India said to punish Paytm Bank for data leaks to Chinese firms

Paytm Payments Bank, which processes transactions for India’s digital payments giant Paytm, was barred from taking on new customers because it violated rules by allowing data to flow to servers abroad and didn’t properly verify its customers, according to a person familiar with the matter.

Annual inspections by the Reserve Bank of India found that the company’s servers were sharing information with China-based entities that indirectly own a stake in Paytm Payments Bank, the person said, asking not to be identified as the details are private. Paytm Payments Bank is a joint venture between Paytm and its founder Vijay Shekhar Sharma. China’s Alibaba Group Holding Ltd. and its affiliate, Jack Ma’s Ant Group Co., own shares of Paytm, according to exchange filings.

An email to the RBI wasn’t immediately answered. Paytm didn’t respond to an email seeking comment. 

In a statement late Friday, the RBI had cited “material supervisory concerns” for its action, without elaborating. Shares of Paytm, formally known as One 97 Communications Ltd., tumbled as much as 13.3% Monday.

While the RBI had similarly punished companies including American Express Banking Corp. and Mastercard Inc. for flouting data-storage rules, the concerns around Paytm Payments Bank are particularly sensitive given India’s hostile political relationship with China. 

India has banned hundreds of apps linked to or originating from China over the past two years following a bloody clash at the nations’ disputed border. Paytm Payments Bank, being a regulated financial institution, was required to maintain a so-called service level agreement with its technology vendor that would ringfence the entity from its owners, the person said. 

Paytm Payments Bank had also onboarded thousands of clients without adequate know-your-customer documentation and the concern was that some of these could have been mules for money laundering, the person added. 

The regulator now wants Paytm Payments Bank to appoint a technology auditor in consultation with the RBI, the person said. The company is taking steps to comply with the RBI’s directive, including the appointment of an external auditor, the company said in a statement on Saturday. Existing customers will be unaffected.

The punishment will make it tough for Paytm Payments Bank to be upgraded to a small finance bank, limiting its ability to attract large deposits, according to Macquarie Capital analyst Suresh Ganapathy. ICICI Securities Ltd. cut its price target on Paytm to to 1,285 rupees from 1,352 rupees. The stock was trading at 691 rupees as of 3 p.m. in Mumbai Monday. 

Paytm Payments Bank has over 300 million wallets and 60 million bank accounts, according to its website. The bank said it has over 100 million KYC-compliant customers and has been adding 0.4 million users every month.