RBI action on Kotak Mahindra Bank: What the restrictions mean for customers

Finding deficiency in the bank's IT infra, the RBI restricted Kotak Mahindra Bank from issuing new credit cards and acquiring customers online. Here's what it means for new and existing customers

The Reserve Bank of India (RBI) on April 24 barred Kotak Mahindra Bank from issuing fresh credit cards and onboarding new customers through online and mobile banking channels over “serious shortcomings” in the bank’s information technology (IT) infrastructure. These are said to have led to frequent outages, including a major disruption on April 15, 2024.

According to a press release from the RBI, “these actions are necessitated based on significant concerns arising out of the Reserve Bank’s IT examination of the bank for 2022 and 2023 and the continued failure on part of the bank to address these concerns in a comprehensive and timely manner”.

In essence, the RBI has put on hold some of Kotak Mahindra Bank’s online activities due to problems with the bank’s computer systems. Here's a breakdown:

The problem: Kotak Mahindra Bank's computer systems have been deficient for a while, as found by the RBI’s audit for two years. This led to frequent outages, including a big one on April 15, which inconvenienced customers.

What the RBI is doing: To protect customers and the overall banking system, the RBI has put in place some restrictions on Kotak Mahindra Bank. For now, the bank cannot do the following:

·     Sign up new customers through the online or mobile banking channels

·     Issue new credit cards

What this means for you:

If you are already a Kotak Mahindra Bank customer, you should not be affected. You can still use your existing accounts and credit cards.

If you were thinking of opening a new account online or getting a new credit card with Kotak Mahindra Bank, you will have to wait until the bank fixes its computer systems and gets the RBI's approval to renew these services. For now, however, you can visit a Kotak Mahindra Bank branch and get a new account opened.

What happens next: Kotak Mahindra Bank will need to hire an outside company to do a full check-up on its computer systems and fix everything that is deficient. Once that is done, and the regulator is happy with the improvements, the RBI can lift the restrictions.

Explained: Section 35A of the Banking ACT, under which the RBI took action:

The rule: A rule under Section 35A of the Banking Regulation Act allows the RBI to step in if something is going wrong at any bank.

Reasons to step in: There are three main reasons under which the RBI can step in:

·     If it is in the best interests of the public (like protecting bank customers).

·     If it is good for the overall banking system (like keeping digital transactions smooth).

·     If a bank is doing something that hurts its depositors or itself (like having bad computer systems that cause outages).

Why the RBI took action: The RBI decided to use the rule to take action because Kotak Mahindra Bank’s computer systems were found to be unreliable and causing frequent outages. This could have caused problems for both the bank's customers and the entire digital banking system in India. The RBI’s press release notes that the action on the bank was to “prevent any possible prolonged outage which may seriously impact not only the bank’s ability to render efficient customer service but also the financial ecosystem of digital banking and payment systems”.

This is a “cease and desist” order, so any deviation or non-compliance would attract very high penal action by the regulator. The restrictions imposed will be “reviewed upon completion of a comprehensive external audit to be commissioned by the bank with prior approval of the RBI, and remediation of all deficiencies that may be pointed out in the external audit as well as the observation contained in the RBI inspections, to the satisfaction of the Reserve Bank”.

What did Kotak Mahindra Bank say? In a statement, the bank said it had taken measures for adoption of new technologies to strengthen its IT systems and would continue to work with the RBI to swiftly resolve pending issues at the earliest.

“We want to reassure our existing customers of uninterrupted services, including credit card, mobile and net banking. Our branches continue to welcome and onboard new customers, providing them with all the bank’s services, other than issuance of new credit cards,” Kotak Mahindra Bank said in a statement.

Some of the IT problems the RBI found with Kotak Mahindra Bank’s IT infrastructure:

·     IT inventory management

·     Patch and change management

·     User access management

·     Vendor risk management

Data security and data leak prevention: This refers to how the bank protects its customer information. The RBI found weaknesses in these areas.

Business continuity and disaster recovery: This refers to how the bank plans to keep operating in case of a major computer system outages. The RBI found problems with the bank's plans, which could leave it unable to serve customers during an outage.

Repeated problems: These problems weren't new. The RBI had found similar issues in its reviews for the previous two years. The bank also failed to properly fix the problems despite being told to do so.

Past cases

This is one of the instances this year when a financial institution has been restricted by the RBI. Kotak Mahindra Bank joins IIFL Finance and JM Financial and Paytm Payments Bank, which faced restrictions earlier in 2024.

The restrictions on Kotak Mahindra Bank also follows similar past action against HDFC Bank and Bank of Baroda. Those restrictions are still in place for Bank of Baroda’s mobile app, Bob World, and it took HDFC Bank almost two years to fix the problems the RBI pointed out in its systems.

Disclosure: Entities controlled by the Kotak family have a significant holding in Business Standard Pvt Ltd