India’s central bank on Wednesday ordered Kotak Mahindra Bank to immediately stop acquiring new customers through its online and mobile banking channels and to stop issuing new credit cards. She pointed to serious deficiencies in the bank’s IT systems and risk management practices.
Kotak Mahindra Bank is India’s fourth most valuable bank. It is also one of the key partners for many fintech startups – including KredX and Rupeek – in the country. The lender, which also invests in many startups, also works with many fintech firms to lend to SMEs and MSMEs and issue co-branded credit cards.
The lender operates Kotak811, a digital offering that has become its strongest customer acquisition tool in recent years. Kotak811, which enables customer onboarding digitally and in “three minutes” with no paperwork, serves nearly 20 million customers.
The Reserve Bank of India (RBI) said it is imposing restrictions on Kotak Mahindra Bank due to significant concerns arising from its IT audits of the bank for 2022 and 2023. The central bank identified serious deficiencies and non-compliance in areas such as IT inventory management, patch and change management, user access management, supplier risk management, data security and business continuity planning, it said.
Existing customers are not affected by the restrictions.
The new restrictions could have a “significant impact on new retail customer additions for the bank, given its smaller branch network compared to competitors and its greater reliance on digital channels,” analysts at Bernstein noted. The inability to issue new cards could impact the bank’s planned shift toward a higher share of unsecured loans, “given the important role credit cards play in achieving this goal,” the analysts added.
Despite undergoing scrutiny and holding high-level discussions with the RBI over the last two years, Kotak Mahindra Bank has failed to adequately address these issues and implement satisfactory corrective measures, the central bank said. The bank’s core banking system and digital channels experienced frequent and significant failures, with the most recent disruption occurring on April 15, 2024, causing significant inconvenience to customers, the RBI added.
The RBI said the rapid growth of digital transactions in the bank, including credit card transactions, had put additional strain on the lender’s already weak IT systems. Without a robust IT infrastructure and risk management framework, prolonged outages could seriously impact the bank’s ability to provide efficient customer service and potentially harm the broader digital banking and payments ecosystem, the central bank warned.
The restrictions imposed on Kotak Mahindra Bank will be reviewed after the completion of a comprehensive external audit commissioned by the bank with the prior approval of the RBI and the satisfactory remediation of all deficiencies identified, the RBI said.