What changed
RBI has permitted scheduled Urban Co-operative Banks (UCBs) meeting specific financial and prudential criteria to offer internet banking to customers. Eligible UCBs must frame a board-approved internet banking policy aligned with RBI's technology, security, and legal guidelines, and obtain prior permission from the concerned Regional Office.
What it means for you
This opens a new digital channel for UCBs to compete with commercial banks, enhancing customer convenience and operational efficiency. However, compliance costs for IT security, audits, and policy documentation will rise. Banks must ensure robust risk management and customer disclosure to avoid regulatory action.
What you must do
- Verify eligibility: networth ≥₹100 crore, CRAR ≥10%, net NPA <5%, net profit for last 3 years.
- Get board approval for an internet banking policy covering technology, security, legal issues, and customer disclosure.
- Engage a Certified Information System Auditor (CISA) to certify IT/IS policy adherence.
- Submit application to RBI Regional Office with policy, cost-benefit analysis, operational details, and auditor certificate.
- Implement segregation of IT and IS duties, appoint a network/database administrator, and set up intrusion monitoring tools.
Who it affects
Scheduled Primary (Urban) Co-operative Banks, IT and Information Security teams of UCBs, Board of Directors of eligible UCBs, Customers of eligible UCBs
What are the minimum eligibility criteria for a UCB to offer internet banking?
A scheduled UCB must have a minimum networth of ₹100 crore, CRAR of at least 10%, net NPA less than 5%, and must have earned net profit continuously in the last three financial years.
What documents must accompany the application to RBI for internet banking permission?
The application must include a board-approved internet banking policy, a cost-benefit analysis, details of technology and business partners, systems and controls for risk management, and a certificate from a Certified Information System Auditor confirming adherence to IT/IS policy requirements.
What are the key technology and security standards required for internet banking?
Banks must have an information security policy, segregate IT and IS duties, appoint a separate Information Security Officer, ensure no direct internet-to-bank system connection, disable unnecessary services like FTP/telnet, log all accesses, and use intrusion monitoring tools. Regular penetration testing is also required.