The Reserve Bank of India has directed Kotak Mahindra Bank to stop accepting new customers online and via mobile banking. The central bank has also instructed the private bank to put a halt on the issuance of new credit cards.
However, existing customers will remain unaffected by the new regulation.
These actions were taken after serious concerns emerged during the Reserve Bank's IT examinations of Kotak Mahindra Bank for the years 2022 and 2023. Despite repeated calls to take action, the bank has not been able to address these concerns in a timely manner.
"Serious deficiencies and non-compliances were observed in the areas of IT inventory management, patch and change management, user access management, vendor risk management, data security and data leak prevention strategy, business continuity and disaster recovery rigour and drill, etc," RBI stated in a press release.
For two consecutive years, the bank was assessed to be deficient in its IT Risk and Information Security Governance, contrary to requirements under Regulatory guidelines, it further added.
Kotak Mahindra Bank has witnessed frequent and significant outages in its Core Banking System (CBS) and online banking channels over the past two years, due to the absence of a strong IT infrastructure and risk management framework.
The most recent disruption occurred on April 15, 2024, that caused serious inconvenience to customers.
"The bank is found to be materially deficient in building necessary operational resilience on account of its failure to build IT systems and controls commensurate with its growth," it added.
The central bank also noted that despite continuous talks with the bank around the strengthening of its IT structure, results have been far from satisfactory. The rapid growth in the volume of online transactions, including that related to credit cards can put additional pressure on the IT structure of the bank.
