The Reserve Bank of India has barred Kotak Mahindra Bank from acquiring new customers through its online and mobile banking channels and stopped it from issuing fresh credit cards with immediate effect.

The Reserve Bank of India has barred Kotak Mahindra Bank from acquiring new customers through its online and mobile banking channels and stopped it from issuing fresh credit cards with immediate effect.

The thunderbolt from the banking regulator sent shock waves through the banking landscape – and strangely redolent of the precipitate action it took against HDFC Bank in December 2020.

The RBI said it was forced to act against Kotak Mahindra Bank because it had failed to address “significant concerns” that been raised during a regulatory examination of the bank’s IT systems and practices in 2022 and 2023.

“Serious deficiencies and non-compliances were observed in the areas f IT inventory management, patch and change management, user access management, vendor risk management, data security and data leak prevention strategy, business continuity and disaster recovery rigour and drill,” the RBI said in a note on its supervisory action against Kotak Bank.

“The compliances submitted by the bank were found to be either inadequate, incorrect or not sustained,” the note added.

Banking circles said the the central bank’s crackdown could severely impact Kotak Mahindra Bank’s growth metrics. This is because the lender has been extremely successful in not only sourcing customers through the digital channels, but also disbursing loans.

According to a presentation put out by Kotak Mahindra Bank in January, 95 per cent of personal loans sold by volume, 99 per cent of new credit cards (also by volume) and 79 per cent of new business loans disbursed by volume were through digital channels.

During the quarter ended December 31, 2023, the bank had a customer base of 4.8 crore as compared with 3.9 crore in December 31, 2022. The number of outstanding credit cards issued by Kotak Mahindra Bank stood at over 59.54 lakh in March 2024.

“We have received an order from the RBI which directs us to temporarily pause onboarding of new customers though our online and mobile banking channels and issuance of fresh credit cards. The bank has taken measures for adoption of new technologies to strengthen its IT systems and will continue to work with RBI to swiftly resolve balance issues at the earliest. We want to reassure our existing customers of uninterrupted services, including credit card, mobile and net banking. Our branches continue to welcome and onboard new customers, providing them with all the bank’s services, apart from issuance of new credit cards,” Kotak Mahindra Bank said.

The troubles for Kotak Mahindra Bank escalated on April 15 after customers complained on social media that they could not access the bank’s mobile app. Some customers had also complained about issues they were facing with the net banking and UPI services.

The RBI said that in the absence of a robust IT infrastructure and IT Risk Management framework, the bank’s core banking system (CBS) and its online and digital banking channels had suffered frequent and significant outages over the past two years.

“The bank is found to be materially deficient in building necessary operational resilience on account of its failure to build IT systems and controls commensurate with its growth,” the RBI added.

This is not for the first time that the RBI is taking such action against a truant bank.

Back in December 2020, it had barred HDFC Bank from issuing fresh credit cards and launching new digital initiatives after repeated instances of technological outages at the lender. The restrictions were fully lifted in March 2022 after being partially relaxed in August 2021.

In January, the regulator directed Paytm Payments Bank to stop accepting deposits or top-ups in any customer accounts, wallets, FASTags and other instruments after February 29. Subsequently, the deadline was extended to March 15. The direction followed persistent non-compliance and continued material supervisory concerns, the central bank had said in a statement.

Later in March 4, the RBI had asked IIFL Finance to stop sanctioning or disbursing gold loans with immediate effect after observing certain material supervisory concerns were in the gold loan portfolio of the company, including serious deviations in assaying and certifying purity and net weight of the yellow metal.

A day later it directed JM Financial Products Ltd (JMFPL) to cease and desist, with immediate effect, from any form of financing against shares and debentures, including sanction and disbursal of loans against Initial Public Offering (IPO) of shares as well as against subscription to debentures.

The swift action came after the banking regulator found serious deficiencies in the loans sanctioned by the company for IPO financing as well as non convertible debenture (NCD) subscriptions.

RBI Governor Shaktikanta Das has said that the apex bank gives enough time to regulated entities to rectify any gaps found by its inspection or supervision team and action is only taken if the problems remain.

“It is only when we see huge or persistent problems that we act,” he said at the post monetary policy press conference on April 5.

The RBI explained that in the past two years, it has been in continuous high-level engagement with the bank on all its concerns with a view to strengthening its IT resilience, but the outcomes have been far from satisfactory.

“It is also observed that, of late, there has been rapid growth in the volume of the bank’s digital transactions, including transactions pertaining to credit cards, which is building further load on the IT systems. The Reserve Bank, therefore, has decided to place certain business restrictions on the bank… in the interest of customers and to prevent any possible prolonged outage which may seriously impact not only the bank’s ability to render efficient customer service but also the financial ecosystem of digital banking and payment systems,” it added.

The regulator said the restrictions that had been imposed would be reviewed upon completion of a comprehensive external audit to be commissioned by the bank with its prior approval.

It will also be subject to remediation of all deficiencies that may be pointed out in the external audit as well as the observations contained in the RBI inspections.

The RBI clarified that these restrictions were without prejudice to any other regulatory, supervisory or enforcement action that may be initiated against the bank.