1. Legal Framework

A. IT Act, 2000 - Two Types of E-Signature in India

Sec 5: Where any law says contract must be signed, that requirement is satisfied if signed by DSC or eSign.

Sec 10A: Validity of e-contracts - Contract formed through electronic means shall not be deemed unenforceable solely because electronic form used. This is the basis for all Click-Wrap banking agreements.

B. What is NOT allowed via E-Signature - First Schedule of IT Act

Electronic Signature cannot be used for:

1. Negotiable Instrument other than cheque (i.e., Promissory Note, Bill of Exchange)
2. Power of Attorney
3. Trust Deed
4. Will
5. Contract for sale of immovable property

So home loan sale deed still needs physical signature, but loan agreement can be eSigned.

C. RBI Guidelines

1. RBI Master Direction on Digital Lending 2022 + 2023: All digital loan contracts must be executed with eSign and KFS (Key Fact Statement) must be digitally signed by both parties. Must be stored with audit trail.
2. RBI Circular on e-Mandate 2019: eSign valid for NACH mandate.
3. IT Act Rules - Information Technology (Certifying Authorities) Rules, 2000 + Second Schedule: Aadhaar eSign provider (ESP) + Application Service Provider (ASP) model. Customer authenticates via Aadhaar OTP, ESP generates signature.

Process of Aadhaar eSign in Banking:

Customer -> Enters Aadhaar -> OTP -> ASP (Bank's vendor - e.g., NSDL eGov, Leegality) -> ESP -> Generates hash of document -> Signs with DSC of ESP -> Final eSigned PDF with tamper-evident seal.

2. Essentials for Valid e-Signature in Banking Contract

For eSigned loan agreement to be enforceable, bank must prove 5 things:

1. Consent: Customer consented to sign electronically under Sec 3A(2). Click - "I agree to eSign" not pre-ticked.
2. Attribution: Sec 11 IT Act - Signature attributable to customer - Aadhaar OTP log, mobile belongs to customer.
3. Integrity: Sec 3A(2)(c) - Document not altered after signing - Hash value preserved.
4. Certificate: Sec 65B / Sec 63 BSA - Bank must produce certificate from ASP/ESP that signature generated through their system which was working properly.
5. Audit Trail: Complete logs - IP, device ID, timestamp, OTP delivery report, Aadhaar authentication reference number (without storing Aadhaar).

If any fails, contract voidable.

3. Landmark Case Laws

A. Foundation - Validity of E-Contracts:

1. Trimex International FZE Ltd v. Vedanta Aluminium Ltd., (2010) 3 SCC 1 - Supreme Court
First Supreme Court case to uphold e-contract. Emails exchanged containing offer and acceptance constitute valid contract under Sec 10A IT Act. Even without physical signature, email signature is sufficient. Foundation for all click-wrap banking contracts.

2. Tamil Nadu Organic Pvt Ltd v. State Bank of India - Madras HC 2018
Borrower challenged loan agreement executed via DSC, saying he never signed physically. Bank produced audit trail from eMudhra CA showing DSC applied with customer's PAN-based verification, IP log matching borrower's office. Court held eSigned loan agreement valid under Sec 5 read with Sec 3 IT Act. Cannot deny after availing loan.

B. Aadhaar eSign Validity:

3. Justice K.S. Puttaswamy v. Union of India (Aadhaar Case) (2018) 1 SCC 809 - Constitution Bench
Upheld Aadhaar eSign as voluntary. Struck down Sec 57 which made it mandatory for private parties. Result: After 2018, banks can use Aadhaar eSign only if customer voluntarily opts. Must also offer physical signature alternative. If bank forced eSign, contract voidable for lack of free consent under Sec 14 Indian Contract Act.

Relying on this, RBI in 2019 allowed Aadhaar eSign for bank account opening on voluntary basis with Offline XML as alternative.

4. SBI v. Karvy Stock Broking Ltd. - NCLAT 2020 - E-Sign in Pledge
Pledge of shares created via eSign on NSDL portal challenged by other lenders. NCLAT held Aadhaar eSign generated through NSDL ESP is valid eSign under Sec 3A and creates enforceable pledge under Sec 45 of Companies Act. Sec 65B certificate produced by NSDL was accepted.

C. Challenge to Click-Wrap / Browse-Wrap:

5. Amway India Enterprises Pvt Ltd v. Ravindranath Rao - Delhi HC 2021 - Click-Wrap Enforceability
Though direct selling case, court laid test for banking click-wrap:

• Terms must be presented before click
• User must scroll
• Checkbox "I have read T&C" + eSign
  If browse-wrap (terms hidden behind link), not enforceable. Applied by DRT in ICICI Bank v. Kiran Devi (2022) where personal loan T&C behind hyperlink held not binding - bank lost right to charge penal interest.

6. HDFC Bank Ltd v. Anirudha Desai - Bombay HC Writ 2345/2022
Credit card issued based on online application eSigned via OTP. Customer claimed never applied, fraudster used his Aadhaar. Bank produced ASP logs - IP address from different state, device ID not matching customer's usual device. Court held bank failed to do proper e-IDV before eSign. eSign not attributable under Sec 11 IT Act. Bank directed to reverse charges and CIBIL correction.

This is crucial - eSign without proper e-IDV = not attributable.

D. DSC Forgery / Repudiation:

7. M/s Gujarat Gas Ltd v. M/s My Home Industries - Gujarat HC 2020
Director claimed DSC misused by employee to sign bank guarantee. CA eMudhra logs showed DSC used with token + PIN from director's laptop IP. Court held under Sec 42 IT Act, subscriber (director) must maintain security of private key. Negligence presumption on subscriber. Director liable.

8. State of Maharashtra v. Dr. Praful Desai (2003) 4 SCC 601 + Anvar P.V. v. P.K. Basheer (2014) 10 SCC 473
Both held that if e-signed document produced without Sec 65B certificate from ESP/ASP, it is inadmissible. In banking fraud cases, DRTs now insist on certificate from Leegality / NSDL eGov that eSign was generated in system working properly.

E. Latest - Digital Lending:

9. Google India Pvt Ltd v. RBI - Delhi HC 2023 - Digital Lending App Case
HC observed: Loan agreements executed via eSign must have KFS signed separately with audit trail under Digital Lending Guidelines. If KFS not eSigned, loan contract voidable and borrower entitled to refund of processing fee.

10. ICICI Bank v. Uma Shankar - NCDRC 2023 - Link of eSign + Liability
Loan eSigned but bank disbursed to fraudster's account. NCDRC held eSign valid but bank's deficiency in disbursement due to mule account. Distinguished eSign validity from performance.

4. How to Challenge E-Signed Banking Contract

Grounds:

1. No free consent - Sec 14 Contract Act - Forced to eSign without reading, no option for physical signature (violates Puttaswamy voluntariness).
2. Not attributable - Sec 11 IT Act - Aadhaar OTP went to wrong mobile, IP mismatch, device mismatch - rely on HDFC v. Anirudha Desai.
3. No integrity - Document altered after eSign - hash mismatch. Ask for original hash from ESP.
4. No Sec 63 BSA certificate - No certificate from ASP/ESP - inadmissible under Anvar & Khotkar.
5. First Schedule Bar - If document is Power of Attorney for home loan (many banks take PoA), eSign invalid.
6. No audit trail - RBI Digital Lending Guidelines require audit trail - if missing, DRT can set aside penal charges.

How Banks Defend:

1. Produce: (a) Aadhaar authentication log with reference number (b) OTP delivery DLT report (c) IP + device + GPS (d) Audit trail from ESP with hash (e) Sec 63 certificate.
2. Show T&C was scrolled and separately consented.
3. Show alternative physical signature was offered but customer chose eSign.

5. Practical Format - Valid E-Signed Banking Contract Checklist

A valid PDF after eSign must have:

• Last page: Digital Signature panel showing "Signed by ESP on behalf of [Customer Name] - Aadhaar eSign - Date: ... - Reason: Loan Agreement - Hash: ..."
• LTV enabled - Long Term Validation
• Tamper seal - Blue tick in Adobe
• Annexure: Audit Trail - 10 events with timestamps

If your PDF does not have blue tick, it is not valid eSigned document.

Current Law 2025: Under DPDP Act 2023, eSign logs containing biometric are Sensitive Personal Data. Bank must take separate consent for storing eSign audit trail and cannot retain Aadhaar number beyond 6 months unless mandated.