PremiumOn a balmy December morning in 2019, Reserve Bank of India (RBI) deputy governor Mahesh Kumar Jain was chauffeured from the central bank’s headquarters in Fort, Mumbai’s business district, to HDFC Bank Ltd’s data centre in Navi Mumbai on the city’s outskirts.
The 34-kilometer trip by Jain, a former IDBI Bank Ltd chief executive officer (CEO), was more of symbolic import than anything else.
HDFC Bank, India’s largest private sector lender by assets, had sparked consternation among its customers some weeks ago when online transactions ran into glitches. Jain’s visit to the bank’s data centre was to drive home to HDFC Bank that the regulator had taken serious note of the digital transaction failures.
“By sending a deputy governor to its data centre, the regulator was trying to convey to the bank management that it meant business," said a person aware of the matter who spoke on the condition that he wouldn’t be identified.
Social media had been inundated with complaints, many of them tagging the central bank. Customers complained that they had been unable to transfer funds or even check their account balance. At its bi-monthly monetary policy press conference in December 2019, RBI officials also confronted questions from the media over what had gone wrong at HDFC Bank and responded that they were trying to stanch the problems.
Between 1 and 31 December, the bank’s shares on the BSE slid 0.22%, while the benchmark Sensex was up 1.13%. In a conference call with journalists a few weeks later, Sashidhar Jagdishan, then the head of finance, said that the bank had underestimated the volume of its digital transactions.
In October 2020, Jagdishan became the CEO after Aditya Puri’s retirement, after one of the longest stints at the helm by a private sector Indian banker. The digital outages weren’t a legacy he would have welcomed. More importantly, the fact that outages have repeatedly hit India’s most valued private bank is a broader problem for the industry and the regulator, especially at a time when the pandemic has hastened the digital shift. What’s in store when more Indians decide to access banking services mainly via the internet?
An email sent to HDFC Bank seeking comments remained unanswered. However, Jagdishan, sent an email to employees on 19 April 2021 which contained official reasons for each of the outages. For instance, the December 2019 disruption was on account of a faulty system upgrade patch and that, in November 2020, it was caused by a third-party human error, he wrote.
An email sent to RBI remained unanswered as well.
What went wrong?
Subsequent to the initial spate of digital transaction failures in 2019, HDFC Bank suffered at least two other major online outages. Customers complained again and the bank apologized. But it was to become a pattern. Customer complaints would be followed by news reports, the bank would say sorry, and life would go on. At a loss to explain what was going on, analysts questioned the bank at regular intervals, trying to push for a substantial response. The bank continued to offer abstruse explanations, holding back more than it gave away.
Experts say that a lack of sufficient investments in information technology (IT), which ran counter to HDFC Bank’s attempt to position itself as a frontline digital bank, was one possible reason for the glitches that beset the lender.
The bank wanted to be a leader in digital banking, but without infusing a commensurate amount of money to ensure the system was failsafe. According to industry executives who didn’t want to be named, two possibilities may explain what went wrong at the bank in 2019 and why the glitches surfaced so often.
One, expanding its business at a brisk pace, the bank had become complacent and did not upgrade its IT infrastructure sufficiently, these executives said. Second, the bank’s servers were simply overwhelmed into capitulation in December 2019 by an extraordinary amount of digital traffic resulting from a suspected cyberattack, a theory HDFC Bank has denied.
Indeed, consultants said, HDFC Bank has followed a prudent strategy in terms of maintaining its cost to income ratio at below 40%. While the bank invested in expanding its network to over 5,000 branches, it skimped when it came to investments in technology. Unlike other banks, HDFC Bank avoided hiring external consultants to build its digital business. Instead, it encouraged its executives to set up in-house systems, a sign the management exercised tight control over spending.
“On the technology side also, they have been quite cost-conscious," said a consultant at one of the Big Four accounting firms who requested anonymity.
“The thing about technology is that it is difficult to have a very optimized infrastructure. If you are offering mobile banking, you will have a separate mobile banking server and a core banking server. If you want to optimize cost, you have to be precise when you are estimating traffic on each of those servers. If your traffic estimate is off by a little, there can be outages," said the consultant.
Victim of own success
HDFC bank’s digital journey, in its current form, started in 2014 when founding managing director and CEO Puri returned from a trip to Silicon Valley, determined to replicate at home the fintech disruption happening there. His message to employees was clear—disrupt the bank before a third party does.
In his book HDFC Bank 2.0, Tamal Bandyopadhyay writes that Puri had set targets to reduce turnaround time, revolutionize marketing procedures, and apply artificial intelligence to the lender’s functioning. It isn’t surprising given HDFC Bank’s quest for growth based on a target-driven approach.
Given the bank’s initial ambition to not just be a part of but to conquer the digital banking future, things seem to have gone astray somewhere down the road.
“The management used to make power point presentations when asked about the glitches and the issues got buried there. Two board members are in fact technology experts. The bank focussed only on maintaining margins," a former banker said on condition of anonymity.
HDFC Bank also did not build its own data centre, as its rivals did. The lender outsourced the data centre infrastructure to Reliance Communications Limited in Dhirubhai Ambani Knowledge City (DAKC), Navi Mumbai.
According to a person aware of the matter, former chief information officer Munish Mittal proposed to the management that the bank set up its own data centre before he left the firm in July 2020, but it was put in cold storage. The person requested anonymity.
The bank realized the importance of an in-house data centre only when an outage hit the Navi Mumbai facility in November last year. This hit the bank’s ATM network as well as transactions on the unified payments interface (UPI), credit cards and debit cards.
“It was not a power outage at the data centre as was made out to be by the bank. It is very rare to have a complete power outage at a data centre as there are backup inverters and power generators to support," said the person cited above. “What happened was that the air conditioning at the data centre failed, which led to the heating up of the systems."
Former RBI deputy governor R Gandhi said the lender may not have reviewed if its technological capacity had expanded in line with business requirements.
“As part of the technology planning, the bank needs to see whether demand on the system is increasing. I believe HDFC Bank had the right amount of preparation, had created additional capacity but probably it was not reviewed in good time. As technology becomes more complex, change is not easy," said Gandhi.
Other bankers say it is unrealistic to expect zero downtime in digital services. “Over the last couple of years, banks have become more like tech firms," said Deepak Sharma, president and chief digital officer at rival Kotak Mahindra Bank Ltd. Sharma added: “There is no silver bullet. For instance, if I have to move an application to the cloud, it is not an overnight journey."
The second theory offered by experts, of a suspected cyberattack, although less plausible, is still an interesting one. It is speculated that the bank faced a so-called distributed denial-of-service (DDoS) attack, which led to the disruption. The bank has denied this.
“It could also have been a cyberattack," said a former RBI official on condition of anonymity. These are typically software programs or computer-generated messages aimed at weakening the IT systems and impairing their ability to handle fund transfers. The question that arises is this: Given RBI’s tight supervision of banks, how come the suspected flaws in the bank’s IT backbone had avoided detection for so long. The former central bank official explained that while RBI indeed performs risk-based audits of banks, it does not subject their IT systems to thorough inspections. Such inspections are part of the statutory and internal audits by banks, and only if those audits raise any red flags does the central bank get involved.
Irritant for management
Since the first outage in December 2019, the RBI has been in talks with the bank and sent it a questionnaire to assess what kind of solutions it was implementing to avoid a repeat. Even while these talks were on, the bank confronted another outage in November 2020.
The RBI couldn’t ignore the November failure, and ordered HDFC Bank to stop all new launches of digital products and suspend signing up new credit card customers until fixes are put in place. The bank had been adding over 100,000 credit card customers every month between April and November 2020.
The lender has given RBI a blueprint on how it plans to tackle the issues, chief financial officer Srinivasan Vaidyanathan told analysts on a call in January. The bank expects its strategies to take shape in 10-12 weeks, following which it will request an inspection by the regulator; it is also making some long-term technology upgrades that will take 12-18 months, he said. On a call with analysts on 17 April, the bank repeated the claims.
Interestingly, between the two calls, another breakdown of e-banking services took place at HDFC Bank. Analysts say the glitches need to be resolved soon and the impact of the regulatory ban on sourcing of new-credit card customers will hurt the bank in the long run.
“The RBI’s suspension of new card acquisition due to continued tech outages remains an irritant," analysts at Emkay Research wrote in a note on 19 April.
Granted, HDFC Bank is not the only lender in India to be hit by digital disruptions. But what befuddles everyone is not just the frequency of outages, but also the time taken to fix them.
State Bank of India (SBI), which has more account holders than any other lender in India, obviously has experienced more disruptions than HDFC Bank, but its outages are relatively short-lived although more frequent. Between September 2020 and March 2021, HDFC Bank experienced seven disruptions (both major and minor) and SBI had 29, shows data from Downdetector, which tracks digital outages in banks and other online services.
A key differentiator, however, is their share valuations. HDFC Bank stock is trading at a one-year forward price-to-earnings multiple of 18.12 times, a considerable premium to SBI’s 7.92.
“The significantly higher valuation of HDFC Bank does not leave any room for it to slip up. When you are traded at those valuations, the market does not want you to falter," said Hemindra Hazari, an independent commentator.
The valuation hinges not just on profits, but also on the assumption that the bank is providing a superior service to customers, Hazari said. “When you claim to be so digitally savvy, as was their unique selling point, but have not invested in IT, then it is a critical shortfall," he added.
HDFC Bank is now at a crucial juncture—customers will compare the bank’s digital performance not with that of its peers alone, but with nimbler financial technology companies that do not have the baggage of legacy banks. That’s not an apples-to-apples comparison certainly, but it will test HDFC Bank’s mettle.
As the former RBI official cited above put it, the December 2019 visit to HDFC Bank’s data centre by deputy governor Jain should have made the lender get its act together. “From what I have seen since then, it does not seem to have had the intended impact," he said.
