The Reserve Bank of India (RBI) has, by an order dated April 29, 2025, imposed a monetary penalty of ?97.80 lakh (Rupees Ninety seven lakh eighty thousand only) on ICICI Bank Ltd. (the bank) for non-compliance with certain directions issued by RBI on ‘Cyber Security Framework in Banks’, ‘Know Your Customer (KYC)’, and ‘Credit Card and Debit Card – Issuance and Conduct’. This penalty has been imposed in exercise of powers conferred on RBI under the provisions of Section 47A(1)(c) read with Section 46(4)(i) of the Banking Regulation Act, 1949.

The Statutory Inspection for Supervisory Evaluation (ISE 2023) of the bank was conducted by RBI with reference to its financial position as on March 31, 2023. Based on supervisory findings of non-compliance with RBI directions and related correspondence in that regard, a notice was issued to the bank advising it to show cause as to why penalty should not be imposed on it for its failure to comply with the said directions.

After considering the bank’s reply to the notice, additional submissions made by it and oral submissions made during the personal hearing, RBI found that the following charges against the bank were sustained, warranting imposition of monetary penalty:

The bank failed to report a cyber security incident to RBI within the stipulated timeline;

The bank failed to put into use a robust software for throwing alerts for certain categories of accounts;

The bank failed to send credit card bills / statements to certain customers, but levied late payment charges.

The action is based on deficiencies in regulatory compliance and is not intended to pronounce upon the validity of any transaction or agreement entered into by the bank with its customers. Further, imposition of monetary penalty is without prejudice to any other action that may be initiated by RBI against the bank.