The Reserve Bank of India (RBI) has, by an order dated June 12, 2023, imposed a monetary penalty of ₹65.00 lakh (Rupees sixty-five lakh only) on Andhra Pradesh Mahesh Co-operative Urban Bank Ltd., Hyderabad (the bank) for non-compliance with directions issued by RBI on ‘Basic Cyber Security Framework for Primary (Urban) Cooperative Banks (UCBs), ‘Comprehensive Cyber Security Framework for Primary (Urban) Cooperative Banks (UCBs) - A Graded Approach’ and ‘Internet Banking Facility for Customers of Cooperative Banks’. This penalty has been imposed in exercise of powers conferred on RBI under section 47 A (1) (c) read with sections 46 (4) (i) and 56 of Banking Regulation Act, 1949 (BR Act).

This action is based on the deficiencies in regulatory compliance and is not intended to pronounce upon the validity of any transaction or agreement entered into by the bank with its customers.

Background

The IT examination of the bank by RBI and an Investigation Report conducted in reference to a Cyber Security Incident revealed inter alia, that the bank had failed to put in place certain mandated controls which led to the cyber security incident. In furtherance to the same, a notice was issued to the bank advising it to show cause as to why penalty should not be imposed on it for failure to comply with the directions issued by RBI, as stated therein.

After considering the bank’s reply to the notice, additional submissions made by it and oral submissions made during personal hearing, RBI came to the conclusion that the charge of non-compliance with the aforesaid directions issued by RBI was substantiated and warranted imposition of monetary penalty, to the extent of non-compliance with such directions.

(Yogesh Dayal)     
Chief General Manager

Press Release: 2023-2024/435