Executive Summary:
This circular from the Reserve Bank of India (RBI), dated September 11, 2020, outlines guidelines for compliance functions in banks and the role of the Chief Compliance Officer (CCO). It aims to bring uniformity in banks' approach to compliance and aligns supervisory expectations with best practices. Banks already having a CCO have six months to comply with the new selection processes; the instructions are effective immediately.
Key Points / Main Content:
Compliance Policy:
* Banks must have a Board-approved compliance policy detailing compliance philosophy, culture, structure, and risk management.
* The policy must include processes for identifying, assessing, monitoring, and reporting compliance risks.
* A quality assurance program must be maintained and independently reviewed at least once every three years.
* The policy should emphasize building a compliance culture and vetting regulatory compliance reports. It shall be reviewed at least once a year.
CCO Appointment and Tenure:
* CCO must be appointed for a minimum fixed tenure of 3 years.
* Transfer or removal before tenure completion requires explicit prior Board approval.
Eligibility Criteria for CCO:
* Rank: Senior executive, preferably General Manager or equivalent, not below two levels from CEO, or recruited from the market.
* Age: Not more than 55 years.
* Experience: At least 15 years in banking or financial services, with a minimum of 5 years in Audit, Finance, Compliance, Legal, or Risk Management.
* Skills: Good understanding of industry, risk management, regulations, legal framework, and supervisory expectations.
* Stature: Ability to exercise independent judgment and interact directly with regulators.
* Other: No pending vigilance case or adverse RBI observation.
Selection Process and Reporting:
* Selection based on a defined process and recommendations by a senior executive selection committee.
* Prior intimation to RBI required before appointment, transfer, or removal of the CCO, including a detailed profile and fit and proper certification.
Reporting Line and Authority:
* CCO must have direct reporting lines to the MD/CEO and/or Board/Board Committee (ACB).
* If reporting to MD/CEO, the ACB must meet the CCO quarterly without senior management.
* CCO should not have reporting relationships with business verticals or business targets.
* Performance appraisal of the CCO must be reviewed by the Board/ACB.
* CCO has the authority to access all necessary records and communicate with staff on compliance issues.
Duties and Responsibilities:
* Apprising the Board and senior management of regulations and standards.
* Providing clarification on compliance issues.
* Conducting annual compliance risk assessments and developing risk-oriented activity plans.
* Reporting major compliance risk changes to the Board/ACB/MD/CEO.
* Reporting compliance failures to the Board/ACB.
* Monitoring and testing compliance, with results reported to the Board/ACB/MD/CEO.
* Ensuring compliance with supervisory observations from RBI.
Other Requirements:
* The compliance function is subject to internal audit.
* No dual hatting is allowed for the CCO, especially roles with conflicts of interest (with some exceptions based on proportionality).
* The CCO should not be a member of committees that conflict with their responsibilities, with only an advisory role if membership exists.
* The CCO mandate includes designing and maintaining the compliance framework and training on regulatory and conduct risks.
* The Board is responsible for overseeing the compliance function, and the MD/CEO must ensure an independent function and adherence to policy.
Impact Analysis:
Banks:
* Impact: Banks must adhere to the new guidelines for compliance functions and CCO roles.
* Action Required: Update compliance policies, review and adjust CCO selection processes, and ensure current CCO appointments meet the new requirements within six months.
Chief Compliance Officers (CCOs):
* Impact: New requirements for appointment, tenure, reporting lines, and responsibilities.
* Action Required: Ensure they meet the eligibility criteria and fulfill the duties outlined in the circular.
Boards of Directors / Audit Committee of the Board (ACB):
* Impact: Increased oversight and responsibility for compliance functions and CCO performance.
* Action Required: Approve compliance policies, participate in CCO selection, review CCO performance, and meet with the CCO quarterly if they report to the MD/CEO.
Managing Directors (MD) / Chief Executive Officers (CEO):
* Impact: Responsibility for ensuring an independent compliance function and adherence to the compliance policy.
* Action Required: Implement the new guidelines, support the CCO, and ensure the bank's compliance framework is effective.
Reserve Bank of India (RBI):
* Impact: Enhanced supervisory oversight of banks' compliance functions.
* Action Required: Review and assess banks' compliance with the new guidelines.
Key Entities Referenced
Reserve Bank of India: The central bank of India, referred to as RBI, which issued the circular regarding compliance functions in banks.
Chief Compliance Officer: Designated officer (CCO) responsible for managing compliance risk in banks.
Scheduled Commercial Banks: Banks regulated by RBI, excluding Regional Rural Banks (RRBs), Local Area Banks, Small Finance Banks and Payment Banks.
Audit Committee of the Board: A committee (ACB) of the bank's board responsible for overseeing the compliance function.
Department of Supervision, Reserve Bank of India, Central Office, Mumbai: The department within the Reserve Bank of India to which prior intimation must be given before the appointment, premature transfer or removal of the CCO.
Mumbai, Maharashtra: City in Maharashtra where the central office of the Reserve Bank of India's Department of Supervision is located.
Managing Director: Abbreviated as MD, is a senior executive of a bank.
Board of Directors: The governing body of a bank, ultimately responsible for overseeing the compliance function and compliance risk.
RBI/2020-21/35
Ref. No. DoS.CO.PPG./SEC.02/11.01.005/2020-21 September 11, 2020
The Chairman / Managing Director & Chief Executive Officer
All Scheduled Commercial Banks (Excluding RRBs)
All Local Area Banks and
All Small Finance Banks and Payment Banks
Madam / Dear Sir,
Compliance functions in banks and Role of Chief Compliance Officer (CCO)
Please refer to the guidelines on compliance functions vide our circulars
DBS.CO.PP.BC.6/11.01.005/2006-07 dated April 20, 2007 and DBS.CO.PPD.10946/
11.01.005/2014-15 dated March 04, 2015.
2. As part of robust compliance system, banks are required, inter-alia, to have an effective
compliance culture, independent corporate compliance function and a strong compliance risk
management programme at bank and group level. Such an independent compliance function is
required to be headed by a designated Chief Compliance Officer (CCO) selected through a
suitable process with an appropriate ‘fit and proper’ evaluation/selection criteria to manage
compliance risk effectively.
However, it is observed that the banks follow diverse practices in this regard. The following
guidelines are meant to bring uniformity in approach followed by banks, as also to align the
supervisory expectations on CCOs with best practices.
2.1 Policy - A bank shall lay down a Board-approved compliance policy clearly spelling out
its compliance philosophy, expectations on compliance culture covering Tone from the
Top, Accountability, Incentive Structure and Effective Communication & Challenges
thereof, structure and role of the compliance function, role of CCO, processes for
identifying, assessing, monitoring, managing and reporting on compliance risk
throughout the bank. This shall, inter-alia, adequately reflect the size, complexity and
compliance risk profile of the bank, expectations on ensuring compliance to all applicable
पय�वे�ण िवभाग, के�ीय काया�लय, व�� ट�ेड स�टर, स�टर-1, कफ परेड, कोलाबा, मुंबई – 400 005
टेलीफोन: 022- 2216 3395 फै�: 022-2218 0157 ई-मेल - cgmicdosco@rbi.org.in
Department of Supervision, Central Office, World Trade Centre, Centre I, Cuffe Parade, Colaba, Mumbai - 400 005
Tel: 022-2216 3395 Fax: 022-2218 0157 e-mail: cgmicdosco@rbi.org.in
ब�क िहन्दी म� प�ाचार का स्वागत करता है।statutory provisions, rules and regulations, various codes of conducts (including the
voluntary ones) and the bank’s own internal rules, policies and procedures, and creating
a disincentive structure for compliance breaches. The bank shall also develop and
maintain a quality assurance and improvement program covering all aspects of the
compliance function. The quality assurance and improvement program shall be subject to
independent external review periodically (at least once in three years). The policy should
lay special thrust on building up compliance culture; vetting of the quality of supervisory
/ regulatory compliance reports to RBI by the top executives, non-executive Chairman /
Chairman and ACB of the bank, as the case may be. The policy shall be reviewed at least
once a year;
2.2 Tenor for appointment of CCO - The CCO shall be appointed for a minimum fixed tenure
of not less than 3 years. The Audit Committee of the Board (ACB) / Managing Director
(MD) & CEO should factor this requirement while appointing CCO;
2.3 Transfer / Removal of CCO - The CCO may be transferred / removed before completion
of the tenure only in exceptional circumstances with the explicit prior approval of the
Board after following a well-defined and transparent internal administrative procedure;
2.4 Eligibility Criteria for appointment as CCO -
Rank - The CCO shall be a senior executive of the bank, preferably in the rank of a
General Manager or an equivalent position (not below two levels from the CEO). The
CCO could also be recruited from market;
Age - Not more than 55 years;
Experience - The CCO shall have an overall experience of at least 15 years in the banking
or financial services, out of which minimum 5 years shall be in the Audit / Finance /
Compliance / Legal / Risk Management functions;
Skills - The CCO shall have good understanding of industry and risk management,
knowledge of regulations, legal framework and sensitivity to supervisors’ expectations;
Stature - The CCO shall have the ability to independently exercise judgement. He should
have the freedom and sufficient authority to interact with regulators/supervisors directly
and ensure compliance;
Others - No vigilance case or adverse observation from RBI, shall be pending against the
candidate identified for appointment as the CCO.2.5 Selection Process - Selection of the candidate for the post of the CCO shall be done on
the basis of a well-defined selection process and recommendations made by the senior
executive level selection committee constituted by the Board for the purpose. The
selection committee shall recommend the names of candidates suitable for the post of the
CCO as per the rank in order of merit and Board shall take final decision in the
appointment of CCO;
2.6 Reporting Requirements - A prior intimation to the Department of Supervision, Reserve
Bank of India, Central Office, Mumbai, shall be provided before appointment, premature
transfer/removal of the CCO. Such information should be supported by a detailed profile
of the candidate along with the fit and proper certification by the MD & CEO of the bank,
confirming that the person meets the above supervisory requirements, and detailed
rationale for changes, if any;
2.7 Reporting Line - The CCO shall have direct reporting lines to the MD & CEO and/or
Board/Board Committee (ACB) of the bank. In case the CCO reports to the MD & CEO,
the Audit Committee of the Board shall meet the CCO quarterly on one-to-one basis,
without the presence of the senior management including MD & CEO. The CCO shall
not have any reporting relationship with the business verticals of the bank and shall not
be given any business targets. Further, the performance appraisal of the CCO shall be
reviewed by the Board/ACB;
2.8 Authority - The CCO and compliance function shall have the authority to communicate
with any staff member and have access to all records or files that are necessary to enable
him/her to carry out entrusted responsibilities in respect of compliance issues. This
authority should flow from the compliance policy of the bank;
2.9 The duties and responsibilities of the compliance function - These shall include at least
the following activities:
(i) To apprise the Board and senior management on regulations, rules and standards
and any further developments.
(ii) To provide clarification on any compliance related issues.
(iii) To conduct assessment of the compliance risk (at least once a year) and to develop
a risk-oriented activity plan for compliance assessment. The activity plan should
be submitted to the ACB for approval and be made available to the internal audit.(iv) To report promptly to the Board / ACB / MD & CEO about any major changes /
observations relating to the compliance risk.
(v) To periodically report on compliance failures/breaches to the Board/ACB and
circulating to the concerned functional heads.
(vi) To monitor and periodically test compliance by performing sufficient and
representative compliance testing. The results of the compliance testing should be
placed to Board/ACB/MD & CEO.
(vii) To examine sustenance of compliance as an integral part of compliance testing
and annual compliance assessment exercise.
(viii) To ensure compliance of Supervisory observations made by RBI and/or any other
directions in both letter and spirit in a time bound and sustainable manner.
2.10 Internal Audit - The compliance function shall be subject to internal audit;
2.11 Dual Hatting - There shall not be any ‘dual hatting’ i.e. the CCO shall not be given any
responsibility which brings elements of conflict of interest, especially the role relating to
business. Roles which do not attract direct conflict of interest like role of anti-money
laundering officer, etc. can be performed by the CCO in those banks where principle of
proportionality in terms of bank’s size, complexity, risk management strategy and
structures justify that;
2.12 The CCO shall not be member of any committee which brings his/her role in conflict
with responsibility as member of the committee, including any committee dealing with
purchases / sanctions. In case the CCO is member of a committee, he/she may have only
advisory role;
2.13 Typical core elements of the mandate of CCO must include the design and maintenance
of compliance framework, training on the regulatory and conduct risks, and effective
communication of compliance expectations, etc.;
2.14 The bank’s Board of Directors shall be overall responsible for overseeing the effective
management of the bank’s compliance function and compliance risk. The MD & CEO
shall ensure the presence of independent compliance function and adherence to the
compliance policy of the bank.
3. The instructions contained in the circular would come into effect immediately from the
date of this circular and any new appointment shall be governed by the instructions contained
herein. In respect of banks already having a CCO, they may follow the indicated processes forselection of CCO within a period of six months and are free to reappoint the current incumbent
as the CCO if she/he meets all the requirements.
4. This circular supplements the guidelines issued by Reserve Bank of India on April 20,
2007 and March 04, 2015 and for any common areas of guidance, the prescription of this
circular shall be followed.
Yours faithfully,
(Ajay Kumar Choudhary)
Chief General Manager