New Delhi: The Reserve Bank of India’s (RBI) action against Kotak Mahindra Bank (KMB) banning it from taking on new customers through its digital portals and from issuing new credit cards is just the latest in a long, tumultuous relationship between the two entities, spanning almost the entire duration of the bank’s existence.
The run-ins between KMB and RBI date back to 2008 and span a variety of issues ranging from the permissible stake that its promoters can own, failing to make adequate deposits in required funds, harassing customers and charging them fees that were not agreed upon, and, most recently, the state of its IT infrastructure.
The to-and-fro between the regulator and its regulated entity has taken the form of multiple letters sent back and forth, show-cause notices issued, multiple fines levied, and even a court case in the Bombay High Court.
The latest development took place Wednesday, when the RBI issued an order directing Kotak Mahindra Bank Limited to “cease and desist” from taking on new customers through its online and mobile banking channels and from issuing fresh credit cards due to “significant concerns” relating to the bank’s IT infrastructure, and its failure to address these.
“Serious deficiencies and non-compliances were observed in the areas of IT inventory management, patch and change management, user access management, vendor risk management, data security and data leak prevention strategy, business continuity and disaster recovery rigour and drill, etc,” the RBI said in its statement.
It added that KMB had been found to be deficient, for two consecutive years, in its IT risk and information security governance, contrary to requirements under regulatory guidelines.
Further, it said the bank had been found to be “significantly non-compliant” with the corrective action plans issued by the RBI for 2022 and 2023, with the compliances submitted by KMB being either inadequate, incorrect or not sustained.
“In the absence of a robust IT infrastructure and IT risk management framework, the bank’s core banking system and its online and digital banking channels have suffered frequent and significant outages in the past two years, the recent one being a service disruption on 15 April, 2024, resulting in serious customer inconveniences,” the RBI stated.
The bank is, however, allowed to continue to provide services to its existing customers, including its credit card customers. The restrictions imposed will remain in place until KMB gets an external audit done on its IT infrastructure and deals with all deficiencies pointed out in the audit to the satisfaction of the RBI.
Also read: How low revenues & high evasion forced Congress to abandon its first tryst with inheritance tax
Digital curbs could hurt the bank
Following the RBI’s order, KMB issued a statement assuring its existing customers that its operations would continue seamlessly and said it would continue to take on new customers through its physical branches.
“We want to reassure our existing customers of uninterrupted services, including credit card, mobile and net banking,” the statement said. “Our branches continue to welcome and onboard new customers, providing them with all the bank’s services, apart from issuance of new credit cards.”
While the statement makes it seem as if the bank will continue its customer acquisition activities through its physical branches, a look at its own data shows how dependent the bank is on its digital channels — a particular concern in light of the RBI’s alarms over the state of its IT infrastructure.
An analysis of the bank’s investor presentation made for the October-December 2023 quarter shows that 95 percent of new personal loans issued during this period were done through the digital channel. Of the new credit cards sold during the quarter, 99 percent were sold either through its app or through online banking.
As for business loans, 79 percent of all new loans were issued through digital channels.
This dependence on its digital platforms has added to the RBI’s concerns, which noted that “it is also observed that, of late, there has been rapid growth in the volume of the bank’s digital transactions, including transactions pertaining to credit cards, which is building further load on the IT systems”.
While the curbs won’t affect existing customers, the data shows that the digital channel is a crucial one for the bank, and so not being able to use it to onboard new customers will likely have a significant impact on the growth of its customer base.
A long, fractious relationship
KMB received its banking licence from the RBI in 2003, with the bank’s promoters’ shareholding to be capped at 49 percent. The promoter’s shareholding above 49 percent (at the time it was 61 percent) was to be reduced after one year of the bank’s operations.
Then, in 2005, the RBI issued its ‘Guidelines on Ownership and Governance in Private Sector Banks’. Under these new rules, no single entity or group of related entities could have a shareholding in any private sector bank above 10 percent of the paid-up capital of that bank.
Paid-up capital refers to the amount a company has received from shareholders in exchange for the purchase of shares.
The back-and-forth letters started a few years later.
In 2008, the RBI wrote to the bank asking it to come up with a plan to reduce its promoter stake to 10 percent, in line with the new rules. KMB didn’t agree with these instructions, with its promoter, Uday Kotak, saying that the 49 percent promoter shareholding limit had been part of its banking licence agreement.
What followed was a series of over 35 letters and emails sent between the central bank and KMB, with the RBI remaining adamant that its shareholding norms be adhered to, and that KMB needs to come up with a plan to do so.
The bank, on its part, argued that the RBI’s requirements were not clear and created confusion between its 2005 guidelines and the banking licence issued to KMB.
In 2012, the bank wrote to the RBI that “whilst the policy and statutory basis of the above requirement is not clear to us”, its best attempt at a “fair and non-disruptive roadmap” for the dilution of its promoter holding would be to take its promoter stake to 20 percent of its paid-up capital by 31 March, 2020. Under its plan, the promoter shareholding would be reduced to 40 percent by 31 March, 2014, 30 percent by 31 March, 2017, and 20 percent by 31 March, 2020.
The RBI rejected KMB’s proposal, saying that the bank must reduce its promoter shareholding to 20 percent of its paid-up capital by 31 March, 2018 and to 10 percent by 31 March, 2020.
The bank again came back with an alternative: 40 percent promoter holding by 31 March, 2014, 30 percent by 31 December, 2016, and 20 percent by 31 March, 2018. However, close to the March 2014 deadline, the bank postponed the first date by which it would comply to September 2014, citing the impending Lok Sabha elections that year.
The RBI was not happy with this, and threatened that the central bank “would be constrained to initiate regulatory action against the bank such as freezing branch expansion, etc”, if it did not meet the 31 March, 2014, deadline.
Over the next few years, more letters flew back and forth between the RBI and KMB, with the former insisting that deadlines be met, and the latter repeatedly seeking extensions.
First major blows land
On 2 August, 2018, KMB announced an issue of Rs 500 crore worth of Perpetual Non-Cumulative Preference Shares (PNCPS). These were basically a form of debt that carried no voting rights. What happened as a result was that the paid-up capital of the bank increased, which meant that the promoters’ holdings fell as a share to below the RBI’s limit.
The RBI response was stern, saying it had “taken serious exception” to the fact that it had not been informed of the issue of the PNCPS, and added that this action did not alter the promoters’ shareholding. The RBI’s objective had been to diversify ownership and control, which such a move by KMB did not do.
Although KMB subsequently clarified its position, the RBI nevertheless resorted to issuing a show-cause notice to the bank in October 2018. The charges against the bank were that it did not inform the RBI of the PNCPS for diluting the promoters’ stake despite the central bank having ordered the KMB to provide an action plan to comply with the RBI’s norms for diluting the promoters’ stake.
KMB wrote back to the RBI saying the show-cause notice was “without jurisdiction and not maintainable in law”. As such, it also filed a writ petition in the Bombay High Court.
“We have since clarified and conveyed to the RBI our position in relation to PNCPS being a part of paid-up capital and the legal basis on the matter of dilution of shareholding under the Banking Regulation Act,” KMB informed the stock exchanges in December 2018.
“We have also shared with the RBI the opinions of eminent jurists and senior-most legal counsels of the country, which confirm our understanding,” it added. “By way of abundant caution, the Bank has today filed a writ petition with the Hon’ble Bombay High Court to validate the Bank’s position.”
Some fines, case settled & more fines
The matter was now in court, but that did not stop the RBI from imposing hefty fines on the bank.
In June 2019, the RBI fined KMB Rs 2 crore for failing to comply with the directions of the central bank to furnish the details of the shareholding held by its promoters and to submit details of the proposed course of action to comply with the permitted timeline for dilution of the promoter shareholding.
Finally, in January 2020, KMB informed the stock exchanges that it had reached an agreement with the RBI wherein the promoters’ shareholding in the bank would be reduced to 26 percent of the paid-up capital of the bank within six months of the date of final approval from the RBI.
As a result, KMB said it was withdrawing its writ petition from the Bombay High Court.
This was not the end of RBI’s actions against the bank, although subsequent fines were imposed for violations that had nothing to do with shareholding.
In July 2022, the RBI fined KMB Rs 1.05 crore for various violations, including failing to credit the eligible amount to the Depositor Education and Awareness Fund within the period prescribed, and failing to reverse the amount involved in unauthorised electronic transactions to the customers’ account within 10 working days from the date of notification by the customer.
Then, in October 2023, the RBI imposed an even larger fine, of Rs 3.95 crore, on KMB. The violations this time were that the bank failed to ensure that customers would not be contacted after 7 pm and before 7 am.
The RBI said the bank also levied interest on loans from the disbursement due date instead of the actual date of disbursement, and levied foreclosure charges despite there being no such clause in the loan agreement.
The RBI’s orders Wednesday are, so far, the only action the central bank has taken against KMB in 2024.
Disclosure: Uday Kotak is among the founder-investors of ThePrint. Please click here for details on investors.
(Edited by Nida Fatima Siddiqui)
Also read: Economists vs statisticians — the battle being fought over the soul of India’s GDP data