Indian banks are slipping on a banana peel of tech adoption
Rapid progress in digital banking has exposed the system to risks
apart from on public health. The season—i.e., the period between and shortduration crops, including some vegetables, fruits and fodder. While the impact on crops is likely to be limited, as harvesting is already underway, daily data shows that select vegetable prices have risen, impacted by inadequate cold-chain infrastructure and the fallout on standing crops.
Food has already punched above its weight in the past 7-8 months, with vegetable inflation unlikely to materially recede from the prevailing 28% year-on-year pace. Notably, costs did not correct to the extent expected during winter, with high temperatures now likely to keep year-on-year growth in double digits over the next few months. The retail prices of potatoes were up 22%, onions 40% and tomatoes 36% in March 2024 from a year before, with other seasonal varieties also likely to be vulnerable. If the month-on-month increase in sequential food inflation quickens from our baseline of 1.1% quarter-on-quarter in April-June 2024 to 1.8-2.0%, headline inflation can potentially jump by 50-70 basis points in the quarter, taking fullyear inflation 40-50 basis points above our baseline at 4.5% year-on-year in 2024-25.
Short-term solutions—such as improved supply networks, better inter-state movement and rotation of short cropping cycles—can be deployed, but are unlikely to provide immediate relief. The strengthening of India’s cold-chain infrastructure and handling of produce will gain importance. Reliance on the upcoming monsoon is high. Today’s reservoir level is at about 31.4% of full capacity, lower than 39% in the comparable period last year. Rains are dearly needed. Dissipating El Niño and the start of La Niña in the third quarter would bode well for crop output and resultant farm income levels, but the spatial and temporal variation of monsoon rains will be equally pertinent.
Policy impact: RBI’s Monetary Policy Committee (MPC) has maintained a cautious and hawkish stance. The impact of weather conditions on food inflation—and consequently on inflationary expectations—will be closely monitored. Given the global conditions, including delays in the US ratecutting cycle, higher oil prices and fluctuations in the value of the rupee, we expect the MPC to extend its wait-and-watch mode and track the monsoon’s progress. The debate over RBI’s policy path ahead has shifted from what ‘the scale of cuts’ will be to whether there will be ‘cuts at all’ in 2024-25. Upside risks to the central bank’s inflation forecast of 4.5% for 2024-25 are also likely to delay any change in its policy stance to ‘neutral.’
Domestic 10-year bond yields have corrected from their mid-April highs, but a dip below 7% is unlikely amid still-high oil prices, a strong dollar and hardening US Treasury yields. The next catalyst for debt markets will be the upcoming index inclusion of Indian bonds, with the first of the global benchmark indices due to start this process in June 2024 and another in January 2025. Mindful of the volatility that could accompany these inflows, India’s monetary authority has steadfastly kept the currency on an even keel, whilst absorbing incremental inflows into its foreign exchange buffer.
After being saddled for years with the biggest bundle of bad loans anywhere in the world, India’s financial system had only recently found its footing. But with profitability at a decade high and capitalization in excess of the regulatory minimum, the country’s banks have begun slipping again. This time, they’re falling on the banana peel of technology.
The latest casualty is Kotak Mahindra Bank. Last week, the regulator ordered what was until recently India’s fourth-largest lender by market value to stop taking new customers via its online and mobile banking channels and refrain from issuing fresh credit cards. The Reserve Bank of India (RBI) said it had found “serious deficiencies” in how the bank manages user access, vendor risk and data security. This is stiff punishment. More than 98% of the transaction volume in Kotak’s savings accounts were from digital or non-branch methods in the December quarter; 99% of new credit cards and 95% of personal loans it sold were also online. While Kotak says it has already taken some steps and will “swiftly resolve balance issues at the earliest,” the brazenness of last year’s scam at UCO Bank is likely to make RBI cautious in lifting the ban. UCO is a small, state-owned lender based in Kolkata. Last November, it found some customers had got nearly $100 million via interbank electronic fund transfers, but accounts at the sending institutions hadn’t been debited.
This month, investigators said that this was no error, but a scam. A couple of outside engineers had allegedly fiddled with UCO’s servers, creating money out of thin air, and crediting it to different accounts. Several account holders made “wrongful gains by withdrawing the proceeds,” according to the bank’s police complaint.
This is the crux of the issue. RBI’s press release highlighted “frequent and significant outages in the last two years” in Kotak’s services that inconvenienced customers. While these are annoying, the big risk is a UCO Bank-type scenario where the same money can be spent twice because it shows up in two accounts. If something like that happens at scale, it could pose serious risks to financial stability. All benefits from digitization pale in front of such a threat.
Digitization has undoubtedly brought benefits, particularly to non-state-owned lenders. Take Kotak, which now has 8.5% of the deposits of State Bank of India (SBI), compared with less than 6% seven years ago. This gain didn’t take a commensurate expansion in physical presence. SBI has added nearly 5,000 branches since 2016 — 10 times as many as Kotak. Even as they have gained from it, banks paid insufficient attention to tech. In December 2020, RBI barred HDFC Bank, India’s largest private lender, from issuing new credit cards and launching fresh digital initiatives. The card ban was lifted after eight months; the digital blockade lasted over a year.
This isn’t just an Indian problem. Singapore’s DBS Group, which has aspired to rank alongside some of the world’s most admired tech brands, has also stumbled on small things like an overheated data centre.
In India, fintech sped up money transactions, but it has also meant complexity. An otherwise staid banking system, running software on servers on bank premises, faces a tsunami of tiny transactions coming via intermediaries that mostly do cloud computing. A widely used smartphonebased protocol, UPI, logged more than 100 billion transactions last year. There are some 50 million merchants accepting online money via QR codes, but the regulator isn’t sure if all are legit. Fast and furious may have opened the floodgates to fraud.
A rattled RBI is in a mood to punish. Earlier, it instructed Paytm, the homegrown payments pioneer, to freeze its banking business because of persistent non-compliance. Separately, it asked Visa Inc to stop the use of its business cards for commercial payments with a fintech firm in between.
Drastic supervisory steps may be necessary at times, but they will not be enough. The Indian regulator needs to update its own understanding of technology—the last edition of RBI’s 164-page financial stability report devoted a mere four paragraphs to digital safety, even though the central bank’s survey showed cybersecurity as a “high-risk” category.
Threat levels are rising. A 2022 study by DeepStrat, a New Delhi-based consulting firm, had raised concerns about what it called a “fraud stack”—a large number of bank accounts “controlled by crime cartels without their owners being aware of their identities being misused,” as explained by Anand Venkatanarayanan, one of the report’s authors.
In one instance, the customer’s address in a bank’s records was the same as that of the bank branch. When such mule accounts hide in plain sight, attacks become highly probable.