After PMC crisis, tighter norms in place for urban cooperative banks

The Reserve Bank of India (RBI) on Thursday announced a slew of measures related to urban cooperative banks (UCBs), including exposure norms, a credit repository and cybersecurity norms.

While guidelines for these measures are yet to be released, the announcements show the central bank’s intent to tighten regulations for urban cooperative banks.

This category of banks came into focus on 24 September when RBI put severe curbs on Punjab and Maharashtra Co-operative (PMC) Bank Ltd, including on cash withdrawals, amid a probe into accounting lapses. Cash withdrawals were capped at ₹1,000 per account for six months, but subsequently relaxed to ₹50,000 as panic spread among depositors. The restrictions, under Section 35A of the Banking Regulation Act, were aimed at preventing a run on the bank that could end up endangering the stability of the entire financial system because of a contagion effect.

The first of the three measures by RBI was to reduce concentration risks in the exposures of UCBs. The central bank said on Thursday that it plans to amend certain regulatory guidelines relating to exposure norms for single and group or interconnected borrowers, promotion of financial inclusion and priority sector lending.

Under the current norms for UCBs, the exposure to an individual borrower should not exceed 15% of its capital funds, and the exposure to a group of borrowers should not exceed 40% of its capital funds.

Rajnish Kumar, chairman, State Bank of India (SBI) said in a statement that on the development and regulatory front, the steps announced for cooperative banks will facilitate increased public confidence in these institutions.

The RBI has already put in place an exposure framework for commercial banks. The Large Exposure Framework (LEF), effective from 1 April 2019, seeks to reduce concentration risk in the banking industry, already saddled with bad loans. It aims to align with the standards on a supervisory framework for measuring and controlling large exposures issued by the Basel Committee on Banking Supervision.

“These measures are expected to strengthen the resilience and sustainability of UCBs and protect the interest of depositors,” said RBI on Thursday, adding that a draft circular proposing the changes for stakeholder comments will be issued shortly.

The PMC Bank case showed how the bank had disbursed most of its loans to a single borrower group. According to a PTI report on 29 September, erstwhile managing director of the bank, Joy Thomas, reportedly admitted to RBI that the bank’s actual exposure to the bankrupt real estate firm Housing Development & Infrastructure Ltd (HDIL) is more than ₹6,500 crore, a whopping 73% of its total assets of ₹8,880 crore.

The second measure relates to bringing UCBs under the ambit of RBI’s Central Repository of Information on Large Credits (CRILC). The central bank said that it has been decided to bring UCBs with assets of ₹500 crore and above under the CRILC reporting framework. The database is used by banks and other financial institutions to share, among themselves and with RBI, the classification status of borrowers. Detailed instructions will be issued by 31 December 2019, it said.

The third measure is meant to strengthen the cybersecurity practices of these cooperative banks. RBI said it had prescribed a set of baseline cybersecurity controls for UCBs in October 2018 and has now decided to prescribe a comprehensive cyber security framework for the UCBs. RBI said that the framework would mandate implementation of progressively stronger security measures based on the nature, variety and scale of digital product offerings of banks.

“Since these service providers also have exposure to the payment system landscape and are, therefore, exposed to the associated cyber threats, it has been decided that certain baseline cybersecurity controls shall be mandated by the regulated entities in their contractual agreements with these service providers,” it said.

According to RBI, such measures would, among others, include implementation of bank specific email domain; periodic security assessment of public facing websites/applications; strengthening the cybersecurity incident reporting mechanism; strengthening of governance framework; and setting up of Security Operations Center (SOC). Detailed guidelines in this regard will be issued by 31 December, it said.

Meanwhile, even members of an RBI cooperative society have not been immune to the PMC Bank crisis. Mint reported on 26 September that the Reserve Bank Officers’ Cooperative Credit Society Ltd (RBOCCS) has fixed deposits totalling ₹105 crore with PMC Bank.

According to the FY19 annual report of RBOCCS, the quantum of the fixed deposits was at ₹96 crore at the end of FY18 and has increased 9% since then. This deposit is part of the cooperative society’s investments of ₹478.64 crore in fixed and short-term deposits in addition to shares of one cooperative bank. Of this, ₹473.36 crore is in fixed deposits while ₹5 crore is in a short-term deposit. It also owns 2,784 shares of ₹1,000 each of Mumbai District Central Cooperative Bank. All the deposits are in various cooperative banks, showed the annual report. The largest of these fixed deposits, as on 31 March 2019, was in PMC Bank, followed by ₹100 crore in Bharat Cooperative Bank (Mumbai) Ltd.

The central bank also had to assure the public that the banking system is “safe and stable” following rumours about the financial health of certain banks, including cooperative banks.

“There are rumours in some locations about certain banks including cooperative banks, resulting in anxiety among the depositors. RBI would like to assure the general public that Indian banking system is safe and stable and there is no need to panic on the basis of such rumours,” RBI had said in a tweet.