RBI Penalty Report – 8th May 2026

Key Details

• Date: May 08, 2026 (Order: April 27, 2026)
• Violation: Know Your Customer (KYC) Directions.
• Finding: Failed to put in place a system of using the KYC Identifier assigned by the Central KYC Records Registry (CKYCR) for establishing account-based relationships with customers.

Root Cause Analysis (RCA)

Incomplete IT integration and API handshakes between the bank’s digital onboarding platforms and the CKYCR database. The operational teams bypassed fetching or generating the 14-digit CKYC number to expedite customer acquisition.

Preventive Controls

Enforce strict API integration where the core onboarding system is technically blocked from finalizing an account opening unless a valid CKYC Identifier is successfully searched, fetched, or uploaded in real-time.

Lessons Learnt

Centralized KYC databases are critical for reducing systemic duplication and AML risks. Large institutions must integrate regulatory APIs seamlessly; prioritizing customer onboarding speed over systemic compliance inevitably attracts significant regulatory penalties.

Key Details

• Date: May 07, 2026 (Order: May 04, 2026)
• Violation: Interest Rate on Deposits & Sections 26A / 51(1) of BR Act.
• Finding: Failed to transfer eligible unclaimed amounts to the DEAF within prescribed time limits and failed to pay applicable interest on overdue Term Deposits from maturity till repayment.

Root Cause Analysis (RCA)

Reliance on manual tracking for the 10-year unclaimed deposit threshold leading to missed reporting and transfer deadlines. Additionally, a misconfiguration in the CBS failed to automatically calculate and apply the savings account interest rate to overdue term deposits.

Preventive Controls

Implement an automated script that sweeps unclaimed balances reaching the 10-year mark directly to the DEAF. Update CBS logic to automatically trigger post-maturity interest calculations at the prevailing savings rate when a term deposit is not renewed.

Lessons Learnt

Statutory timelines (like DEAF transfers) and customer payout mandates cannot rely on manual oversight. Systemic automation is the only reliable way to ensure scaleable compliance with deposit regulations.

Key Details

• Date: May 04, 2026 (Order: April 29, 2026)
• Violation: Asset classification and treatment of accounts as NPA.
• Finding: Sanctioned additional credit facilities to certain borrowers specifically for the repayment of their existing non-performing loans.

Root Cause Analysis (RCA)

Severe gaps in the credit appraisal and risk management process. Branch or credit officers engaged in “evergreening” practices to artificially suppress Non-Performing Asset (NPA) levels rather than recognizing the stress and initiating recovery or legitimate restructuring.

Preventive Controls

Configure the loan origination system to block new credit sanctions to entities (or connected entities) currently classified as NPA. Establish an independent credit risk review committee that must clear any supplementary funding to stressed accounts.

Lessons Learnt

Evergreening loans strictly violates RBI’s asset classification norms. Transparent NPA recognition is critical; masking bad loans with new credit only compounds institutional risk and invites regulatory sanctions.

Key Details

• Date: May 08, 2026 (Order: April 27, 2026)
• Violation: Governance (Section 52A of NHB Act).
• Finding: Effected a change in management resulting in the change of more than 30% of its directors (excluding independent directors) without prior written permission from the RBI.

Root Cause Analysis (RCA)

Breakdown in corporate governance tracking. The secretarial and legal teams failed to monitor the cumulative percentage of board changes against the regulatory threshold, allowing board reconstitutions to proceed without securing statutory approvals.

Preventive Controls

Establish a mandatory compliance checklist for any board-level appointment or resignation. The Company Secretary must maintain a rolling tracker of management changes to trigger an immediate halt and RBI application process if the 30% threshold is approached.

Lessons Learnt

Structural management changes in financial institutions are heavily regulated to ensure “fit and proper” criteria. Prior RBI approval is a strict prerequisite, not a post-facto notification process.

Key Details

• Date: May 07, 2026 (Order: May 06, 2026)
• Violation: Inoperative Accounts / Unclaimed Deposits & KYC Norms.
• Finding: Activated certain inoperative accounts without obtaining fresh KYC documents from the customers.

Root Cause Analysis (RCA)

Failure in standard operating procedure (SOP) adherence. System allowed manual overrides by staff to change account status from ‘Inoperative’ to ‘Active’ without enforcing a mandatory document upload and verification workflow.

Preventive Controls

Enforce a system-driven “maker-checker” workflow where dormant account status cannot be altered until a compliance officer digitally signs off on newly uploaded and verified KYC documentation in the CBS.

Lessons Learnt

Dormant and inoperative accounts are highly susceptible to internal and external fraud. Fresh KYC is an absolute non-negotiable prerequisite for reactivation, prioritizing security over operational speed.

Key Details

• Date: May 04, 2026 (Order: April 29, 2026)
• Violation: Prudential Norms on Capital Adequacy (UCBs).
• Finding: The bank refunded share capital on multiple occasions despite its Capital to Risk-Weighted Assets Ratio (CRAR) being below the regulatory minimum.

Root Cause Analysis (RCA)

Lack of systemic controls within the Core Banking System (CBS) to correlate share capital refund requests with real-time CRAR metrics. The operational team processed refunds manually without cross-verifying current capital adequacy limits against the regulatory floor.

Preventive Controls

Implement a hard-stop validation in the CBS that automatically blocks any transaction attempting to refund share capital if the bank’s CRAR falls below the RBI-mandated minimum. Mandate a secondary compliance approval layer for all equity payouts.

Lessons Learnt

Capital adequacy is a strict, continuous regulatory boundary, not merely a periodic reporting metric. Regulatory capital minimums must act as hard stops for any outflow of equity.