The Reserve Bank of India expects the management and board of directors of banks to continually assess financial risks and focus on building adequate capital and liquidity buffers beyond the regulatory minimum for continued resilience and sustainable growth, according to Governor Shaktikanta Das. 

The RBI governor noted that recent events in the banking landscape in the US and Europe suggest that risks for an individual bank could crop up from segments of its balance sheet that may have been considered relatively safe.

Das emphasised that a future-ready bank needs to be financially, operationally and organisationally resilient.

“To be financially resilient, a bank should have adequate capital buffers and be able to generate earnings even in times of severe macroeconomic shocks.

“It should also have adequate liquidity to meet its obligations in various situations,” Das said in a speech delivered at the Global Conference on Financial Resilience organised by the College of Supervisors in Mumbai.

Therefore, financial resilience is closely linked to a bank’s business model and strategy, he added.

Business models

The Reserve Bank has started looking at the business models of banks more closely, he said, cautioning that aspects or deficiencies in the model itself could spark a crisis.

The RBI has devoted efforts to identifying and addressing the root causes of vulnerabilities in banks, non-banking financial companies (NBFCs) and other entities, he said.

“Many a time, vulnerabilities arise from inappropriate business models adopted by banks and other financial entities. Over-aggressive growth strategies or mindless pursuit of bottomlines, for instance, are often a precursor to future problems.

“While we do not interfere with business decision-making, regulated entities must demonstrate adequacy of internal controls and loss absorption capacity to match the risks that their business models may generate,” he said.

The governor observed that RBI’s approach is to flag deficiencies in this area to the senior management or the board of directors of individual institutions for remedial action.

Focus on ‘root cause’

“We also remain engaged with external auditors and flag issues that are relevant for their role as the third line of defence.

“In recent times, our focus on ‘root cause’ has led us to mandate certain housekeeping hygiene such as automated identification of non-performing loans and provisioning, proper checks and balances in the use of internal and office accounts, implementation of early warning systems (EWS) for preventing frauds, and a host of IT- and cybersecurity-related controls, among others,” he said.

The RBI has not only prescribed regulatory norms for capital adequacy and liquidity ratios, but also gone beyond to nudge banks to build up capital buffers in good times.

“We did this during the Covid-19 pandemic when there was plenty of liquidity, the interest rates were low and the full impact of the pandemic on the financial sector was still highly uncertain.

“The Reserve Bank has also put in place various prudential regulatory frameworks. These include capital adequacy requirements, asset classification and provisioning requirements, dividend distribution framework, and liquidity management framework,” Das said.

In addition, the central bank periodically deploys macroprudential measures to address system-level build-up of risks.

“As a consequence of the measures taken by both the Reserve Bank and the banks themselves, the Indian banking system has remained resilient and has not been affected adversely by the recent sparks of financial instability seen in some advanced economies. This also comes out clearly in our recent stress test results,” Das said.

Operational risks

The governor underscored that robust IT and information security governance would help in increased predictability and reduction of uncertainty in operations, minimise losses from information security related incidents, and enhance operational resilience.

Given the extensive outsourcing by banks and other regulated entities, there is an even greater need for effective policies and practices, he said.

In the context of the growing exposure of regulated entities to various risks from dependency on third-parties that provide technology and IT-enabled services, Das observed that the RBI recently issued comprehensive guidelines on IT outsourcing by banks, NBFCs, and other regulated entities.

The governor said banks and other financial institutions need to be organisationally resilient to anticipate risks early and absorb them efficiently.

“Organisations must have the capacity and resilience to protect themselves from adverse incidents and shield their balance sheets.

“To achieve organisational resilience, REs [regulated entities] need to continuously evolve by standardising policies, processes, organisational culture and governance. They must also be flexible enough to encourage diverse ideas and innovations within the organisation,” he said.