RBI Penalty Report – 21st August 2026

Key Details

• Date of Order: August 19, 2026
• Penalty Amount: ₹8.10 Lakh
• Reference Period: Financial position as of March 31, 2025

Violations / Deficiencies

1. Failure to obtain prior written permission from RBI for appointment of a director, which resulted in a change in management (change of more than 30% of directors, excluding independent directors).
2. Failure to implement a system for categorizing customers into low, medium, and high-risk categories.
3. Failure to upload KYC records of certain customers to the Central KYC Records Registry (CKYCR) within the prescribed timeline.

Root Cause Analysis (RCA)

• Governance Oversight: Lack of robust internal compliance mechanisms to track changes in the Board of Directors against RBI thresholds for prior approval.
• Inadequate Systems: Absence of an automated or defined manual process within the core system to risk-profile customers based on KYC parameters.
• Operational Delays: Process inefficiencies or technical lags preventing the timely upload of customer records to the CKYCR portal.

Preventive Controls Required

• Regulatory Checklists: Implement mandatory compliance sign-offs from the Company Secretary/Compliance Officer before processing any changes to the Board of Directors.
• System Integration: Deploy a robust AML/KYC system capable of automatically assigning risk categories during onboarding and subsequent reviews.
• Automated Reporting: Set up automated API integrations or strict SLA-driven manual workflows for uploading data to CKYCR, coupled with regular exception reporting.

Lessons Learnt

Management changes, especially those exceeding specific regulatory thresholds, require proactive engagement with the regulator, not just post-facto reporting. Furthermore, foundational KYC practices—like risk categorization and central registry uploads—are critical compliance pillars that must be embedded in operational systems, rather than treated as secondary tasks.

Key Details

• Date of Order: August 19, 2026
• Penalty Amount: ₹2.70 Lakh
• Reference Period: Financial position as of March 31, 2025

Violations / Deficiencies

1. Failure to put in place a system for the periodic review of the risk categorization of accounts at least once every six months.

Root Cause Analysis (RCA)

• Process Gap: While initial risk categorization might occur at onboarding, there was a failure to establish a recurring, scheduled process for reassessing that risk over time.
• System Limitations: The core banking or customer management system lacked automated triggers or alerts to prompt compliance teams to perform the required semi-annual reviews.

Preventive Controls Required

• Automated Alerts: Configure the customer database to generate alerts for accounts approaching the six-month mark since their last risk review.
• Compliance Calendars: Implement a mandatory compliance calendar with dedicated resources assigned to execute periodic risk reviews.
• Audit Trails: Ensure the system logs the date and outcome of every periodic risk review for future regulatory inspections.

Lessons Learnt

KYC compliance is an ongoing process, not a one-time onboarding event. Financial institutions must establish dynamic monitoring systems to ensure customer risk profiles remain accurate and updated according to regulatory frequencies (minimum every six months).