Supervisory Action against Kotak Mahindra Bank Limited under Section 35A of the Banking Regulation Act, 1949

Case Brief

RBI, exercising powers under Section 35A of the Banking Regulation Act, 1949, directed Kotak Mahindra Bank Limited to cease and desist immediately from onboarding new customers through online and mobile banking channels and from issuing fresh credit cards. RBI said the action was driven by serious concerns arising from its IT examinations for 2022 and 2023, continued failure to address those concerns comprehensively and in time, and repeated non-compliance with corrective action plans. The release details deficiencies in IT inventory, patch and change management, user access, vendor risk, data security, data leak prevention, and business continuity/disaster recovery. RBI also noted the bank’s IT risk and information security governance was deficient for two consecutive years, and that its CBS and digital banking channels had experienced frequent significant outages. The restrictions are to be reviewed after a comprehensive external audit and remediation to RBI’s satisfaction.