Recorded RBI impact
Fine: Rs 2.66 Cr
Monetary penalty · Fresh imposition
Published by RBI
19 Dec 2022
Case Brief
By an order dated December 12, 2022, RBI imposed a monetary penalty of Rs 2.66 crore on Bank of Bahrain & Kuwait BSC, India Operations. The penalty was imposed for non-compliance with RBI directions on the Cyber Security Framework in Banks, under section 47A(1)(c) read with section 46(4)(i) of the Banking Regulation Act, 1949. RBI’s examination and related materials found that the bank had not implemented several required controls, including systems for detecting unusual or unauthorized activity, a Security Operations Centre, audit logging, multi-factor authentication, controls over administrative rights and critical-server access, a Cyber Crisis Management Plan, real-time alerting and centralized monitoring, and file integrity mechanisms. RBI said these lapses contributed to an unauthorized intrusion going undetected. The order was stated to be based on regulatory non-compliance and not intended to pronounce on customer transactions or agreements.
Why RBI Acted
RBI imposed a monetary penalty under section 47A(1)(c) read with section 46(4)(i) of the Banking Regulation Act, 1949 for non-compliance with its directions on the Cyber Security Framework in Banks. The bank was found to have failed to implement several required cyber controls, including systems to detect unusual and unauthorized activity, a Security Operations Centre, audit logs for database and server OS, restrictions on administrative rights on endpoints, multi-factor authentication for critical servers, controls to manage and monitor access to critical servers, a Cyber Crisis Management Plan, real-time alerting and centralized log monitoring, and mechanisms to ensure integrity of critical files. RBI stated that these deficiencies resulted in an unauthorized intrusion going undetected and led to the cyber security incident.
Operating Impact
The bank must absorb the monetary penalty and address the cyber control gaps identified by RBI. The action does not bar operations, but it highlights supervisory expectations around cyber security governance, monitoring, access controls, and incident detection for the bank’s systems and customers.
Regulatory Basis
- section 47 A (1) (c) read with sections 46 (4) (i) of the Banking Regulation Act, 1949
Action Facts
- Primary Impact
- Fine: Rs 2.66 Cr
- Order Date
- 12 Dec 2022
- Effective From
- 12 Dec 2022
- Entities Affected
- 1
- Entity Role
- Primary
- Entity Type
- Bank