RBI forbids Kotak Mahindra Bank from issuing new credit cards or onboarding new clients via mobile or internet banking

RBI forbids Kotak Mahindra Bank from issuing new credit cards or onboarding new clients via mobile or internet banking

However, the RBI said that the bank would keep offering its current clientele services, including credit card holders.

On April 24, Kotak Mahindra Bank received a request from the Reserve Bank of India (RBI) to cease accepting new clients via its mobile and internet banking platforms and to start issuing new credit cards.

However, the RBI said that the bank would keep offering its current clientele services, including credit card holders.

"These actions are necessitated based on significant concerns originating out of Reserve Bank’s IT Examination of the bank for the years 2022 an 2023 and the continued failure on portion of the bank to address these concerns in a comprehensive and timely manner," the central bank said.

According to the RBI, there were serious flaws and non-compliances in the following areas: vendor risk management; data security and leak prevention strategy; business continuity as well as disaster recovery drills; IT inventory management; patch and change management; user access management; etc.

According to the RBI, the bank was found to have inadequate information security governance and IT risk management for two years running, which is against regulatory norms.

In the course of the ensuing examinations, the bank's compliances with the Corrective Action Plans issued by the Reserve Bank for the years 2022 and 2023 were determined to be either insufficient, erroneous, or not maintained, resulting in a serious non-compliant situation.

"In the absence of a durable IT infrastructure and IT Risk Management framework, the bank’s Core Banking System (CBS) as well as its online and digital banking channels have suffered frequent as well significant outages in the last two years, the most recent one being a service disruption on April 15, 2024, resulting in serious customerinconveniences," the central bank stated.

Due to the bank's inability to develop IT systems and controls that matched its expansion, it is determined that it is materially lacking in the development of the required operational resilience.