Sting For India’s Banking Tale: Paytm’s punishment and the pain ahead

Paytm's strained relationship with regulators may not bode well for its lending partnerships moving forward.

Paytm, with all the RBI restrictions, is now a pay-when-able bank.

On Wednesday evening, the Reserve Bank of India restricted business activities of Paytm Payments Bank Ltd, instructing it to halt all banking activities by the end of February. The existing customers have the liberty to withdraw funds and deplete balances in prepaid cards or wallets without constraints, the regulatory message is clear: adherence to compliance standards is non-negotiable.

The central bank, in a statement, disclosed that an audit report uncovered "persistent non-compliances and ongoing significant supervisory concerns within the bank, necessitating additional supervisory measures." To an outside observer, this is essentially regulator-speak that the situation is worse than what they estimated it to be.

The previous occasion RBI used Section 35A of the Banking Regulation Act was to manage a mismanaged bank. There it had at least stopped the consumers from withdrawing their deposits. In this case, the regulator has allowed for free exit of all monies. A case that might end up emptying the payments bank’s coffers.

Earlier in October 2023, the RBI had acted against Paytm Payments Bank, identified breaches in specific provisions related to 'RBI Guidelines for Licensing of Payments Banks,' 'Cybersecurity framework in banks,' and 'Securing mobile banking applications, including the UPI ecosystem.' This action followed an extensive system audit exposing a recurring pattern of inadequate Know Your Customer (KYC) checks during customer onboarding and persistent violations of compliance standards.

The RBI had stated that Paytm Payments Bank failed to identify beneficial owners for entities providing payout services and neglected to monitor payout transactions and conduct risk profiling for entities availing payout services – serious regulatory concerns constituting the fundamental responsibilities of any bank.

A comprehensive system audit, coupled with an acknowledgment of inadvertent omissions and a commitment to addressing deficiencies, is urgently needed. However, the crucial question remains: Will consumers wait – guesstimated around 12-18 months – for such an overhaul? Doubtful.

A digitally-led bank, facing stringent regulatory action for core-banking functions, exposes a fundamental paradox. Its inability to adhere to basic cybersecurity and Know Your Customer (KYC) norms underscores a critical lapse in core functions expected from any financial entity in the 21st century. In an era dominated by digital transactions and evolving technological landscapes, such failure is not just a compliance failure but a blatant disregard for the security and trust that customers place in such institutions.

This incident should serve as a wakeup call for all financial entities, emphasising that regardless of their digital nature or size of equity they have raised or the high-profile personalities on their capTable or Boards, the foundational principles of cybersecurity, data governance and regulatory adherence remain non-negotiable. If they want to be in the finance business, toe the regulatory line.

It’s a message to get their Consumers, CapTable, Compliance, Cyber - correct.

Paytm's strained relationship with regulators may not bode well for its lending partnerships moving forward. Their repeatedly shifting pivot

towards "lending" now faces scepticism, as potential lenders may reconsider their faith in the entity's capability to co-lend or onward-lend.

For those litigation-minded, trying to take on the regulator for these actions, won’t cut ice. The banking law allows for this type of serious power for the regulator to take action, where it feels that public interest is in threat. That is the indication of how serious the regulator is looking at this issue. Every single past litigation around regulatory supervisory authority has been upheld in favour of the regulator.

Furthermore, will the regulator place trust in the current leadership? This is a leadership which, under its watch, witnessed a collapse of compliance and non-adherence to RBI regulations, leading to this extensive regulatory action. In the finance sector, trust forms the bedrock of the ecosystem.

Disregarding regulators, simply because one is a poster boy for their industry vertical, holds no sway with the regulators, atleast the RBI. For those sceptical about regulatory independence in India, consider this a potent wake-up call. This is also a message to other financial regulators to showcase their supervisory independence and proactively act against errant entities.

Perhaps Paytm can and will embark on a comprehensive overhaul of its compliance architecture, demonstrating true intent by having all current management members step down from its Boards. Let the management teams focus on getting their core job right – operational excellence, before they jump to handle additional governance roles. Genuine governance intent could be showcased by bringing in external experts, given the apparent shortcomings of the existing leadership and board members despite their commendable pedigree.

Another aspect: Will this play out towards Paytm merging with another financial giant looking to scale ? After all, the valuations would be depressed for a good merger.

Crucially, this serves as a clue to the RBI to leverage this incident as an opportunity for evaluating the viability and relevance of the 'payments banks' category. When the licence category was shaped, this category of licensing was introduced, the payments ecosystem had yet to gain significant traction. The present consumer ecosystem is far more digital and mobile first. Probably time to introspect on what type of licence would be useful.