Reserve Bank of India (RBI) has fined ICICI and Kotak Mahindra for breaching its directives. ICICI Bank was penalized ₹12.19 crore for various violations, including granting loans to companies with common directors, selling non-financial products, and failing to report fraud promptly. Kotak Mahindra Bank was fined ₹3.95 crore for not conducting due diligence on service providers and improper customer contact hours. The RBI emphasized the banks’ non-compliance with its regulations, and the penalties were related to regulatory issues rather than the validity of specific transactions.

 

ICICI and Kotak Mahindra Bank’s regulatory violations and ongoing issues

The RBI has brought to light several regulatory violations by ICICI Bank, encompassing contraventions of the Banking Regulation Act, 1949, and a failure to comply with RBI’s directives on loans and advances, financial services, and the classification and reporting of fraud by banks and select financial institutions. Notably, ICICI Bank faces these penalties amid ongoing investigations into allegations that, during Chanda Kochhar’s tenure as chief, the bank sanctioned a ₹1,875 crore loan to the Videocon Group in contravention of lending policies. In the case of Kotak Mahindra Bank, the RBI has cited non-compliance with its directives in several areas, including risk management, codes of conduct for outsourcing financial services, use of recovery agents, customer service, and statutory restrictions on loans and advances.

 

RBI clarifies the need for regulation

The RBI clarified that these actions were taken due to deficiencies in regulatory compliance and were not intended to pass judgment on the validity of transactions or agreements between the banks and their customers.

Follow GRC guidelines to comply with standards and be risk compliance

 

ICICI and Kotak Mahindra Bank Penalties for non-compliance

ICICI Bank and Kotak Mahindra Bank are facing penalties from the RBI. ICICI Bank has been fined ₹12.19 crore for three primary violations, which include granting loans to companies where two of its directors also held director positions, engaging in the sale of non-financial products, and as required. Similarly, Kotak Mahindra Bank (KMB) received a ₹3.95 crore penalty for various breaches, such as failing to conduct an annual review and due diligence of its service provider, allowing customer contact outside prescribed hours, misapplying interest from the disbursement due date, and imposing foreclosure charges without a corresponding clause in loan agreements. In the past year, the RBI had imposed penalties totalling ₹12.17 crore on seven private sector banks. Notably, ICICI Bank faced a substantial penalty in March 2018, amounting to ₹58.9 crore, for non-compliance with directives related to the direct sale of securities from its HTM (held-to-maturity) portfolio and specific disclosure requirements.

 

Recommendations/Remedies:

Non-compliance with cybersecurity standards poses significant risks, including security gaps for hackers, financial losses, and data breaches.

1. Strengthen Security:
   • Use Firewalls, Intrusion Detection, and Secure Authentication: Implement robust firewalls to protect your network from unauthorized access and employ intrusion detection systems to identify and respond to potential threats like with NGFWs. Organizations should utilize secure authentication methods, such as 2FA, to ensure that only authorized personnel can access sensitive systems and data.
   • Regularly Update Software and Enforce Access Controls: Keep all software and systems up to date with the latest security patches as outdated software is a common entry point for cyberattacks and organizations should also enforce strict access controls, limiting who can access specific resources or data, and ensure that employees only have access to what is necessary for their roles.

 

2. Train Employees:
   • Educate Staff on Cyber Threats and Best Practices: Organizations should provide comprehensive training to employees about common cyber threats, such as phishing, malware, and social engineering, to make sure they understand the potential risks and are equipped to identify and respond to threats effectively.
   • Foster a Culture of Cybersecurity Awareness: Organizations should also encourage a culture of cybersecurity awareness within the organization and promote a sense of responsibility among employees to report security incidents promptly and follow security protocols diligently.

 

3. Encrypt Data:
   • Encrypt Sensitive Data at Rest and in Transit: Implement strong encryption mechanisms for sensitive data which ensures that even if unauthorized access occurs, the data remains protected.

 

4. Audit and Monitor:
   • Conduct Routine Audits to Assess Compliance: Regular audits should be performed to evaluate the organization’s compliance with cybersecurity policies and procedures as these audits can help identify vulnerabilities, gaps, or deviations from security standards.
   • Continuously Monitor for Emerging Threats: Investing in continuous monitoring tools and threat intelligence to stay updated on emerging cybersecurity threats and being proactive in threat detection and response can help prevent or mitigate security breaches before they become major incidents.Top of Form

These measures protect against cyber threats and compliance risks, preserving data security and stakeholder trust in the digital landscape.