Why RBI has to appoint external firm to audit HDFC Bank's IT infra ?

The move comes after the bank customers faced a number of incidents of outages in the internet banking/ mobile banking/ payment utilities of the bank over the past 2 years, including the recent outages in the bank’s internet banking and payment system on November 21, 2020 due to a power failure in the primary data centre.

HDFC Bank is a leading player in terms of digital transactions processed. In FY20, nearly 95% of the bank's retail transactions were conducted digitally, up from about 85 per cent in FY18. An expert says, more digitisation has invited huge problems to itself. The recurring outages also risk hurting the bank's brand perception among a growing and increasingly digital-savvy customer base, and increase the chances of clients switching to other banks.

RBI has appointed an external professional IT firm for carrying out a special audit of the entire IT infrastructure of the bank under Section 30 (1-B) of the Banking Regulation Act, 1949..., at the cost of the Bank under Section 30 (1-C) of the Act. The bank shall accordingly extend its cooperation to the external professional IT firm so appointed by RBI for conducting the special IT audit as above," HDFC Bank said in a regulatory filing.

"The RBI vide said Order has advised the Bank to temporarily stop i) all launches of the Digital Business generating activities planned under its program ‐ Digital 2.0 (to be launched) and other proposed business generating IT applications and (ii) sourcing of new credit card customers. In addition, the Order states that the Bank’s Board examines the lapses and fixes accountability," the bank said in an exchange filing.

Reserve Bank of India’s action was in response to weaknesses in HDFC Bank's digital infrastructure and operational resilience. HDFC Bank responded that it has, over the last two years, "taken several measures to fortify its IT systems and will continue to work swiftly to close out the balance and would continue to engage with the Regulator in this regard".

The action plan will take 10-12 weeks for implementation, and further time-frame will depend on the RBI's inspection. Based on the satisfaction level, the regulator will lift the ban, the official said at an analysts' meet.

Taking a stern view of the repeated outages, RBI Governor Shaktikanta Das had said in December the regulator had some concerns about certain deficiencies and it was necessary that HDFC Bank strengthens its IT system before expanding further.

"... we cannot have thousands and lakhs of customers who are using digital banking to be in any kind of difficulty for hours together and especially when we are ourselves giving so much emphasis on digital banking. Public confidence in digital banking has to be maintained," Das had said.

The bank is the largest issuer of credit cards and had 1.49 crore customers as of September 2020 while on the debit cards front, it had 3.38 crore customers.