Deterrence beyond a slap on the wrist: Reimagining financial penalties

Fines on Indian financial institutions are a pittance. The enforcement regime must be reimagined, reports Raghu Mohan

Reserve Bank of India (RBI) Governor Sanjay Malhotra said on January 9: “Enforcement, restrictions and penalties are measures of last resort. Our endeavour is to have a robust financial ecosystem where supervision encourages self-correction and enforcement acts only as a backstop.” He was speaking at the Third Annual Global Conference of the College of Supervisors in Mumbai and held that the purpose of enforcement actions “is generally not punitive. The intent is largely to correct”. They serve two purposes — as “a signal to those against whom such measures have been initiated; and to make others aware of our acceptable standards of conduct and expectations.” 

Penalty framework 

In FY26, there were 241 instances of Mint Road penalties amounting to ₹26.33 crore on regulated entities (REs). This compares with 353 instances and ₹54.78 crore in FY25; 281 and ₹86.11 crore in FY24; and 211 and ₹40.40 crore in FY23. These amounts are a pittance: Globally, penalties run into hundreds of millions of dollars. The highest imposed by the RBI to date is ₹58.9 crore in March 2018 — on ICICI Bank for failing to adhere to directives on the sale of securities from the lender’s held-to-maturity portfolio. 

Regulatory censure (of any kind) may be the last resort, but is the RBI’s enforcement regime deterrent enough? 

“I do believe that the penalty framework has to be reimagined for it to be effective, like in the advanced economies,” says Dinesh Kumar Khara, former chairman of the State Bank of India. “Now, there are two ways of going about it: At the institutional and personnel level. In the latter instance, you already have the clawback provision for private banks. In the case of state-run banks, the executive (concerned) may not have the ability to pay.” And “the larger point is that if you look at the penalties for breaches under the DPDP Act, 2023 (Digital Personal Data Protection Act), it indicates directionally where we are headed. Banks and financial institutions should take note of this.” 

Under the Act, penalties on institutions can range from ₹50 crore to ₹250 crore. 

For Vimal Bhandari, chairman of HDFC Mutual Fund Trustee Company (and an independent director on the board of Escorts Kubota, having also served RBL Bank in a similar capacity): “Companies have to develop a framework where adherence to regulations is a given in letter and spirit. Penalties and regulatory censure should come higher up on the escalatory ladder, based on a consistent record of non-adherence to these essential requirements.” 

A technical aspect at play here is that a penalty is imposed with a lag (it is for a past supervisory cycle) and by the time it kicks in, the management of an RE may have moved on. Regulators in the United States and Europe confronted this after the 2007–2008 global financial crisis — they changed the remuneration mechanisms for CXOs worldwide by partially linking compensation to an institution’s performance with clawback clauses for misconduct detected later. 

“The penalties imposed (in India) are a tiny fraction of the sector’s earnings. While penalties are only one component of enforcement and reputational impact, supervisory restrictions and governance directions often carry greater weight. One needs to ask (given the current penalties) whether repeat violations are becoming sufficiently expensive to discourage recurrence,” notes Rishi Agrawal, cofounder and chief executive officer (CEO) of TeamLease RegTech. 

A fault line is in how banks and non-banking financial companies (NBFCs) are penalised. The RBI has cut down on the regulatory arbitrage between them, but there is a gap in enforcement. Kartik Sharma, partner at Saxena Singhal & Vaid, a New Delhi-based chartered accountancy firm, points out that banks are penalised under Section 47A of the Banking Regulation Act, 1949, which since an amendment in 2012 allows for a penalty of up to ₹1 crore, or twice the quantifiable amount involved — whichever is higher. NBFCs come under Section 58G(1)(b) of the RBI Act, 1934, but the base penalty figure is ten times lower: ₹10 lakh, or twice the quantifiable amount, whichever is higher. 

The NBFC penalty figure was doubled from ₹5 lakh in 2019, so the gap used to be 20 times and has been narrowed since. The common reasons for which NBFCs are penalised — such as not conducting know-your-customer (KYC) exercises or missing the risk-categorisation cycle — have no quantifiable amount attached to them. The doubling never kicks in and ₹10 lakh is what applies. Both provisions allow a daily penalty for repeated defaults. And here the two are equal: ₹1 lakh a day, for banks and NBFCs alike. Neither figure under Section 58G was touched by the Banking Laws (Amendment) Act, 2025, which reopened five statutes, including the RBI Act, 1934. 

Sharma throws in a depth charge: The working Indian precedent for scaling penalties to the offender (rather than merely fixing them in rupees). He cites the Competition (Amendment) Act, 2023 and the Competition Commission of India’s 2024 guidelines: Penalties can run up to 10 per cent of average global turnover. Apple is challenging the provision in the Delhi High Court as being disproportionate and unconstitutional. Importing it wholesale into financial regulation would invite the same fight. “But the idea itself isn’t foreign to Indian law. There’s also inconsistency. An NBFC facing a ₹10 lakh RBI ceiling for a KYC failure can face up to ₹250 crore under the DPDP Act, 2023 for mishandling the same customer’s data. I wouldn’t import that number either (into the RBI framework, that is), but it also doesn’t do the banking regulator’s ceiling any favours by comparison.” 

Managing domains 

A related aspect is the increasing intersection between financial sector regulators: How do you pin a penalty framework given this? “For large cross-domain groups (financial conglomerates), models such as lead-regulator coordination and joint supervisory engagement are the way out, building on the FSDC (Financial Stability and Development Council),” feels Anuroop Omkar, founding partner at AK & Partners. This can provide clarity and reduce duplication for REs. Harmonisation of the compliance baseline — common KYC, shared infrastructure, interoperable consent, and coordinated grievance and ombudsman mechanisms — will ensure that overlapping mandates translate into streamlined rather than duplicative compliance. 

Then you have the scale-based approach to enforcement — a key agenda set by Mint Road as part of its enforcement initiatives for FY24. While its details have not been spelt out, it may have led to a hike in the penal amount and linking it to the size of REs, especially for systemically important entities. In the case of state-run banks, remarks made by the RBI’s senior supervisory manager on key management personnel would have weighed on how they progressed in their careers. Plus, the option of an additional capital charge on REs. Incidentally, the RBI was to undertake a complete review of its penalties framework. 

The woes at IndusInd Bank put the spotlight back on the scale-based approach to enforcement. And on the circular on the “Compensation of whole-time directors, CEOs, material risk-takers and control function staff in banks” (November 4, 2019). While the circular said the approach will kick in only for pay cycles beginning from or after April 1, 2020, it was to apply to prior slip-ups by way of clawback. It basically fine-tuned an earlier circular of January 13, 2012. (The objective of the November 2019 circular was to better align with the Basel-based Financial Stability Board’s March 2018 “Principles and Implementation Standards for Sound Compensation Practices and the Supplementary Guidance” on the use of compensation tools to address misconduct risk.) This was tested during the Yes Bank fiasco, but censure by way of clawback can be litigated and it can take years before a final settlement is reached. 

Whichever way you consider, Mint Road’s penal framework may need a relook.