RBI tells Kotak Mahindra Bank to stop issuing new credit cards

The Reserve Bank of India (RBI) on Wednesday asked private-sector lender Kotak Mahindra Bank to stop onboarding new customers through its online and mobile banking channels and barred it from issuing fresh credit cards.

The regulator said the action was necessary as the bank failed to plug gaps in its information technology (IT) systems. There were frequent outages in the bank’s core banking system and online channels in the last two years which inconvenienced the customers, the central bank said.

The bank can continue to provide services to existing customers, including credit card customers, the RBI added.

In a statement, Kotak Mahindra Bank said: “We have received an order from the RBI which directs us to temporarily pause onboarding of new customers through our online and mobile banking channels and issuance of fresh credit cards. The bank has taken measures for adoption of new technologies to strengthen its IT systems and will continue to work with RBI to swiftly resolve balance issues at the earliest. We want to reassure our existing customers of uninterrupted services, including credit card, mobile and net banking. Our branches continue to welcome and onboard new customers, providing them with all the bank’s services, apart from issuance of new credit cards.”

The regulatory action came after market hours on Wednesday.

Earlier, Kotak Mahindra Bank's shares closed on the BSE at Rs 1,843.05 apiece, up 1.64 per cent over their previous close.

The restrictions will be reviewed after a comprehensive external audit commissioned by the bank, with the regulator’s prior approval, is completed, and all deficiencies pointed out in the external audit and observations contained in the RBI inspections are remedied to the satisfaction of the regulator.

“These actions are necessitated based on significant concerns arising out of Reserve Bank’s IT examination of the bank for the years 2022 and 2023 and the continued failure on part of the bank to address these concerns in a comprehensive and timely manner,” the RBI said in a press release.

According to the regulator, serious deficiencies and non-compliances were observed in the areas of IT inventory management, patch and change management, user access management, vendor risk management, data security and data leak prevention strategy, business continuity and disaster recovery rigour and drill, etc.

“For two consecutive years, the bank was assessed to be deficient in its IT risk and information security governance, contrary to requirements under regulatory guidelines,” the RBI said.

The bank was found to be significantly non-compliant with the corrective action plans issued by the RBI for the years 2022 and 2023, as the compliances submitted by the bank were found to be either inadequate, incorrect, or not sustained.

The regulator further said that in the absence of a robust IT infrastructure and IT risk management framework, the bank’s core banking system (CBS) and its online and digital banking channels had suffered frequent and significant outages in the last two years, the recent one being a service disruption on April 15, 2024, resulting in serious customer inconvenience.

“The bank is found to be materially deficient in building necessary operational resilience on account of its failure to build IT systems and controls commensurate with its growth,” the RBI release said.

The regulator said it had been holding high-level engagement with the bank on all these concerns with a view to strengthening its IT resilience for the past two years, but the outcomes had been far from satisfactory.

According to the regulator, there was rapid growth in the volume of the bank’s digital transactions, including transactions pertaining to credit cards, which was building further load on the IT systems.

The RBI said the decision to place business restrictions was in the interest of customers and to prevent any possible prolonged outage which might seriously impact not only the bank’s ability to render efficient customer service but also the financial ecosystem of digital banking and payment systems.