Volume V Issue 4
October 2008

MONETARY AND CREDIT INFORMATION REVIEW

POLICY

Operative Guidelines for Mobile Banking

The Reserve Bank has finalised the operative guidelines for mobile banking transactions to be adopted by banks  from October 8, 2008. For the purpose of these guidelines, “mobile banking transactions” is, undertaking banking transactions using mobile phones by bank customers involving credit/debit to their accounts. The salient features of the guidelines are -

Regulatory/Supervisory Issues

*     Only banks which are licensed and supervised in India and have a physical presence in India would be permitted to offer mobile banking services.

*     The services should be restricted only to banks’ customers and/or holders of debit/credit cards issued as per the extant Reserve Bank’s guidelines.

*     Only Indian Rupee based domestic services should be provided. Use of mobile banking services for cross border inward and outward transfers is strictly prohibited.

*     Banks may use the services of business correspondents for extending this facility to their customers.

*     The guidelines issued by the Reserve Bank on ‘Risks and Controls in Computers and Telecommunications’ in its circular of February 4, 1998 will apply mutatis mutandis to mobile banking.

*     The guidelines issued by the Reserve Bank on “know your customer” (KYC), anti-money laundering (AML) and combating the financing of terrorism (CFT) from time to time, would be applicable to mobile based banking services also.

*     Only banks which have implemented core banking solutions would be permitted to provide mobile banking services.

*     Banks should file suspicious transaction report (STR) to Financial Intelligence Unit – India (FIU-IND) for mobile banking transactions as in the case of normal banking transactions.

Registration

* Banks should put in place a system of document based registration with mandatory physical presence of their customers, before commencing mobile banking service. The Reserve Bank would consider relaxation in specific cases while approving banks’ proposals.

* On registration, full details of the terms and conditions of the service offered should be communicated to the customer.

Technology/Security Standards

Information Security is most critical to the business of mobile banking services and its underlying operations. Technology used for mobile banking must, therefore, be secure and should ensure confidentiality, integrity, authenticity and non-repudiability.

Banks should put in place appropriate risk mitigation measures like transaction limit (per transaction, daily, weekly, monthly), transaction velocity limit, fraud checks, AML checks etc., depending on their own risk perception, unless otherwise mandated by the Reserve Bank.

Authentication

Banks should comply with the following security principles and practices for  authentication of mobile banking transactions:

(a) All mobile banking should be permitted only by validation through a two factor authentication.

(b) One of the factors of authentication should be mPIN or any higher standard.

(c) Where mPIN is used, end to end encryption of the mPIN is desirable,  i.e.,  mPIN should not be in clear text anywhere in the network.

(d) The mPIN should be stored in a secure environment.

Proper level of encryption and security should be implemented at all stages of transaction processing. Adequate safe guards should also be put in place to guard against the use of mobile banking in money laundering, frauds etc. Banks should also -

(i) Implement application level encryption over network and transport layer encryption wherever possible.

(ii) Establish proper firewalls, intruder detection systems (IDS), data file and system integrity checking, surveillance and incident response procedures and containment procedures.

(iii) Conduct periodic risk management analysis, security vulnerability assessment of the application and network etc., at least once in a year.

(iv) Maintain proper and full documentation of security practices, guidelines, methods and procedures used in mobile banking and payment systems and keep them up to date based on the periodic risk management, analysis and vulnerability assessment carried out.

(v) Implement appropriate physical security measures to protect the system gateways, network equipments, servers, host computers, and other hardware/software used from unauthorised access and tampering. The data centre of the bank and its service providers should have proper wired and wireless data network protection mechanisms.

Mobile banking servers at the bank’s end or at the mobile banking service provider’s end, if any, should be certified by an accredited external agency. In addition, banks should conduct regular information security audits on mobile banking systems to ensure complete security.

For mobile banking facilities which do not contain the phone number as identity, a separate login ID and password is desirable to ensure proper authentication.

Inter-operability

*     Banks offering mobile banking service must ensure that customers having mobile phones of any network operator are able to avail of the service. Restriction, if any, on customers of particular mobile operator(s) is permissible only during the initial stages of offering the service, up to a maximum period of six months, subject to review.

*     The long term goal of mobile banking framework in India would be to enable funds transfer from the account in one bank to any other account in the same or any other bank on a real time basis irrespective of the mobile network a customer has subscribed to. This would require inter-operability between mobile banking service providers and banks and development of a host of message formats. To ensure inter-operability between banks, and between their mobile banking service providers, banks should adopt message formats like ISO 8583, with suitable modification to address specific needs.

Clearing/Settlement

To meet the objective of a nation-wide mobile banking framework, facilitating inter-bank settlement, a robust clearing and settlement infrastructure operating on a 24x7 basis would be necessary. Pending creation of such a national infrastructure, banks may enter into bilateral or multilateral arrangement for inter-bank settlements, with express permission from the Reserve Bank, unless such arrangements have been authorised by the Reserve Bank under the Payment and Settlement Systems Act, 2007.

Customer Protection

• Any security procedure adopted by banks for authenticating users, needs to be recognised by law as a substitute for signature. In India, the Information Technology Act, 2000, provides for a particular technology as a means of authenticating electronic record. Any other method used by banks for authentication is a source of legal risk. Customers must be made aware of the legal risk prior to sign up.



• Banks are required to maintain secrecy and confidentiality of customers’ accounts. They may be exposed to enhanced risk of liability to customers on account of breach of secrecy, denial of service etc., on account of hacking/other technological failures. Banks should, therefore, institute adequate risk control measures to manage such risks.



• As in an Internet banking scenario, in the mobile banking scenario too, there is very limited or no stop-payment privileges since it becomes impossible for banks to stop payment in spite of receipt of stop payment instruction as the transactions are completely instantaneous and are incapable of being reversed.  Hence, banks offering mobile banking should notify their customers the timeframe and the circumstances in which any stop-payment instructions could be accepted.



• The Consumer Protection Act, 1986 defines the rights of consumers in India and is applicable to banking services as well. Currently, the rights and liabilities of customers availing of mobile banking services are being determined by bilateral agreements between banks and customers. Taking into account the risks arising out of unauthorised transfer through hacking, denial of service on account of technological failure etc., banks providing mobile banking would need to assess the liabilities arising out of such events and take appropriate counter measures like insuring themselves against such risks, as in the case with internet banking.



• Bilateral contracts drawn up between the payee and payee’s bank, the participating banks and service provider should clearly define the rights and obligations of each party.



• Banks are required to make mandatory disclosures of risks, responsibilities and liabilities of customers on their websites and/or through printed material.



• The existing mechanism for handling customer complaints/grievances should be used for mobile banking transactions as well. Banks should also set up a help desk and disclose the details of the help desk and escalation procedure for lodging the complaints, on their websites. Such details should also be made available to customers at the time of sign up.



• If a customer files a complaint with the bank disputing a transaction, it would be the responsibility of the service providing bank, to expeditiously redress the complaint. Banks should put in place procedures for addressing such customer grievances. The grievance handling procedure including the compensation policy should be disclosed.



• Customer complaints/grievances arising out of mobile banking facility is covered under the Banking Ombudsman Scheme.



• The jurisdiction of legal settlement would be within India.

Transaction Limit

For the present, banks are permitted to offer this facility to their customers subject to a daily cap of Rs. 5000 per customer for funds transfer and Rs.10,000 per customer for transactions involving purchase of goods/services.
Banks may also put in place monthly transaction limit depending on their own risk perception of the customer.

Board Approval

Banks must obtain the approval of their board of directors (local board in case of foreign banks) for the product, as also for the perceived risks and mitigation measures proposed to be adopted, before launching the scheme.

Reserve Bank’s Approval

Banks wishing to provide mobile banking services should seek the Reserve Bank’s one time prior approval by furnishing full details of the proposal.

Prudential Norms for Off-balance Sheet Exposures

Examining the issues regarding asset classification status of overdue payments in respect of derivative transactions and re-structuring of derivative contracts, the Reserve Bank has advised banks that –

Asset Classification

(i) The overdue receivables representing positive mark-to-market value of a derivative contract would be treated as a non-performing asset, if these remain unpaid for 90 days or more. In such a case, all other funded facilities granted to the client should also be classified as a non-performing asset following the principle of borrower-wise classification as per the existing asset classification norms.

(ii) If the client concerned is also a borrower of the bank enjoying a cash credit or overdraft facility, the receivables mentioned at item (i) above may be debited to that account on due date and the impact of its non-payment would be reflected in the cash credit/overdraft facility account. The principle of borrower-wise asset classification would be applicable here also, as per extant norms.

(iii) In cases where the contract provides for settlement of the current mark-to-market value of a derivative contract before its maturity, only the current credit exposure (not the potential future exposure) would be classified as a non-performing asset after an overdue period of 90 days.

(iv) As the overdue receivables mentioned above would represent unrealised income already booked by the bank on accrual basis, after 90 days of overdue period, the amount already taken to ‘profit and loss a/c’ should be reversed and held in a ‘suspense a/c’  in the same manner as is done in the case of overdue advances.

Re-structuring of Derivative Contracts

In cases where a derivative contract is restructured, the mark-to-market value of the contract on the date of restructuring should be cash settled. For this purpose, any change in any of the parameters of the original contract would be treated as a restructuring.

These instructions are also applicable to foreign branches of Indian banks.

CUSTOMER SERVICE

ElectronicTransactions/Outstation Cheque Collection Charges

The Reserve Bank has advised banks that from October 8, 2008, the charges to be levied by them for offering various electronic products and for outstation cheque collection service would be as under :

Banks may prescribe charges not higher than cheque return charges for ECS debit returns. These charges shall be applicable for all types of transactions, including inter-bank funds transfers.

Banks have also been advised that –

• To reduce the clearing cycle and to promote electronic modes of payment, drawee banks should use electronic modes like RTGS/NEFT, wherever available, to remit proceeds to the collecting bank branch.



• They should also make increased use of speed clearing and national clearing facilities for providing efficient service.



• These charges are applicable only to transactions originated and payable within India.



• These instructions are not applicable to cash handling charges levied by them for handling large value cash transactions.



• They should desist from refusing to offer the products to their customers or declining to accept outstation cheques deposited by their customers for collection.

Measures announced by RBI for improving Domestic and Foreign Currency Liquidity

The Reserve Bank has been continuously monitoring the monetary and liquidity conditions with a view to maintaining domestic macroeconomic and financial stability in the context of the global financial crisis. The Reserve Bank has taken a number of measures in the recent past to augment domestic and forex liquidity. However, the continuing uncertain global situation is having an indirect impact on India’s financial markets. In order to alleviate pressures and, in particular, to maintain financial stability, the Reserve Bank has announced the following additional measures:

CRR

The cash reserve ratio (CRR) to be maintained by scheduled banks has been reduced to 6.50 per cent of their net demand and time liabilities (NDTL) from the fortnight beginning October 11, 2008. This measure would release additional liquidity into the system to the order of Rs.40,000 crore.

Repo Rate

The repo rate under the liquidity adjustment facility (LAF) has been reduced by 100 basis points to 8.0 per cent from October 20, 2008.

Interest Rates on NRI Deposits
NRE Deposits

Until further notice and with effect from the close of business in India as on October 15, 2008, the interest rates on fresh non-resident (external) rupee (NRE) term deposits for one to three years maturity should not exceed the LIBOR/SWAP rates plus 100 basis points, as on the last working day of the previous month, for US dollar of corresponding maturities (as against LIBOR/SWAP rates plus 50 basis points effective from the close of business on September 16, 2008). The interest rates as determined above for three year deposits would also be applicable in case the maturity period exceeds three years. The changes in interest rates would also apply to NRE deposits renewed after their present maturity period.

FCNR (B) Deposits

The interest rates on foreign currency non-resident (banks) {FCNR(B)} deposits of all maturities contracted from the close of business in India as on October 15, 2008, shall be within the ceiling rate of LIBOR/SWAP rates plus 25 basis points for the respective currency/corresponding maturities (as against LIBOR/SWAP rates minus 25 basis points effective from close of business on September 16, 2008). On floating rate deposits, interest shall be paid within the ceiling of SWAP rates for the respective currency/maturity plus 25 basis points. For floating rate deposits, the interest reset period shall be six months.

Temporary Liquidity Support for financing Agricultural Operations

With a view to ensuring adequate financing of agricultural operations by banks, the Reserve Bank would provide temporary liquidity support to the National Bank for Agriculture and Rural Development (NABARD) and scheduled banks to the extent of Rs.25,000 crore against their outstanding agricultural advances. The limits would be related to the quantum of debt waived by banks under the Agricultural Debt Waiver and Debt Relief Scheme, 2008. The liquidity support availed by banks and NABARD would be available at a rate of 9 per cent per annum, and would have to be repaid by them within a period of three weeks from October 15, 2008 but not later than November 3, 2008. The rate of interest on this facility has been reduced to 8 per cent per annum from October 20, 2008.

Accordingly, scheduled commercial banks and scheduled primary urban co-operative banks (UCBs) desirous of availing of the support should approach the Regional Director, Deposit Accounts Department, Reserve Bank of India, Mumbai for the purpose. Non-scheduled UCBs may approach the Reserve Bank through the respective state co-operative banks. Regional rural banks (RRBs) and co-operatives may access this facility through NABARD.

Special Fixed Rate Repo under LAF

The Reserve Bank conducted daily a special 14 day repo at 9 per cent per annum against eligible securities for a notified amount of Rs. 20,000 crore from October 14, 2008, with a view to enabling banks to meet the liquidity requirements of mutual funds.

Additional Liquidity Support under LAF

Banks were permitted, purely as a temporary measure, to avail of additional liquidity support exclusively for the purpose of meeting the liquidity requirements of mutual funds to the extent of up to 0.5 per cent of their NDTL. This additional liquidity support would terminate 14 days from the closure of the special term repo facility for mutual funds announced on October 14, 2008. This accommodation would be in addition to the temporary measure announced on September 16, 2008 permitting banks to avail of additional liquidity support against SLR securities to the extent of up to 1 per cent of their NDTL. Penal interest for any shortfall in maintenance of SLR due to availing of this additional liquidity support will be waived on request.

Limit for Overseas Foreign Currency Borrowings enhanced

With a view to providing greater flexibility to AD Category -I banks in accessing overseas funds, they have been permitted to borrow funds from their head office, overseas branches and correspondents and overdrafts in nostro accounts up to a limit of 50 per cent of their unimpaired Tier I capital as at the close of the previous quarter or USD 10 million (or its equivalent), whichever is higher, as against the earlier limit of 25 per cent (excluding borrowings for financing of export credit in foreign currency and capital instruments).

Loans to MFs against and buy back of CDs

Banks and financial institutions (FIs) have been permitted to grant loans to mutual funds (MFs) against certificates of deposits (CDs). Furthermore, they have also been permitted to buy-back their own CDs before maturity.

While granting such loans to MFs, banks should keep in view the provisions of paragraph 44(2) of the SEBI (Mutual Funds) Regulations, 1996. Such finance, if extended to equity-oriented MFs, will form part of banks’ capital market exposure, as hitherto.

Edited and published by Alpana Killawala for the Reserve Bank of India, Press Relations Division (now Department of Communication), Central Office, Shahid Bhagat Singh Marg, Mumbai - 400 001 and printed by her at Onlooker Press, 16, Sassoon Dock, Colaba, Mumbai - 400 005. For renewal and change of address please write to the Chief General Manager, Press Relations Division, Reserve Bank of India, Central Office Building, 12th floor, Fort, Mumbai - 400 001 without enclosing DD/cheque. MCIR is also available on Internet at www.mcir.rbi.org.in.