E-Banking In India

Reserve Bank of India (RBI) has come across many complaints and disputes regarding fraudulent credit card, online banking and ATM transactions. Even phishing incidences have sharply arisen in India resulting in loss of money of public at large. RBI ombudsmen office has been flooded with such complaints.

In these circumstances, online banking in India is risky. We have no e-banking laws in India and this also makes the mobile banking in India risky. Even RBI has acknowledged risks of e-banking in India.

E-banking in India cannot succeed till a strong legal framework in this is enacted. According to Praveen Dalal, managing partner of New Delhi based law firm Perry4Law and leading techno legal expert of India, we have no dedicated E-Banking Law in India. Although, RBI has issued many guidelines in this regard and even our Information Technology Act, 2000 contains some indirect and implied provisions for Internet or E-Banking yet we need a separate and dedicated law in this regard, opines Praveen Dalal.

Recently, G Gopalakrishna, the executive director of RBI, said that all Banks would have to create a position of Chief Information Officers (CIOs) as well as Steering Committees on Information Security at the Board Level at the earliest, informs Dalal. This step was taken to ensure proper Cyber Security Policies and Strategies at the highest Board Level of Banks, says Dalal.

Although RBI has mandated cyber due diligence for banks in India especially the due diligence for banks under IT Act 2000 yet banks have still to keep their functions in order. Indian banks are poor at cyber security and they are in no mood to appoint CIOs and steering committee.

Recently the final report of working group of RBI on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds has been released. It has prescribed the time limits for implementation of RBI recommendations on information security. With the deterrent approach of RBI towards non compliance, it would be safe to presume that CIOs, steering committee and cyber security related compliances would also be taken seriously by RBI.

It is high time for banks operating in India to keep their e-banking infrastructure technologically and legally sound. The best option for banks seems to be to adopt Techno Legal Measures that covers both Technical and Legal aspects of Banking, suggests Dalal.

Non Compliance Penalty Imposed By RBI Upon 19 Commercial Banks

Reserve Bank of India (RBI) is the apex bank of India that regulates the conduct of various commercial banks of India. If these commercial banks are found deviant they are also penalized by RBI.

Recently, RBI has imposed penalties upon 19 commercial banks like Axis Bank Ltd, Barclays Bank PLC, HDFC Bank Ltd, ICICI Bank Ltd, Kotak Mahindra Bank Limited, Yes Bank Ltd, BNP Paribas, Citi Bank NA, Credit Agricole – CIB, Development Credit Bank Ltd, ING Vysya Bank Ltd, Royal Bank of Scotland, Standard Chartered Bank, State Bank of India, Bank of America NA, DBS Bank Ltd, Deutsche Bank AG, Hongkong and Shanghai Banking Corporation Ltd and JP Morgan Chase Bank NA.

By exercising its powers under the provisions of Section 47A (1) (b) read with Section 46(4) (i) of the Banking Regulation Act, 1949, RBI imposed these penalties. The penalties have been imposed on these banks for contravention of various instructions issued by the Reserve Bank in respect of derivatives, such as, failure to carry out due diligence in regard to suitability of products, selling derivative products to users not having risk management policies and not verifying the underlying/ adequacy of underlying and eligible limits under past performance route.

The Reserve Bank had issued Show Cause Notices to these banks. In response to this, the banks submitted their written replies. On a careful examination of the banks’ written replies and the oral submissions made during the personal hearings, the Reserve Bank found that the violations were established and the penalties were thus imposed.

RBI has been taking many pro active reforms for the Banking Sector of India, says Praveen Dalal, managing partner of New Delhi base ICT law firm Perry4Law and leading cyber law expert of India.. RBI is not only ensuring strict compliance with various Laws, Regulations and Norms but is also prescribing various Policies and Strategies for Effective and Secure Banking in India, informs Dalal. Ensuring Cyber Security for preventing Cyber Crimes has been recently directed by RBI that all Commercial Banks of India must follow, informs Dalal.

However, although the directions of cyber security are of great interest yet banks have failed to comply with the same. For instance, till now the directions of RBI to appoint CIOs and steering committee has not been followed by banks of India. Similarly, banks of India are also at fault for ignoring the cyber security requirements.

RBI must take these non compliances very seriously as banking customers interest are at stake. Just like it imposed penalties for non compliance in the present case, penalties for non compliance with cyber security requirements must also be imposed by RBI. Let us see how RBI would react to this situation.

Indian Banks Are Poor At Cyber Security Policy

Banking industry of India has started using information and communication technology (ICT) for various banking related affairs. However, with the growing use of ICT, cyber crimes and banking frauds have also increased. Although Reserve Bank of India (RBI) has taken many pro active steps to introduce cyber security element in the Indian banking sector yet banks of India are not using the same at all.

For instance, RBI has recently directed that all banks would have to create a position of chief information officers (CIOs) as well as steering committees on information security at the board level at the earliest. This direction was provided through the information technology vision document for 2011-17 (IT Vision 2011-17). This document has suggested many technological as well as legal reforms for banking sector of India.

However, banks of India have shown no willingness to incorporate cyber security into their day to day functions. Till now the directions of RBI to appoint CIOs and steering committee has not been followed by banks of India.

Cyber Security Policy is an issue that is very important for Banks of India, says Praveen Dalal, managing partner of New Delhi base ICT law firm Perry4Law and leading cyber law expert of India. With the growing use of Internet Banking, ATM machines, Credit and Debit Cards, Online Banking, etc, Banks of India must also upgrade their Cyber Security Infrastructure and establish a Cyber Security Policy, suggests Dalal.

RBI has to make it sure that its directions regarding cyber security policy and practices are accepted and implemented by banks operating in India. Till now Indian banks have shown a poor track record of cyber security usage.

Steering Committees On Information Security By Banks In India

Cyber crimes have increased a lot in India. Cyber crimes have not left any field or commercial activity untouched. Even the banking sector has not remained unaffected by cyber crimes. Further, the cyber law of India has introduced its own set of due diligence requirements for banks operating in India.

Realising the gravity of the situation, the Reserve Bank of India (RBI) has recently released a report of its working group on information security, electronic banking, technology risk management, and cyber frauds. In this report, the RBI mandated cyber due diligence for banks in India.

The matter does not end here. It is clear that RBI has to meet great challenges before Indian banking industry can be considered reasonably safe from cyber criminals. This is more so when we have inadequate cyber laws and other laws to effectively tackle cyber crimes pertaining to banking sector of India.

Internet banking is increasingly becoming popular in India. However, Internet banking is a risky venture and India must be prepared to deal with the risks associated with it. The increasing cases of ATM frauds, online banking frauds, credit cards frauds, etc have shaken the confidence of Indian consumers in Internet banking in India.

However, Internet banking in India cannot succeed till a strong legal framework in this is enacted. According to Praveen Dalal, leading techno legal expert of India and a Supreme Court lawyer, we have no dedicated Internet Banking Law in India. Although, RBI has issued many guidelines in this regard and even our Information Technology Act, 2000 contains some indirect and implied provisions for Internet Banking yet we need a separate and dedicated law in this regard, opines Praveen Dalal.

Similarly, the present banking and other technology related legal frameworks are not conducive for mobile banking in India. We do not have a well developed e-governance infrastructure in India. Similarly, on the front of e-commerce as well, India is not much successful.

In this background, the requirements of cyber due diligence of banks in India has become more onerous. RBI has further made this requirement absolute through its Information Technology Vision Document 2011-17. According to this policy document, all banks now would have to create a position of chief information officers (CTOs) as well as steering committees on information security at the board level at the earliest.

The presence of CTO and steering committees on information security would ensure that banks are following cyber due diligence and other technology and non technology related due diligence requirements in India, says B.S.Dalal, a banking and financial law expert and senior partner of Perry4Law. Till now there was no such requirement and banks were taking cyber law related issues lightly. RBI has taken a good step in right direction and this would increase the confidence of bank customers of India.

Internet Banking Laws In India

Internet banking is increasingly becoming popular in India. However, Internet banking is a risky venture and India must be prepared to deal with the risks associated with it. The increasing cases of ATM frauds, online banking frauds, credit cards frauds, etc have shaken the confidence of Indian consumers in Internet banking in India.

Similarly, mobile banking in India is also being explored. Some segments have suggested active use of mobile banking in India. While the idea is great yet India is still not ready for mobile banking. In fact, mobile banking in India is a risky business.

The problem of Internet banking frauds has become even more sever due to absence of legal framework in this regard. However, the Reserve Bank of India (RBI) has recently recommended use of “cyber due diligence” for banks in India. With the present guidelines, banks can no more ignore due diligence requirements that they have been ignoring for long.

Although the requirements of due diligence may arise out of many laws, but cyber due diligence is the most required one. Realising the seriousness of the situation, RBI has recently released a report of its working group on information security, electronic banking, technology risk management, and cyber frauds.

Previously, banks were required to manage due diligence arising out of laws alone but now the responsibility of banks have become very wide. The banks must now manage due diligence requirements of both technical and legal nature. In other words, the due diligence requirements of banks have now become techno legal in nature.

However, Internet banking in India cannot succeed till a strong legal framework in this is enacted. According to Praveen Dalal, leading techno legal expert of India and a Supreme Court lawyer, we have no dedicated Internet Banking Law in India. Although, RBI has issued many guidelines in this regard and even our Information Technology Act, 2000 contains some indirect and implied provisions for Internet Banking yet we need a separate and dedicated law in this regard, opines Praveen Dalal.

It would be a good idea if RBI starts working in the direction of enacting a suitable Internet banking law of India. The same may also incorporate cyber due diligence requirements and punishments for cyber crimes against banking institutions. The call is for the RBI to take and it would definitely take it.