The central bank's decision stems from significant deficiencies and non-compliance observed in various areas of IT management, including inventory management, user access management, data security, and disaster recovery. Despite repeated assessments and corrective action plans, Kotak Mahindra Bank failed to address these concerns adequately.