RBI’s 100+ Penalties in a Year: What Went Wrong?
In the past year, the Reserve Bank of India (RBI)
has imposed more than 100 monetary penalties on banks, NBFCs, fintechs,
and cooperative institutions. These penalties span a wide range of compliance
failures—from customer due diligence lapses to weak cyber security, and from
outsourcing gaps to violations of lending norms.
While the penalties differ in size, they all point
to a common theme: regulatory compliance is non-negotiable. Here’s a
breakdown of the most frequent reasons behind these actions.
Category
Typical Lapses
Illustrative Orders
Key Directions
Change in management
Failed to take prior written permission of the RBI before appointing a director
Scale-Based Regulations
Change in shareholding
—
Scale-Based Regulations
End Use
Failed to ensure end-use of funds with respect to certain loans sanctioned by it.
-
Gradation of risk and Interest rate
a) Failed to disclose and explicitly communicate the rate of interest and the approach for gradation of risks on its website.
Scale-Based Regulations
IT & Audit
Non-implementation of prescribed cyber security controls.
No IS Audit for Network & Security since inception.
Poor audit log retention/analysis; unaddressed alerts.
Master Direction — IT Framework for NBFCs
KYC
a) Failed to carry out periodic updation of KYC of its customers.
b) Delay in uploading Customer KYC Records (CKYCR) on time.
c) BO identification gaps for legal persons.
d) PAN not verified with issuing authority at the time of customer acceptance
KYC Directions
NPA
a) Failed to classify certain loan accounts as non-performing.
b) Reclassifying NPAs as standard without clearing all arrears.
Prudential Norms & IRAC Guidelines
Outsourcing
Did not ensure that its agreements with service providers include a provision enabling RBI to cause an inspection to be made of the service providers
Scale-Based Regulations
Policy review
Did not conduct periodic review of the compliance of the Fair Practices Code and functioning of the Grievances Redressal Mechanism.
Scale-Based Regulations
Risk categorisation
Customers not classified as Low/Medium/High; periodic reviews not done.
KYC Directions
Reporting to CIC / CRILC
No/partial submission to all CICs; data accuracy issues in CRILC.
Scale-Based Regulations
Credit & Concentration (Exposure Limits)
Breaches of single-borrower exposure limits.
Scale-Based Regulations
Other Non-compliances
Interest charged prior to disbursement/cheque issuance.
Fair Practices
Key Takeaways for Regulated Entities
RBI’s recent enforcement actions are a reminder that proactive compliance protects both reputation and business continuity. Below are practical, immediately actionable steps every financial institution should prioritise:
-
Conduct Legal & Compliance Due Diligence
- Review processes, agreements, IT systems and governance structures to identify gaps.
- Pay attention to high-risk areas flagged by RBI: KYC, outsourcing, cyber security, reporting and exposure norms.
- Prepare a compliance roadmap with clear timelines.
- Undertake structured compliance audits or independent reviews.
- Address legacy issues before they surface in inspections.
-
Formulate & Update Policies
- Ensure KYC, Fair Practices, Outsourcing, IT/Cybersecurity and Risk Management policies are current.
- Board-level approval and periodic review of policies is essential.
- Include measurable controls and vendor clauses (with RBI inspection rights).
-
Implement with Discipline
- Train staff and management teams on compliance responsibilities.
- Introduce dashboards and monitoring triggers with documented evidence of reviews.
- Follow a “test & evidence” approach to prove implementation.
In our previous blog, we have cover a list of policies that NBFCs should draft or update to stay on the right side of RBI’s tightening scrutiny.
Comments
Post a Comment