RBI Imposes Rs 66.7 Lakh Penalty on Bank of Baroda for KYC and Fair Practices Code Violations

Background and Overview

The Reserve Bank of India (RBI), on July 3, 2026, imposed monetary penalties totalling Rs 66.7 lakh on Bank of Baroda and GIC Housing Finance Ltd for non-compliance with regulatory norms relating to the Fair Practices Code for Lenders and Know Your Customer (KYC) guidelines. The penalty on Bank of Baroda was Rs 63.6 lakh, while GIC Housing Finance was penalised Rs 3.1 lakh.

The penalties were imposed following a statutory inspection conducted by the RBI for the supervisory evaluation of Bank of Baroda with reference to its financial position as on March 31, 2025. The RBI clarified that the penalties are based on deficiencies in regulatory compliance and are not intended to pronounce upon the validity of any transaction or agreement entered into by the entities with their customers.

Specific Violations by Bank of Baroda

The RBI’s inspection of Bank of Baroda revealed two categories of regulatory violations:

Charging Interest Above Contracted Rates

The first violation relates to the Fair Practices Code for Lenders. The RBI found that Bank of Baroda had collected interest at rates higher than the contracted rate of interest in certain loan accounts. This means that borrowers were charged more interest than what was agreed upon in their loan agreements, a practice that directly violates the principles of transparent and fair lending.

The Fair Practices Code, issued by the RBI under its Master Direction on Fair Practices Code (last updated in 2024), requires lenders to clearly communicate the terms and conditions of loans to borrowers, including the applicable interest rate, and to strictly adhere to the contracted terms. Any change in interest rates must be communicated to the borrower in advance, and the borrower must be given the option to exit the loan without penalty if the terms are altered.

Failure to Upload KYC Records to CKYCR

The second violation relates to KYC norms. The RBI found that Bank of Baroda did not upload KYC records of certain customers to the Central KYC Records Registry (CKYCR) within the prescribed timelines.

The CKYCR is a centralised repository of KYC records maintained by the Central Registry of Securitisation Asset Reconstruction and Security Interest of India (CERSAI). Under the Prevention of Money Laundering (Maintenance of Records) Rules, 2005, as amended, all regulated entities are required to upload KYC records of their customers to the CKYCR within the prescribed timeline. The purpose of this requirement is to enable a unified KYC framework where customers do not need to undergo KYC verification repeatedly across different financial institutions.

Penalty on GIC Housing Finance

GIC Housing Finance Ltd was separately penalised Rs 3.1 lakh for non-compliance with certain provisions of the KYC guidelines. While the specific details of GIC Housing Finance’s violations were not elaborated upon in the same detail as Bank of Baroda’s, the penalty indicates that the housing finance company also failed to meet the RBI’s KYC norms, which apply uniformly to all regulated entities including housing finance companies supervised by the National Housing Bank (NHB) or, where applicable, the RBI.

The RBI’s Fair Practices Code: Key Requirements

The Fair Practices Code is a set of guidelines issued by the RBI that governs the conduct of lending institutions in their dealings with borrowers. The key requirements include:

• Transparent Communication: Lenders must clearly communicate all terms and conditions of a loan, including the interest rate, processing fees, prepayment charges, and any other charges, at the time of loan sanction.

• Loan Application Processing: Lenders must process loan applications within a reasonable timeframe and communicate the reasons for rejection in writing.

• Interest Rate Changes: Any change in the interest rate or other terms must be communicated to the borrower in advance. The borrower must be given the option to prepay the loan without penalty if the terms are altered.

• Non-Coercive Recovery: Lenders must not resort to harassment, intimidation, or coercive tactics for loan recovery. Recovery agents must be properly trained and authorised.

• Grievance Redressal: Lenders must have a robust grievance redressal mechanism, including a designated nodal officer for handling complaints.

KYC and CKYCR Compliance: The Regulatory Framework

The KYC framework in India is governed by the RBI’s Master Direction on KYC (updated periodically), the Prevention of Money Laundering Act, 2002 (PMLA), and the Prevention of Money Laundering (Maintenance of Records) Rules, 2005. Key requirements include:

• Customer Identification: Regulated entities must verify the identity and address of customers using officially valid documents (OVDs) such as Aadhaar, PAN, passport, or voter ID.

• CKYCR Upload: KYC records must be uploaded to the CKYCR within the prescribed timeline. For individual customers, the KYC Identifier (a 14-digit number) must be generated and communicated to the customer.

• Periodic Updation: KYC records must be periodically updated, with the frequency depending on the risk categorisation of the customer (every 2 years for high-risk, every 8 years for medium-risk, and every 10 years for low-risk customers).

• Video KYC: The RBI has permitted Video-based Customer Identification Process (V-CIP) as an alternative to in-person verification, subject to compliance with prescribed safeguards.

RBI’s Enforcement Approach

The RBI’s decision to impose penalties on Bank of Baroda and GIC Housing Finance is consistent with its broader enforcement strategy, which has become more rigorous in recent years. The central bank has been imposing penalties on banks and financial institutions with increasing frequency for violations of KYC norms, Fair Practices Code, and other regulatory requirements.

In the financial year 2025-26 alone, the RBI has imposed penalties on several major banks and non-banking financial companies (NBFCs) for various regulatory violations. The penalties serve as a deterrent and underscore the RBI’s expectation that regulated entities maintain robust compliance frameworks.

It is important to note that the RBI’s penalties are imposed under Section 47A(1)(c) of the Banking Regulation Act, 1949 (for banks) and Section 46(4) of the Reserve Bank of India Act, 1934 (for NBFCs and housing finance companies). The penalties are for regulatory non-compliance and do not constitute a finding of wrongdoing in any specific transaction.

Compliance Lessons for Banks and Financial Institutions

The Bank of Baroda penalty case offers several important compliance lessons for banks and financial institutions operating in India:

• Interest Rate Governance: Banks must implement robust systems to ensure that the interest rates charged to borrowers at all times match the contracted rates. Any discrepancy, even if unintentional or arising from system errors, can attract regulatory penalty.

• CKYCR Compliance: Timely upload of KYC records to the CKYCR is a mandatory requirement. Banks should implement automated systems to ensure that KYC records are uploaded within the prescribed timelines and should conduct periodic audits to identify and rectify any gaps.

• Internal Audit: Banks should strengthen their internal audit mechanisms to proactively identify instances of Fair Practices Code and KYC non-compliance before regulatory inspections.

• Staff Training: Regular training programmes for front-line staff on Fair Practices Code requirements and KYC procedures can help prevent inadvertent violations.

• Technology Solutions: Investment in technology solutions for loan management, interest rate computation, and KYC record management can significantly reduce the risk of compliance failures.

Recent RBI Penalty Trends

The RBI’s penalty action against Bank of Baroda and GIC Housing Finance is part of a broader enforcement trend. In the financial year 2025-26, the RBI has imposed penalties on over 30 banks and financial institutions for various regulatory violations, reflecting the central bank’s increasingly strict supervisory approach.

Notable penalties imposed by the RBI in 2025-26 include actions against HDFC Bank for non-compliance with digital lending guidelines, State Bank of India for violations of priority sector lending norms, and several cooperative banks for inadequate anti-money laundering controls. The aggregate penalties imposed by the RBI have increased significantly year-on-year, signalling that regulatory compliance is no longer an area where institutions can afford to be complacent.

The RBI has also introduced risk-based supervision (RBS) as its primary supervisory framework, under which banks and financial institutions are assessed not just on compliance outcomes but also on the robustness of their compliance processes, risk management frameworks, and governance structures. Under the RBS approach, even procedural or technical violations (such as delayed CKYCR uploads) are treated as indicative of broader systemic weaknesses and are penalised accordingly.

Financial institutions should also note that the RBI’s penalty framework was strengthened by the Banking Laws (Amendment) Act, 2012, which significantly enhanced the maximum penalty amounts. Under the current framework, the RBI can impose penalties of up to Rs 1 crore for each contravention, with additional daily penalties for continuing violations. The penalties imposed on Bank of Baroda and GIC Housing Finance, while relatively modest, represent a graduated enforcement response that could escalate for repeat violations.

Key Takeaways

• The RBI has imposed a combined penalty of Rs 66.7 lakh on Bank of Baroda (Rs 63.6 lakh) and GIC Housing Finance (Rs 3.1 lakh) for violations of the Fair Practices Code and KYC norms.

• Bank of Baroda was found to have charged interest above contracted rates and failed to upload KYC records to the CKYCR within prescribed timelines.

• The penalties reflect the RBI’s increasingly rigorous enforcement approach towards regulatory non-compliance by banks and financial institutions.

• Banks and financial institutions must ensure strict adherence to the Fair Practices Code, particularly regarding transparent communication of loan terms and interest rate governance.

• Timely upload of KYC records to the CKYCR remains a critical compliance requirement, and institutions should invest in automated systems to ensure compliance.