Ten Months Without New Customers
A study from the public record of what the RBI named when it restricted a bank's new business over its IT, the options for finding out where an old system stands, what we would advise against, and the benchmark we would set.
1. At a Glance
Issue study · From the public record. None of the organisations named here was an IOanyT client, and IOanyT had no part in the events described. Everything about them comes from the public record, reported without judgement on the institutions. IOanyT is not a compliance or audit firm, and nothing here is regulatory or legal advice.
| Organisation type | An Indian bank restricted by the RBI over its IT, set beside one Indian co-operative bank’s penalty and one UK fine |
| Size band | Kotak Mahindra Bank: large. Andhra Pradesh Mahesh Co-operative Urban Bank: an urban co-operative bank. TSB Bank: large |
| Region | India; TSB Bank in the UK |
| The decision at stake | How a firm on old systems learns where it stands, and what it puts in front of its board |
| The public outcome | Kotak Mahindra Bank was barred from onboarding customers through its online and mobile channels and from issuing new credit cards for about ten months, from 24 April 2024 to 12 February 2025 |
| Why it matters to a mid-size lender | The remedy for IT failings can be a stop on new business, and regulatory action over IT has reached an urban co-operative bank too |
2. The Business Problem, in the Buyer’s Words
“Our old system has been amber on the board report for years. Every team knows its own gaps: the server list is out of date, changes go in by hand, one vendor holds the knowledge. Nobody has put it together. If the inspectors asked tomorrow, we would spend a fortnight writing the answers, and I am not sure they would match what the system does.”
These words are imagined. They describe the position as the research shows it, not a real conversation.
The firm is not short of warnings. It is short of one written record of its own system, and a plan it could defend.
3. What We Found
Method. We went through the public record on regulatory action over IT in banking: the RBI’s direction on IT governance, its published enforcement releases, the UK regulators’ published findings on one failed migration, and one 2025 industry survey, from 2018 to 2025.
The restriction. On 24 April 2024 the RBI directed Kotak Mahindra Bank to “cease and desist, with immediate effect, from (i) onboarding of new customers through its online and mobile banking channels and (ii) issuing fresh credit cards”, while it kept serving its existing customers. The RBI lifted the restrictions on 12 February 2025.
| What | Public record |
|---|---|
| Date of the order | 24 April 2024 |
| What was barred | ”Onboarding of new customers through its online and mobile banking channels”; “issuing fresh credit cards” |
| Restrictions lifted | 12 February 2025 |
| Length | About ten months |
| Areas named, in the RBI’s words | ”IT inventory management, patch and change management, user access management, vendor risk management, data security and data leak prevention strategy, business continuity and disaster recovery rigour and drill, etc.” |
| Also noted | ”Frequent and significant outages in the last two years” |
It reaches co-operative banks. On 19 June 2023 the RBI announced a penalty of 65 lakh rupees on Andhra Pradesh Mahesh Co-operative Urban Bank, Hyderabad, by an order of 12 June 2023, for non-compliance with its cyber security framework directions. The RBI said its IT examination and an investigation of a cyber security incident showed the bank “had failed to put in place certain mandated controls which led to the cyber security incident”.
The rule. The RBI’s direction on IT governance, in force since 1 April 2024, says regulated entities “shall avoid using outdated and unsupported hardware or software”.
Moving badly is penalised too. TSB Bank in the UK migrated to a new IT platform in April 2018, and the migration failed. On 20 December 2022 its regulators fined it £48.65 million in total, finding that it had failed to manage the risks of its “IT outsourcing arrangements with its critical third-party supplier”.
How leaders see it. In one 2025 industry survey of 500 senior leaders at large mainframe-based enterprises, 94% said regulatory compliance strongly influences their modernisation decisions.
Our reading of why firms meet these areas unprepared. These are our reasoning from the cases above. None is a regulator’s finding.
- Each area belongs to a different team, and nobody holds all of them together.
- The areas are connected: a firm cannot patch what it has not listed, or oversee a supplier whose work it cannot read.
- The old system reaches the board as a budget request, not as a business risk, so it waits.
- When a finding comes, the response promises a date before anyone has read the system.
What this record does not show. The research read the RBI’s press releases, not its inspection reports or its letters to the banks, so it has the areas the RBI named and not the detail behind them. It saw no inspection questionnaire, finding or response letter, and does not know what deadlines the RBI sets. The RBI’s release does not say Andhra Pradesh Mahesh ran unsupported software. The survey covers large mainframe-based enterprises, not mid-size lenders. We found no named NBFC, broker, insurer or fintech restricted over an old system, and no figure for what a restriction cost in lost business.
4. The Options a Firm in This Position Had
| Option | When it fits | What it risks | Our view |
|---|---|---|---|
| Wait until someone asks | The systems are recent and documented, and past inspections found little | The firm learns its position from someone else, on someone else’s timetable | Right only where the systems are already in order |
| Fix the cited areas one by one, team by team | One area is clearly weak and the rest are sound | The areas are connected; separate fixes do not add up to a plan | Useful for one urgent gap, not as the plan |
| Commission a compliance audit against the rules | The firm needs an independent view of where it stands | It says what is wrong, not how to fix it inside the system | Often worth doing alongside; not work IOanyT does |
| Map the system, then build a staged plan with evidence at each stage | The system is old, layered and customised | An assessment comes before any plan, and the stages take longer than one date | Our recommendation for the systems around the core |
What we would have advised against: promising one completion date chosen before anyone had read the system, and replacing the whole system on one date to meet it. The first gives the board nothing to check until the date arrives. The second risks the kind of failure the TSB record shows.
5. Our Recommendation, and the Decision It Asks of the Board
For the systems a lender has built around its core (loan origination, collections, agent and branch portals, reporting): first write down what the system is, what it runs on and where each area the regulator has named stands. Then build a staged plan for the weak parts, one module at a time, with evidence at each stage, while the old system keeps running. What the firm tells its regulator is for the firm and its compliance advisers.
The decision it asks of the board: approve a fixed-price assessment before anyone else asks for the record. Then approve each stage on its own evidence, with the freedom to pause after any accepted module. The board replaces one amber line with a position on each area and a plan it can check.
6. Benchmark: Where You Are Now, and Where You Should Be
These are targets, not results. In an engagement the starting points are replaced by the firm’s own figures, taken in the first review.
| Measure | Typical starting point | Where it should be | How it is checked |
|---|---|---|---|
| An IT inventory | Several lists that do not agree | One complete record of what runs and what depends on it | The record is compared with the servers, databases and code |
| Each area in the RBI’s 24 April 2024 release | Known to each team, never put together | What the system record shows on each area, in one place | The risk register |
| A dated, staged plan | One completion date, or none | Stages of one module each, dated by the firm | The staged plan with a fixed quote |
| Evidence for each stage | Nothing to show until the end | A record of what moved and how it was checked, for every accepted module | The traceability matrix |
| Board reporting | One amber line, carried forward | The position on each area and progress against the plan | Board papers, at every review |
The areas are the ones the RBI listed in one bank’s case. Using them as headings is our choice, not a statement of what the RBI expects any firm to show.
7. How IOanyT Would Work
- We listen: a free Reliability Review. A first conversation about the system, what past inspections have asked, and what the growth plan depends on. You leave with a short written note of what we found.
- We research. We research your sector, the regulator’s position and what the public record says about firms in your situation. This study is an example of that work.
- We read the system and propose: the Legacy System Specification Assessment. It produces a map of the system as it stands, a written specification of what it does, a risk register, a cost comparison between keeping and replacing the system, and a staged plan with a fixed quote. AI does a first pass, our senior engineers review it and trace it to the code, and your own experts confirm it. Code access is read-only and logged, never used for training, and deleted within 30 days of the evaluation ending unless we engage.
- If you approve, we build. We replace a system one module at a time while the old one keeps running. We never do a single cutover. A traceability matrix links every old function to its replacement. The work is billed by milestone, each milestone tied to a module you accept, and you can pause after any accepted module.
- We review against the benchmark. Before work starts we set the benchmark. After each module we show you where each measure stands, and the filled-in benchmark is yours at the end.
The Review is free. Every paid step is fixed price, agreed at scoping. Stop after any step. The findings are yours. The assessment fee is credited in full against the first build stage if it starts within 90 days of the report.
A firm examined on vendor risk will check its suppliers, IOanyT included. IOanyT is certified to ISO 9001, ISO/IEC 27001 and ISO/IEC 42001.
8. What the Client Would Own
- The map and the specification: what the system is and what it does, in writing and portable to any supplier.
- The risk register: the weak parts, ranked, before any price is set.
- The staged plan: each stage, in order, with a fixed quote, for the firm to date and to take to its board.
- The traceability matrix: for each replaced module, every old function linked to its replacement, with how it was checked.
- The code: the new modules are the client’s.
- The filled-in benchmark: each measure, where it started and where it stands.
9. What This Approach Does Not Cover
- IOanyT is not a compliance or audit firm. It offers no RBI or DPDP compliance service and no legal advice, and does not say what a regulator requires.
- IOanyT does not write a firm’s response to a regulator. What the firm tells its regulator is its own decision.
- IOanyT cannot promise that a regulator will accept a plan, lift a restriction or withhold a penalty.
- IOanyT does not secure, patch or maintain the old system in the meantime, and does not supply security controls such as access management or firewalls. The client’s current team or vendor does that.
- IOanyT does not work on mainframes or core banking products.
- This study does not say IOanyT would have prevented the events described, or that IOanyT has done this work for a bank.
About this study: IOanyT did not work on this case. It is drawn from published findings, cited below.
10. Sources
| Source | Used for |
|---|---|
| RBI press release 2024-2025/172, 24 April 2024 | Kotak Mahindra Bank: the restriction and the areas named |
| RBI press release 2024-2025/2139, 12 February 2025 | Lifting of the restrictions |
| RBI press release 2023-2024/435, 19 June 2023 | Andhra Pradesh Mahesh Co-operative Urban Bank: the penalty and the RBI’s finding |
| RBI Master Direction | The rule on unsupported hardware and software |
| Bank of England, 20 December 2022 | TSB Bank fine and finding |
| News report of a vendor’s survey, 9 September 2025 | The survey figure |
IOanyT is a consultancy with its own engineering team: we study the problem, recommend, and prove it by building only what you approve. We give a firm the facts about its own system and a staged plan; what it does with them is its own decision.
Read the research notes on this issue
Regulator restrictions and penalties
Research note 1
The Regulator Can Now Stop a Lender's Growth Over Its IT. Most Boards Hear It Last.
We reviewed the RBI's published action over IT failings: what a restriction holds back, four ways to find out where a system stands, and our benchmark.
Research note 2
The Regulator Named the Areas in Public. The Record Behind Them Can Be Ready First.
The RBI named the IT areas in public when it restricted a bank. What a record built from the system opens up, four options weighed, and our recommendation.
Research note 3
A Replacement Plan Needs Stages Someone Can Check. Here Is the Benchmark We Would Set.
One completion date gives a board nothing to check. The benchmark we would set for a staged replacement plan, with evidence at each stage.