RBI Restricts Kotak Mahindra Bank from Adding New Online Customers

The RBI announced that it has placed certain restrictions on Kotak Mahindra Bank Limited in response to serious deficiencies observed in the bank’s IT management and data security practices. The bank has been directed to cease onboarding new customers through its online and mobile banking channels and issuing fresh credit cards. However, it can continue to provide services to its existing customers, including credit card holders.

The RBI highlighted deficiencies and non-compliances in IT inventory management, patch and change management, user access management, vendor risk management, data security, and data leak prevention strategy, as well as business continuity and disaster recovery practices. The bank’s inadequate IT infrastructure has led to frequent outages in its digital banking channels, causing inconvenience to customers. Despite ongoing engagement with the bank to address these concerns, the RBI found the outcomes unsatisfactory.

The rapid growth in digital transactions, including credit card transactions, has further strained the bank’s IT systems, leading the RBI to implement restrictions in the interest of customers and the stability of the financial ecosystem. The imposed restrictions will be reviewed after a comprehensive external audit, approved by the RBI, is conducted by the bank. Remediation of deficiencies identified in the audit and RBI inspections will be required to the satisfaction of the Reserve Bank.

The restrictions are independent of any other regulatory or enforcement actions that may be initiated by the RBI against the bank. Kotak Mahindra Bank Limited, originally Kotak Mahindra Finance, received its banking license in 2003 and offers a wide range of financial services including commercial banking, stock broking, mutual funds, insurance, and investment banking. As of December 31 last year, the bank served 4.8 crore customers through 1869 branches and 3239 ATMs.