RBI places restrictions on Kotak Mahindra Bank over IT infrastructure concerns

The Reserve Bank of India (RBI) has imposed restrictions on Kotak Mahindra Bank, barring it from adding new customers through online and mobile platforms and issuing new credit cards.

The central bank has cited data security issues and an insufficient IT infrastructure as the primary reasons for its actions.

In its official statement, the RBI invoked Section 35A of the Banking Regulation Act, 1949, to direct Kotak Mahindra Bank to cease online customer onboarding and new credit card issuance. However, the bank remains authorized to continue serving its existing clientele, inclusive of its credit card holders.

The RBI's decision comes in light of the bank's failure to address concerns highlighted during IT examinations for the years 2022 and 2023.

Kotak Mahindra Bank responded to the directive by stating its commitment to enhancing its IT systems. The bank mentioned its ongoing efforts to adopt new technologies and collaborate with the RBI to resolve the identified issues promptly.

The statement read, "We have received an order from the RBI which directs us to temporarily pause onboarding of new customers through our online and mobile banking channels and issuance of fresh credit cards. The bank has taken measures for adoption of new technologies to strengthen its IT systems and will continue to work with RBI to swiftly resolve balance issues at the earliest."

Despite the imposed restrictions, the bank assured its existing customers of uninterrupted services across various platforms, including credit card services. It clarified, "Our branches continue to welcome and onboard new customers, providing them with all the Bank's services, apart from issuance of new credit cards."

The RBI's concerns primarily revolve around Kotak Mahindra Bank's IT inventory management, data security, and its handling of various IT processes.

The central bank highlighted, "Serious deficiencies and non-compliances were observed in the areas of IT inventory management, patch and change management, user access management, vendor risk management, data security and data leak prevention strategy, business continuity, and disaster recovery rigour and drill, etc."

Moreover, the RBI emphasized that the bank's IT systems frequently experienced outages, causing inconvenience to customers. "In the absence of a robust IT infrastructure and IT Risk Management framework, the bank's Core Banking System (CBS) and its online and digital banking channels have suffered frequent and significant outages in the last two years," the RBI stated.

The central bank further expressed its concerns about the growing volume of digital transactions processed by Kotak Mahindra Bank, adding strain to its already compromised IT systems. "Of late, there has been rapid growth in the volume of the bank's digital transactions, including transactions pertaining to credit cards, which is building further load on the IT systems," the RBI noted.

In the interest of the customers and to safeguard the financial ecosystem, the RBI has placed these restrictions on Kotak Mahindra Bank.

It stated, "The Reserve Bank, therefore, has decided to place certain business restrictions on the bank as mentioned above, in the interest of customers and to prevent any possible prolonged outage which may seriously impact not only the bank's ability to render efficient customer service but also the financial ecosystem of digital banking and payment systems."

The RBI has also indicated that the restrictions will be lifted once an external audit verifies the bank's compliance with regulatory guidelines and addresses all deficiencies. "The restrictions now being imposed will be reviewed upon completion of a comprehensive external audit to be commissioned by the bank with the prior approval of RBI, and remediation of all deficiencies," the RBI clarified.

Established in 1985 by Uday Kotak as Kotak Capital Management Finance, the company witnessed investments from Anand Mahindra and Harish Mahindra a year later, leading to its renaming as Kotak Mahindra Finance. In a significant development in 2003, Kotak Mahindra Finance Ltd. secured a banking license from the RBI, becoming the first non-banking finance company in India to transition into a bank.

The bank offers a diverse range of services, including commercial banking, stock broking, mutual funds, insurance, and investment banking. As of December 31, the bank boasts a customer base of 4.8 crore, with 1,869 branches and 3,239 ATMs across the country.