The Regulator Named the Areas in Public. The Record Behind Them Can Be Ready First.

The inspection team has sent its questions ahead of the visit.

One section asks for a list of everything the firm runs. One asks how fixes and changes reach the live systems. One asks how the firm oversees its technology suppliers. One asks for every outage in the past two years.

The technology head calls a meeting. For two weeks, four teams pull together what they can. What goes back is partly from documents, partly from memory, and partly written that fortnight.

What We Found

We went through the RBI’s published release on what it named when it restricted a bank over its IT in 2024, and one 2025 industry survey of how regulation shapes decisions about old systems.

The areas are published. When the RBI restricted Kotak Mahindra Bank on 24 April 2024, its release said “serious deficiencies and non-compliances were observed in the areas of IT inventory management, patch and change management, user access management, vendor risk management, data security and data leak prevention strategy, business continuity and disaster recovery rigour and drill, etc.” It also said the bank’s core banking system and its online and digital banking channels “have suffered frequent and significant outages in the last two years”. Any firm can read that list today.

The areas are connected. A firm cannot patch what it has not listed. It cannot oversee a supplier whose work it cannot read. It cannot plan for continuity on a system nobody has mapped. Answered one by one, by separate teams, the answers do not fit together.

The remedy falls on growth. The RBI directed Kotak to “cease and desist, with immediate effect, from (i) onboarding of new customers through its online and mobile banking channels and (ii) issuing fresh credit cards”. It lifted the restrictions on 12 February 2025, about ten months later.

Regulation already drives these decisions. In one 2025 industry survey of 500 senior leaders at large enterprises that run mainframes, 94% said regulatory compliance strongly influences their decisions on modernising those systems.

What Being Ready First Opens Up

Being ready for an inspection is usually seen as a cost. Our reading is that a firm holding its answers first also gains things it cannot get any other way.

• It chooses the order. A firm that knows where each area stands decides what is fixed first. A firm that learns it from a finding is given the order, and the deadline.
• Money goes where the record shows. Requests from four teams compete for one budget. A single record shows which area is weakest and what depends on it.
• The board sees one picture. Not four separate reports, but one position on every area, written from the system.
• The inspection checks what exists. Instead of a fortnight assembling answers, the firm hands over what it already holds, and goes back to its plans.

This is our reading of the evidence. It is not a measured market figure.

Four Ways to Build a Record of the Areas the Regulator Named, Weighed

Option	When it fits	What it risks
Wait to be asked, then assemble the answers	Past inspections found little, and the systems are well documented	Answers written under deadline describe intentions, not practice
Give each area to its own team to fix	One area is clearly weak and the others are sound	The areas are connected. Separate fixes do not add up to one plan, and the budget is split four ways
Commission a compliance audit against the rules	The firm needs an independent view of where it stands	It says what is wrong, not how to fix it inside the system. This is not work we do
Map the system once, then build a staged plan with evidence at each stage	The system is old, layered and customised	An assessment comes before any plan, and the map will show more than expected

Area, in the RBI’s words (24 April 2024)	Our reading of what the area covers	What the assessment gives it
IT inventory management	What the system is made of, and what depends on what	A map of the system as it stands
Patch and change management	What a change touches, before it is made	A written specification and a risk register. Your own team applies the fixes
Vendor risk management	Its own knowledge of systems a supplier runs	A specification that belongs to the firm and can go to any supplier
Business continuity and disaster recovery; “frequent and significant outages”	The weak parts, and a plan for each	The risk register and a staged plan
User access management; data security and data leak prevention strategy	Controls on who reaches what	Not our work. These are security controls for the firm’s own security team

The RBI listed these areas in one bank’s case. The middle column is our reading, not the regulator’s; which areas apply to a firm is for its compliance team.

We are not a compliance or audit firm. We do not tell a firm what its regulator requires, we do not write its response, and we cannot promise that a regulator will accept a plan, lift a restriction or withhold a penalty. A firm examined on vendor risk will check its suppliers, us included: IOanyT is certified to ISO 9001 and ISO/IEC 27001.

Where You Are Now, and Where You Should Be

Before work starts, we would set a benchmark for the firm’s readiness.

Measure	Typical starting point	Where it should be	How it is checked
An IT inventory	Lists from different teams that do not agree	One complete record of what runs and what depends on it	The record is compared with the servers, databases and code
Each area in the RBI’s 24 April 2024 release	Each team knows its own; nobody holds all of them	What the system record shows on each area, in one place	The risk register
Where the money goes first	Whichever request is loudest	The weakest area, as the record shows it	The cost comparison and staged plan
A dated plan	None, or one date for everything	Stages, each dated by the firm	The staged plan
Board reporting	Separate reports by team	One position on every area, at every review	Board papers

The starting points above are what we expect to find. In an engagement they are replaced by your own position, taken in the first review. The targets are what we would work towards with you. They are not results we have already achieved for a lender.

The areas are the ones the RBI listed in one bank’s case. Using them as headings is our choice, not a statement of what the RBI expects any firm to show.

How We Work With You

1. We listen: a free Reliability Review. A first conversation about the system and the areas that worry you most. You leave with a short written note of what we found.
2. We research. We research your sector, the regulator’s position and what the public record says about firms in your situation. This article is an example of that work.
3. We read the system and propose: the Legacy System Specification Assessment. It produces a map of the system as it stands, a written specification of what it does, a risk register, a cost comparison between keeping and replacing the system, and a staged plan with a fixed quote. AI does a first pass, our senior engineers review it and trace it to the code, and your own experts confirm it. Code access is read-only and logged, never used for training, and deleted within 30 days of the evaluation ending unless we engage.
4. If you approve, we build. We replace a system one module at a time while the old one keeps running. We never do a single cutover. The work is billed by milestone, each milestone tied to a module you accept, and you can pause after any accepted module.
5. We review against the benchmark. Before work starts we set the benchmark. After each module we show you where each measure stands, and the filled-in benchmark is yours at the end.

The Review is free. Every paid step is fixed price, agreed at scoping. Stop after any step. The findings are yours. The assessment fee is credited in full against the first build stage if it starts within 90 days of the report.

We do not secure, patch or maintain the old system while it waits; your current team or vendor does that. We offer no RBI or DPDP compliance service, and do not work on mainframes or core banking products.

What changes for the business:

Role	What they gain
CEO	The board learns the firm’s position before anyone else does.
CTO or CIO	One map and one risk register covering inventory, change, suppliers and weak parts.
CFO	A basis for deciding which of the areas needs money first.
CISO	Unsupported software and the patch backlog are visible and ranked.
Risk and compliance	A record for each area, written from the system, to use as they decide.

The cases in this article, and what IOanyT does about that kind of problem:

The case	What IOanyT does
The RBI restricted Kotak Mahindra Bank for about ten months, naming areas that included IT inventory management, patch and change management, and vendor risk management.	The table above sets out what our assessment gives each area, and where our part stops. We list the weak parts in a risk register and, if you approve, replace them one module at a time while the old system keeps running. What the firm tells its regulator is its own decision.

IOanyT is a consultancy with its own engineering team: we study the problem, recommend, and prove it by building only what you approve. The areas are public; the record behind your answers can be yours before anyone asks.

Book a free Reliability Review →

Get a fixed quote →

See the Legacy System Specification Assessment →