On 24-04-2024, the Reserve Bank of India (‘RBI’), under Section of the , directed Kotak Mahindra Bank Limited (‘the bank’) to cease and desist from onboarding new customers through its online and mobile banking channels and from issuing fresh credit cards, with immediate effect. The bank shall continue to provide services to its existing customers including credit card users. The direction came into effect on 24-04-2024.
Key Points:
After significant concerns arising out of the Information Technology (‘IT’) Examinations of the bank, which were not addressed for two consecutive years of 2022 and 2023, these actions to place business restrictions were taken by the RBI.
The practices of the bank were found to be contrary to the Regulatory guidelines for IT Risk and Information Security Governance required by the RBI for two consecutive years.
The bank also failed to comply with the Corrective Action Plans which were issued by the RBI for 2022 and 2023.
The bank’s Core Banking System (CBS) as well as its online and digital banking channels suffered frequent significant outages in the past two years due to the absence of a robust IT infrastructure and IT Risk Management Framework. Recently, on 15-04-2024, a service disruption occurred which caused serious customer inconveniences.
Even though the RBI had been in continuous high-level engagement with the bank to strengthen its IT resilience, the results were dissatisfactory.
These restrictions were placed by the RBI in consumer interest and to prevent any possible prolonged outage that may seriously impact the bank’s efficiency along with the financial ecosystem of digital banking and payment systems.
The RBI will review these restrictions once a comprehensive external audit is done by the bank with prior approval of the RBI.
These restrictions are without prejudice to any other regulatory, supervisory, or enforcement action that may be initiated against the bank by the RBI.
The post appeared first on .