), https://api.sci.gov.in/supremecourt/2007/6593/6593_2007_5_1501_43137_Judgement_27-Mar-2023.pdf; The Consumer Protection Act, 1986, No. 68, Acts of Parliament, 1986 (India), § 2(1)(g); The Consumer Protection Act, 2019, No. 35, Acts of Parliament, 2019 (India).
17. Press Release No. 2024-2025/2006, Reserve Bank of India, RBI Releases Annual Report of Ombudsman Scheme, 2023-24 (Jan. 24, 2025), https://rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=59604; Reserve Bank of India, Annual Report of Ombudsman Scheme, 2023-24 ¶ 1.14 & tbl. 1.2 (Jan. 24, 2025), https://rbi.org.in/scripts/PublicationsView.aspx?id=23126; Reserve Bank of India, Reserve Bank – Integrated Ombudsman Scheme, 2021, Ref. CEPD.PRD.No.S873/13.01.001/2021-22 (Nov. 12, 2021); Reserve Bank of India, Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, RBI/2017-18/15, DBR.No.Leg.BC.78/09.07.005/2017-18 (July 6, 2017).
18. State Bank of India v. Pallabh Bhowmick, Special Leave to Appeal (C) No. 30677 of 2024, 2025 LiveLaw (SC) 22 (Jan. 3, 2025) (India) (dismissing the bank’s petition against a judgment of the Gauhati High Court).
19. Press Release, Ministry of Home Affairs, Alert Against Incidents of ‘Blackmail’ and ‘Digital Arrest’ by Cyber Criminals Impersonating State/UT Police, NCB, CBI, RBI and Other Law Enforcement Agencies (Press Information Bureau, May 14, 2024), https://pib.gov.in/PressReleasePage.aspx?PRID=2020570 (describing the measures of the Indian Cyber Crime Coordination Centre against such scams).
20. Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023); Harber v. Commissioners for His Majesty’s Revenue and Customs, [2023] UKFTT 1007 (TC) (UK) (Dec. 4, 2023); R (Ayinde) v. London Borough of Haringey, [2025] EWHC 1383 (Admin) (Eng.) (Div. Ct., June 6, 2025) (heard with Al-Haroun v. Qatar National Bank QPSC).
21. Christian Louboutin SAS v. M/s The Shoe Boutique – Shutiq, CS(COMM) 583/2023, ¶ 28 (Del. HC Aug. 22, 2023) (India).
22. Christian Louboutin, CS(COMM) 583/2023, ¶ 28.
23. Supreme Court of India, AI Committee, Draft Regulations for Use of Artificial Intelligence (AI) in Courts, 2026, regs. 8(3), 43(3)–(4), 44 (June 3, 2026) (published with a notice inviting comments by June 20, 2026; deadline extended to July 15, 2026 by notice of June 16, 2026), https://cdnbbsr.s3waas.gov.in/s3ec0490f1f4972d133619a60c30f3559e/uploads/2026/06/2026060342.pdf.