The Reserve Bank of India (RBI) has, by an order dated May 20, 2021 imposed a monetary penalty of ₹1.00 crore (Rupees One crore only) on Tamilnad Mercantile Bank Ltd. (the bank) for non-compliance with certain provisions of directions issued by RBI on “Cyber Security Framework in Banks” dated June 2, 2016.

The penalty has been imposed in exercise of powers vested in RBI under the provisions of Section 47A(1)(c) read with Section 46(4)(i) of the Banking Regulation Act, 1949. This action is based on the deficiencies in regulatory compliance and is not intended to pronounce upon the validity of any transaction or agreement entered into by the bank with its customers.

Background

The bank had reported a few cyber incidents to RBI in October 2019. Examination of the incident reports revealed, inter alia, non-compliance by the bank with RBI directions on “Cyber Security Framework in Banks” dated June 2, 2016. In furtherance to the same, a notice was issued to the bank advising it to show cause as to why penalty should not be imposed on it for non-compliance with the said directions. After considering the bank’s reply to the notice, oral submissions made in the personal hearing and examination of additional submissions, RBI came to the conclusion that the charges of non-compliance with RBI directions on “Cyber Security Framework in Banks” were substantiated and warranted imposition of monetary penalty.

(Yogesh Dayal)     
Chief General Manager

Press Release: 2021-2022/247