RBI imposes monetary penalty on Bank of Bahrain & Kuwait BSC, India Operations

Case Brief

By an order dated December 12, 2022, RBI imposed a monetary penalty of Rs 2.66 crore on Bank of Bahrain & Kuwait BSC, India Operations. The penalty was imposed for non-compliance with RBI directions on the Cyber Security Framework in Banks, under section 47A(1)(c) read with section 46(4)(i) of the Banking Regulation Act, 1949. RBI’s examination and related materials found that the bank had not implemented several required controls, including systems for detecting unusual or unauthorized activity, a Security Operations Centre, audit logging, multi-factor authentication, controls over administrative rights and critical-server access, a Cyber Crisis Management Plan, real-time alerting and centralized monitoring, and file integrity mechanisms. RBI said these lapses contributed to an unauthorized intrusion going undetected. The order was stated to be based on regulatory non-compliance and not intended to pronounce on customer transactions or agreements.