Foreign holding rules for NBFCs raise risk of data breaches

 Foreign holding rules for NBFCs raise risk of data breaches 

The Indian financial system faces a new threat from overseas – data and capital dumping. The regulatory arbitrage between NBFCs and banks could open up avenues through which Chinese investors in NBFCs could take out data of Indian borrowers. While the Reserve Bank of India has been strict with foreign ownership of Indian banks, a loophole in NBFCs’ ownership, which are competing and eating into market share of banks, poses a threat. 

The industry is concerned about the easy access of data by foreign entities in the financial services sector. Some leading players want to have a relook at the regulation relating to holding structure of NBFCs. “There are two different issues --one is data and the other is capital dumping,” said Gagan Banga, vice chairman, Indiabulls Housing Finance. “If capital dumping is coming from promoters, who are in the habit of losing capital for the first few years and building business on it, lending recklessly creates instability for a long time.” 

Foreign ownership of up to 100 per cent is allowed in NBFCs. 

NBFCs now account for a fourth of credit flow into India. There is an arbitrage as within banks foreigners cannot own more than 74 per cent and no one single foreign entity can hold more than 5 per cent. 

At present, there are over 12,000 NBFCs and many are fully-owned owned by foreigners. For instance, Fullerton is a wholly-owned subsidiary of Temasek Holdings, Singapore. If NBFCs have dominant control, then foreign promoters will have access to Aadhar document, which can become a national security issue. India should form rules against capital dumping by introducing a benchmark rate like MCLR for banks,” said Banga. 

In April, the RBI had asked all payment players to ensure data related to payment system to be stored inside the country within six months to reduce the risks from data breaches. The central bank had observed that currently only certain payment system operators and their outsourcing partners store the payment system data either partly or completely in India. 

Similarly, Irda insists that control and management have to be in India. Foreign banks have to adapt to all rules applicable to scheduled commercial banks. RBI has brought parity between banks and NBFCs to a large extent. The NPA recognition norms of 90 days past due was introduced recently. Industry experts have been advocating for tightening of NBFC regulation. 

“Sectors like telecom, auto and FMCG have a strong presence in India with a huge customer base which gives them easy access to data. While the concern may be valid, but why single out NBFCs?” said Raman Aggarwal, chairman, FIDC. “There is a biased view being taken in singling out the NBFC sector. The core issue is not specific to the NBFC sector, but to any sector where foreign participation is allowed. To single out NBFC is a narrow view,” he said. 

The Economic  Times, New Delhi, 18th June 2018