The Reserve Bank of India (RBI) has barred Kotak Mahindra Bank from onboarding new customers through its online and mobile banking channels and  issuing fresh credit cards with immediate effect.

The action against Kotak Mahindra Bank has come after the RBI found serious deficiencies in the lender’s IT risk management and information security governance for two consecutive years.

What prompted RBI to act

The directive against the third-largest private lender by market capitalisation was based on significant concerns found in RBI's IT examination for 2022 and 2023 and the continued failure on part of the bank to address these concerns in a comprehensive and timely manner.

"Serious deficiencies and non-compliances were observed in the areas of IT inventory management, patch and change management, user access management, vendor risk management, data security and data leak prevention strategy, business continuity and disaster recovery rigour and drill," the RBI said in a release.

For two consecutive years, the bank was assessed to be deficient in its IT risk and information security governance, contrary to requirements under regulatory guidelines, it added.

The central bank noted that the bank's core bank system and its online channels suffered frequent outages in the past two years, the most recent being a service disruption on April 15, 2024, resulting in serious customer inconveniences.

Existing customers not impacted

The RBI’s directive does not restrict the bank to offer services to its existing customers, including its credit card users.

The bank’s existing customers can thus continue to use their credit cards and make account transactions online and offline without any restrictions.

The RBI said it was placing the restrictions on Kotak in the interest of customers and to avoid a possible prolonged outage that might affect customer service and broader digital banking and payment systems.

Will the bank’s business be impacted?

The bank's customer acquisition targets will be impacted. It may also hurt the bank's loan share target.

Incidentally, Kotak Mahindra Bank was seeing a significant growth in the volume of digital transactions, including transactions pertaining to credit cards. 

As of March-end, Kotak Mahindra Bank’s credit card issuance had touched 59.54 lakh.

"The RBI's action is obviously going to impact the bank's ambition to get to a 15% share of unsecured loans but the bigger impact is going to be on the savings accounts," Pranav Gundlapalle, senior research analyst at AllianceBernstein, told news agency Reuters.

RBI to review the restrictions

RBI said it will review the restrictions imposed on the bank upon completion of a 'comprehensive external audit' to be commissioned by the lender with the prior approval of the regulator.

In 2020, RBI barred HDFC Bank from issuing new credit cards and introducing digital products following payment failures. The restrictions on the bank were lifted in 2021.