History so far: On April 24, the Reserve Bank of India (RBI) banned Kotak Mahindra Bank (KMB) from accepting novel customers to its online and mobile banking channels and issuing novel credit cards. However, it would be able to provide these services to its existing customers. The RBI said the action was necessary due to weaknesses observed in the private lender’s IT systems and controls, commensurate with its growth. KMB CEO Ashok Vaswani recently stated that the bank is in continuous dialogue with the RBI to achieve the desired compliance outcomes.
What are these activities based on?
The RBI observed “sedate deficiencies and inconsistencies” regarding KMB’s IT inventory and user access management, data leakage prevention and business continuity strategies, and disaster recovery rigor and exercises, among others. This was based on the regulator’s examination of the private bank’s systems for two years, 2022 and 2023. The regulator found that KMB had consistently failed to address issues in a “comprehensive and timely manner.” The bank was also found to have failed to comply with subsequent recommendations of the RBI, i.e. Corrective Action Plans (CAP). The CAPs are part of the RBI’s intervention program to ensure the soundness of regulated entities.
According to the RBI, the compliances presented by KMB were “inadequate, incorrect or unsubstantiated.” Moreover, in the absence of hearty IT infrastructure and risk management systems, online and digital banking channels have experienced “habitual and significant outages over the past two years.” The last incident occurred on April 15. In the “X” post, a bank customer service representative reported that its technical servers were experiencing “intermittent slowdowns.” The current measures will be reviewed in an external audit commissioned by the bank with the approval of the RBI to assess the corrective actions taken.
Is this the first time?
NO. The RBI, like others around the world, is particularly cautious about the operation of digital banking and the overall financial landscape. In December 2020, the regulator banned HDFC from launching any novel digital products and acquiring novel credit card consumers. This was also based on a two-year assessment that found repeated incidents of disruptions to online and mobile banking platforms and payment tools. The restrictions were lifted more than a year later, in March 2022, after effective countermeasures.
Similarly, the RBI in October 2023 directed Bank of Baroda to suspend novel customer onboarding on the ‘bob World’ mobile application. This was also based on “certain significant supervisory concerns” for which the RBI requested that the observed deficiencies be addressed.
What about the bank’s finances?
According to S&P Global Ratings, regulatory actions may inhibit the development of lending and the bank’s profitability. He added that credit cards belong to the bank’s segment with higher profitability and targeted growth. The portfolio grew by 52% y/y as of December 31 last year compared to a 19% growth in total loans. “The Reserve Bank of India’s (RBI) actions this week may prompt the bank to rely more on expanding its physical branch network to complement growth, resulting in higher operating costs,” the note said. However, the agency maintained that the RBI’s actions would not “materially impact” its ratings. This is because at the end of the year, credit cards accounted for only 4% of the bank’s total loans, and the bank would still be able to cross-sell its products.
Banks’ net profit in the fourth quarter rose 18% to ₹ 4,133 crore from ₹ 3,496 crore in the same period a year ago. This was driven by a 13% year-on-year boost in net interest income of ₹6,909 crore. Importantly, however, CEO Mr Vaswani stated that while the financial impact (caused by the RBI’s actions) was expected to be minimal, he was more concerned about the “reputational impact”. Earlier, Mr. Vaswani described the bank’s previous efforts to enhance technological resilience, including capacity building and risk and resilience management. Importantly, it stated that technology spend accounts for approximately 10% of their total operating costs.
Kotak Mahindra, however, had plans to continue investing in the card franchise. As stated in an earlier investor call, total credit card advances increased more than 50% year-over-year. The plan may now be put on hold. Brokerage services provider Motilal Oswal noted that the ban will disrupt the growth trajectory of the bank’s retail products. This would also have an adverse impact on their margins and profitability. Its note explained that KMB’s growth in retail products was supported by greater interconnection of digital sources and a focus on unsecured products.
For perspective, the private lender sold 95% of its personal loans and 99% of its (novel) credit cards through digital means. On the profitability front, Shivaji Thapliyal, research director and principal analyst at YES Securities, noted that HDFC ultimately lost market share in credit card spends during the credit card ban period. S&P predicts it could take KMB a year to fully resolve key RBI issues. It noted that while the bank has made “significant progress” on technological improvements, it will take time to implement the changes and undergo an external audit.
