RBI Fines Jilla Sahakari Bank, Azamgarh ₹1.15 Lakh Over CIC Reporting and CKYCR Delays

The Reserve Bank of India imposed a ₹1.15 lakh monetary penalty on Jilla Sahakari Bank Ltd., Azamgarh, Uttar Pradesh, after identifying failures in two different regulatory reporting processes: borrower credit information was not reported to all Credit Information Companies (CICs), and customer KYC records were not uploaded to the Central KYC Records Registry (CKYCR) within the prescribed timeline.

RBI announced the action on September 10, 2026. The penalty order itself is dated September 9. The amount is relatively small, but the case is useful because both findings involve controls that can be tested objectively from system records: whether the required data reached every required destination, and whether it reached there on time.

RBI found two separate reporting failures

The first finding relates to credit information. RBI said the bank failed to report the credit information of its borrowers to all CICs. The second relates to KYC infrastructure: customer KYC records were not uploaded to CKYCR within the prescribed timeline.

Those are not the same compliance problem. CIC reporting feeds the credit-information system used by lenders and credit bureaus. CKYCR is the central repository for customer KYC records. Treating both simply as a generic “data submission issue” can hide the control failure that actually matters.

The RBI release also does not disclose how many borrower or customer records were affected, the length of individual delays, or whether every delayed CKYCR record arose from the same type of KYC event. Those details should not be inferred from the penalty amount.

RBI's published information names four registered Credit Information Companies (CICs): TransUnion CIBIL, Equifax, Experian and CRIF High Mark. CICs receive and maintain credit information reported by banks and other credit institutions. That makes the words “all Credit Information Companies” important in this order: a successful submission to one bureau does not by itself establish complete reporting to every required CIC. RBI's published CIC information lists the four companies.

The CIC issue is about complete delivery, not merely generating a file

RBI tightened the frequency of credit-information reporting through its August 8, 2024 direction. For the institutions covered by that direction, including specified categories of co-operative banks, credit information is to be updated on a fortnightly basis — as on the 15th and the last day of the month — or at a shorter mutually agreed interval. The relevant fortnight's information is to be submitted to CICs within seven calendar days. These requirements took effect from January 1, 2025.

That context gives the phrase “to all Credit Information Companies” practical significance. A control that proves only that one reporting file was generated, or that one CIC received data, does not by itself establish complete compliance where information is required to reach multiple CICs.

For an internal audit or compliance review, the stronger evidence is a reconciliation between the reportable borrower population and destination-level submission records. Missing borrowers, rejected records and failed or delayed resubmissions should remain visible until resolved. That is an audit implication of the reporting framework; RBI's penalty announcement itself does not prescribe a specific audit procedure for this bank.

CKYCR deadlines depend on what triggered the reporting obligation

CKYCR is the Central KYC Records Registry, the central digital repository used for receiving, storing, safeguarding and retrieving customer KYC records. A CKYCR-upload failure is therefore different from simply having KYC documents available inside the bank: the regulatory issue is whether the required record reached the central registry within the applicable timeline. Readers looking for the wider customer-KYC framework can also refer to this guide to RBI periodic KYC and CKYCR.

RBI's KYC framework requires a regulated entity to capture a customer's KYC record and upload it to CKYCR within 10 days of commencement of a new account-based relationship.

The framework separately addresses changes to existing KYC information. Where additional or updated customer information is obtained in the circumstances covered by the KYC Direction and the applicable rules, the updated information is to be furnished to CKYCR within seven days, or within another period notified by the Central Government.

This distinction is important in the Azamgarh case. RBI said customer KYC records were not uploaded within the prescribed timeline, but its penalty release does not identify which underlying KYC event applied to every affected record. It would therefore be misleading to state that every delayed record necessarily breached the 10-day new-account rule.

A useful control test starts with the event that created the reporting obligation, identifies the applicable deadline and then compares that deadline with evidence of successful CKYCR upload. Preparing a file internally is not the same as demonstrating that the record was uploaded successfully within the applicable period.

Similar findings have appeared in recent co-operative-bank enforcement

The Azamgarh action also has useful recent context. RBI's August 27 action against Jalna District Central Co-operative Bank included a finding relating to failure to report borrower credit information to all CICs. In separate actions announced on August 31, Jai Bhawani Sahakari Bank and Mumbai District Central Co-operative Bank were cited respectively for incomplete CIC reporting and delayed CKYCR uploads.

These are separate enforcement orders and do not, by themselves, establish a new RBI policy or an industry-wide deterioration. They do show that credit-information completeness and timely KYC-registry reporting have appeared repeatedly in several recent co-operative-bank enforcement actions.

The supervisory process and the limits of the order

The enforcement followed a statutory inspection conducted by the National Bank for Agriculture and Rural Development (NABARD) with reference to the bank's financial position as on March 31, 2025. RBI says the supervisory findings and related correspondence led to a show-cause notice. The bank's reply, additional submissions and oral submissions during a personal hearing were considered before RBI concluded that the relevant charges were sustained.

The penalty was imposed using powers under the Credit Information Companies (Regulation) Act, 2005 and the Banking Regulation Act, 1949.

RBI also makes an important limitation clear: the action concerns deficiencies in regulatory compliance. It is not a ruling that transactions or agreements entered into by the bank with its customers are invalid, and the announcement does not establish customer loss or fraud merely from the existence of the penalty. RBI also states that the action is without prejudice to any other action it may initiate.

For regulated entities and assurance teams, the lasting value of this case is the evidence trail behind the two obligations. CIC and CKYCR compliance should be demonstrable at record level — completeness of the required population, delivery to the correct destination, adherence to the applicable timeline and resolution of exceptions — rather than inferred merely from the existence of a policy or a generated submission file.

Official references: RBI penalty announcement for Jilla Sahakari Bank Ltd., Azamgarh; RBI direction on frequency of credit-information reporting; RBI Master Direction – Know Your Customer (KYC) Direction, 2016.