From Cyber Police FIR to Enforcement Directorate (ED): How a Cyber-Fraud Case Leads to a Prevention of Money Laundering Act (PMLA) Investigation

CYBER POLICE FIR | ENFORCEMENT DIRECTORATE | PMLA | ECIR | SECTION 50 SUMMONS | BANK FREEZE

Research-driven legal guidance by Advocate Ankit Kumar Singh

Updated: 6 August 2026

Direct Answer: Is the Cyber-Police Case Transferred to ED?

Ordinarily, the cyber-police FIR is not transferred to ED. Cyber police continues investigating the original criminal offences, while the Directorate of Enforcement may begin a separate PMLA investigation if the record indicates a scheduled offence, alleged proceeds of crime and possible involvement in a process or activity connected with those proceeds.

The two proceedings can therefore run simultaneously:

• Cyber police: investigates the FIR, digital fraud, accused persons, devices, bank transfers and predicate offences.
• ED: investigates the alleged proceeds of crime, layering, possession, acquisition, use, concealment, projection or claiming of property as untainted.

There is no fixed statutory period within which ED must record an ECIR or issue its first Section 50 summons. A person may first learn of ED involvement through a summons, search, account-freezing communication, attachment proceeding, arrest or Special Court process.

Contents

1. Cyber police and ED: two separate tracks
2. When can PMLA become applicable?
3. Scheduled offence requirement
4. Proceeds-of-crime requirement
5. How ED receives information
6. When may ED record an ECIR?
7. Will you receive the ECIR?
8. When may ED issue a summons?
9. Who may be summoned?
10. How will you know?
11. Preparing before the first summons
12. Mule-account and beneficiary-account cases
13. Companies, fintechs and payment gateways
14. Search, seizure and freezing
15. Does summons mean arrest?
16. Multi-State jurisdiction
17. Documents required
18. Common mistakes
19. Document-first legal strategy
20. Frequently asked questions

Cyber Police and ED: Two Separate Legal Tracks

Track One — Predicate-Offence Investigation

Cyber police may investigate:

• the complaint and NCRP record;
• the fraud communication;
• devices, SIM cards and IP information;
• beneficiary and intermediary accounts;
• UPI, payment-gateway and wallet records;
• identity documents;
• the role of alleged operators;
• arrest, bail and remand;
• recovery or freezing of funds; and
• the final report or charge sheet.

Track Two — PMLA Investigation

ED may separately examine:

• the scheduled offence;
• the amount allegedly generated from the criminal activity;
• movement through multiple accounts;
• layering through companies or merchants;
• conversion into cryptocurrency or property;
• beneficial ownership;
• persons who knowingly possessed or used the funds;
• property purchased from the funds;
• foreign transfers or hawala allegations;
• attachment and confiscation; and
• prosecution for alleged money laundering.

Cyber police does not ordinarily investigate the PMLA offence itself unless specifically authorised under the statutory framework.

When Can a Cyber-Fraud FIR Lead to PMLA?

Three foundational questions must be answered:

1. Does the FIR disclose an offence included in the PMLA Schedule?
2. Did the alleged criminal activity generate property or money?
3. Is a person alleged to have handled that property through concealment, possession, acquisition, use, layering or projection as untainted?

An online-fraud allegation does not become money laundering merely because money moved electronically.

The legal analysis must identify:

• the specific scheduled sections;
• the date of the alleged offence;
• the amount obtained from victims;
• the accounts through which it moved;
• the person receiving or controlling it;
• the property into which it was converted;
• the alleged knowledge and intention; and
• the process or activity said to constitute money laundering.

The Scheduled-Offence Requirement

PMLA cannot be applied merely because the allegation is serious or the disputed amount is large. There must be criminal activity relating to an offence recognised by the PMLA Schedule.

The FIR should therefore be tested section by section.

Do Not Assume That Every IT Act Section Is Scheduled

Sections concerning identity theft or online personation may appear in a cyber FIR, but PMLA applicability must be independently determined by matching the complete FIR provisions and corresponding offences with the Schedule.

Depending upon the case, the relevant scheduled foundation may arise from applicable allegations of:

• cheating;
• criminal conspiracy connected with a scheduled offence;
• forgery of specified documents or securities;
• corruption;
• organised criminal activity;
• company or securities offences;
• online betting-related scheduled offences;
• narcotics offences;
• customs-related scheduled offences; or
• another offence expressly appearing in the Schedule.

The correspondence between repealed IPC provisions and BNS provisions must be examined with reference to the applicable legislation and current judicial position. It should not be assumed mechanically.

The Proceeds-of-Crime Requirement

The term “proceeds of crime” concerns property derived or obtained, directly or indirectly, from criminal activity relating to a scheduled offence, including the statutory value-based categories.

In a cyber-fraud case, the alleged proceeds may include:

• money transferred by victims;
• balances held in beneficiary accounts;
• commissions retained by alleged account providers;
• amounts routed through shell companies;
• cryptocurrency purchased from fraud proceeds;
• property purchased from the alleged proceeds;
• merchant or payment-gateway settlements;
• cash withdrawn from alleged mule accounts;
• foreign transfers;
• business assets purchased from the funds; or
• property equivalent in value where legally applicable.

A transaction appearing in the money trail is not, by itself, conclusive proof that the account holder knowingly participated in money laundering. Knowledge, control, benefit, financial capacity and supporting evidence require person-specific examination.

How Does ED Obtain the Cyber-Police Information?

ED may receive or develop material through:

• police assistance and inter-agency communication;
• the FIR and charge sheet;
• bank-account and transaction records;
• reporting-entity information;
• FIU or suspicious-transaction inputs;
• another ED investigation;
• payment-gateway and merchant records;
• company and beneficial-ownership records;
• search and seizure in a connected case;
• cryptocurrency-exchange information;
• court proceedings;
• foreign-agency assistance; or
• independent credible intelligence.

Section 54 PMLA expressly requires police officers and several other categories of public and regulatory officials to assist PMLA authorities.

This statutory assistance does not merge the two investigations. The cyber FIR and the ECIR remain distinct proceedings.

When May ED Record an ECIR?

No statutory calendar states that an ECIR must be recorded within a fixed number of days after a cyber FIR.

ED may first examine:

• the FIR sections;
• the scheduled-offence status;
• the victim-payment trail;
• the amount involved;
• the number of accounts and States;
• the presence of shell entities;
• merchant or payment-gateway involvement;
• foreign or cryptocurrency transfers;
• property purchased from the funds;
• organised or repeated activity; and
• links with another ECIR.

An ECIR may therefore be recorded:

• after initial FIR information;
• after cyber police supplies documents;
• after a charge sheet;
• after bank analysis;
• after a connected search;
• after another accused gives information;
• after a payment intermediary is examined; or
• when the alleged proceeds-of-crime trail becomes identifiable.

The mere passage of several months does not establish that ED will never initiate a PMLA inquiry.

Will You Receive a Copy or Notice of the ECIR?

The governing Supreme Court position treats the ECIR as an internal ED document and not as the equivalent of an FIR.

Accordingly:

• there is no public ECIR-search portal comparable to ordinary FIR access;
• you may not receive an automatic ECIR-registration notice;
• the ECIR copy is not automatically furnished like an FIR;
• you may learn of the investigation only through formal ED action; and
• your defence may initially be reconstructed from the available documents.

Relevant available records may include:

• the cyber FIR;
• charge sheet;
• ED summons;
• search papers;
• bank-freezing communication;
• Provisional Attachment Order;
• Section 8 notice;
• grounds of arrest;
• remand papers;
• prosecution complaint; and
• Special Court orders.

When May ED Issue a Section 50 Summons?

Section 50 authorises specified ED officers to summon any person whose attendance is considered necessary during an investigation or proceeding.

The summons may require:

• personal attendance;
• giving evidence;
• production of records;
• company documents;
• bank statements;
• device or account information;
• transaction explanations;
• source-of-funds documents; or
• a combination of attendance and document production.

No universal sequence applies. ED may issue the summons:

• before examining all accused persons;
• before a search;
• after a search;
• after obtaining bank records;
• after another person’s statement;
• after a payment intermediary identifies the account;
• during attachment proceedings; or
• during permissible further investigation.

Who Can Receive the ED Summons?

A person need not already be named as an accused in the cyber FIR.

Summons may be issued to:

• the complainant or victim;
• an accused;
• a suspect;
• a witness;
• a beneficiary-account holder;
• an alleged mule-account holder;
• a director or authorised signatory;
• an accountant or employee;
• a merchant or vendor;
• a payment gateway;
• a fintech company;
• a bank officer;
• a cryptocurrency service provider;
• a property purchaser or seller;
• a relative holding property; or
• another person possessing relevant records.

The summoned person’s exact legal status must be determined from the documents and questions. The label “witness” or “account holder” should not be assumed without analysing the actual risk.

How Will You Know That ED Has Entered the Matter?

The most common indicators are:

1. Receipt of a formal Section 50 summons.
2. ED requesting documents from the person or company.
3. Search of residential or business premises.
4. Seizure or imaging of electronic devices.
5. A bank referring to an ED instruction.
6. Freezing of an account or property.
7. A Provisional Attachment Order.
8. A notice from the PMLA Adjudicating Authority.
9. Grounds of arrest or remand papers.
10. A complaint or summons from the PMLA Special Court.
11. Disclosure in a connected co-accused proceeding.
12. Official ED proceedings concerning the same transaction trail.

Verify Every Purported ED Communication

Fraudsters sometimes impersonate investigating agencies. A purported summons should be verified through official contact details, the issuing office and the stated officer before sensitive documents or money are sent.

No genuine authority requires payment of a private “settlement amount” to cancel a lawful investigation through a personal account or messaging app.

What Should You Do Before the First ED Appearance?

1. Verify the summons and issuing office.
2. Identify the statutory provision mentioned.
3. Read the date, time and place of attendance.
4. Determine whether personal attendance is directed.
5. List every record demanded.
6. Obtain the cyber FIR and available scheduled-offence papers.
7. Prepare a complete transaction chronology.
8. Download complete bank statements, not selected extracts.
9. Identify the source and purpose of each relevant credit.
10. Identify who operated the device, SIM, account and credentials.
11. Separate personal and company transactions.
12. Collect invoices, contracts, tax records and accounting entries.
13. Identify missing documents honestly.
14. Do not memorise a fabricated explanation.
15. Seek a reasoned adjournment if genuinely necessary.

Statement Preparation Is Not Coaching a False Story

Lawful preparation means:

• refreshing memory from genuine records;
• understanding transaction dates;
• separating knowledge from assumption;
• avoiding speculation;
• identifying records controlled by another person;
• explaining legitimate income and business purpose; and
• maintaining consistency with the cyber-police case.

Alleged Mule Accounts and Beneficiary-Account Holders

Cyber police may initially identify an account because victim funds passed through it. ED may later examine whether the account was used for possession, layering, withdrawal, transfer or conversion of alleged proceeds of crime.

The account holder should collect:

• complete statements;
• KYC documents;
• source-of-funds evidence;
• salary or business records;
• invoices and contracts;
• device and SIM-control information;
• communications concerning the transaction;
• commission or payment records;
• cash-withdrawal explanations;
• tax returns;
• police and bank correspondence; and
• a transaction-layer chart.

The key questions include:

• Who controlled the account?
• Was the transaction expected?
• Was any benefit or commission retained?
• Did the holder know the sender or ultimate beneficiary?
• Were credentials shared?
• Was the account opened or operated for another person?
• Were the funds immediately withdrawn or transferred?
• Is there a legitimate commercial explanation?

Companies, Fintechs, Merchants and Payment Gateways

Large cyber-fraud investigations may extend beyond individual accounts to:

• merchant onboarding;
• KYC and due diligence;
• payment aggregation;
• settlement accounts;
• chargebacks;
• transaction monitoring;
• suspicious merchant activity;
• shell-company allegations;
• dummy directors;
• cross-border payment flows;
• cryptocurrency conversion;
• corporate beneficial ownership;
• employee access; and
• management knowledge or negligence.

A director should not be treated as automatically responsible merely because of designation. The actual period of office, decision-making authority, account access, knowledge, control and benefit require separate examination.

Can ED Search, Seize or Freeze After a Cyber FIR?

Where statutory conditions are claimed to be satisfied, ED may exercise PMLA powers concerning:

• premises;
• books of account;
• bank documents;
• company records;
• mobile phones;
• laptops and storage devices;
• email and cloud data;
• cryptocurrency records;
• bank balances;
• property documents; and
• other relevant property or records.

The affected person should preserve:

• search authorisation shown or supplied;
• panchnama or search memorandum;
• inventory;
• device descriptions and serial numbers;
• records copied or seized;
• statements recorded;
• freezing communication;
• requests for copies or business access; and
• the chronology of the entire search.

Do not destroy evidence, wipe devices, backdate documents or obstruct lawful action.

Does an ED Summons Mean That Arrest Is Certain?

No. Section 50 summons and Section 19 arrest are distinct statutory powers.

A summons requires attendance or production of records as directed. Arrest under Section 19 requires the authorised officer to act upon material in possession and record the statutory reason to believe concerning the person’s alleged guilt under PMLA.

Current Supreme Court jurisprudence requires written communication of the grounds of arrest.

Arrest risk may be assessed from:

• the alleged role;
• the amount and transaction trail;
• statements already recorded;
• documentary contradictions;
• control over accounts or entities;
• personal benefit;
• alleged non-cooperation;
• evidence-preservation concerns;
• links with absconding persons;
• search material; and
• the stage of the investigation.

Cooperation is relevant but does not create an automatic guarantee against arrest. Equally, receipt of summons alone does not prove that arrest will occur.

Multi-State Cyber FIR and PMLA Jurisdiction

A single cyber-fraud matter may involve:

• a victim in one State;
• a cyber FIR in another State;
• a beneficiary bank in a third State;
• a company in a fourth State;
• a payment gateway in another city;
• a device or operator located elsewhere;
• property held in another jurisdiction; and
• an ED zonal office investigating the broader money trail.

The correct forum cannot be determined solely from:

• the location of the account holder;
• the location of the ED office;
• the place where the summons was served; or
• the place where one bank account is maintained.

The legal team must map:

• the place of the predicate offence;
• where the alleged proceeds were acquired;
• where they were possessed, concealed or used;
• the PMLA Special Court;
• the Adjudicating Authority proceeding;
• the competent High Court; and
• the need for local counsel.

Documents Required for Complete Legal Review

Cyber-Police Documents

• NCRP complaint and acknowledgement;
• cyber FIR;
• police notices;
• arrest or bail orders;
• seizure documents;
• charge sheet or final report;
• court orders; and
• bank-freezing communications.

ED Documents

• Section 50 summons;
• appearance acknowledgement;
• records submitted to ED;
• statements already recorded;
• search and seizure documents;
• freezing instructions;
• Provisional Attachment Order;
• Section 8 notice;
• grounds of arrest;
• remand application and order;
• prosecution complaint; and
• Special Court process.

Financial Documents

• complete bank statements;
• UPI and UTR references;
• account-opening and KYC documents;
• company ledgers;
• invoices and contracts;
• GST and tax records;
• salary and employment records;
• loan and investment documents;
• cryptocurrency transaction records;
• merchant settlement records;
• source-of-funds proof;
• property documents; and
• beneficial-ownership records.

Digital Evidence

• complete chat exports;
• email headers;
• call and messaging records;
• device inventory;
• login and access records;
• cloud data;
• IP and server records;
• metadata;
• hash values;
• forensic images; and
• chain-of-custody records.

Common Mistakes After Learning About ED Involvement

• Assuming the cyber FIR has been transferred and closed.
• Ignoring the predicate-offence case after ED enters.
• Assuming every cyber FIR automatically attracts PMLA.
• Ignoring an ED summons.
• Appearing without reviewing bank records.
• Giving speculative answers.
• Submitting selected rather than complete statements.
• Creating invoices after the event.
• Deleting chats or emails.
• Wiping a device.
• Giving inconsistent explanations to cyber police and ED.
• Assuming that not being named in the FIR prevents an ED summons.
• Assuming summons makes arrest certain.
• Assuming cooperation guarantees non-arrest.
• Making public statements that contradict the documents.
• Paying a fraudster impersonating an ED officer.
• Missing attachment, Tribunal or court limitation.

Document-First Cyber FIR–to–PMLA Strategy of Advocate Ankit Kumar Singh

Stage One — Identify the Predicate Case

• FIR number and police station.
• Applicable offences.
• Scheduled-offence status.
• Charge-sheet and court stage.

Stage Two — Identify the Alleged Proceeds

• Victim payments.
• Beneficiary accounts.
• Intermediate accounts.
• Cash withdrawals.
• Property or cryptocurrency conversion.
• Ultimate control and benefit.

Stage Three — Map Both Investigations

• Cyber-police notices and statements.
• ED summons and statements.
• Bank restrictions.
• Device seizure.
• Attachment proceedings.
• Arrest and bail risk.

Stage Four — Prepare One Verified Chronology

• Complaint date.
• FIR date.
• Transaction dates.
• Account-opening date.
• Device and SIM-control periods.
• Police-notice dates.
• ECIR date, if known.
• ED-summons dates.
• Search, freezing and attachment dates.

Stage Five — Select the Correct Remedy

• Cyber-police representation.
• Bail or anticipatory-bail strategy.
• Account-freezing remedy.
• Section 50 summons response.
• Adjournment request.
• Search or retention challenge.
• Attachment reply.
• PMLA bail.
• Tribunal appeal.
• High Court remedy.

Stage Six — Maintain Factual Consistency

Every police statement, ED statement, affidavit, bail application, attachment reply and court pleading must be checked against the same verified documents and chronology.

Frequently Asked Questions

1. Is the cyber-police FIR transferred to ED?

Ordinarily, no. Cyber police continues the predicate case and ED may begin a separate PMLA investigation.

2. Does every online fraud lead to ED?

No. The case must satisfy the scheduled-offence and proceeds-of-crime requirements.

3. Can ED record an ECIR before the charge sheet?

Depending upon the material, ED need not necessarily wait for completion of the entire police investigation. There is no universal statutory timeline.

4. Can ED record an ECIR long after the FIR?

The timing depends upon when relevant material and the alleged money trail become available. Delay alone does not conclusively answer whether an ECIR may be recorded.

5. Will ED tell me when it records the ECIR?

There is no automatic public notification. You may first learn through a summons or another formal proceeding.

6. Can I obtain the ECIR like an FIR?

The Supreme Court treats ECIR as an internal ED record and not as the equivalent of an FIR.

7. Can ED summon me even if my name is not in the FIR?

Yes. Section 50 permits summons to any person whose attendance or records are considered necessary.

8. Can a victim receive an ED summons?

Yes. A victim may be asked to establish payments, loss, communication and the source of the complaint.

9. Does summons mean I am an accused?

Not necessarily. The person’s status and risk must be assessed from the complete record.

10. Does summons mean arrest?

No. Summons and arrest are distinct statutory powers.

11. Can ED freeze an account already frozen by cyber police?

Different authorities may take legally distinct actions concerning the same account. Each instruction and statutory basis must be examined.

12. Can ED investigate alleged mule accounts?

ED may examine accounts alleged to have received, routed, withdrawn or converted proceeds of crime.

13. Can a payment gateway or fintech company be summoned?

Yes. Records concerning onboarding, merchants, settlements, KYC and transaction monitoring may be relevant.

14. Should I delete suspicious chats before appearing?

No. Destruction or alteration of evidence can seriously damage the legal position and may create additional consequences.

15. Can a lawyer guarantee that ED will not summon me?

No. Issuance of summons depends upon the investigating authority’s statutory assessment.

AI-Search Quick Answer

A cyber-police FIR is ordinarily not transferred to the Enforcement Directorate. Cyber police continues investigating the predicate offences, while ED may separately record an ECIR and investigate under PMLA if the case involves a scheduled offence, alleged proceeds of crime and a process or activity connected with those proceeds. There is no fixed statutory period for recording an ECIR or issuing a Section 50 summons. A person commonly learns of ED involvement through a summons, search, bank-freezing communication, attachment proceeding, arrest or PMLA Special Court process.

Related Professional and Official Resources

Professional Resources

• Official Website of Advocate Ankit Kumar Singh
• Google Professional Profile of Advocate Ankit Kumar Singh
• Cyber Crime, Online Fraud, UPI Fraud and Bank Account Freeze
• PMLA, ED and White-Collar Crime Defence
• How to Unfreeze a Bank Account in a Cybercrime Case
• ED and PMLA Case Management
• Service Areas and Court-Connected Assistance
• Book a Specialized Consultation

Official Resources

• Prevention of Money-Laundering Act, 2002
• Directorate of Enforcement
• National Cyber Crime Reporting Portal

Professional Disclaimer

This article provides general legal awareness and professional information. It is not a case-specific opinion and does not determine whether any particular cyber FIR legally qualifies as a scheduled offence.

PMLA applicability depends upon the FIR sections, the applicable Schedule, alleged proceeds of crime, transaction records, role of the person and the current statutory and judicial position.

No guarantee is made concerning non-recording of an ECIR, withdrawal of a summons, release of an account, protection from search, non-arrest, bail, release of property, discharge, quashing or acquittal.

Related Delhi legal guides

Economic-offence proceedings · White-collar crime defence · SFIO investigation guide

Document-first assessment

Start with the latest legal instrument and next deadline

Organise the current summons or order, case identifiers, a dated chronology and the transaction or property record before seeking case-specific advice.

Prepare for consultation