1. What Counts as Downtime?

RBI Circular - Cyber Security Framework 2016 + IT Governance, Risk, Controls and Assurance Practices Master Direction April 2023 says:

Bank must ensure 99.5%+ uptime for critical customer facing systems. Any outage >2 hours in internet banking / mobile banking / UPI must be reported to CSITE, CERT-In and RBI within 2-6 hours. Repeated outages = Board accountability.

2. Statutory Obligations of Bank During Downtime

A. Under RBI:

1. Communication: Publish on app/website/social within 30 mins, give expected restoration time
2. TAT & Compensation - Harmonization Circular 2019:

• Failed ATM: Reversal in T+5 days, else Rs 100/day
• Failed UPI / IMPS / Card: T+1 day reversal, else Rs 100/day auto
• Delay in return of property documents after loan closure: 30 days, then Rs 5,000/day
• Delay in credit of failed transaction is compensable without customer asking - bank must auto-credit penalty

1. Customer Protection on Unauthorized Transactions 2017: If downtime leads to fraud, customer zero liability if reports within 3 days

B. Under Consumer Protection Act, 2019:
Banking is Service under Section 2(42). Person availing is Consumer. Downtime = deficiency under Sec 2(11) - any fault, imperfection in quality, manner of performance. Complainant can go to District/State/NCDRC + Ombudsman simultaneously now after 2021 amendment.

3. Landmark Cases & Regulatory Actions

CASE 1: RBI vs HDFC Bank - The First Digital Ban - Dec 2020

Facts: Between 2018-2020 HDFC Bank had 3 major outages:

• Nov 21, 2020: Primary data center power failure - internet banking, mobile, UPI down for 24+ hours
• Dec 2019: Mobile app down after new version launch
  Customers flooded Twitter.

RBI Action: Under Sec 35A Banking Regulation Act, RBI ordered:

• Stop all launches under Digital 2.0 initiative
• Stop sourcing new credit cards
• Board to examine lapses and fix accountability

This was first time in India RBI imposed business sanctions for system outages, not for capital or fraud. RBI Governor said "Public confidence in digital banking has to be maintained."

Lifted after 15 months after external IT audit by KPMG. Moody's called it credit negative.

Legal Principle: License obligation includes maintaining IT resilience. Downtime = violation of Sec 22(3)(b) - affairs detrimental to depositors.

CASE 2: RBI vs Kotak Mahindra Bank - April 2024

Facts: Repeated outages in online, mobile, UPI in 2022-23 inspection, severe deficiencies in user access management, data security, vendor risk.

RBI Action: Barred from onboarding new customers via online/mobile channels and issuing new credit cards till remediation. Stock fell 11%.

Principle: Continuous downtime triggers prompt corrective action on technology, not just financials.

CASE 3: P.N. Prasad Vs. Union Bank of India 1991(1) CPR 198 (SCDRC)
First consumer case to hold: Bank liable for deficiency for inordinate delays in providing banking services. Customer entitled to compensation for loss/injury due to delay in premature encashment of deposit certificate. Cited in all downtime cases.

CASE 4: House of Dubary Vs. New Bank of India 1991(1) CPR 216 (NC)
Rendition of accounts by bank delayed - held deficiency. Bank must provide service within reasonable time.

CASE 5: Canara Bank vs NCDRC - Supreme Court Civil Appeals 2587-2588 of 2025 - Decided 15.04.2026
Facts: Complainants deposited two cheques within validity, bank failed to present them within time, cheques expired.
Held: Supreme Court held Canara Bank guilty of deficiency in service for failure to present cheques within validity period. Bank's internal server/downtime excuse not accepted as force majeure. Must have Business Continuity Plan.
Upheld compensation but reduced quantum.

CASE 6: Arun Bhatiya vs HDFC Bank (2022) Supreme Court - FD Encashment
Held: Person availing bank's service is consumer under CPA 1986 Sec 2(1)(d)(ii). Complaint about premature encashment of joint FD in contravention of terms maintainable even if technical glitch claimed. Consumer Forum jurisdiction not ousted by Ombudsman.

CASE 7: ICICI Bank Automated Error Case - Lawful Legal Report
Customer Singh found discrepancy due to automated system error. Supreme Court examined whether bank liable for automated errors in digital banking. Held: Bank liable for deficiency in digital banking services - cannot hide behind "system error". Must ensure transparency and audit trail.

CASE 8: SunTrust / Truist US Case - 1.5M records
Not downtime but same principle: FTC held unsafe/unsound banking practice when bank failed to maintain operational controls. Used as persuasive authority in India for "unsafe IT practice".

4. Compensation You Can Claim Today

1. Auto-compensation: Rs 100/day after TAT for failed digital transaction - check statement, if not credited, raise complaint
2. Consumer Court: For loss - EMI bounce due to UPI downtime, loss of business opportunity, mental agony. File with proof of downtime screenshot + loss.
   Example: If your UPI payment for property booking failed due to bank downtime and you lost token, you can claim token amount + damages.
3. RBI Ombudsman: File on CMS portal within 30 days of bank's reply. RBI Integrated Ombudsman Scheme 2021 specifically covers "deficiency in internet/mobile banking".
4. Class Action: Under CPA 2019, multiple consumers affected by same outage can file together.

Defenses Bank Cannot Take:

• "Third party vendor failure" - RBI says bank responsible for vendor
• "Force majeure - data center power" - Must have DR on different seismic zone as per 2016 framework
• "We displayed notice" - Notice does not waive compensation if TAT breached

If you are drafting internal policy or reply to customer notice, structure should be:

Outage Root Cause -> Duration -> Customer Impact -> TAT met? -> Compensation paid -> CAPA -> Board Note