In an order dated December 2, 2020, RBI has asked HDFC Bank, one of the biggest private lenders, to temporarily stop all launches of its digital business generating activities under its Digital 2.0 programme as well as sourcing of new credit card customers. The move comes in as a result of the recent outages in the internet banking, mobile banking, and payment utilities of the bank, latest one being reported on November 21, 2020. The recent most outage was attributed to the power failure in the primary data centre of the Bank.

According to the reports, the issue of outages has been witnessed by customers of the Bank since last two years and RBI was in the process of assessment of the situation since last year December when a team was sent to the Bank for identification of the reason for such outages. However, the order of RBI has come with an instruction for HDFC Bank's board to examine the lapses and fixes accountability for the lapses.

What went wrong?
It is being said that the latest outage was on account of power failure which further reflects on the business continuity planning (BCP) of the Banks, especially banks operating on large scales. This also reflects upon non-compliance with the RBI's BCP guidelines which is required to be followed by all the regulated entities in the industry.

What will the restriction entail?
The restriction imposed on HDFC Bank is currently two-fold:

1. Restriction on launching new digital products;
2. Restriction on on-boarding new credit card customers.

However, there is no restriction on opening of new accounts or issuance of new debit cards or usage of the existing digital platforms, thereby providing some relief to the Bank that is already under tremendous pressure from the market, which is clearly reflecting in the sudden fluctuation in share-prices of HDFC Bank vis-à-vis other lending entities.

The order further comes with a provision that the restrictions shall be considered for lifting based on satisfactory compliance with the major critical observations as identified by RBI.

What does this mean for the existing customers?
In a statement from the MD & CEO of HDFC Bank, Mr. Sashi Jagdishan, he has apologized to the customers for sometimes, not being able to live up to your (customers) expectations” and also mentioned that: Some of our strategic digital initiatives to improve the front-end digital experience, improve digital origination, straight through processing, next generation of mobile and internet banking, APIs based banking on the edge etc would now be readied and launched post the approval and clearance from regulator.”

The move is only restrictive for new digital launches and on-boarding of new credit card customers. There will be no repercussion on the existing customers and/or the existing digital platforms being run by HDFC Bank. In the regulatory intimation submitted to BSE, HDFC Bank has expressed its belief that these measures will not materially impact its overall business.

The road ahead
Of late, outages have become more commonplace with Banks than they were till a few years bank. It is noteworthy that on the same day when HDFC Bank received the order from RBI, State Bank of India said its YONO mobile banking application has been impacted due to system outage. It is speculated that RBI will be taking action against other market players as well and HDFC Bank was just the beginning & unless such harsh action is taken by RBI, the lead banks will continue to lapse in their BCP.

RBI has also decided to come up with digital payment security control directions for ensuring that there is a proper governance structure for banking systems and there are minimum standards of security controls for digital channels such as internet and mobile banking, card payments etc. RBI Governor, Shaktikanta Das also said that the directions will also include provision for a comprehensive framework for grievance redressal in banks for further strengthening the internal grievance redressal mechanism & providing for monetary disincentives amongst others. The directions are expected to be rolled out early next year and shall supplement the present Banking Ombudsman mechanism.

Conclusion
Looking at the history of outages in banking services in the recent past, it is quite clear that the decision of RBI was not taken in haste but was a deliberate and calculated move on the part of the Apex Banking Institution to remind the behemoths of the banking and finance industry that they should bite only what they can chew.

The step from RBI comes in as a reminder to all the large banks handling millions of customers that they are not above the regulations. Given that banking services also fall under the scope of consumer protection laws, the customers can also approach the newly formed Central Consumer Protection Authority for redressal of their grievances as a customer. The penalties under Consumer Protection Act 2019 can be a lot worse that the current restrictions placed by RBI.

End-Notes:

1. https://www.livemint.com/companies/news/hdfc-bank-outages-rbi-tells-bank-to-stop-sourcing-new-credit-card-customers-11606973498182.html
2. https://www.business-standard.com/article/finance/halt-digital-launches-stop-selling-new-credit-cards-rbi-tells-hdfc-bank-120120300354_1.html
3. https://www.thehindubusinessline.com/money-and-banking/rbi-to-issue-digital-payment-security-controls-directions/article33247289.ece
4. https://www.rbi.org.in/scripts/PublicationReportDetails.aspx?UrlPage=&ID=622

Written By - Rashmi Priya