Indian bank’s IT is so shabby it’s been banned from opening new accounts

India’s central bank has banned Kotak Mahindra Bank from signing up new customers for accounts or credit cards through its online presence and app. The ban came after what the Reserve Bank of India described as “Serious deficiencies and non-compliances … in the areas of IT inventory management, patch and change management, …

[Khaptain]

The next superpower ?

There are a lot of very competent people in India but the country seems rife with these kinds of problems.

It's hard to believe that it will ever be a superpower, either through corruption or just the inability to be serious on certain issues.

[FIA]

Re: The next superpower ?

There are a lot of very competent people in India but the country seems rife with these kinds of problems.

Is the country rife with these kind of problems, or is it growing up in a time with globalised 24/7 media?

There are a lot of very competent people in most countries. Most countries are rife with corruption when you scratch the surface, it's just done in a way that the citizens of that country tolerate. (e.g. I'd argue 'political lobbying' in the US essentially allows the buying of favourable legislation; the UK has a definite 'boys club' when it comes to government, and so on...).

It's hard to believe that it will ever be a superpower, either through corruption or just the inability to be serious on certain issues.

You're suggesting it's not yet corrupt enough? The current superpower is looking like it'll have it's first president with an ankle tag in 6 months. ;)

In all seriousness, I'd argue this is what happens when growth occurs in a country with a population measured in billions. In somewhere like the UK the customer numbers involved would've been smaller, and you could argue that a more mature industry would be more in tune to these kind of issues. It sounds like the grown ups have stepped in though, so I'm sure it'll be fine.

[Cav]

Re: The next superpower ?

"In somewhere like the UK the customer numbers involved would've been smaller"

Modern databases and other tech can handle any number of customers. The numbers are largely irrelevant. You might get a performance hit on the web servers for online access and slow query responses to DB queries but numbers are no excuse for poor firewall, intrusion detection and SIEM systems. They are certainly no excuse for not having policies and business continuity proceddes in place.

[Terje]

Re: The next superpower ?

I would argue that it's likely in part to corporate/social culture that seems to my outside view to be highly hierarchical and you do anything to avoid losing face to people above or below you by admitting you don't know something. There also seems to be a degree of shoot the messenger involved although I have less evidence for that.

I think that this leads to an environment where equipment easily ends up misconfigured, unpatched and uncontrolled, add some old expensive but obsolete kit that no one wants to tell the bosses needs to be replaced yesterday, and you end up with a situation where security is almost bound to suffer.

This is definitely not something unique to India though but can be seen to differing degrees in many places.

[BillG]

Re: The next superpower ?

@Terje, your post reminds me of something a business mentor once told me - "Nobody gets promoted for stopping screwing-up".

Not only do you not get promoted for stopping screwing-up, but the people (there are always more than one) responsible for the screw-up will deeply resent you, either for embarrassing them or for making them do more work to fix the problem. In a static status-quo culture it can end your career.

[steelpillow]

Re: The next superpower ?

Read your history books, your Rudyard Kipling and your 19th and 20th century travelogues. India and its neighbours have always been rife with these problems.

Corruption has always been endemic there throughout every level of society. In the West we at least require it to be discreet, while some forms are widely regarded as socially acceptable and therefore not "corruption" as such (for example one might argue that buying a private consultation with a doctor whose NHS waiting list is two years long is a form of legalised corruption).

Then again, what superpower does not have its majority undercurrent of rebellious and law-breaking retrogrades? Yee-haarr!

[Anonymous Coward]

Re: The next superpower ?

India's long been 'the next superpower', they hold themselves back.

They can't even get farmers to stop illegal field burning from clogging up the air in Delhi

[perkele]

Re: The next superpower ?

Or people to find and use the porcelain pot, in any authorised configuration (sit or squat).

[RegGuy1]

Re: The next superpower ?

Thank you for your shit comment.

[Bitbeisser]

Re: The next superpower ?

Yeah, sometimes it's the simple things that throw a wrench into the gears of a super power. Like forgetting to close a hatch on a US$3B nuclear submarine...

[Pascal Monett]

I can't imagine the state of their IT

For a bank to be forbidden from adding new accounts, that is just . . mind boggling.

I've seen some bank departments where some people were seriously out of touch, but that was just the one person here or there. For the entire bank to not know what it's doing with 40+ million customers ?

How can that happen ?

Yeah, I know, India. But this is a bank. We're not talking some online store, this is supposed to be men in suits with serious boardroom power.

I just cannot fathom what the hell is going on over there.

[Dan 55]

Re: I can't imagine the state of their IT

What about those unfortunate enough to already be their customers? What redress do they have, I doubt current account switching is easy.

[pradeepvasudev]

One of the challenges in India is that the courts, though independent, are sclerotic. As a result, if a bank faces a huge fine (like in the US), it can drag the matter to the courts and spend a decade there. Instead, the RBI uses its powers to restrict new business for the entities which, in a fast growing country like India, is the kiss of death.

For those who are thinking - I cannot fathom what the hell is going on over there... consider that at least one UK bank (TSB) was down for a week just a couple of years ago. https://www.theregister.com/2018/04/23/tsb_systems_go_titsup_as_customers_cant_bank_online/

And the fine was a paltry 48 million.

And then of course the Bank of England itself screwed up and caused Real Time Gross Settlements to, well, be unsettled. https://www.theguardian.com/business/2023/aug/14/bank-of-england-outage-hits-key-payments-systems-processing-billions

Compare the 48 million fine that TSB paid with the hundreds of millions in losses for PayTM when it screwed up its risk systems - the RBI shut down the bank - imagine shutting down a bank to protect customers! Brits are zapped because they cant imagine that the regulator, instead of sweeping things under the carpet, takes public actions to shame the entity and hurt its business.

[Abominator]

TSB's issue was the result of a regulatory mandated fork of systems from RBS. Was a disaster waiting to happen.

[Falmari]

Why would there be regulatory mandated fork of systems from RBS? RBS is part of the Nat West group TSB is part of Santander and before that part of Lloyds TSB.

TSB's issue was the result of fucking up moving TSB off Lloyds systems and onto Santander's.

[katrinab]

Sabadell, not Santander.

Also, I’m pretty sure it was TSB’s system that was kept from the original merger, not Lloyds’s.

But then Lloyds Banking Group plc was originally TSB Group plc.

[Lord Elpuss]

@katrinab

Every time I read one of your comments I'm surprised by just how much random stuff you know. It's impressive.

[dak]

No it wasn't. TSB's original de-merger system was a fork from Lloyd's. That was bad enough, but the outage was caused by a bungled switch to an entirely different system used by Sabadell.

[Stuart Castle]

I can't help thinking this is what you get when you do security on the cheap. Don't get me wrong, the bank may have paid through the nose for this security, but the way things seem to work now is that one company wins the contract to design, implement and maintain the system. They then take their profit (which is likely huge), and work out what parts of the project can be subcontracted. The subcontractors also take their profit, and do what they can, subcontracting the rest.

I suspect most of these projects, if the money paid to the main contractor was actually paid directly to those working on the system, after taking money for costs, and a reasonable profit margin, you'd probably get better systems..

Note: Not having a go at contractors as such, more the frankly ludicrous number of companies involved in subcontracting projects.

[Doctor Syntax]

"work out what parts of the project can be subcontracted"

IME, which admittedly is not in India, it's more a case of work out which parts have to be subcontracted because they're specialist and the main contractor doesn't want to build up in-house expertise for a relatively small number of use cases.

[elsergiovolador]

Infocyst?

Kotak Mahindra Bank Goes Live On Finacle™ To Accelerate Innovation-Led Growth

Mumbai, Bangalore India - March 1, 2012

[CowHorseFrog]

Having worked with quite a few indians and others from the sub-continent its hardly a shock. QUite a few have no respect for doing things properly, no wonder India is a shithole with fake doctors, fake this and that, because everyone is always trying to cheat the next person, what they dont realise is collectively they make their homeland worse and this is one example.

[SnOOpy168]

Perhaps their best talents are in other countries, enjoying the fruits of their capabilities and higher earning power.

[Lord Elpuss]

"The Register has spotted other eyebrow-raising FinTech in India, such as the bank that operated without intrusion detection or prevention systems or a licensed firewall, and another that was censured for failing its obligations to prevent money laundering."

None of this is an accident.

[Plest]

I kind of get the feeling the whole sub-continent of India is like an old company finally realising they have to start doing things properly or go out of business. Anyone who's worked at a company found in the 1980s didn't you notice that most cut corners all the time, didn't do proper change paperwork, everyone simply changed prod systems whenever the wind changed direction, then suddenly around 2002 we all had to start doing proper paperwork, getting change comittees set up and doing things like adults.

This is how I see India, they've always just got by on a bit of luck, cutting a few corners and everyone's just patched up on the fly, now they want to play in the big boys playgrounds around the world, they need to follow our rules and stop acting like children and grow up.

[TeeCee]

Doesn't help that it feels like every single bugger involved in anything you do in India has two priorities: Secondly, to do the bare minimum necessary to satisfy any contractual requirements and firstly, to chisel off 10% for themselves.