The Reserve Bank of India (RBI) took a major regulatory step on April 24 by prohibiting Kotak Mahindra Bank (KMB) from acquiring new customers through its online and mobile banking platforms and issuing fresh credit cards.

This action, based on supervisory concerns over the bank's technology platforms, came after the RBI conducted an examination of KMB's IT systems over the past two years, highlighting the bank’s persistent failure to address these concerns adequately, as stated by the central bank.

Existing customers of KMB will not be affected by the ban, and the bank can continue to provide services to them, including its credit card customers.

However, the prohibition on onboarding new customers and issuing fresh credit cards is expected to impact KMB's new customer acquisition, particularly through online and mobile banking channels, which witness a significant portion of new account openings.

Additionally, this move is anticipated to affect KMB's credit card business, including its co-branded credit card deals, as indicated by industry experts.

The RBI justified its actions by citing "significant concerns" arising from its IT Examination of KMB for the years 2022 and 2023, emphasising serious deficiencies and non-compliance in various areas such as IT inventory management, patch and change management, user access management, vendor risk management, data security, business continuity, disaster recovery, among others.

The central bank's decision stemmed from KMB's repeated non-compliance with corrective action plans issued by the RBI in the preceding years, as noted during subsequent assessments. The RBI's concerns were further exacerbated by frequent and significant outages in KMB's Core Banking System (CBS) and online/digital banking channels over the last two years, with the most recent disruption occurring on April 15, 2024, leading to severe customer inconveniences.

Despite continuous engagement by the RBI over the past two years to address these concerns and strengthen KMB's IT resilience, satisfactory outcomes were not achieved. The recent surge in the bank’s digital transactions, including credit card transactions, further stressed the IT systems, prompting the RBI to act in the interest of customers and the stability of the financial ecosystem.

However, the RBI clarified that these restrictions would be re-evaluated upon the completion of a comprehensive external audit, approved by the RBI, and the remediation of identified deficiencies. The decision will also consider observations from RBI inspections and must meet the satisfaction of the Reserve Bank.

This isn't the first time the RBI has taken such action; in 2020, HDFC Bank faced a similar penalty for tech issues, resulting in restrictions on new digital launches and issuing new credit cards. These restrictions were later partially lifted, showcasing a precedent for such regulatory interventions in the banking sector.