RBI Halts New Customer Onboarding at Kotak Mahindra Bank Over IT Compliance

In a significant move to enforce IT compliance, the Reserve Bank of India (RBI) has imposed restrictions on Kotak Mahindra Bank, prohibiting the institution from adding new customers via its online and mobile banking platforms and from issuing new credit cards. This decision was announced on Wednesday, following the identification of serious lapses in the bank's IT risk management practices. The RBI's action reflects deep concerns over the bank's IT systems, highlighted by examinations conducted for the years 2022 and 2023, and Kotak Mahindra Bank's consistent inability to address these issues effectively.

Representative image

Kotak Mahindra Bank responded to the RBI's supervisory action by stating its commitment to enhancing its IT infrastructure through the adoption of new technologies. The bank aims to work closely with the RBI to address and resolve the remaining issues promptly. This situation mirrors a similar incident from December 2020 when HDFC Bank faced restrictions due to technological disruptions, which were eventually lifted in March 2022 after necessary improvements were made.

The RBI's scrutiny of Kotak Mahindra Bank revealed deficiencies across several areas including IT inventory management, data security, and business continuity plans. As a result, the bank is now required to halt the onboarding of new customers through digital channels and the issuance of new credit cards, although it will continue serving existing customers.

Further investigations by the RBI found Kotak Mahindra Bank significantly non-compliant with corrective actions prescribed for 2022 and 2023. The bank's IT infrastructure and risk management framework were deemed inadequate, leading to frequent service outages that caused customer inconvenience. The most recent disruption occurred on April 15, 2024, underscoring the urgent need for robust IT systems.

The central bank emphasized that Kotak Mahindra Bank's operational resilience was compromised due to its failure to upgrade its IT systems in line with its growth. Despite ongoing discussions aimed at bolstering IT resilience, outcomes have been unsatisfactory. The RBI also noted a surge in digital transactions at the bank, further straining its IT infrastructure.

In light of these challenges, the RBI has opted to impose business restrictions on Kotak Mahindra Bank to safeguard customer interests and ensure stability within India's digital banking and payment ecosystem. The bank reassured its existing customers that services would remain uninterrupted and that it would continue welcoming new customers through its branches, excluding new credit card services.

The RBI stated that these restrictions would be subject to review following a comprehensive external audit of Kotak Mahindra Bank's IT systems. This audit is expected to identify all deficiencies for remediation, in addition to addressing observations from RBI inspections. The review process aims to ensure that all issues are resolved to the central bank's satisfaction before any restrictions are lifted.

Moreover, these measures do not preclude any further regulatory or supervisory actions that may be deemed necessary by the RBI. Kotak Mahindra Bank Limited is scheduled to announce its financial results for the March 2024 quarter and the fiscal year 2023-24 on May 4, which will likely provide further insights into how these developments have impacted the bank's operations.