Senior bankers point out that while they will eventually attract qualified professionals, onboarding them takes time.
The situation at Paytm Payments Bank has heightened the urgency to onboard top-flight information technology personnel in the financial services space.
The Reserve Bank of India's master direction issued on November 7 last year said that regulated entities -- banks, non-banking financial companies, including financial technology companies -- must establish a board-level IT strategy committee (ITSC) with a minimum of three directors as members.
The chairperson is required to be an independent director with 'substantial IT expertise' in managing/guiding IT initiatives, and other members must be 'technically competent'.
Mint Road's directive to establish ITSC takes effect from April 1, 2024, and with less than two months remaining, some regulated entities, sources say, may seek a relaxation in the time frame to comply.
The RBI defines 'substantial IT expertise' as a person with a minimum of seven years of experience in managing information systems and/or leading/guiding technology/cybersecurity initiatives/projects.
Such members should also understand business processes at a broader level and the impact of IT on these processes.
'Technically competent' is detailed as the ability to understand and evaluate information systems and associated IT/cyber risks.
Senior bankers point out that while they will eventually attract qualified professionals, onboarding them takes time.
The increased scrutiny on independent directors, given the governance premium placed by RBI recently, coupled with the lower levels of compensation compared to what is offered in wider India Inc for the same talent, has made hiring challenging.
Independent directors are also not allowed to have a business relationship with the regulated entities on whose boards they sit.
On January 31, the RBI came down hard on Paytm Payments Bank, stating that the comprehensive system audit report and subsequent compliance validation report of external auditors revealed persistent non-compliance and continued material supervisory concerns in the bank, warranting further supervisory action.
Interestingly, on the same day, the RBI also mentioned that it had recently assessed select supervised entities regarding the prevailing system for internal monitoring of compliance with regulatory instructions and the extent of usage of technological solutions to support this function.
Supervised entities adopted varying levels of automation for this function, ranging from the use of macro-enabled spreadsheets to workflow-based software solutions.
The automation of the compliance monitoring process remains a work in progress, with various aspects of this function being carried out with significant manual intervention.
The need to implement comprehensive, integrated, enterprise-wide, and workflow-based solutions/tools to enhance the effectiveness of this function was emphasised.
On December 28, RBI Deputy Governor Swaminathan Janakiraman drew attention to incidents of unscheduled downtimes inconveniencing several customers.
Many banks have not been fully spending the budget earmarked for the procurement of IT systems and IT security systems.
Banks need to proactively commit adequate resources for augmenting their IT infrastructure, commensurate with their business plans, and also monitor them for their continued availability and stability.
Janakiraman reiterated that the 'boards and ITSC of banks need to step up their oversight in this matter'.
Feature Presentation: Ashish Narsale/Rediff.com
