RBI Penalty Report – 7th August 2026

Key Details

• Penalty Amount: ₹5.40 Lakh
• Order Date: August 03, 2026
• Regulatory Violations: Non-compliance with RBI ‘Know Your Customer (KYC) Directions’ and ‘Fair Practice Code’.
• Reference: Statutory Inspection based on financial position as of March 31, 2025.

Root Cause Analysis (RCA)

The penalty stems from systemic gaps in both compliance monitoring and customer transparency:

• Inadequate KYC Lifecycle Management: The company lacked a system for the periodic review of account risk categorization (mandated at least once every six months).
• Opaque Pricing Mechanisms: Failure to explicitly disclose the risk gradation approach and the rationale for charging different interest rates to different borrowers in application forms and sanction letters.

Preventive Controls

• Automated KYC Alerts: Implement a robust Core Banking/Loan Management System module that automatically flags accounts requiring risk categorization review every 5 months (allowing a 1-month buffer).
• Document Template Overhaul: Revise all standardized loan application forms and sanction letters to include dedicated sections detailing the borrower’s assigned risk grade and a matrix explaining how this grade influences their specific interest rate.

Lessons Learnt

Fair Practice Codes are not merely guidelines but strictly enforced regulations. Transparency in borrower pricing and proactive, continuous KYC monitoring are foundational requirements that cannot be ignored post-onboarding.

Key Details

• Penalty Amount: ₹3.90 Lakh
• Order Date: August 03, 2026
• Regulatory Violations: Non-compliance with directions on ‘Governance’ and ‘Submission of data to Credit Information Companies (CICs)’.
• Reference: Statutory Inspection based on financial position as of March 31, 2025.

Root Cause Analysis (RCA)

The regulatory breach occurred due to oversights in corporate governance frameworks and data reporting infrastructure:

• Governance Conflict: Key Management Personnel (KMP) concurrently held office/directorships in other NBFCs (Middle Layer), violating conflict-of-interest and governance mandates.
• Data Reporting Failures: Systemic omissions resulted in the failure to submit credit information of certain loan accounts to the relevant CICs.

Preventive Controls

• Enhanced KMP Vetting: Institute a mandatory, recurring annual declaration for all KMPs and Directors regarding their external affiliations. Implement strict HR and compliance screening during KMP onboarding.
• Automated Data Reconciliation: Deploy an automated reconciliation tool that cross-verifies the total number of active loan accounts in the Loan Management System against the data packets successfully transmitted to CICs to ensure 100% reporting coverage.

Lessons Learnt

Cross-directorships within the same tier of regulated entities pose serious systemic risks and invite immediate regulatory action. Additionally, flawless credit reporting to CICs is essential for maintaining the integrity of the national credit ecosystem.

Key Details

• Penalty Amount: ₹2.70 Lakh
• Order Date: August 03, 2026
• Regulatory Violations: Non-compliance with ‘Reserve Bank of India (Know Your Customer (KYC)) Directions’.
• Reference: Statutory Inspection based on financial position as of March 31, 2025.

Root Cause Analysis (RCA)

The core issue lies in inadequate technological infrastructure for Anti-Money Laundering (AML) controls:

• Deficient Transaction Monitoring: The company failed to implement a robust, automated software system capable of effectively identifying, flagging, and reporting suspicious transactions.

Preventive Controls

• Technology Procurement and Integration: Immediately procure and integrate a dedicated AML/CFT software suite equipped with dynamic rule-based scenarios and threshold alerts to monitor customer transactions.
• System Audits: Conduct quarterly independent audits of the AML software to ensure rules are up-to-date with emerging typologies and that no suspicious activity is bypassing the system logic.

Lessons Learnt

Manual transaction monitoring is no longer acceptable in the modern financial landscape. Investment in robust regulatory technology (RegTech) is a mandatory cost of doing business, not an optional upgrade.

Key Details

• Penalty Amount: ₹40,000
• Order Date: August 03, 2026
• Regulatory Violations: Non-compliance with ‘Know Your Customer (KYC)’ directions and operational instructions under the ‘Supervisory Action Framework (SAF)’.
• Reference: Statutory Inspection based on financial position as of March 31, 2025.

Root Cause Analysis (RCA)

The breaches were a mix of operational delays and disregard for strict supervisory parameters:

• Operational Bottlenecks: Failure to upload customer KYC records to the Central KYC Records Registry (CKYCR) within the mandated timelines.
• SAF Violation: Offering interest rates on specific deposits that exceeded those offered by the State Bank of India, directly contravening the restrictions imposed under the Supervisory Action Framework.

Preventive Controls

• System Hard-coding for Rates: Implement hard-coded caps within the core banking system (CBS) that prevent branch managers or staff from inputting deposit interest rates higher than the prevailing SBI benchmark while under SAF.
• API Integration for CKYCR: Transition from manual CKYCR uploads to an automated API-driven process that submits KYC records directly from the CBS to the CKYCR registry upon account opening.

Lessons Learnt

Institutions operating under SAF must exercise extreme caution regarding business operations, particularly pricing. Furthermore, regulatory timelines for central registry submissions are inflexible, necessitating automated workflows.