The RBI said this action is based on significant concerns arising from the Reserve Bank’s IT audit of the bank for the years 2022 and 2023 and the bank’s continued failure to address these concerns in a comprehensive and timely manner.
Citing data security concerns, the Reserve Bank of India has stopped Kotak Mahindra Bank from adding new customers and issuing new credit cards with immediate effect. However, the bank can continue to serve its customers, including credit card holders.
“The Reserve Bank of India, in exercise of its powers under Section 35A of the Banking Regulation Act, 1949, has permitted Kotak Mahindra Bank Limited to add new customers through its online and mobile banking channels with immediate effect,” the central bank said in a release. “And is directed to stop work on issuance of new credit cards. However, the Bank will continue to provide services to its existing customers including its credit card customers.”
RBI said this action is based on the significant concerns arising from the IT audit of Kotak Mahindra Bank by the Reserve Bank for the years 2022 and 2023 and the continued failure on the part of Kotak Mahindra Bank to address these concerns in a comprehensive and timely manner . The RBI said there were “serious deficiencies” in the way Kotak Mahindra Bank managed its IT inventory and secured its data.
RBI said, “Serious deficiencies and non-compliances in the areas of Kotak Mahindra Bank’s IT inventory management, patch and change management, user access management, vendor risk management, data security, data leakage prevention strategy, business continuity, disaster recovery hardiness and drill etc. -Kotak Mahindra Bank was assessed for deficiencies in its IT risk and information security governance for two consecutive years, which is contrary to the requirements under regulatory guidelines, the RBI said.
RBI said, “During the subsequent assessment, Kotak Mahindra Bank was found to be consistently non-compliant with the corrective action plans issued by the Reserve Bank for the years 2022 and 2023, as the compliance submitted by Kotak Mahindra Bank was either inadequate, incorrect or Were not found.” RBI said that due to the absence of a strong IT infrastructure, Kotak Mahindra Bank’s digital banking channel has faced repeated disruptions and caused inconvenience to customers. RBI said, “The restrictions imposed on Kotak Mahindra Bank will be reviewed upon completion of a comprehensive external audit. This audit will be conducted by the bank with the prior approval of RBI. All the deficiencies pointed out in the external audit as well as RBI’s observations will be reviewed. RBI will inspect after removing the same.”
