Recorded RBI impact
Monetary penalty
Monetary penalty · Fresh imposition
Published by RBI
13 Sept 2024
Case Brief
By an order dated September 4, 2024, RBI imposed a monetary penalty of Rs 23,10,000 on SMFG India Credit Company Limited (formerly Fullerton India Credit Company Limited). The penalty was for non-compliance with provisions of the Master Direction - Information Technology Framework for the NBFC Sector and certain RBI directions on cyber security measures. RBI said the sustained lapses included missing monitoring and oversight clauses in outsourced-vendor contracts, not conducting IS audits for Network and Security Solutions since inception, inadequate storage/retention of audit logs for the email gateway, and failure to analyse or act on a critical malware alert from an Endpoint Detection & Response solution. The action was taken under Section 58G read with Section 58B(5)(aa) of the RBI Act, 1934 and is without prejudice to any other action RBI may initiate.
Why RBI Acted
RBI imposed a monetary penalty after supervisory findings showed the company had not complied with certain provisions of the Master Direction - Information Technology Framework for the NBFC Sector and related cyber security measures. The sustained charges included failure to ensure outsourced-vendor contracts had monitoring/oversight provisions, failure to conduct an IS audit for Network and Security Solutions since inception, and inadequate storage/retention of audit logs and follow-up on a critical malware alert from an Endpoint Detection & Response solution. The penalty was imposed under Section 58G read with Section 58B(5)(aa) of the RBI Act, 1934.
Operating Impact
SMFG India Credit Company Limited must absorb the monetary penalty and may face further supervisory or enforcement action. The release does not indicate any operational restriction, but it signals continuing compliance expectations around IT governance, cyber security controls, vendor oversight, logging, auditing, and incident response.
Regulatory Basis
- clause (b) of sub-section (1) of Section 58 G read with clause (aa) of sub-section (5) of Section 58 B of the Reserve Bank of India Act, 1934
Action Facts
- Primary Impact
- Monetary penalty
- Order Date
- 4 Sept 2024
- Effective From
- 4 Sept 2024
- Entities Affected
- 1
- Entity Role
- Bulk Member
- Entity Type
- NBFC
Related Entities
Entities similar to Fullerton India Credit Company Limited