The Reserve Bank of India (RBI) has, by an order dated September 4, 2024, imposed a monetary penalty of ₹23,10,000/- (Rupees Twenty three lakh ten thousand only) on SMFG India Credit Company Limited (formerly known as Fullerton lndia Credit Company Limited) (the company) for non-compliance with certain provisions of the ‘Master Direction - Information Technology Framework for the NBFC Sector’ and certain directions relating to cyber security measures issued by RBI. This penalty has been imposed in exercise of powers conferred on RBI under the provisions of clause (b) of sub-section (1) of Section 58 G read with clause (aa) of sub-section (5) of Section 58 B of the Reserve Bank of India Act, 1934.

A control gap assessment of the company was conducted by the Reserve Bank in April 2023. Based on supervisory findings of non-compliance with RBI directions and related correspondence in that regard, a notice was issued to the company advising it to show cause as to why penalty should not be imposed on it for its failure to comply with the said directions.

After considering the company’s reply to the notice, additional submissions made by it and oral submissions made during the personal hearing, RBI found, inter alia, that the following charges against the company were sustained, warranting imposition of monetary penalty.

The company:

1. did not ensure that the contract between the company and its outsourced vendors contained the provision with respect to monitoring and oversight,
2. did not conduct IS Audit for Network and Security Solutions since its inception, and
3. did not ensure adequate storage/retention of audit logs of the email gateway and analyse or take action on a critical alert generated from Endpoint Detection & Response solution for malware detection from an infected server.

     This action is based on deficiencies in regulatory compliance and is not intended to pronounce upon the validity of any transaction or agreement entered into by the company with its customers. Further, imposition of this monetary penalty is without prejudice to any other action that may be initiated by RBI against the company.

(Puneet Pancholy)     
Chief General Manager

Press Release: 2024-2025/1110