India's central bank said on Wednesday it had barred Kotak Mahindra Bank (KTKM.NS) from taking on new customers via its online and mobile banking channels, and from issuing new credit cards, due to information technology-related deficiencies.
The Reserve Bank of India (RBI) said it had taken the action after its examination of the country's fourth largest private lender's IT systems in 2022 and 2023 raised concerns and Kotak failed to address them adequately.
"For two consecutive years, the bank was assessed to be deficient in its IT Risk and Information Security Governance," the RBI said in a statement.
Confirming receipt of the order, Kotak said it has "taken measures to adopt new technology to strengthen its IT systems" and believes the direction will not materially impact its overall business.
Its existing customers will receive uninterrupted services, including credit cards, mobile and net banking, it said in a statement.
"Our branches continue to welcome and onboard new customers, providing them with all the Bank's services, apart from issuance of new credit cards."
The Mumbai-based bank was also found to be materially deficient in building the necessary operational resilience due to its failure to build IT systems and controls commensurate with its growth, the central bank added.
The RBI has taken measures against non-compliant entities in recent years, including fines and business restrictions.
In December 2020, the RBI took similar action against HDFC Bank (HDBK.NS), barring India's largest private lender from recruiting new credit card customers or launching new digital products after its digital payment services were hit by a power failure. That ban was lifted in August 2021.
"This is a drastic move by the regulator on Kotak and comes at a time when the bank was looking to go aggressive on digital banking and add new customers and take on deposits," said Amit Khurana, head of equities at Dolat Capital.
"It seems that this was a well-thought out action by the central bank and could take some time to get resolved."
In the quarter ended December, 95% of Kotak's new personal loans sold by volume were disbursed digitally, while it sold 99% of new credit cards through digital channels.
The RBI said it was placing the restrictions on Kotak in the interest of customers and to avoid a possible prolonged outage that might affect customer service and broader digital banking and payment systems.
"The RBI's action is obviously going to impact the bank's ambition to get to a 15% share of unsecured loans but the bigger impact is going to be on the savings accounts," said Pranav Gundlapalle, senior research analyst at AllianceBernstein.
Kotak had a 5.8% share of outstanding credit card balances as of end-March, with its book having increased 52% year-on-year in the December quarter.
The bank was relying on digital means given its sub-par branch network, Gundlapalle said.
The RBI will review the restrictions after a comprehensive external audit which must be commissioned by Kotak with the RBI's prior approval and once all the deficiencies are fixed to its satisfaction.
"The bank shall, however, continue to provide services to its existing customers, including its credit card customers," the RBI said.
