Executive Summary:
This circular from the Reserve Bank of India (RBI), dated April 27, 2017, addresses risk management systems within scheduled commercial banks, excluding Local Area Banks, Regional Rural Banks, and Small Finance Banks. It focuses on the role of the Chief Risk Officer (CRO) to bring uniformity in approach followed by banks and align the risk management system with best practices. The circular outlines specific guidelines for the CRO's appointment, responsibilities, and reporting structure.
Key Points / Main Content:
CRO Role and Responsibilities:
* Banks must have a Board-approved policy defining the CRO's role and responsibilities.
* The CRO's appointment is for a fixed tenure and requires Board approval. Premature removal/transfer also requires Board approval and reporting to the Department of Banking Supervision, RBI, Mumbai, and to stock exchanges for listed banks.
* The CRO must be a senior official with adequate professional qualifications and experience in risk management.
Reporting Structure:
* The CRO must report directly to the MD & CEO or the Risk Management Committee (RMC) of the Board.
* If the CRO reports to the MD & CEO, the RMC must meet with the CRO one-on-one at least quarterly without the MD & CEO present.
* The CRO must not have reporting relationships with business verticals or be given business targets.
Credit Sanction Process:
* The policy must clarify whether the CRO's role in credit sanction is advisory or decision-making, ensuring independence.
* In committee-based high-value credit sanctions, if the CRO is a decision-maker, they have voting power and are liable for all aspects of the credit proposal. If not a part of the credit sanction process, the CRO's role is limited to that of an advisor.
* In banks without a committee approach for high-value credits, the CRO can only advise and cannot have sanctioning power.
* As an advisor, the CRO is an invitee to the credit sanction/approval committee without voting rights.
Other Restrictions:
* Dual hatting is prohibited; the CRO cannot simultaneously hold positions such as CEO, COO, CFO, or head of internal audit.
Impact Analysis:
Scheduled Commercial Banks (Excluding Local Area Banks, Regional Rural Banks, and Small Finance Banks):
* Impact: Banks must review and update their risk management policies and procedures to align with the new guidelines, particularly regarding the CRO's role, responsibilities, and reporting lines.
* Action Required: Develop a Board-approved policy for the CRO, ensure the CRO's appointment and removal adhere to the guidelines, and adjust reporting structures and credit sanction processes as necessary.
Chief Risk Officers (CROs):
* Impact: CROs' roles and responsibilities are more clearly defined, with specific requirements for reporting lines, independence, and involvement in credit sanction processes.
* Action Required: Understand the new guidelines and ensure their activities comply with the defined role, reporting structure, and restrictions on dual hatting.
Board of Directors:
* Impact: Increased oversight responsibilities regarding the appointment, removal, and performance evaluation of the CRO.
* Action Required: Approve the CRO's appointment and any premature removal/transfer, ensure the CRO reports appropriately, and meet with the CRO (or via the RMC) as required.
Key Entities Referenced
Reserve Bank of India: The central bank of India, responsible for regulating the banking sector and monetary policy.
Chief Risk Officer: A senior management executive responsible for overseeing an organization's risk management activities.
Scheduled Commercial Banks: Banks in India that are listed in the Second Schedule to the Reserve Bank of India Act, 1934.
Local Area Banks: Banks operating in a limited area, as defined by the Reserve Bank of India.
Regional Rural Banks: Government-sponsored regional banks in India aimed at providing credit and banking facilities to rural areas.
Small Finance Banks: A type of niche bank in India licensed by the Reserve Bank of India to provide basic banking services to underserved populations.
Risk Management Committee: A committee of the Board responsible for overseeing the risk management activities of the bank.
Mumbai, Maharashtra: A city in India where the Department of Banking Supervision, Reserve Bank of India is located.
RBI/2016-17/294
DBR.BP.BC.No.65/21.04.103/2016-17 April 27, 2017
The Chairman and Managing Director/Chief Executive Officer
All Scheduled Commercial Banks
(Excluding Local Area Banks and Regional Rural Banks)
And
Small Finance Banks
Madam/Dear Sir,
Risk Management Systems – Role of the Chief Risk Officer (CRO)
Please refer to the guidelines on Risk Management Systems issued vide our circular
DBOD.No.BP.(SC).BC.98/21.04.103/99 dated October 7, 1999 and the Guidance
Notes on Management of Credit Risk and Market Risk issued in terms of our circular
DBOD. No. BP. 520/21.04.103/2002-03 dated October 12, 2002.
2. As part of effective risk management, banks are required, inter-alia, to have a
system of separation of credit risk management function from the credit sanction
process. However, it is observed that the banks follow diverse practices in this
regard. In order to bring uniformity in approach followed by banks, as also, to align
the risk management system with the best practices, banks are advised as under:
a) They shall lay down a Board-approved policy clearly defining the role and
responsibilities of the CRO.
b) Appointment of the CRO shall be for a fixed tenure with the approval of the
Board of Directors of the banks. The CRO may be transferred/removed from
his post before completion of the tenure only with the approval of the Board
and such premature transfer/removal shall be reported to the Department of
Banking Supervision, Reserve Bank of India, Mumbai. In case of listed banks,
any change in incumbency of CRO shall be reported to the stock exchanges
also.
c) CRO shall be a senior official in the banks’ hierarchy and shall have the
necessary and adequate professional qualification/experience in the areas of
risk management.
बकैं िंग विनियमि विभाग, ेन्द्रीय ायाालय, 12ि िंमिंज़िल, शहीदभगतस हिं माग,ा म िंबई – 400001
Department of Banking Regulation, Central Office, 12th Floor, Shahid Bhagat Singh Marg, Mumbai - 400001
Tel No: 22661602 Fax No: 22705691 Email ID: cgmicdbr@rbi.org.in
हहदिं ी आ ाि हैं, इ ा प्रयोग बड़ाइए2
d) The CRO shall have direct reporting lines to the MD & CEO / Risk
Management Committee (RMC) of the Board. In case the CRO reports to the
MD & CEO, the RMC shall meet the CRO on one-to-one basis, without the
presence of the MD & CEO, at least on a quarterly basis.
e) The CRO shall not have any reporting relationship with the business verticals
of the bank and shall not be given any business targets.
f) In case the CRO is associated with the credit sanction process, it shall be
clearly enunciated whether the CRO’s role would be that of an adviser or a
decision maker. The policy shall include the necessary safeguards to ensure
the independence of the CRO.
g) In banks that follow committee approach in credit sanction process for high
value proposals, if the CRO is one of the decision makers in the credit
sanction process, he shall have voting power and all members who are part of
the credit sanction process, shall individually and severally be liable for all the
aspects, including risk perspective related to the credit proposal. If the CRO
is not a part of the credit sanction process, his role will be limited to that of an
adviser.
h) In banks which do not follow committee approach for sanction of high value
credits, the CRO can only be an adviser in the sanction process and shall not
have any sanctioning power.
i) The CRO in his role as an adviser shall be an invitee to the credit
sanction/approval committee without any voting rights in the proceedings of
the committee.
j) There shall not be any ‘dual hatting’ i.e. the CRO shall not be given the
responsibility of Chief Executive Officer, Chief Operating Officer, Chief
Financial Officer, Chief of the internal audit function or any other function.
Yours faithfully,
(S. S. Barik)
Chief General Manager-in-Charge