## cr1804 - 2017

## Source details

**Canonical URL:** [cr1804 - 2017](https://www.imf.org/-/media/files/publications/cr/2018/cr1804.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2018/cr1804.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2018/cr1804.pdf.json)

---

### EXECUTIVE SUMMARY — key findings and recommendations
- RBI has made "remarkable progress in strengthening banking supervision since the last FSAP." Supervision and regulation remain strong and have improved in recent years.
- Risk-based supervision:
  - SPARC introduced in 2013 is the main instrument for risk-based supervision; deploys onsite and offsite tools and a proprietary model IRISc.
  - Upon external validation of its models, SPARC will become fully enforceable, including for determining capital add-ons (presently computed but not enforced).
  - Implementation issues: IRISc needs independent review and validation; linkage between SPARC assessments and enforceable supervisory actions (capital add-ons) is weak.
- Prudential standards and international alignment:
  - Most of the Basel III framework (and related guidance) implemented; RBI adopts Basel III capital adequacy framework and is phasing in Liquidity Coverage Ratio and revised large exposure limits.
  - RBI currently applies the standardized approach for credit, market, and operational risk; reviewing IRB applications pending validation.
- Asset quality and provisioning:
  - 2015 system-wide Asset Quality Review (AQR) and strengthened prudential regulations demonstrate commitment to transparency and more accurate recognition of banking risks.
  - IFRS 9 introduction (accounting expected loan-loss provisioning in April 2018) is an opportunity to strengthen loan classification and provisioning rules.
    - RBI may need to maintain a prudential filter as a regulatory floor after IFRS 9 introduction.
    - RBI should review classification and provisioning calibration, reassess special loan categories, and consider proactive provisioning incentives to tackle NPAs.
- Governance, independence and PSBs:
  - Remaining weaknesses concern RBI independence and conflicts when supervising public sector banks (PSBs).
  - RBI cannot remove PSB directors or management (appointed by the Government of India (GOI)); cannot force a merger or trigger liquidation of a PSB; limited authority to hold PSB Boards accountable on strategy, risk profiles, assessment of management, and compensation.
  - Recommendations: legal reforms to empower RBI over PSBs; near-term: empower Banks Board Bureau (BBB) to appoint/remove senior management of PSBs; longer-term: remove requirement that PSB Boards include ex officio RBI officials.
- Supervision enforcement and early action:
  - RBI plans updated Prompt Corrective Action (PCA) framework with more prudent risk tolerance thresholds; establish an Enforcement Department.
  - Need for proactive supervisory attitude and conclusive actions backed by data sources such as the Central Repository of Information on Large Credits (CRILC).

*Source: Excerpted content from the provided IMF chapter text.*

### INSTITUTIONAL AND MARKET STRUCTURE
- Regulatory architecture:
  - Four main agencies: Reserve Bank of India (RBI), Securities and Exchange Board of India (SEBI), Insurance Regulatory and Development Agency of India (IRDAI), Pension Fund Regulatory and Development Agency (PFRDA).
  - Ministry of Finance (MOF) is main financial sector policy body; Minister of Finance chairs Financial Stability and Development Council (FSDC).
- Banking sector composition (as presented):
  - 21 PSBs
  - 20 private sector banks (PVBs)
  - 46 foreign banks (FBs) as branches and 39 representative offices
  - 56 regional rural banks
  - 1,562 urban cooperative banks
  - 93,913 rural cooperative banks
  - cooperative credit institutions such as primary agricultural credit societies
  - a small number of newly formed niche banks, such as payments banks and small finance banks
- Structural statistics and exposures:
  - Financial system assets doubled in nominal terms since 2011, reaching "close to 90 percent of GDP at end-2015."
  - Banks account for about "two-thirds of the financial system"; "72 percent of banking assets are held by the PSBs."
  - Banks required to hold buffers of government securities: "20.5 percent of assets."
  - Loans account for about "60 percent of bank assets."
  - Bank lending exposures (as of December 2016):
    - Infrastructure: 14.1 percent of gross loans for commercial banks; 16.1 percent of gross loans for PSBs
    - Metals: 6.1 percent of gross loans for commercial banks; 7.3 percent of gross loans for PSBs
  - PSBs’ stressed assets (NPAs + restructured loans): 15.8 percent of gross loans at end-2016.

### SUPERVISION FRAMEWORK, TOOLS, AND GRADING
- Assessment framework and methodology:
  - Assessment against BCBS 2012 revised Core Principles (BCP); ECs and ACs assessed; only ECs graded.
  - Grading scale: "compliant"; "largely compliant"; "materially noncompliant"; and "noncompliant."
- SPARC / Risk-Based Supervision (RBS):
  - SPARC core: IRISc (536 data points and 319 subjective control parameters), three-pillar assessment (risk, compliance, capital), RoFS and supervisory ratings A–E feeding supervisory stances Level 1–4.
  - Supervisory cycle: 12–18 months for full-scope exams; 32 small banks examined under a Small Bank Variant Model.
  - Implementation gaps:
    - Independent validation of IRISc pending.
    - Weak enforcement link: computed capital add-ons under Pillar II not enforced; RARs often do not translate identified capital shortages into enforceable capital augmentation requests.
    - Limited SPARC assessment of resolvability; no mandated recovery and resolution plans.
- Supervisory data, reporting and systems:
  - Offsite returns collected at frequencies varying from fortnightly to annual; XBRL reporting platform; Business Intelligence tools; CRILC centralizes large-credit data.
  - Consolidated Prudential Reports (CPR) semi-annual; need to enhance consolidated data granularity and frequency.
- Grading highlights:
  - Principle 1 (Responsibilities, objectives and powers): Assessment: Largely Compliant.
  - Principle 2 (Independence, accountability, resourcing and legal protection): Assessment: Materially Non-Compliant (statutory provisions and government appointment/removal powers undermine independence, and limitations over PSBs create material shortcomings).
  - Principle 3 (Cooperation and collaboration): Assessment: Compliant.
  - Principle 4 (Permissible activities): Assessment: Compliant.
  - Principle 5 (Licensing criteria): Assessment: Largely Compliant.
  - Principle 6 (Transfer of significant ownership): Assessment: Compliant.
  - Principle 8 (Supervisory approach): Assessment: Compliant.
  - Principle 9 (Supervisory techniques and tools): Assessment: Largely Compliant.
  - Principle 10 (Supervisory reporting): Assessment: Largely Compliant.
  - Principle 11 (Corrective and sanctioning powers): Assessment: Largely Compliant.
  - Principle 12 (Consolidated supervision): Assessment: Compliant.
  - Principle 14 (Corporate governance): Assessment: Materially Non-Compliant.
  - Principle 15 (Risk management): Assessment: Largely Compliant.
  - Principle 16 (Capital adequacy): Assessment: Compliant.
  - Principle 17 (Credit risk): Assessment: Largely Compliant.
  - Principle 18 (Problem assets, provisions and reserves): Assessment: Largely Compliant.
  - Principle 19 (Concentration risk): Assessment: Largely Compliant.
  - Principle 20 (Related-party transactions): Assessment: Largely Compliant.
  - Principle 21 (Country and transfer risks): Assessment: Compliant.
  - Principle 22 (Market risk): Assessment: Compliant.
  - Principle 23 (Interest rate risk in the banking book): Assessment: Compliant.
  - Principle 24 (Liquidity risk): Assessment: Largely Compliant.
  - Principle 25 (Operational risk): Assessment: Largely Compliant.
  - Principle 26 (Internal control & audit): Assessment: Compliant.
  - Principle 27 (Financial reporting & external audit): Assessment: Largely Compliant.
  - Principle 28 (Disclosure & transparency): Assessment: Compliant.
  - Principle 29 (AML/CFT): Assessment: Largely Compliant.

### LICENSING, OWNERSHIP TRANSFERS, AND ACQUISITIONS
- Licensing and entry:
  - RBI is licensing authority for private sector banks; guidance issuances include February 2013, November 2014, August 2016.
  - Total private sector bank license applications in past five years: 139 applications received; 112 rejected; four applicants withdrew before in-principle approval; three withdrew after in-principle approval; licensed: two universal banks, ten small finance banks, and seven payments banks.
  - Minimum paid-up capital: payments banks and small finance banks: Rs 1 billion; universal banks: Rs 5 billion.
- Ownership transfers and approvals:
  - Section 12B requires prior RBI approval for any purchase that would lead a person or group to own 5 percent or more of paid-up capital or voting rights.
  - RBI can restrict voting rights, reject changes on fit-and-proper grounds, and require banks to notify on suspected circumvention even below 5 percent.
  - Recommendation: RBI should require groups that own significant shares to list all beneficial owners and promptly report material changes.
- Major acquisitions and investment limits:
  - Statutory ceilings: bank shareholding in nonsubsidiary companies limited to 30 percent of the bank’s own paid up capital and reserves or 30 percent of investee’s paid-up capital, whichever lower.
  - Regulatory limits and examples:
    - Prior approval for investments in a financial services company > 10 percent of investee capital.
    - Sum of all equity investments in subsidiaries and other entities cannot exceed 20 percent of a bank’s paid-up share capital and reserves.
    - To invest in an insurance business: net worth of Rs 10 billion; CRAR not less than 10 percent after investment; NPA ratio not more than 3 percent; track record of profitability.

### CAPITAL, PROVISIONS, AND LARGE EXPOSURES
- Capital framework and phasing:
  - Minimum CAR: 9 percent of risk-weighted assets (standardized approach).
  - CET1 minimum: 5.5 percent; Tier 1: 7 percent; total Tier 1 + Tier 2: 9 percent.
  - Phasing-in process for capital conservation buffer:
    - Per March 31, 2017 banks should have total capital including capital conservation buffer, of 10.25 percent,
    - per March 31, 2018: 10.875 percent,
    - per March 31, 2019: 11.5 percent.
  - Additional CET1 requirement for D-SIBs phased in till April 1, 2019; SBI assigned bucket 3 (0.6 percent CET1 surcharge); ICICI Bank bucket 1 (0.2 percent CET1 surcharge).
- Internal models and approvals:
  - RBI reviewing IRB and AMA applications; none authorized pending validation and parallel runs; RBI has staff dedicated to model reviews.
- Provisioning and asset classification:
  - Master Circular on Prudential Norms (MCCP) defines NPA treatment: NPA at 90 days overdue; migration timelines: substandard ≤ 12 months NPA; doubtful after 12 months in substandard; loss when considered uncollectible.
  - Provisioning examples:
    - Standard assets general provision rates: between 0.25 percent and 1 percent (2 percent for housing loans with teaser rates).
    - Substandard: Secured 15 percent; Unsecured 25 percent.
    - Doubtful: Unsecured 100 percent; Secured: up to 25 percent / 40 percent / 100 percent depending on duration.
    - Fraudulent NPAs: MCCP Section 4.2.9 requires 100 percent write-off over at most 4 quarters.
  - 2015 AQR covered loan portfolios of 36 largest banks comprising 93 percent of total loans; banks advised to recognize impairments and complete provisioning by March 2017.
- Large exposure limits and CCFs:
  - New Large Exposures circular (December 1, 2016) to be fully in force by April 1, 2019:
    - Definition: large exposure if ≥ 10 percent of bank’s eligible capital base (Tier 1 capital).
    - Single counterparty limit: 20 percent of available eligible capital base; Board may allow additional 5 percent.
    - Group of connected counterparties limit: 25 percent of available eligible capital base.
  - Current general limits (pre-full implementation): single borrower 15 percent of regulatory capital (Tier 1 +2); borrower group 40 percent. Exceptions exist for infrastructure, oil companies, etc.
  - Credit conversion factors and exposures: examples for CCFs across maturities and instruments preserved (e.g., foreign exchange and gold contracts CCFs: 2 percent, 10 percent and 15 percent as cited).
- Liquidity and HQLA:
  - LCR in effect since January 1, 2015; expected 100 percent coverage by January 1, 2019.
  - RBI allows Indian State Government Securities (SDLs) to be included in level 1 HQLA; Basel RCAP concluded SDLs do not qualify as sovereign debt securities — inclusion materially upwardly affects reported liquidity; assessors regard inclusion as a shortcoming.

### SUPERVISORY ENFORCEMENT, PCA, CRISIS MANAGEMENT AND RESOLUTION
- Prompt Corrective Action (PCA):
  - PCA framework revised with effect from April 13, 2017; parameters monitored include CRAR, Net NPA, ROA and CET1 along with leverage ratio.
  - CRAR trigger ranges historically: 6–9 percent; 3–6 percent; below 3 percent. Structured and discretionary actions tied to trigger ranges (examples preserved).
  - Recommendation: implement revised PCA triggers and capital definitions soon; amend legislation so RBI can independently enforce PCA and revoke licenses without appeal to GOI.
- Crisis management and resolution:
  - FSDC (non-statutory) coordinates; FSDC-SC chaired by RBI governor; Early Warning Group (EWG) and technical groups exist.
  - RBI powers: mergers, moratoriums, suspension of management, liquidation for commercial banks; constrained over PSBs (cannot dismiss government-appointed directors/management or force mergers).
  - Draft Financial Resolution and Deposit Insurance Bill 2016 proposes a Resolution Corporation and broader resolution tools aligned with FSB Key Attributes.
  - Liquidity lender-of-last-resort: Sections 17 and 18 of RBI Act provide wide discretion; RBI interprets facility as discretionary to solvent banks to prevent failure.
  - Deposit insurance: DICGC insures all commercial banks etc.; coverage: deposits up to a maximum of Rs 1,00,000 per depositor; DICGC liable to pay insured amount within two months from receipt of claim list from liquidator.

### CORPORATE GOVERNANCE, REMUNERATION, AND PSB REFORM
- Governance framework:
  - Companies Act 2013 sets governance and disclosure requirements; RBI requires disclosures on asset quality, exposures to sensitive sectors, unsecured exposures, and key ratios.
  - RBI Guidelines on remuneration and compensation apply only to private sector banks and foreign banks, not to PSBs.
- PSB governance concerns:
  - Government appoints PSB full-time Board members including CEO and chairman; RBI cannot hold PSB Boards fully accountable.
  - Conflicts: placement of RBI representatives on PSB Boards and MOF role in appointing management can create supervisory conflicts.
  - Recommendations:
    - Near-term: empower Banks Board Bureau (BBB) to appoint/remove senior management of PSBs, assuming current MOF role.
    - Longer-term: amend laws to accord RBI and PSB Boards same responsibilities for PSBs as private banks; consider removing ex officio RBI officials from PSB Boards.

### FINANCIAL REPORTING, AUDIT, DISCLOSURE
- Accounting and audit:
  - Ind-AS (IFRS convergence) to be implemented by scheduled commercial banks and certain NBFCs in April 2018; IFRS 9 expected then.
  - RBI prescribes rotation of audit firms every 3–4 years; only RBI-approved auditors may audit banks.
  - Current limitation: external auditors not obliged to report immediately to RBI on material issues before publication of annual statements; regulators lack explicit power to access auditors’ working papers.
  - Recommendation: laws/regulations should explicitly authorize external auditors to inform RBI at any time and grant RBI authority to access auditors’ working papers.
- Disclosure regime:
  - RBI disclosure requirements built on Section 31 of BR Act; banks must publish audited financial statements and detailed Notes to Accounts; quarterly disclosures required.
  - April 2017 Circular: banks must disclose any difference > 15 percent between audited provisions and RBI-mandated provisions following supervisory review.
  - RBI publishes system-wide data (FSR, Reports, Weekly/Monthly bulletins) to support market discipline.

### AML/CFT, KYC, AND FRAUD REPORTING
- KYC framework and gaps:
  - RBI Master Direction requires REs to have Board-approved KYC policy; CDD, ongoing monitoring, enhanced diligence for PEPs, record retention for at least five years.
  - Deficiency: Master Direction does not explicitly require identification of beneficial ownership where the customer is an individual.
  - Deficiency: No specific requirement on domestic PEPs treatment; foreign PEP requirements incomplete vis-à-vis FATF Recommendation 12.
- Fraud and suspicious reporting:
  - Suspicious transactions reported to FIU-IND; banks not required to report suspicious activity to RBI (RBI supervisors access STRs during onsite inspection).
  - Master Direction on Frauds (July 01, 2016) and Central Fraud Registry operationalized January 2016 for frauds above Rs 1 lakh; fraud reporting well established but focused on fraud rather than wider predicate crimes.
  - Recommendation: broaden reporting requirements to address money-laundering issues, not just fraud; require domestic PEP EDD measures aligned with FATF.
- Legal protections and cooperation:
  - Section 14 of PMLA 2002 protects banking companies/officials furnishing information from civil/criminal proceedings.
  - MOU between FIU-IND and RBI (August 2012) formalizes cooperation.

### SELECTED NUMERIC HIGHLIGHTS (preserved verbatim)
- Financial system assets: "close to 90 percent of GDP at end-2015."
- PSB share: "72 percent of banking assets are held by the PSBs."
- Banks’ government securities buffer: "20.5 percent of assets."
- Loans share: "60 percent of bank assets."
- Infrastructure exposures (Dec 2016): 14.1 percent (commercial banks); 16.1 percent (PSBs).
- Metals exposures (Dec 2016): 6.1 percent (commercial banks); 7.3 percent (PSBs).
- PSBs’ stressed assets: 15.8 percent of gross loans at end-2016.
- AQR coverage (2015): 36 largest banks, comprising 93 percent of total loans.
- Private bank licensing applications (past five years): 139 received; 112 rejected; licensed: two universal banks, ten small finance banks, and seven payments banks.
- Minimum paid-up capital: payments banks and small finance banks: Rs 1 billion; universal banks: Rs 5 billion.
- Minimum CAR: 9 percent of risk-weighted assets.
- CET1 minimum: 5.5 percent; Tier 1: 7 percent; total Tier 1 + Tier 2: 9 percent.
- Phasing-in capital targets:
  - Per March 31, 2017: 10.25 percent total capital including conservation buffer.
  - Per March 31, 2018: 10.875 percent.
  - Per March 31, 2019: 11.5 percent.
- Deposit insurance coverage: up to Rs 1,00,000 per depositor.
- DICGC payout timeframe: within two months from date of receipt of claim list from liquidator.
- Large exposure thresholds (new circular): 10 percent (definition of large exposure relative to Tier 1); single counterparty 20 percent; group 25 percent (full effect by April 1, 2019).
- Current general limits (pre-new LE framework): single borrower 15 percent; borrower group 40 percent.
- Examples of provisioning and classification figures preserved in MCCP (e.g., fraud write-off 100 percent over at most 4 quarters; standard provisions 0.25–2 percent etc.).

### MAIN POLICY RECOMMENDATIONS (aggregated)
- Legal and institutional reforms:
  - Amend legislation to clarify RBI’s supervisory objectives, formally ground RBI independence, and empower RBI to exercise same powers over PSBs as private banks (including Board member removal, mergers, license revocation).
  - Amend RBI Act to appoint the governor for a minimum term, restrict government dismissal to due process grounds, and remove GOI appeal over license revocation.
  - If statutory change difficult, adopt framework agreement between GOI and RBI similar to monetary policy arrangements.
- Supervision practice and SPARC:
  - Expedite independent validation of SPARC/IRISc models and link SPARC assessments to enforceable supervisory actions (capital add-ons).
  - Develop supervisory assessment handbooks and formal guidelines to ensure consistent enforcement of RAR action points.
  - Require recovery and resolution regimes and resolvability assessments for large banks upon passage of resolution legislation.
- Asset quality and provisioning:
  - Reassess special loan categories that weaken classification and provisioning; develop reporting tools to monitor materiality and trends of special situations.
  - Maintain prudential filter after IFRS 9 implementation; back-test provisioning percentages, actual losses and cure rates; consider proactive provisioning incentives to tackle NPAs.
- Capital, liquidity, and concentration:
  - Monitor and enforce transition to new large exposure limits; reduce/remove exceptions where feasible.
  - Review inclusion of SDLs in level 1 HQLA to align with Basel standards.
  - Enhance liquidity regulation alignment with Basel standards.
- Governance and PSB reform:
  - Empower BBB in near-term to appoint/remove PSB senior management; remove ex officio RBI Board membership for PSBs over time.
  - Strengthen independence of Board selection for PSBs and reduce MOF interference.
- Audit, reporting and AML/CFT:
  - Amend laws/regulations to authorize external auditors to report concerns to RBI at any time and give RBI explicit power to obtain auditors’ working papers.
  - Require identification of beneficial ownership where customer is an individual; strengthen domestic PEP treatment and EDD consistent with FATF Recommendation 12.
  - Broaden reporting beyond fraud to cover money-laundering predicate crimes and related suspicious activity reporting to supervisors.
- Operational risk and data:
  - Expand supervisory reporting of non-fraud operational risk events and losses; strengthen loss-data collection.
  - Institute guidelines for use and oversight of third parties in supervisory activities.

*Source: Excerpted content from the provided IMF chapter text.*

### 2017. It contains technical analysis and detailed

### cr1804 - 2017

### EXECUTIVE SUMMARY — Key findings and recommendations
- The RBI has made "remarkable progress in strengthening banking supervision since the last FSAP." Supervision and regulation remain strong and have improved in recent years.
- A key achievement is the implementation of a risk-based supervisory approach using a complex supervisory assessment framework to guide supervisory intensity and resource allocation.
- Most of the Basel III framework (and related guidance) has been implemented; cooperation arrangements domestically and cross-border are firmly in place.
- The system-wide asset quality review (AQR) and strengthening of prudential regulations in 2015 demonstrate authorities’ commitment to transparency and more accurate recognition of banking risks.
- Prudential regulations are "broadly aligned to the requirements of the BCP," reflecting international standards and best practices in capital adequacy and market, interest rate, and operational risks.
- RBI is phasing in international standards on liquidity risk (the Liquidity Coverage Ratio) and large exposure limits, the latter being important given large concentration risks in the banking sector.
- The introduction of IFRS 9 (accounting expected loan-loss provisioning in April 2018) provides an opportunity to strengthen loan classification and provisioning rules:
  - The RBI may need to maintain a prudential filter as a regulatory floor after IFRS 9 introduction.
  - RBI should review existing classification and provisioning rules to ensure calibration in line with actual losses and cure rates.
  - RBI should reassess special loan categories that could weaken loan classification and provisioning adequacy.
  - Given the high level of nonperforming assets (NPAs), authorities should consider a more proactive approach so banks, via adequate provisioning, have proper incentives to tackle NPAs and free up balance sheets for more productive lending.
- SPARC (Supervisory Program for Assessment of Risk and Capital):
  - Introduced in 2013 as the main instrument for risk-based supervision.
  - Deploys a mix of onsite and offsite tools in a comprehensive and forward-looking process.
  - Upon external validation of its models, SPARC will become fully enforceable, including for determining capital add-ons, which are presently computed but not enforced.
- Supervision needs to become more conclusive and capable of "leaning against the wind":
  - RBI plans to introduce an updated Prompt Corrective Action (PCA) framework with more prudent risk tolerance thresholds and to establish a new Enforcement Department.
  - These enhancements, together with competent supervisors and information databases such as the Central Repository of Information on Large Credits (CRILC), will provide a robust supervisory enforcement framework that needs to be backed by a proactive supervisory attitude enabling conclusive supervisory actions.
- Remaining governance and independence issues:
  - Some weaknesses persist concerning RBI independence and conflicts when supervising public sector banks (PSBs).
  - RBI enjoys a large degree of operational autonomy, but amendments to several legal provisions and formal grounding of RBI independence in the RBI Act would provide greater legal certainty.
  - RBI’s legal powers to supervise and regulate PSBs are constrained:
    - It cannot remove PSB directors or management (appointed by the Government of India (GOI)).
    - It cannot force a merger or trigger the liquidation of a PSB.
    - It has limited legal authority to hold PSB Boards accountable regarding strategic direction, risk profiles, assessment of management, and compensation.
  - Legal reforms are desirable to empower RBI to exercise the same responsibilities for PSBs as for private banks and to ensure a level playing field in supervisory enforcement.
- Bank governance strengthening (priority action):
  - Consistent with Indradhanush Plan and 2014 Nayak Commission Report, near-term: empower the Banks Board Bureau (BBB) to appoint and remove senior management of PSBs, drawing from a broad set of qualified banking professionals, assuming roles presently carried out by the Ministry of Finance.
  - Longer term: remove the requirement that PSB Boards include ex officio RBI officials.

### INTRODUCTION AND METHODOLOGY — scope and approach
- Assessment completed as part of the FSAP undertaken by the IMF and World Bank in 2017 at the request of Indian authorities.
- Scope: scheduled commercial banks; reflects the regulatory and supervisory framework in place as of assessment completion.
- This assessment does not analyze the state of the banking sector or crisis management framework (addressed elsewhere in the FSAP).
- Assessment against the Basel Committee on Banking Supervision (BCBS) 2012 standard (revised Core Principles — BCP).
  - The 2012 revision increases focus on risk-based supervision, early intervention, corporate governance, and supervisors’ understanding of banks’ risk profiles and systemic risks.
  - Number of principles increased from 25 to 29; essential criteria expanded from 196 to 231; 35 new essential criteria introduced; 16 additional criteria exist for jurisdictions opting for assessment against ACs.
- Both essential criteria (EC) and additional criteria (AC) were assessed; only ECs were graded.
- Grading is qualitative and may vary by country circumstances; commentary accompanying each Principle grading is emphasized.
- Methodology included extensive meetings with RBI, MoF, industry, review of laws/regulations/guidelines, RBI self-assessments, questionnaires, and access to supervisory documents and systems.
- The assessment team noted excellent cooperation from RBI staff during a time of significant supervisory and regulatory activity related to resolving stressed bank assets.

### INSTITUTIONAL AND MARKET STRUCTURE — structural facts and statistics
- The financial sector expanded rapidly since the last FSAP; structure remains broadly unchanged.
- Financial system assets doubled in nominal terms since 2011, reaching "close to 90 percent of GDP at end-2015."
- Banks account for about "two-thirds of the financial system"; "72 percent of banking assets are held by the PSBs."
- Banks are required to hold large buffers of government securities: "20.5 percent of assets."
- Loans account for about "60 percent of bank assets."
- Linkages with international financial markets remain limited, partially reflecting limits on capital account convertibility.
- PSBs are the dominant providers of credit to corporates; private banks are more retail-oriented.
- Smaller regional banks and cooperative credit institutions provide financial services to low- and middle-income households.
- All credit institutions are required to extend a material portion of their credit to state-determined priority sectors (priority sector lending (PSL)).

*Prepared by Hee Kyong Chon (IMF), Charles Taylor, and Jan Willem Van der Vossen (external experts).*

### 16.      India’s financial sector is supervised and regulated by four main agencies. The RBI is

### 16.      India’s financial sector is supervised and regulated by four main agencies. The RBI is

### Overview
- Four main agencies supervise and regulate India’s financial sector: the Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI), the Insurance Regulatory and Development Agency of India (IRDAI), and the Pension Fund Regulatory and Development Agency (PFRDA).
- Additional sectoral oversight: the Financial Markets Commission (FMC) oversees commodity derivatives markets; the National Housing Bank (NHB) has oversight responsibilities for housing finance companies.
- The Ministry of Finance (MOF) is the main financial sector policy body; the Minister of Finance chairs the Financial Stability and Development Council (FSDC), responsible for coordination among financial sector regulators.

### Banking sector structure and RBI supervisory role
- The RBI is the central bank and oversees the banking sector, other deposit-taking institutions, and payment and securities clearance systems.
- Banking sector composition (as presented):
  - 21 PSBs
  - 20 private sector banks (PVBs)
  - 46 foreign banks (FBs) as branches and 39 representative offices
  - 56 regional rural banks
  - 1,562 urban cooperative banks
  - 93,913 rural cooperative banks
  - cooperative credit institutions such as primary agricultural credit societies
  - a small number of newly formed niche banks, such as payments banks and small finance banks
- The RBI’s supervisory function operates under the guidance of the Board for Financial Supervision (BFS), constituted in November 1994 as a committee of the RBI’s central Board of directors.
- RBI supervisory aims: maintain public confidence, protect depositors' interest, and ensure the banking system provides cost-effective services to the public.

### Corporate and banking sector vulnerabilities; asset quality
- Corporate and banking sector vulnerabilities have risen sharply since 2011 and present a risk to financial stability.
- Bank lending exposures (as of December 2016):
  - Infrastructure: 14.1 percent of gross loans for commercial banks; 16.1 percent of gross loans for PSBs
  - Metals: 6.1 percent of gross loans for commercial banks; 7.3 percent of gross loans for PSBs
- PSBs’ stressed assets—the sum of NPAs and restructured loans—reached 15.8 percent of gross loans at end-2016.
- Indian corporates became one of the most leveraged among emerging markets (statement preserved as in source).
- Risks: deterioration in asset quality, low profitability, and potentially insufficient capital positions to support higher credit growth.

### Preconditions for effective bank supervision — Macroeconomic and policy context
- Current account deficits averaged 1.4 percent of GDP over the past three years (relative to the report’s timeframe).
- RBI institutional changes:
  - Flexible inflation targeting regime adopted in August 2016, with a formal inflation target band.
  - Statutory Monetary Policy Committee introduced in September 2016.
- Structural/fiscal reforms highlighted:
  - Pan-India Goods and Services Tax expected to create a single national market and enhance efficiency.
  - Recent major currency exchange initiative expected to formalize economic activity and spur digitalization, while straining consumption and business activity in the short term.

### Policy initiatives to address banking risks
- Asset quality review (AQR), 2015:
  - Covered loan portfolios of the 36 largest banks, comprising 93 percent of total loans in the banking system.
  - Banks were advised to recognize impairments and complete provisioning by March 2017.
- Corporate debt restructuring schemes introduced in 2015:
  - 5:25 Refinance Scheme
  - Strategic Debt Restructuring (SDR)
  - Scheme for Sustainable Structuring of Stressed Assets (S4A)
- Insolvency regime:
  - Insolvency and Bankruptcy Code, 2016 aims to reduce debt resolution to 180 days from 4.3 years currently.
  - 2016 Bill on Enforcement of Security Interest and Recovery of Debts to support faster bank asset recovery.
- Banking sector revitalization:
  - Indradhanush Plan (2015) intended to revitalize PSBs via capital injections and governance improvements; greater consolidation of the 27 PSBs is being considered.
- Development of corporate funding alternatives:
  - RBI liberalized external commercial borrowings (ECBs) regulations in 2015 and expanded access in 2016.
  - Rupee-denominated (Masala) bonds framework introduced in 2015.
  - 2016 RBI Measures for Development of Fixed Income and Currency Markets proposes development of corporate bond and currency derivatives markets.

### Financial stability governance and macroprudential toolkit
- Financial Stability and Development Council (FSDC):
  - Established in 2010 as a non-statutory apex body for inter-agency coordination on financial stability, development, and inclusion.
  - Chaired by the finance minister; members include heads of RBI, SEBI, PFRDA, and IRDAI and key MOF representatives.
  - Decisions reached by consensus; implementation lies with relevant participating domestic authority.
  - No explicit mechanism under the FSDC to consider trade-offs between mandates (see FSB Peer Review of India, 2016).
  - FSDC-SC (sub-committee) is the executive arm, chaired by the RBI governor.
  - Permanent technical groups under FSDC-SC include: Inter-Regulatory Technical Group, Inter-Regulatory Forum, and Early Warning Group (EWG).
- RBI macroprudential developments:
  - Since 2004, RBI voluntarily included financial stability as an additional institutional objective.
  - Expanded use of quantitative systemic risk-assessment tools and stress tests.
  - Financial stability analyses reviewed by FSDC-SC and published in the Financial Stability Report (FSR).
  - Steps underway to form a Financial Data Management Center to facilitate information sharing and analysis.

### Public infrastructure, accounting, auditing, and payments systems
- Insolvency and Bankruptcy Code (2016):
  - Requires bankruptcy processes be completed within 180 days, or borrowers’ assets may be sold to repay creditors.
  - Insolvency and Bankruptcy Board of India to exercise regulatory oversight over insolvency professionals, insolvency professional agencies, and informational utilities.
- Convergence with IFRS:
  - IFRS transposed into Indian Accounting Standards (Ind AS).
  - Ind AS to be implemented by scheduled commercial banks and certain NBFCs in April 2018.
  - RBI issued directions in February 2016 on the Ind AS roadmap.
  - New standards will allow timelier recognition of credit losses and provide forward-looking information; implementation implies a steep learning curve.
- Auditing:
  - Indian auditing standards set by the Institute of Chartered Accountants of India (ICAI) are broadly in line with International Standards on Auditing.
  - Bank annual financial statements must be audited by an RBI-approved auditor.
- Payment, clearing, and settlement infrastructures:
  - Payment and Settlement Systems Act, 2007 designates the RBI as authority to regulate payment and settlement systems.
  - Act amended in 2015 to strengthen systems and align with international norms.

### Consumer protection and disclosure
- Banks required to have a detailed Code of Customer Rights and minimum standards of practice.
- RBI enforces disclosure standards; banks must disclose service charges, interest rates, services offered, product information, time norms, and grievance-redressal mechanisms.
- RBI’s Banking Ombudsman scheme resolves disputes between a bank and its customers.
- RBI set up a Customer Redressal Cell and a Customer Service Department in 2006; the Banking Codes and Standards Board of India promotes adherence to self-imposed codes.

### Crisis management, resolution framework, and public safety net
- Crisis coordination:
  - FSDC expected to coordinate authorities’ responses during a crisis.
  - EWG of the FSDC analyzes early warning signals and coordinates responses; chaired by the DG of the RBI in charge of the Financial Markets Department and includes MOF and regulator representatives.
  - Crisis management, contingency planning, and resolution currently reside primarily with sectoral regulators; an overarching crisis-preparedness framework appears lacking.
- RBI resolution powers and constraints:
  - RBI has powers for mergers, imposition of moratorium, suspension of management, and liquidation for commercial banks.
  - RBI constrained in exercising corrective powers over PSBs (no legal ability to dismiss PSB Board members, merge PSBs, or revoke their statutory authority) and limited over Urban Cooperative Banks due to dual control with the government.
- Resolution reform:
  - Government steps to establish a full-fledged Resolution Corporation (RC) covering the entire financial sector and to introduce a comprehensive resolution framework broadly aligned with the FSB’s Key Attributes.
  - A draft Bill on Financial Resolution and Deposit Insurance has been submitted to parliament; proposes measures to address gaps in legal powers, resolution tools, timelines for triggering resolution, and cooperation among authorities.
- Liquidity and lender-of-last-resort:
  - Under sections 17 and 18 of the RBI Act, RBI has wide discretion to lend to economic agents on a system-wide or individual basis in normal and exceptional circumstances.
  - RBI interprets its lender-of-last-resort arrangement as a discretionary facility available to solvent banks facing temporary liquidity needs, provided in the interest of depositors and to prevent bank failure.
- Deposit insurance:
  - Deposit Insurance and Credit Guarantee Corporation (DICGC) is a wholly owned subsidiary of the RBI.
  - DICGC insures all commercial banks, including branches of foreign banks functioning in India, local area banks, cooperative banks, and regional rural banks; primary cooperative societies are not insured.
  - Coverage: all deposits up to a maximum of Rs 1,00,000 per depositor.
  - DICGC liable to pay insured amount within two months from date of receipt of the claim list from the liquidator.
  - Proposed Resolution Corporation (RC) would subsume the role of the DICGC.

### Governance, disclosure, and PSB reform
- Corporate governance and disclosure:
  - Indian Companies Act of 2013 sets governance and disclosure requirements (Board constitution, meetings, independent directors, audit committees, related-party transactions, disclosure requirements).
- Bank-specific disclosures:
  - RBI requires disclosures on asset quality, exposures to sensitive industry sectors, unsecured exposures, and key financial ratios.
  - RBI Guidelines on remuneration and compensation apply only to private sector banks and foreign banks, not to PSBs.
- PSB governance reforms:
  - Indradhanush plan (August 2015) included separating chairman and CEO/MD posts, and establishing a Banks Board Bureau (BBB) to recommend appointments of PSB executives and chairs.
  - Plan stated: “there will be no interference from government and Banks are encouraged to take their decisions independently keeping the commercial interest of the organization in mind.”
  - Authorities urged to follow through on commitments to enhance PSBs’ governance.

### Main findings — Responsibilities, objectives, powers, independence, and accountabilities (CPs 1–2)
- The RBI’s supervisory responsibilities and powers are generally well established; no material gaps in coverage of the Indian system of bank supervision and regulation are identified.
- Legal framework gives RBI powers to authorize banks, conduct ongoing supervision, address compliance, and undertake timely corrective actions; laws and regulations are updated frequently.
- Areas of concern and recommended legal changes:
  - Supervisory objectives and priority of safety and soundness are not clear in law, despite RBI’s operational commitment.
  - Supervisory powers over PSBs are incomplete: RBI lacks legal ability to dismiss PSB Board members, merge PSBs, or revoke their statutory authority to conduct banking business.
  - Government appoints the governor of the RBI for a maximum term rather than a minimum term, and can dismiss the governor without cause.
- Recommendations:
  - Amend legislation to clarify supervisory objectives and formally ground the RBI’s independence in exercising supervisory attributes.
  - Amend legislation to enable the RBI to extend all powers currently exercised over private sector banks to PSBs, specifically regarding Board member dismissals, mergers, and license revocation.
  - Amend the RBI Act to appoint the governor for a minimum term, ending the government’s ability to dismiss the governor without cause, and remove the option of an appeal to the government when the RBI revokes a license.
  - If statutory changes are difficult, consider a framework agreement where the government acknowledges the RBI’s full operational authority and independence in supervision and regulation, similar to arrangements for monetary policy.

*Source: Excerpted content from the provided IMF chapter text.*

### 40.      Permissible activities for banks, licensing, transfers of ownership, and bank mergers

### 40.      Permissible activities for banks, licensing, transfers of ownership, and bank mergers

### Permissible activities and licensing
- The use of the word “bank” is controlled and deposit taking is confined largely to banks; any deposit taking by institutions that are not regulated as banks should be prohibited.
- Guidance and processes for scrutiny of license applications are adequate in almost all respects.
- Recommendation: The RBI should require groups that own significant shares of a bank to list all their beneficial owners and to report promptly to the RBI any material changes in the holdings of those shares.

### Ongoing supervision (CPs 8–10, 12, and 15)
- The RBI has made substantive changes toward a risk-based approach; further enhancements are necessary.
- The SPARC framework was introduced in FY 2013 and deploys a mix of onsite and offsite supervisory tools.
- Core of SPARC risk assessment: proprietary statistical model IRISc, a multi-tiered scorecard with qualitative assessments, updated dynamically.
- Implementation issues:
  - The IRISc model needs independent review and validation.
  - The process of implementation and adjustment should be managed strictly to maintain consistency and the framework’s robustness.
- Enforcement link weakness:
  - The enforcement link between SPARC assessments and supervisory actions is weak regarding imposing capital add-on.
  - A bank’s Risk Assessment Report (RAR) does not discuss the bank’s identified capital shortage in association with necessary capital augmentation or risk-mitigation plans.
  - Although there were cases requiring identified capital add-ons, none was followed by supervisory actions (i.e., written requests for capital augmentation).
  - Recommendation: The RBI should enhance the robustness of the RBS framework by clearly linking the SPARC assessments to enforceable supervisory actions.
- Compliance oversight:
  - Formal comprehensive guidelines regarding the oversight of compliance with RAR action points need to be established.
  - The RBI states that non-compliance is managed by SSMs and factored into governance assessments, but without formal guidelines consistent enforcement across banks is difficult.
- Consistency tools:
  - Recommendation: Develop supervisory assessment handbooks to ensure consistency across banks and supervisory judgments once SPARC robustness is enhanced.
- Resolvability and recovery:
  - The extent of the assessment of resolvability of banks is limited under SPARC.
  - Recovery and resolution plans have not been required by the RBI.
  - Recommendation: Establish a recovery and resolution regime and conduct risk assessment of resolvability for large banks (such as D-SIBs) upon passage of the resolution legislation bill.
- Engagement, stress testing, and consolidated returns:
  - Supervisor should maintain frequent contact with Boards and non-executive members to assess strategy, group structure, corporate governance, performance, risk management, and controls.
  - More active engagement with independent Board members is needed.
  - Recommendation: Finalize and utilize stress testing methodology to identify, assess, and mitigate emerging risks across banks.
  - Recommendation: Enhance collection of data for consolidated supervision in frequency and granularity.

### Corrective and sanctioning powers (CP 11)
- In almost all respects, the RBI has sufficient supervisory powers, but limitations exist, particularly with respect to PSBs.
- Recommendation: Amend legislation to remove statutory limitations on the RBI’s ability to enforce regulations in PSBs, including Board member removal, mergers, and withdrawals of licenses.
- Issue: Any private sector license revocation could be appealed on its merits to government, whose decision is final.
- Recommendation: Amend legislation to give the RBI full authority to revoke a bank license without appeal to the GOI; and to ensure it can act independently with respect to PCA enforcement.

### Cooperation and cross-border banking supervision (CPs 3, 13)
- Domestic cooperation:
  - A framework for cooperation with other domestic financial regulators is in place.
  - In February 2013, an MoU was signed to facilitate cooperation in supervision of the 11 financial conglomerates in India (information sharing, coordinated onsite inspections, early information in crisis).
  - The MoU does not yet envisage joint inspections; work is ongoing.
  - Recommendation: Strengthen RBI’s financial stability mandate in applicable bills, acts, and regulations to support recovery and resolution actions mutually.
  - Recommendation: Streamline FSDC-SC, Early Warning Group, and FDSC working group committee structures for clearer mandates and more efficient coordination.
- Cross-border cooperation:
  - Since 2010, the RBI concluded MoUs with 43 jurisdictions covering information sharing, onsite examinations, crisis management, confidentiality, and meetings of authorities.
  - Supervisory colleges established for the six Indian banks with cross-border operations; RBI chairs meetings and invites important home and host authorities.
  - In the past five years: 36 onsite inspections were performed in the establishments of 15 Indian banks; a number of these jointly with the host authority.
  - RBI staff report good day-to-day working relationships with main foreign counterparts.

### Corporate governance (CP 14)
- Rules on fitness and propriety and internal governance structures are in place for private and foreign banks.
- Problematic aspects:
  - Influence the RBI may exercise through section 21 BR Act, placement of RBI representatives on banks’ Boards, and limited authority under the Banking Acts is problematic.
  - Under law and custom, the RBI cannot hold PSB Boards accountable for assessing and replacing weak and nonperforming senior management and government-appointed Board members.
  - The government’s and RBI’s roles in appointing senior management and placing officials on Boards creates a conflict of interest with supervision and PSB business decisions.
- Recommendation: Improvements in PSB governance consistent with Indradhanush Plan and 2014 Nayak report:
  - The Banks Board Bureau (BBB) should be able to appoint and remove senior management of PSBs, assuming the role presently carried out by the MOF.
  - Over time, amend banking laws to empower the RBI and PSB Boards to exercise the same responsibilities for PSBs as apply to private banks.
  - When law is amended, consider amending the requirement that PSB Boards include, ex officio, the RBI, and the power of the RBI under section 21 BR Act.

### Capital, risks, problem assets, provisions and large exposure (CPs 16–19, 22–25)
- Capital framework:
  - The RBI has adopted the Basel III capital adequacy framework.
  - In a 2015 Regulatory Capital Assessment Program (RCAP) under the Basel Committee, the RBI framework was assessed to be compliant with the Basel Framework.
  - The RBI capital framework includes a capital conservation buffer, leverage ratio, and countercyclical capital buffer, applying to public and private sector banks.
  - Currently the RBI offers only the standardized approach for credit, market, and operational risk.
  - RBI is reviewing applications of several banks to apply the Internal Ratings Based Approach (IRB) for credit risk; no authorizations yet pending validation of banks’ models and parallel runs.
- Risk management and supervision:
  - Regulations and supervision on risk management are broadly adequate.
  - The RBI prescribes banks’ systems for credit risk management; Board approval required for risk strategy.
  - Requirements: Risk Management Committee, Risk Management Department, robust loan review process, internal risk rating system, independent loan review officers review credit risk twice per year, banks report quarterly to RBI on loan quality, classification, and provisions.
- Priority sector lending (PSL) issues:
  - All banks must meet PSL guidelines and targets, which compromise banks’ independent, risk-based credit allocation policies and strategies.
  - Recommendation: RBI should consider reviewing PSL policy, including targets and scope, to allow banks flexibility when proposed projects do not meet banks’ commercial risk management strategies.
- IFRS 9 and provisioning:
  - Introduction of IFRS 9 provides an opportunity to strengthen loan classification and provisioning rules.
  - Recommendation: RBI may need to maintain a prudential filter as a regulatory floor after introduction of accounting expected loan-loss provisioning in April 2018.
  - RBI should review classification and provisioning rules to ensure calibration with actual losses and cure rates; adjust regulatory parameters if necessary for timely recognition of provisions.
  - RBI should reassess special loan categories that could weaken classification and provisioning adequacy and develop reporting tools to enhance monitoring of special situations.
  - Given high NPAs, authorities should consider a more proactive approach to ensure banks, via adequate provisioning, have incentives to tackle NPAs and free up balance sheets.
- Large exposure and concentration:
  - RBI introduced revised large exposure and risk concentration rules to converge with Basel guidance; new circular fully enters into force in April 2019.
  - New prescribed general limits: 20 percent and 25 percent of bank Tier 1 capital for exposure to individual borrowers and groups of borrowers, respectively.
  - Current general limits are 25 percent and 40 percent, respectively.
  - The current system allows differentiated treatment for a significant number of special situations that need review and simplification.
- Liquidity and HQLA:
  - RBI allows inclusion of Indian State Government Securities (State Development Loan, SDLs) in level 1 HQLA buffer.
  - The 2015 Basel Committee RCAP concluded SDLs do not qualify as sovereign debt securities in the context of Basel standards.
  - Inclusion of SDLs results in a material upward effect on reported liquidity, hampering international comparability.
  - RBI does not consider it necessary to rectify this rule; assessors regard inclusion of SDL in level 1 HQLA as a shortcoming.
  - Recommendation: RBI should consider reviewing and enhancing regulation of liquidity risk management to be more in line with Basel standards.
- Operational risk reporting:
  - RBI should consider expanding scope of supervisory reporting of operational risk events and associated losses.
  - Progress made: comprehensive Cyber Security Framework in banks issued June 2016; Cyber-Security and Information Technology Examination Cell launched; reporting of financial fraud well established.
  - Gap: Formal reporting protocol for non-IT operational risk has limited applicability beyond fraud.
  - Recommendation: Strengthen reporting on human errors, processing errors, and external events.

### Other regulation, accounting, and disclosure (CPs 20, 26–29)
- Related-party transactions (RPTs) and intra-group exposures:
  - RBI issued Guidelines on Intra-Group Transactions and Exposures, including RPTs since last FSAP, but rules still need improvement.
  - No explicit requirement for Board approval prior to related-party exposure write-offs.
  - Unclear whether intragroup exposure limit is applied to RPTs between a bank and its major individual shareholder or family.
  - Regulations affecting RPTs are scattered across supervisory documents and legal texts; recommendation to add clarity in RP regulations/guidelines.
- Internal controls and audits:
  - Internal control regulations are adequate and supported by SPARC.
  - SPARC provides extensive guidelines for inspection of internal control and audit; Internal Audit Departments required to have appropriate resources and skills; outsourcing allowed.
  - Auditors report overall experience with quality of internal audit as satisfactory.
- Accounting standards and auditors:
  - The ICAI issues Accounting Standards (AS) applicable to all listed companies, including banks.
  - Banks are governed by RBI norms on income recognition, asset classification and provisioning, and classification and valuation of investment portfolios.
  - Banks required to publish audited financial statements annually in the regional newspaper.
  - Only external auditors approved by the RBI and on the list of approved auditors may audit banks.
  - Starting April 1, 2018, Indian Accounting Standards (Ind-AS) will converge with IFRS, including IFRS 9 on expected losses.
  - RBI prescribes rotation of audit firms every 3–4 years.
  - Accounting and auditing professions are of high quality and bank accounting standards are comprehensive.
- Auditor reporting and access:
  - Currently external auditor is not obliged to report immediately to the RBI any issues encountered that are of material interest to the supervisor; reporting is permitted only after publication of annual statements.
  - Regulators lack powers to access auditors’ working papers when needed; not currently envisaged.
  - Recommendation: Laws/regulations should explicitly authorize external auditors to inform the RBI of any concerns at any time (including before annual statements finalized and published); RBI should be given explicit authority to obtain information from external auditors at any time.
- AML/CFT gaps:
  - No specific requirement on banks for treatment of customers who are domestic politically exposed persons (PEPs).
  - Recommendation: In line with FATF Recommendation 12, banks should be required to take reasonable measures to determine whether a customer or beneficial owner is a domestic PEP or a person entrusted with a prominent function by an international organization and, where higher risk, take enhanced due diligence.
  - KYC rules do not highlight that banks are required to identify beneficial ownership where customer is an individual; this is a deficiency.
  - AML/CFT reporting:
    - Controls over reporting financial fraud are well established but financial fraud is only one type of predicate crime.
    - Recommendation: RBI should broaden reporting requirements to address money-laundering issues, not just fraud.

*Source: cr1804 - 40.      Permissible activities for banks, licensing, transfers of ownership, and bank mergers*

### 65.      The assessment used a four-part grading system: compliant; largely compliant;

### The assessment used a four-part grading system: compliant; largely compliant;

### Grading framework and application
- The assessment used a four-part grading system: "compliant"; "largely compliant"; "materially noncompliant"; and "noncompliant."
- Assessments of compliance with each CP are made on a qualitative basis to judge whether criteria are fulfilled in practice. Effective application of relevant laws and regulations is essential to provide indication that criteria are met.
- Definitions:
  - "A 'compliant' assessment is given when all of the essential (and additional) criteria are met without any significant deficiencies, including instances where the principle has been achieved by other means."
  - "A 'largely compliant' assessment is given only when minor shortcomings are observed that do not raise any concerns about the authority’s ability and clear intent to achieve full compliance with the principle within a prescribed period of time. The assessment 'largely compliant' can be used when the system does not meet all of the essential criteria, but the overall effectiveness is sufficient, and no material risks are left unaddressed."
  - "A 'materially noncompliant' assessment is given in case of severe shortcomings, despite the existence of formal rules and procedures. It is given if there is evidence that supervision has clearly been ineffective or that the shortcomings are sufficient enough to raise doubts about the authority’s ability to achieve compliance."
  - "A 'noncompliant' assessment is given if the criteria are not substantially implemented, several essential criteria are not complied with, or supervision is manifestly ineffective."

### Structure of Table 1 (Detailed Principle-by-Principle Assessment)
- Table 1 provides a detailed Principle-by-Principle Assessment of the BCP, structured as follows:
  - "description and findings" sections provide information on the legal and regulatory framework, as well as evidence of implementation and enforcement.
  - "assessment" sections contain only one line, stating whether the system is "compliant," "largely compliant," "materially non-compliant," or "non-compliant" (as described above).
  - "comments" sections explain why a particular grading is given; they are judgmental and reflect the assessment team’s views regarding strengths and areas for further improvement. Emphasis should be placed on the comments accompanying each principle, rather than on the individual grades.

### A. Supervisory Powers, Responsibilities, and Functions — key findings (Principle 1 and Essential Criteria EC1–EC5)
- Principle 1: "Responsibilities, objectives and powers. An effective system of banking supervision has clear responsibilities and objectives for each authority involved in the supervision of banks and banking groups."
- General finding: "A suitable legal framework for banking supervision is in place to provide each responsible authority with the necessary legal powers to authorize banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions to address safety and soundness concerns."

EC1 — Responsibilities and objectives (Description and findings)
- The RBI’s responsibilities and objectives with regard to supervision are defined in legislation and publicly disclosed.
- The RBI is the authority for banking supervision in India; enabling legislation gives it the authority to supervise all banks, public sector and private, domestic and foreign. It also supervises urban cooperative banks.
- Exceptions: state cooperative banks, district central cooperative banks, and rural regional banks are supervised by NABARD; these exceptions account for a small share of deposits.
- The responsibilities and objectives appear in different places and in somewhat different forms, leading to some lack of clarity.
- Examples of legislative phrasing:
  - Preamble to 1934 Act creating the RBI: RBI is "... generally to operate ... any credit system of the country to [the country’s] advantage," which could be construed to include objectives beyond prudential regulation.
  - 1949 Banking Regulation Act Statement of Objectives and Reasons: "[the primary objective] of banking legislation should be the protection of the interests of the depositor."
  - Sections cited in the 1949 Act: 10BB, 12B, 19, 21, 22, 28, 35, 35A, 36, 39, and 45 (noting Sections 35 and 35A as important; Section 51 extends applicability of most supervisory powers over private sector banks to PSBs).
  - Section 35A objective language: RBI may give directions where it is satisfied that it is "in the public interest" or "in the interest of banking policy," or "to prevent the affairs of any banking company being conducted in a manner detrimental to the interests of the depositors, or in a manner prejudicial to the interests of the banking company, or to secure the proper management of any banking company generally."
  - Section 5 (ca) discussion of "banking policy" and Section 45 on suspension of business where RBI considers "good reason so to do."
- Noted risk: phrases such as "interest of the banking system" and "interest of monetary stability" potentially extend beyond safety and soundness and could create ambiguity about supervisory priorities.

EC2 — Primary objective of supervision (Description and findings)
- The 1949 Act frequently cites protection of depositors' interests, nearly equivalent to "protecting the safety and soundness of banks."
- RBI website states the objective of supervision is to "maintain public confidence in the system, protect depositors’ interest and provide cost-effective banking services to the public."
- In practice, RBI gives weight to safety and soundness; supervisory departments take safety and soundness considerations seriously.
- Uncertainty remains whether safety and soundness is explicitly the primary objective; other objectives (including consumer protection and administration of PSL) may be on par with financial stability.

EC3 — Power to set and enforce prudential standards (Description and findings)
- The 1934 and 1949 Acts provide the RBI with statutory power to set and enforce minimum prudential standards for banks and banking groups.
- RBI standards cover capital, management, governance, risk management, and other aspects; powers extend to PSBs as well as private banks.
- Example: India has a supplementary capital requirement for systemically important banks in line with the Basel III standards.
- RBI adopted risk-based supervision; supervisory team size increases with bank complexity and size; riskiness of institution factors into staff allocation.
- Supervisors have power to add to minimum capital requirements: "Capital add-on requirements under Pillar II can be imposed to meet risks not reflected in Pillar I minimum capital requirements."

EC4 — Updating laws, regulations, and public consultation (Description and findings)
- Since the global financial crisis and the domestic NPA crisis, several banking-related laws and regulations have been updated. Major examples:
  - The Insolvency and Bankruptcy Code, 2015: consolidated insolvency laws; limits time for resolving a bankruptcy to 180 days. 22
    - Note: "This duration can be extended by another 90 days by the Adjudicating Authority if considered necessary (Section 12(3) of the Insolvency and Bankruptcy Code, 2015)."
    - Code establishes bonded insolvency professionals (IPs), information utilities (IUs), National Company Law Tribunal (NCLT) for companies, Debt Recovery Tribunal (DRT) for individuals, and an Insolvency and Bankruptcy Board of India.
  - RBI Act, 1934 amendments: created a Joint Mechanism under GOI finance minister to decide regulatory overlap issues; amended in 2016 to give statutory basis for a Monetary Policy framework and to establish a Monetary Policy Committee.
- Other examples of legislative/regulatory change:
  - Finance Act, 2015 merged the Forward Market Commission with SEBI.
  - Negotiable Instrument Act, 1881 amended in 2015 to clarify filing locations.
  - Payment and Settlement Systems Act, 2007 amended in 2015 to align with international norms.
  - Insurance Laws (Amendment) Act, 2015 raised the cap on foreign investment in Indian insurance companies from 26 percent to 49 percent of outstanding equity.
- A draft bill is moving forward to create a resolution and recovery regime for Indian banks. 23
- RBI schedule for introducing Basel III capital rules is in line with the Basel Committee timeline. 24
- The same is true for the LCR. 25
- Public consultation:
  - Laws are subject to parliamentary process, providing opportunity for public consultation.
  - RBI regulations (circulars, guidelines, guidance, directions) are sometimes published for comment; drafts often originate in working groups and are circulated to industry groups such as the Indian Banking Association.
  - Until recently, no structured process existed for public review of all RBI regulations; RBI has now adopted a process for publishing major drafts and allowing time for public comment, after which they are approved by its Board.
  - "In 2016, 86 separate regulations were issued, excluding consolidations of former regulations into 'Master Directions.'"

EC5 — Supervisory powers of access, consolidated and cross-border supervision (Description and findings)
- Section 35 of the 1949 Act empowers the RBI to inspect any banking company at any time; inspections can look into "the affairs of any banking company," implying full access to Boards, management, staff, books and accounts.
- Consolidated supervision and financial conglomerates:
  - RBI does not allow nonfinancial companies to own banks.
  - RBI is the lead supervisor (or Principal Regulator) of all financial conglomerates in India that include a bank.
  - RBI has agreements with insurance, fund, and market supervisors to receive information on nonbank parts of any banking group.
  - Financial Stability and Development Council (FSDC), chaired by the finance minister, has a subcommittee chaired by the governor of the RBI; under it is an Inter Regulatory Technical Group to address inter-regulatory coordination. Issues unresolved at lower levels can be elevated to the FSDC. So far, no issue has had to be referred to the FSDC.
- Cross-border supervision:
  - A 2010 framework for Cross-Border Supervision and Supervisory Cooperation is in place; RBI has built formal arrangements with foreign supervisors (MoUs, Statements of Cooperation, Letters of Cooperation).
  - Supervisory colleges have been established for six Indian banks.
  - Periodic onsite inspections of overseas operations of Indian banks are undertaken by the RBI.
- Key statistics:
  - "Indian banks operate in 54 jurisdictions across the world;"
  - "46 foreign banks have presence as branches and 39 as representative offices."
  - "Formal arrangements established with 40 overseas supervisory authorities (as against two MoUs at the time of the last FSAP)."
  - "Supervisory colleges were established during 2012–14 for all six major Indian banks having significant overseas operations. Meetings organized by the RBI are held at least once in two years. In the meantime, college members communicate to exchange information and to coordinate supervisory action."

*Source: cr1804 - 65.*

### Section 22 (3A) of the 1949 Act extends the general power of the RBI to supervise

### Section 22 (3A) of the 1949 Act extends the general power of the RBI to supervise domestic banks to foreign banks operating in India

### EC6 — Powers to address non-compliance, unsafe or unsound practices
- Supervisor powers when a bank is not complying with laws or regulations, or is or is likely to be engaging in unsafe or unsound practices:
  - a. take (and/or require a bank to take) timely corrective action;
  - b. impose a range of sanctions;
  - c. revoke the bank’s license; and
  - b. cooperate and collaborate with relevant authorities to achieve an orderly resolution of the bank, including triggering resolution where appropriate.
- Description and findings re EC6:
  - For private sector banks, the RBI can:
    - levy fines;
    - revoke a bank’s license (subject to appeal to the GOI);
    - remove Board, management or staff;
    - restrict a bank’s activities; and
    - prevent a distribution of capital when it judges that circumstances warrant it.
  - Revocation of licenses is subject to appeal to the GOI (see Section 35 of the 1949 Act).
  - For PSBs, the RBI’s power to enforce actions is generally the same in most respects, but:
    - the RBI cannot independently revoke their licenses or force a merger;
    - the RBI can recommend dismissals of Board members or senior officers, but cannot independently enforce them.
  - A bill before parliament would create a resolution and recovery regime that applies to public as well as private sector banks; the bill proposes some supervisory powers over a public sector bank will continue to reside with the GOI (see Schedule 10 of the Financial Resolution and Deposit Insurance Bill 2016, which amends the Acquisition and Transfer of Undertakings Act of 1980).

### EC7 — Power to review activities of parent and affiliated companies
- Supervisor capability:
  - The supervisor has the power to review the activities of parent companies and of companies affiliated with parent companies to determine their impact on the safety and soundness of the bank and the banking group.
- Description and findings re EC7:
  - The RBI can supervise any associated financial firm (in cooperation with its sectoral supervisor) as well as parent companies, and can review activities of nonbank parts of any banking group to determine impact on safety and soundness.

### Assessment of Principle 1 — Scope and clarity of supervisory powers
- Assessment: Largely Compliant
- Key findings:
  - No material gaps in coverage of the Indian system of bank supervision and regulation; legal framework gives RBI powers to authorize banks, conduct ongoing supervision, address compliance, and undertake timely corrective actions.
  - Laws and regulations are updated frequently; new arrangements between domestic financial supervisors have been implemented to smooth group regulation and supervision.
  - In the past five years, the RBI has established formal relationships with overseas supervisors, including colleges for its six largest internationally active banks (EC5).
  - RBI can review activities of parents, affiliates, and subsidiaries of banks (EC7).
  - Safety and soundness is important but "it is not clearly and unambiguously its first priority for supervision (EC2)."
- Policy recommendations and suggested reforms:
  - Legislation is needed to update and clarify the RBI’s supervisory mandate; statute should clearly state that safety and soundness, including systemic stability, are the top priorities of supervision.
  - The GOI should defer to the RBI in matters of safety and soundness, including matters affecting the PSBs; the RBI’s decisions with respect to safety and soundness should not be subject to GOI review.
  - Supervisors should be able to use independently the same broad range of supervisory tools and enforcement actions with respect to public and private sector banks.
  - Short of legislation, the RBI and the GOI should consider adopting a framework agreement (as done recently for monetary policy) to formalize and clarify objectives and responsibilities:
    - The main objective of RBI bank supervision should be prudential; other supervisory objectives (financial inclusion, financing government, priority sector funding, consumer protection) should be secondary.
    - The GOI would defer to the RBI in all matters regarding licensing of banks (including revoking licensing), permissible activities, governance (including dismissal of Board members), general management and risk management, and corrective actions needed to address safety, soundness and stability concerns (see CP2, CP4, CP11, and CP14).
    - These provisions would apply to all banks, including PSBs, fully and without reservation.

### Principle 2 — Independence, accountability, resourcing and legal protection for supervisors
- Principle summary:
  - Supervisor should possess operational independence, transparent processes, sound governance, budgetary processes that do not undermine autonomy, adequate resources, accountability for duties and use of resources, and legal protection.
- EC1 — Operational independence, accountability and governance (findings):
  - RBI has statutory authority to set banking policy and examine banks; banks must submit requested information.
  - For private banks: independent authority to grant or rescind licenses, remove management, file with the High Court to close banks, control loans and advances, impose penalties, and file criminal complaints.
  - Section 22 (5) allows any banking company aggrieved by the decision of the RBI to cancel a license to appeal with the central government within 30 days; central government decision is final (Section 22 (6)).
  - For PSBs: RBI cannot remove government-appointed directors or management, force a merger, or revoke a license; can advise GOI but government is not bound to follow RBI advice.
  - RBI must designate a non-executive member on PSB Boards, creating potential conflict of interest and possibly compromising independence.
  - Statutory provisions that may undermine RBI independence:
    - Section 7 of the RBI Act allows the central government to give directions to the RBI "as it may, after consultation with the governor, consider necessary in the public interest";
    - Section 30 of the RBI Act allows the central government to supersede the RBI if it "fails to carry out any of the obligations imposed on it under the RBI Act."
  - RBI’s accountability and governance are prescribed in legislation and publicly disclosed (including in Annual Reports).

- EC2 — Appointment and removal processes (findings):
  - Central Board composition:
    - governor;
    - up to four deputy governors appointed by the central government;
    - four more directors nominated by the central government from the four RBI local Boards;
    - 10 other directors nominated by the central government;
    - a government official nominated by the central government.
  - Appointment terms:
    - The governor and a deputy governor may be appointed for up to five years and be reappointed at most once.
    - Directors are appointed for a four-year term and may be reappointed for, at most, one additional term.
  - Removal:
    - The central government "may remove from office the governor or a Deputy Governor or any other Director or any member of a Local Board" at will; there are no restrictions as to cause.
    - Legislation does not provide for an obligation to make public the reasons for a governor’s dismissal.

- EC3 — Publication of objectives and accountability framework (findings):
  - RBI publishes its core purpose, values, and mission on its website. Core purpose stated as: "to foster monetary and financial stability conducive to sustainable economic growth and to ensure the development of an efficient and inclusive financial system."
  - Five "commitments to the nation" published; the second commitment: "to regulate markets and institutions under its ambit to ensure financial system stability and consumer protection."
  - RBI is publicly accountable via its website, testimony before parliament, and published Annual Reports, which include sections on regulation, supervision, and financial stability.

- EC4 — Internal governance and decision-making (findings):
  - RBI has a hierarchy to take supervisory decisions at an appropriate level; powers delegated to officers through “notification to sign the letters.”
  - Officers empowered to take timely decisions in emergencies.
  - Central Board structured to avoid possible conflicts of interest; statutory restrictions bar salaried government officials or officers/directors of a bank from Board appointment.

- EC5 — Credibility, professionalism, and conflict rules (findings):
  - Staff recruitment selective with strong academic qualifications.
  - Turnover is low—in the order of 1 percent a year—yielding high average staff experience.
  - Use of internal and external training; staff regulations address conflicts of interest and misuse of information.

- EC6 — Adequacy of resources (findings):
  - RBI generates its own funds from central banking activities and does not depend on the GOI for budget requirements.
  - Department of Supervision has about 435 staff.
  - The D-SIBs—ICICI and SBI—have a dedicated professional team of six or seven examiners under a Senior Supervisory Manager (SSM); staffing can be supplemented from other RBI resources with specialized skills as needed.
  - RBI does not depend on outside experts for supervision; employee compensation is attractive and ensures retention.
  - RBI has sufficient resources for technology infrastructure, travel for onsite work, and participation in domestic and international meetings.

- EC7 — Resource planning and skills (findings):
  - Management in RBI Supervisory Departments regularly review skills availability and needs.
  - Identified gaps are referred to HRMD; HRMD collates with Performance Management System information and advises training establishments to organize appropriate training.
  - HRMD uses e-learning facilities such as FSI Connect and online IMF courses.

- EC8 — Risk-based resource allocation (findings):
  - Supervisory strategies and resource allocation depend on size, risk profile, and importance of banks.
  - The RBS approach considers systemic importance when allocating resources and determining supervisory stance.

- EC9 — Legal protection for supervisors and staff (findings):
  - Both the 1934 and the 1949 Act protect the RBI and its officers from suit regarding anything done in good faith to implement the Acts; protection extends to any possible damage caused in the process.

- Assessment of Principle 2:
  - Assessment: Materially Non-Compliant
  - Summary comments:
    - RBI has budgetary autonomy and adequate resources; transparent core purpose; public accounting through Annual Reports.
    - Operational independence exists in most respects and legal protection for RBI and officers is in statute.
    - However, statutory provisions and appointment/removal powers of the central government, and limitations in RBI’s authority over PSBs (including inability to remove government-appointed directors, force mergers, or revoke PSB licenses independently), create material shortcomings in independence and operational autonomy.

*Source: cr1804 - Section 22 (3A) of the 1949 Act extends the general power of the RBI to supervise*

### Section 54 of the 1949 Act.

### Section 54 of the 1949 Act.

### RBI legal independence and governance (summary of findings)
- While it does regulate and supervise the PSBs, the RBI does not have full discretion to take supervisory actions (EC1).  
- The RBI Act contains a number of powers enabling the central government to supersede decisions of the RBI. Although these powers have not been used in practice, they are broad and their existence undermines the RBI’s legal independence (EC1).  
- The RBI governor is not appointed for a minimum term but for a maximum one, and may be dismissed at will by the government (EC2) without disclosing the reasons for such action.  

### Recommendations on legal and institutional reforms
- Legislation should be updated to extend the RBI’s independent authority, so that RBI has full discretion to take any supervisory actions as needed.  
- As second best, the government and the RBI should consider entering into a framework agreement to similar effect covering all matters of prudential supervision.  
- The 1934 Act should be amended, so that the RBI governor is appointed for a minimum term rather than a maximum term.  
- It should be possible for the GOI to dismiss the governor before the end of his/her term only if due process establishes incapacity, dereliction of duty, or unethical behavior, in which case the reasons for dismissal should be published.  
- For legal clarity, it would be preferable to eliminate the provisions providing the government with powers to supersede decisions of RBI.  
- The RBI should track the resources deployed through dedicated SSM teams and specialist units for supervision of the D-SIBs and other large banks. It should review whether the level and character of resources are appropriate in absolute terms and as a share of total supervisory departmental resources, compared with the importance of these institutions in the banking system.  

### Cooperation and collaboration — Principle 3 (assessment: Compliant)
- EC1: Domestic cooperation framework and practice  
  - The Financial Stability and Development Council (FSDC) created in December 2010 is chaired by the Minister of Finance and includes the RBI governor and other senior officials; the FSDC meets twice per year. The Sub-Committee (SC) of the FSDC is chaired by the RBI governor and meets thrice per year.  
  - Four technical committees exist. The Inter-Regulatory Forum (IRF), created in 2013 and chaired by the deputy governor in charge of the RBI’s Department of Banking Supervision, has met 21 times. An Early Warning Group was set up in June 2012. The FSDC secretariat rests with the RBI’s Financial Stability Unit (FSU). A financial stability report is written twice per year by the FSU of the RBI and placed on the RBI’s website.  
  - In February 2013, the RBI, SEBI, IRDA, and PFRDA concluded an MoU to formalize cooperation in supervision of cross-sector financial conglomerates. The MoU formalizes collaboration, information sharing, consultation, and assessment of systemic risk for the 11 conglomerates and macroprudential risks. The RBI is lead regulator for bank-led conglomerates and, by virtue of section 29 (A) of BR Act, has authority to conduct inspections in nonbank entities of these conglomerates. Inspections are not yet conducted jointly, but work is underway to design a protocol for joint inspection.  
  - The FSDC, its SC, and the IRF provide a mechanism for coordinated crisis response among regulators and the government.  

- EC2: Cross-border cooperation and supervisory colleges  
  - Since 2010, 43 MoUs with foreign regulators were concluded under a 2010 government Framework for Cross-border Supervision and Supervisory Cooperation. MoUs cover information sharing, onsite examinations, crisis management, confidentiality, and supervisory colleges.  
  - The 2010 framework supported creation of supervisory colleges for the six main Indian banks with cross-border operations. In total, 25 Indian banks have operations in 54 jurisdictions and 86 foreign banks have operations in India. The colleges meet once every two years; the RBI chairs the meetings.  
  - Thirty-six onsite inspections in establishments of 15 Indian banks abroad, including offshore units, were performed between 2012 and 2015 in 23 jurisdictions. A number of cross-border inspections were undertaken jointly with the host authority. RBI staff report good day-to-day working relationships with main foreign counterparts.  

- EC3: Safeguards on confidential information shared with domestic and foreign supervisors  
  - The 2013 domestic MoU requires agencies to preserve confidentiality and not disclose information without written consent of the providing authority; conditions may be attached. For fitness and propriety information, there is an obligation to share subject to applicable laws.  
  - Sharing with foreign regulators is on a voluntary basis, with prior written consent, legal constraints, and any conditions imposed by the sharing authority. The MoU signals that Indian authorities may be compelled by a Court of Law, in particular under the Freedom to Information Act, to disclose confidential information. RBI staff using shared information remain bound by normal RBI confidentiality obligations.  

- EC4: Restrictions on onward disclosure and legal compulsion procedures  
  - Domestic MoU Art. 9 places sharing in context of supervising conglomerates (risk analysis, risk management, internal controls, capital, liquidity, and funding). Art. 18 confirms professional secrecy and confidentiality.  
  - Article 19 of foreign MoUs specifies confidential information is to be used only for lawful supervisory purposes. Article 20 states received confidential information shall be disclosed to third parties only after written approval of the providing authority and consideration of any conditions. Article 21 requires prompt notification to the providing authority if legally compelled to disclose; receiving authority will use best endeavors to preserve confidentiality. Article 29 allows denial of information provision when disclosure would violate local laws, interfere with an investigation, or on grounds of national interest or national security, or any other legitimate ground adversely impacting effective supervision.  

- EC5: Support for recovery and resolution planning and actions  
  - Provision of information under MoUs permits receiving regulatory agencies to use information to support resolution and recovery actions, provided confidentiality is respected. The FSDC structure is available to exchange information among domestic regulatory agencies and the Ministry of Finance to support recovery and resolution actions.  
  - The RBI can be required by the government to perform specific inspections under section 35(4) of the BR Act. Art. 10 of the cross-border MoU acknowledges benefits of close liaison in case a cross-border institution encounters serious financial difficulties.  
  - Under the draft Financial Resolution and Deposit Insurance Bill 2016, the regulator may authorize any officer or agent of the deposit insurance corporation to enter bank premises to inspect equipment and documents and require staff to provide required information or documents to ensure compliance with the law.  

- Assessment and comments:  
  - The overall framework for cooperation is considered comprehensive and effective, and a grading of Compliant is given for Principle 3.  
  - Recommendations include: include more explicit provisions in applicable bills, acts, and regulations to support mutual recovery and resolution actions (e.g., agency-appointed administrators, prosecutors, and liquidators); amend the interagency MoU of 2013 to create options to provide assistance among agencies in case of enforcement actions; amend mandates in the RBI Act and BR Act to strengthen the RBI mandate for financial stability; streamline the FSDC, SC, Early Warning Group, and FSDC working group committee structures to achieve clearer mandates and more efficient crisis coordination; consider higher frequency of supervisory colleges or increased information exchange between meetings for larger institutions.  

### Permissible activities and use of the term “bank” — Principle 4 (assessment: Compliant)
- EC1: Definition of “bank”  
  - The Banking Regulation Act of 1949 defines “banking” and “banking company.”  
  - Section 5 (b) defines “banking” as “the accepting, for the purpose of lending or investment, of deposits of money from the public, repayable on demand or otherwise, and withdrawal by cheque, draft, order or otherwise.”  
  - Section 5 (c) defines "banking company" to mean “any company which transacts the business of banking in India.”  

- EC2: Permissible activities of licensed banks  
  - Section 6 of the 1949 Act specifies permissible activities including borrowing and lending, issuing financial guarantees and letters of credit, dealing in bullion and forex, underwriting and dealing in securities, including debt and equity instruments, and in government securities, providing custodian services, acting as government agents, and undertaking and executing trusts.  
  - Section 6(n) permits banks to “[do] all such things as are incidental or conducive to the promotion or advancement of the business of the company.”  
  - Section 6(o) states “banking companies may do any other form of business which the central government may, by notification in the Official Gazette, specify.” This permits the central government to require banks to undertake other forms of business.  

- EC3: Control on use of the word “bank” in names and domain names  
  - Section 7 (1) states no company other than a banking company shall use as part of its name, or in connection with its business, any of the words "bank,” "banker," or "banking," and no company shall carry on the business of banking in India unless it uses as part of its name at least one of such words. The RBI regulation interprets this to extend to domain names.  
  - With some small cooperatives exceptions and limited deposit-taking by nonfinancial companies, all banking activity in India is regulated and supervised by the RBI. Private sector banks are licensed by the RBI. The PSBs are created by statute by the central government.  

- EC4: Reservation of deposit-taking to licensed banks (description and findings)  
  - State cooperative banks, district central cooperative banks, and regional rural banks are supervised as banks by NABARD. Otherwise, almost all deposit taking is reserved for institutions licensed and supervised by the RBI. Section 22(1) requires private sector firms to obtain a license from the RBI before engaging in banking.  
  - Not all deposit-taking occurs in banks: Industrial, manufacturing, and other nonfinancial companies can take deposits under conditions in the Companies Act 2013. These companies are overseen by the Ministry of Corporate Affairs and the rupee amount of deposit taking concerned is very small compared with regulated banks. Conditions include: being profitable for the last three years and having a positive net worth; obtaining a credit rating annually; depositing at least 15 percent of the amount of deposits maturing by the next financial year in a separate bank account as a repayment reserve; taking deposits only up to a proportion of net owned funds; and offering an interest rate prescribed by the RBI.  

- EC5: Public list of licensed banks  
  - The RBI publishes the list of commercial banks functioning in India including PSBs, private sector banks and foreign bank branches which is readily available at the RBI website at https://rbi.org.in/commonman/English/Scripts/BanksInIndia.aspx.  

- Assessment: Compliant. The permissible activities of institutions licensed and supervised as banks are defined, the use of the word “bank” is controlled, the term “bank” is defined in law (EC1), permissible activities are defined though the central government has power to require nontraditional activities (EC2), only banks regulated by the RBI may use the term “bank” (EC3), deposit-taking is largely confined to banks with limited exceptions (EC4), and the RBI maintains a public list of banks (EC5).  

*Source: Section 54 of the 1949 Act.*

### Section 6(o) of the 1949 Act should be repealed.

### Section 6(o) of the 1949 Act should be repealed.

### Recommendation on Section 6(o)
- Section 6(o) of the 1949 Act should be repealed.
- Rationale: While the volume of deposits held in nonbanking institutions is very small and may have been justified by historical circumstances as well as overseen by the government, deposit-taking by these institutions should be prohibited under the law.

### Principle 5 — Licensing criteria (overview)
- The licensing authority has the power to set criteria and reject applications for establishments that do not meet the criteria.
- At a minimum, the licensing process consists of an assessment of:
  - ownership structure and governance (including the fitness and propriety of Board members and senior management),
  - strategic and operating plan,
  - internal controls,
  - risk management,
  - projected financial condition (including capital base).
- Where the proposed owner or parent organization is a foreign bank, the prior consent of its home supervisor is obtained.

### Essential criteria and findings (Principle 5)
- EC1: Authority to grant/withdraw licenses
  - The law identifies the authority responsible for granting and withdrawing a banking license.
  - Findings:
    - The RBI has the authority to grant and withdraw bank licenses (Section 35; Section 22 (1); Section 22 (4)).
    - License revocations can be appealed to and overturned by the GOI (Section 22(5)).
    - The RBI does not have the power to revoke the license of any licensed PSB or to take equivalent action over PSBs established by statute.
    - No licenses have been revoked (or withdrawn) in the last five years.

- EC2: Power to set criteria and reject applications
  - Laws or regulations give the licensing authority the power to set criteria for licensing banks and revoke licenses based on non-fulfilment or false information.
  - Findings:
    - The 1949 Act sets statutory requirements for granting a license which RBI must enforce (Section 22 (3)).
    - The 1949 Act empowers the RBI to set and enforce additional criteria for licensing banks.
    - RBI issued guidance for licensing: February 2013 (private sector banks), November 2014 (Payments Banks and Small Finance Banks), August 2016 (renewed guidance).
    - Total applications for private sector bank licenses in the past five years: 139 applications received; 112 were rejected; four applicants withdrew before in-principle approval; three withdrew after in-principle approval; two universal banks, ten small finance banks, and seven payments banks were licensed.
    - RBI licensing review process:
      - Preliminary scrutiny by RBI team; findings presented to External Advisory Committee (EAC).
      - Detailed assessment by RBI team; EAC reviews and recommends.
      - Internal Screening Committee (ISC) (governor and deputy governors) examines applications and EAC recommendations; ISC recommends to Committee of the Central Board (CCB).
      - CCB decides final list for in-principle approval. An in-principle approval is valid for 18 months.

- EC3: Consistency with ongoing supervision
  - Criteria for issuing licenses are consistent with those applied in ongoing supervision.
  - Findings:
    - Statutory licensing requirements cross-reference supervisory standards for established banks (Section 23(2) cross-references Section 35).
    - RBI has specific regulatory criteria for licensing consistent with supervisory requirements (Guidelines for On-Tap Licensing of Universal Banks in the Private Sector dated August 1, 2016).

- EC4: Structures do not hinder supervision or corrective measures
  - Licensing authority determines proposed legal, managerial, operational and ownership structures will not hinder effective supervision on both a solo and a consolidated basis.
  - Findings:
    - Section 22(3)(g) requires RBI to ensure carrying on banking business in India will be in the interests of the public and depositors.
    - Universal Bank Guidelines require promoter group shareholding held through a Non-Operative Financial Holding Company (NOFHC) if bank is not stand-alone; NOFHC corporate governance norms in 2013 RBI Guidelines; corporate structure must allow supervision on solo and consolidated basis and permit ring-fencing.

- EC5: Suitability of major shareholders and UBOs
  - Licensing authority identifies and determines suitability of bank’s major shareholders, including ultimate beneficial owners (UBOs).
  - Findings:
    - “Substantial interest” defined as ”beneficial interest” of more than 10 percent of the equity or shareholding exceeding Rs. 0.5 million, whichever is less (Section 5(ne)).
    - Section 12(B) requires RBI to ensure those with such interest are fit and proper.
    - Prior RBI approval required for any shareholder to obtain 5 percent or more shareholding (with relatives/associates/persons acting in concert) (Section 22 (3)).
    - Licensing guidelines require assessment of fit-and-proper status, investigation of experience, business interests, shareholding patterns, financial statements, income tax returns, annual reports, and sources of capital; applicants must furnish information on persons/entities subscribing to 5 percent or more of paid-up equity capital.
    - RBI staff acknowledged difficulty in establishing ultimate beneficial ownership; fit-and-proper reviews may not always extend to all UBOs who could exercise some control.
    - Comment: Difficulty in establishing ultimate beneficial ownership should be grounds for rejecting a license application. RBI needs to review regulations/practices to ensure suitability of shareholders encompasses UBOs.

- EC6: Minimum initial capital
  - A minimum initial capital amount is stipulated for all banks.
  - Findings:
    - Statutory provisions for minimum capital (Sections 11 and 12) have been superseded by regulatory requirements.
    - Minimum paid-up capital: payments banks and small finance banks: Rs 1 billion; universal banks: Rs 5 billion.
    - Historical statutory minimum for a bank operating in a single state with no operations in Mumbai or Kolkata was Rs. 100,000.

- EC7: Fit-and-proper evaluation of Board and senior management
  - Licensing authority evaluates proposed Board members and senior management for expertise, integrity, and conflicts of interest.
  - Findings:
    - Section 10A stipulates Board should include persons with professional or special knowledge or practical experience; restricts commercial interests of a director.
    - Fit-and-proper criteria for existing banks (circular dated June 25, 2004) apply to new banks.
    - Licensing guidelines require majority of independent directors for Small Finance Banks, Payments Banks, and Universal Banks.
    - RBI checks credentials and professional experience of whole time directors and Chairman; appointment of managing director and chairman need prior RBI approval.

- EC8: Review of strategic and operating plans, governance, risk management, outsourced functions
  - Licensing authority reviews strategic and operating plans including corporate governance, risk management, internal controls, detection/prevention of criminal activities, and oversight of outsourced functions.
  - Findings:
    - Applicants must submit business plan covering product lines, target clientele, target locations, usage of technology, risk management, human resources plans, proposed branch network, priority sector compliance, compliance with prudential norms, and expected loan portfolio composition.

- EC9: Review of pro forma financial statements and projections
  - Licensing authority reviews pro forma financial statements and projections to assess adequacy of financial strength and shareholders’ financial information.
  - Findings:
    - Applicants must furnish pro forma financial statements and financial projections for the first years of operations.

- EC10: Foreign banks — no objection from home supervisor and global consolidated supervision
  - For foreign banks establishing a branch or subsidiary, host supervisor obtains statement of no objection from home supervisor and determines if home supervisor practices global consolidated supervision.
  - Findings:
    - Foreign banks applying for presence in India are required to submit No Objection Certificate (NOC) from home country regulator; home regulator must certify it practices global consolidated supervision.

- EC11: Monitoring progress of new entrants
  - Licensing authority or supervisor has policies/processes to monitor progress of new entrants in meeting business and strategic goals and supervisory requirements.
  - Findings:
    - Conditions imposed while granting license are monitored and evaluated during regular supervision.
    - Section 22 (4) empowers RBI to cancel a license if a banking company fails to comply with any of the conditions imposed while granting license under Section 22(1).

### Assessment (Principle 5)
- Largely Compliant
- Comments:
  - The RBI is the licensing authority for all banks in India. Guidance and processes for scrutiny of license applications are generally adequate.
  - Concern: ultimate beneficial ownership. Difficulty in establishing UBOs should be grounds for rejecting a license application. RBI needs to review regulations/supervisory practices to ensure suitability of shareholders encompasses UBOs.

### Principle 6 — Transfer of significant ownership (EC1)
- Principle summary:
  - The supervisor has the power to review, reject and impose prudential conditions on proposals to transfer significant ownership or controlling interests in existing banks.
- EC1: Definitions of “significant ownership” and “controlling interest”
  - Findings:
    - The term “substantial interest” is defined in statute.
    - Requirements linked to percent ownership levels give effect to “significant ownership” and “controlling interest”; these vary with legal form and whether a public or private sector bank, but are clear in all cases.
    - For private sector banks and banking groups, Section 5 (ne) defines “substantial interest” as the paid-up shareholdings of a beneficial interest for individuals; applies to individual or spouse or minor child, whether singly or together.
    - For a listed company, the limit is Rs 500,000 or 10 percent of the paid-up capital, whichever is less.
    - The limit for an unlisted firm is 10 percent of total paid-up capital.
    - All large private sector Indian banks and PSBs are listed companies.

*Source: cr1804 - Section 6(o) of the 1949 Act should be repealed.*

### Section 12B of the 1949 Act requires prior RBI approval for any purchase that would

### cr1804 - Section 12B of the 1949 Act requires prior RBI approval for any purchase that would

### Overview
- Section 12B of the 1949 Act requires prior RBI approval for any purchase that would lead a person or group of persons to own 5 percent or more of the paid-up capital or voting rights of a banking company.
- The term “supervisor” is used throughout Principle 6; in some countries issues might be addressed by a separate licensing authority.
- The RBI can reject requests or impose prudential conditions on acquisitions that go beyond 5 percent, or approve the acquisition if it is in the public interest, the interests of the banking system or the interest of the RBI’s banking policy.

### EC2 — Requirements for supervisory approval or notification for ownership changes
Description and findings:
- The RBI requires private sector banks to obtain prior approval for any acquisition that would result in any person or group of persons holding shares or voting rights of 5 percent or more.
- Even when the acquisition/aggregate holding is proposed to be less than 5 percent, if the concerned bank suspects that questionable methods have been adopted to get over the ceiling of 5 percent to camouflage the real purpose of cornering of shares or voting rights by individuals/groups with a view to acquire controlling interest in the bank, a reference shall be made to the RBI by the bank.
- In such cases, the RBI may require such shareholders to comply with the procedure for prior approval as detailed in the master direction.
- As per BR Act, 1949, before issuing or allotting any share to any person or registering the shares in the name of any person, the banking company shall ensure the requirements of prior approval and the conditions of approval are complied with.
- For PSBs, the RBI has no specific powers to limit private sector ownership. Typically, Indian PSBs have private shareholders who, collectively, can own as much as 48 percent of outstanding capital.
- There is no specific requirement for a PSB to get prior approval from the RBI for any stock sale; however, if a PSB with 30 percent private sector ownership decided to raise capital with a sale of 10 percent interest to a single private sector owner, the RBI could intervene by exercising its general powers to act in the interests of the banking system.
- Where secondary market trading is concerned, the RBI relies on supervisory oversight and periodic public reports to SEBI rather than specific reporting requirements to know if any banking company shareholder is increasing their share significantly. All the major banking companies in India are publicly listed.

Key statutory and regulatory references (as described in the source):
- Section 12B of the 1949 Act (prior approval thresholds).
- RBI Master Direction: “Prior Approval for Acquisition of Shares or Voting Rights in Private Sector Banks,” Directions 2015 (Master Direction dated November 19, 2015).

### EC3 — Power to reject or modify changes in significant ownership
Description and findings:
- For private sector banks, the RBI can reject a change in significant ownership on fit-and-proper grounds; these are similar to the fit-and-proper tests applied during licensing.
- Subsections (3) and (4) of Section 12B of the 1949 Act give the RBI its powers.
- The RBI decision to reject or limit a share purchase, or to impose conditions (such as fit-and-proper conditions or limits to voting rights), is binding on the applicant and the concerned bank.
- If a bank suspects someone is using “questionable methods” (including false information) to increase their shareholding, it must notify the RBI, even for small amounts; the RBI can use its prior approval powers to prevent it outright.
- While the RBI regulates and supervises PSBs, it does not license them; powers over transfers in ownership of PSBs equal or exceed those of its licensing powers. The RBI can restrict voting rights if warranted (see EC5).

### EC4 — Supervisor obtains names and holdings of significant shareholders, including beneficial owners
Description and findings:
- Once a year, banks and banking companies supervised by the RBI report on the fit-and-proper status of major shareholders to the RBI.
- The RBI also relies on ongoing supervisory oversight and periodic public reports to SEBI to know if any banking company shareholder is increasing their share significantly.
- While periodic reporting to the RBI and SEBI and the RBI’s supervision onsite and offsite do allow the RBI to monitor significant ownership, it is not clear that they would necessarily detect changes in beneficial ownership.
- Only one question (question 21) of the application form for the RBI’s approval asks about beneficial ownership: whether any other person other than the applicant has beneficial interest in the proposed acquisition (Form A in the schedules attached to the Master Direction).

### EC5 — Power to modify, reverse, or otherwise address unauthorized change of control
Description and findings:
- The RBI is concerned with unapproved changes in control involving people who are not fit and proper.
- It limits to 5 percent the voting rights of a group of shareholders with any person in it who is not fit and proper, regardless of the group’s collective share of total bank equity.
- The RBI’s general powers are sufficient to intervene and prevent a transfer of ownership that it deems not in the public interest if it becomes aware of it.

### EC6 — Requirement for banks to notify supervisor of material information affecting suitability of major shareholders
Description and findings:
- As per the Master Direction dated November 19, 2015, banks have to notify the RBI immediately if they learn that any major shareholder is no longer "fit and proper."
- Every bank is required to review the status of their shareholders once a year and, after Board review, certify to the RBI that their major shareholders continue to be fit and proper.

### Assessment of Principle 6 — Summary and comments
- Assessment: Compliant
- Findings summarized:
  - The RBI has the power to review any transfer of significant ownership or controlling interests held in existing banks. Significant ownership is either expressly or implicitly defined in statute (EC1).
  - Approval by the RBI for a significant transfer in ownership is required for private sector banks.
  - RBI could in principle block a significant ownership transfer for a PSB if it judged that such a transfer was not in the interest of the banking system (EC2).
  - RBI’s supervisory powers to prevent a change in significant ownership refer to a fit-and-proper test similar to that undertaken as part of a bank licensing and they can reject a change based on false information (EC3).
  - Banks must advise the RBI if a significant shareholder becomes unfit (EC6).
  - The RBI can restrict voting rights if warranted (EC5).
  - While periodic reporting to the RBI and SEBI, and the RBI’s supervision onsite and offsite do allow the RBI to monitor significant ownership, it is not clear that they would necessarily detect changes in beneficial ownership (EC4).
- Recommendation identified in the source:
  - The RBI should require groups that own significant shares of a bank to list all their beneficial owners and to report promptly any material changes in those shares.

### Principle 7 — Major acquisitions (EC1–EC3) — Description and findings
EC1 — Definition of acquisitions/investments requiring prior approval:
- The 1949 Act allows banks to create subsidiaries, including through acquisitions.
- There are no statutory restrictions on the creation of a subsidiary if it is going to operate domestically and undertake activities that are permitted for the bank itself.
- The Act specifies prior approval is needed to form a subsidiary to operate abroad.
- The 1949 Act restricts bank shareholding in nonsubsidiary companies: statutory ceiling is 30 percent of the bank’s own paid up capital and reserves or 30 percent of the investee company’s paid-up share capital, whichever is lower.
- RBI regulations further restrict investments in shares:
  - Prior approval is needed for investments in a financial services company of over 10 percent of the investee company’s capital.
  - Below that level, any investment is subject to the normal prudential parameters on profitability and capital adequacy ratios (CAR).
  - Investments of over 10 percent of a bank’s own paid-up capital in a single entity are not allowed.
  - The sum of all equity investments in subsidiaries and other entities cannot exceed 20 percent of a bank’s paid-up share capital and reserves.
- Investments or acquisitions by banks in financial entities are permitted only in those companies which are regulated either by RBI, or by one of the other national financial regulatory agencies — SEBI, IRDA, PFRDA, or NHB.

EC2 — Criteria to judge individual proposals:
- The criteria for judging individual proposals for major acquisitions or investments by a bank are governed by rules on the financial services that banks may provide; these services are defined by statute.
- Exact criteria for the bank to qualify are set for each kind of acquisition or investment. Example provided:
  - To invest in an insurance business, the bank should have net worth of Rs 10 billion.
  - It should also have a CRAR not less than 10 percent after investment, an NPA ratio not more than 3 percent; a net profit in the preceding three financial years; and a track record of existing subsidiaries that is satisfactory.
- Similar rules apply to all permitted investments and acquisitions.
- Criteria for the businesses in which the bank is investing are generally those set by the national financial regulator responsible for that type of business.

EC3 — Safeguards against undue risk and impediments to supervision:
- Consistent with licensing requirements, objective criteria include that new acquisitions and investments do not expose the bank to undue risks or hinder effective supervision.
- The supervisor can prohibit banks from making major acquisitions/investments where appropriate (as governed by rules on permitted activities and prudential limits).

### Key numeric and regulatory thresholds (as stated in the source)
- 5 percent — prior approval threshold for ownership or voting rights under Section 12B.
- 10 percent — threshold for restrictions on private sector holding (State Bank of India Act consultation) and for prior approval for investments in a financial services company of over 10 percent of the investee company’s capital.
- 48 percent — typical maximum collective private shareholder ownership in PSBs.
- 30 percent — statutory ceiling on bank shareholding in nonsubsidiary companies (of the bank’s own paid up capital and reserves or of investee’s paid-up share capital, whichever is lower).
- 20 percent — limit on the sum of all equity investments in subsidiaries and other entities as a percentage of a bank’s paid-up share capital and reserves.
- 15 percent — example maximum paid-in capital holding by Life Insurance Corporation of India (LIC) in some banks; LIC is prohibited from appointing directors.
- 10 billion (Rs 10 billion) — net worth requirement to invest in an insurance business.
- CRAR not less than 10 percent — capital adequacy requirement after investment for an insurance investment.
- NPA ratio not more than 3 percent — asset quality requirement for an insurance investment.
- Annual reporting — banks report once a year on fit-and-proper status of major shareholders and must review shareholder status once a year and certify to the RBI.

*Content adapted from the IMF source document cr1804.*

### Section 6(1), the 1949 Act. These are, effectively, the sectors regulated by the RBI itself and the other national

### cr1804 - Section 6(1), the 1949 Act. These are, effectively, the sectors regulated by the RBI itself and the other national

### Acquisitions, investments and supervisory control (EC3–EC5, AC1)
- Statutory and regulatory ceilings on investments permit the RBI to prohibit banks from making major acquisitions above defined thresholds, including establishment of cross-border banking operations, and to reject proposals that might hinder effective supervision or where serious regulatory/supervisory issues are observed.
- For foreign branches or subsidiaries, the RBI can reject proposals where host country secrecy laws might hinder effective RBI supervision.
- Proposed acquisitions are reviewed with respect to:
  - financials of the bank;
  - adherence to statutory/regulatory norms;
  - supervisory issues/concerns from onsite/offsite (risk based) supervision;
  - regulatory issues/concerns and the compliance culture of the bank.
- Historical approvals and rejections:
  - In the past five years, 80 applications were approved for acquisitions and investments in nonbanking financial entities by banks.
  - 25 approvals were granted for acquisitions and investments in nonfinancial entities during the year 2012 to 2016.
  - Over that period, 23 applications were rejected for various reasons.
- RBI examination of a bank’s ICAAP includes review of whether contemplated acquisitions are within its financial capacity and the bank’s ability to manage investee activities.
- RBI requires banks that are part of banking groups to prepare a Consolidated Prudential Report (CPR) including related entities carrying on banking or financial activities (except insurance and nonfinancial activities).
- Investments by banks in financial entities are permitted only in companies regulated by RBI, SEBI, IRDA, PFRDA or NHB; nonfinancial entity investments are very sparingly allowed.
- Financial Stability and Development Council (FSDC) functions under the aegis of the MOF to assess systemic risks and inter-regulatory issues.

### Supervisory approach — SPARC, RBS and overall assessment (Principle 8, EC1–EC8)
- RBS implementation:
  - The RBI introduced a comprehensive Risk-Based Supervision (RBS) framework for supervising scheduled commercial banks (SCBs) from FY 2013.
  - At present, all 91 SCBs in India are being supervised under the RBS.
  - Supervisory single point of contact: SSM and team responsible for continuous onsite and offsite monitoring of specific bank(s).
  - Supervisory cycle and onsite engagement frequency: supervisory cycle (12–18 months); full-scope examination for most banks at least once during 12–18 months; 32 small banks examined under a Small Bank Variant Model.
- SPARC framework components and tools:
  - SPARC is underpinned by Integrated Risk and Impact Scoring model (IRISc), a proprietary statistical model using 536 data points and 319 subjective control parameters.
  - Three-pillar assessment: risk, compliance, and capital.
  - Inherent risks classified under 5 business risk categories: Credit risk, Market risk, Liquidity risk, operational risk, and other Pillar II risk.
  - Objective quantitative parameters scored on a scale of 1–4 (1 being the lowest risk and 4 the highest risk).
  - Control gap and governance/oversight gap assessments also scored on a scale of 1–4.
  - Risk of Failure score (RoFS) measured on a relative scale (1–4) as a function of aggregate risk score and capital score.
  - Supervisory ratings: A–E; supervisory stance matrix produces four stances: “Level 1” (Baseline Monitoring), “Level 2” (Close Monitoring), “Level 3” (Active Oversight), “Level 4” (Corrective actions).
  - Risk Compass Report introduced under SPARC in September 2016 to enhance comparability between banks.
- Implementation gaps and limitations:
  - SPARC is primarily a solo (bank-level) framework; group risks are only partially captured (e.g., other Pillar 2 risks).
  - Assessors found limited enforcement of SPARC-calculated capital add-ons for banks rated “C” or “D”; no cases where identified capital add-ons were enforced while independent validation of SPARC models was pending.
  - RoFS and supervisory rating feed into capital add-on, supervisory stance, and supervisory actions, but linkage to firm, action-oriented capital augmentation plans is weak.
  - There is no comprehensive bank resolution framework; RBI does not assess bank resolvability nor prepare recovery and resolution plans. BR Act (1949) provides limited resolution powers; draft Financial Resolution and Deposit Insurance Bill, 2016 under consideration.
- Early intervention and stress detection:
  - RBI has a PCA framework with Trigger Points in terms of CRAR, Net NPA and ROA (see CP 11).
  - Early Warning System (EWS) uses 17 financial indicators covering growth, solvency, asset quality, profitability, and liquidity.
  - Trigger points set for five indicators: credit growth, CRAR, net NPA ratio, RoA, and LCR — banks breaching any one are flagged as ‘outliers’ for further examination.
- Assessment of Principle 8: Compliant.
- Comments and recommendations noted by assessors:
  - RBI should expedite independent validation of SPARC models and link risk assessments more firmly to supervisory actions.
  - RBI should consider developing detailed SPARC assessment handbooks to enhance consistency.
  - Establishment of recovery and resolution regime and resolvability assessments for large banks (such as D-SIBs) should be considered after resolution bill finalization.

### Supervisory techniques and tools (Principle 9, EC1–EC12, AC1)
- Onsite and offsite mix and processes:
  - RBS employs an appropriate mix of onsite and offsite supervision; relative intrusiveness determined by evolving risk and systemic importance.
  - Offsite returns capture balance sheet, profit-and-loss, prudential indicators (capital adequacy, asset quality, large exposures, maturity profile, leverage, connected exposures, ownership structure, solo and consolidated financials).
  - Domestic banks with cross-border business submit separate returns covering overseas branches/subsidiaries/joint ventures.
  - Offsite reporting powers under Banking Regulation Act 1949 (Section 27).
  - Data collection via XBRL reporting platform; centralized environment with BI tool and defined access controls.
  - Preformatted BI reports and ad-hoc query capabilities available to supervisors.
- Risk discovery and supervisory planning:
  - SPARC risk discovery exercise uses bank profile, prudential offsite returns, compliance with prior supervisory recommendations, sectoral analyses, and results in RAR and RC prepared by SSMs and reported to RBI senior management annually.
  - RAR components:
    - Risk Assessment: aggregate risk, supervisory evaluation of risks and control gaps, governance & oversight.
    - Capital Assessment: Pillar 1 Capital & CRAR, capital management, ICAAP and stress tests, leverage ratio, supervisory capital prescription.
    - Compliance Assessment: compliance culture, major areas of financial divergence and non-compliance.
  - RC components: risk summary, relative risk position, key constituents of risks and proportions.
  - Quality Assurance Division in DBS reviews SPARC process flow and establishes standardized supervisory procedures.
- Analytical tools and datasets:
  - Central Repository of Information on Large Credits (CRILC) collects detailed information on individual large exposures for asset classification consistency and targeted analyses.
  - EWS report captures critical financials and compares current quarter to prior periods (previous quarter, average of previous eight quarters, same quarter a year ago) across bank, peer group, and industry.
  - RBI examines banks’ internal stress test results incorporated in ICAAPs annually; RBI Guidelines on Stress Testing provide objectives, governance, design, and implementation.
- Use of third parties and audits:
  - Under section 30 (1B) of the Banking Regulation Act 1949, RBI can conduct special audits by statutory auditors or other eligible persons; use of this power is rare.
  - RBI mandates external auditors to report concurrently to bank CEO and RBI any matter susceptible to fraud; Long Form Audit Report (LFAR) submitted annually to bank chair and RBI.
  - No explicit RBI rules governing hiring third parties for supervisory activities, quality control, or conflict of interest prevention, though contracts used contain detailed mandates.
- Information systems and automation:
  - XBRL-based online submission, centralized server, robust BI tool, browser-based access, automated RBS data operationalization and MIS outputs.
  - First signal reports, preformatted reports, EWS reports, peer group reports, and ad-hoc query facilities available to supervisors.
- Identified shortcomings:
  - No periodic formal independent review procedure exists to assess adequacy and effectiveness of supervisory tools (AC1).
  - More detailed formal guidelines needed for oversight of RAR action point compliance; oversite currently lacks enforceable escalation guidelines.
  - Supervisory bottom-up stress testing methodology under development and not yet finalized.
  - No explicit mandatory regulatory requirements for banks to report substantive changes in activities, structure, or condition in a timely manner.
- Assessment of Principle 9: Largely Compliant.

### Supervisory reporting (Principle 10, EC1–EC2)
- Legal powers and reporting scope:
  - RBI empowered under Banking Regulation Act 1949 (Section 27) to collect information on financial condition, performance, and risks in formats and frequencies it deems necessary.
  - Offsite returns collected at frequencies ranging from fortnightly to annual.
  - Offsite returns capture granular data including:
    - on- and off-balance sheet details, operating results;
    - capital adequacy, asset quality, lending per sectors;
    - large exposures, structural liquidity in domestic and foreign currency;
    - liquidity coverage ratio, leverage ratio, interest rate sensitivity in domestic and foreign currency;
    - related-party exposures, ownership and control structures, geographical distribution of loans and deposits.
  - Consolidated reporting:
    - Semi-annual Consolidated Prudential Reports covering consolidated balance sheet and profit and loss statements, list of subsidiaries, affiliates, joint ventures, and selected prudential statements (return on capital adequacy, large exposures, forex exposures, exposures to capital market, exposure to unsecured guarantees and advances, CRR, SLR, and structured liquidity).
    - Quarterly returns on financial conglomerates capturing intra-group transactions.
- Reporting standards and guidance:
  - Financial statements of banks prepared using Indian Accounting Standards prescribed by the ICAI.
  - Banks must use same accounting standards for prudential returns.
  - RBI has issued detailed guidance in the form of “Offsite Surveillance Reports” to assist completion and submission of prudential returns.

*Source: IMF Financial Sector Assessment — India (excerpts from cr1804 PDF).*

### Section 29 of the BR Act prescribes the format for preparing the financial

### cr1804 - Section 29 of the BR Act prescribes the format for preparing the financial

### Legal and disclosure framework
- "Section 29 of the BR Act prescribes the format for preparing the financial statements."
- "Banks are mandated to disclose additional information as part of the annual financial statements, such as the CARs, shareholding structure, lending, etc."
- "Financial reporting information contained in the bank disclosure statements and prudential returns is required to be subject to a limited scope review by an external auditor on a quarterly basis."

### EC3 — Valuation governance and supervisory adjustments
- Principle: "The supervisor requires banks to have sound governance structures and control processes for methodologies that produce valuations."
- Key requirements:
  - "The measurement of fair values maximizes the use of relevant and reliable inputs and is consistently applied for risk management and reporting purposes."
  - "The valuation framework and control procedures are subject to adequate independent validation and verification, either internally or by an external expert."
  - "The supervisor assesses whether the valuation used for regulatory purposes is reliable and prudent. Where the supervisor determines that valuations are not sufficiently prudent, the supervisor requires the bank to make adjustments to its reporting for capital adequacy or regulatory reporting purposes."
- Description and findings:
  - "The prudential norms for classification, valuation and operation of the investment portfolio as well as the prudential norms on income recognition, asset classification and provisioning pertaining to advances are the areas where the RBI valuation rules complement the accounting standards."
  - "The RBI examiners verify adherence to the guidelines during onsite inspections. In case the RBI determines that valuations are not adequate, banks are required to make adjustments."

### EC4 — Frequency and tailoring of data collection
- Principle: "The supervisor collects and analyses information from banks at a frequency commensurate with the nature of the information requested, and the risk profile and systemic importance of the bank."
- Legal basis and submission frequencies:
  - "The BR Act (Section 27) empowers the RBI to collect offsite information in such formats and frequencies from any bank as it deems fit."
  - "The prudential returns are submitted on a fortnightly, monthly, quarterly, half-yearly, and annual basis."
- Examples of frequency choices:
  - "Liquidity being a critical issue in supervisory risk assessment, information on liquidity is collected on a fortnightly basis."
  - "Balance sheet details, interest rate sensitivity, and exposure to sensitive sector are collected on monthly basis."
  - "The impact of business activities on capital adequacy, profitability, large exposure, risk concentration, etc., are collected on a quarterly basis."
- Additional supervisory use:
  - "The EWS report captures additional information on trends and developments relative to peers or previous time frames (see CP9, EC1). Identified areas of concern may trigger enhanced offsite reporting, among other supervisory actions."

### EC5 — Comparability and consolidated/period alignment
- Principle: "In order to make meaningful comparisons between banks and banking groups, the supervisor collects data from all banks and all relevant entities covered by consolidated supervision on a comparable basis and related to the same dates (stock data) and periods (flow data)."
- Description and findings:
  - "The prudential returns (stock and flow data) are collected on a comparable basis and are related to the same dates and periods."
  - "The prudential returns are submitted on a fortnightly, monthly, quarterly, half-yearly and annual basis."
  - "After collection, the offsite data is analyzed from multiple angles such as compliance, trends, peers, stocks and flows, industries, sensitivities to various risks, etc. Such reports are used by supervisors in conjunction with individual bank statements and reports."
  - "Offsite analysis is also informed by market intelligence inputs, regulatory filings by banks active in capital markets, discussions with management, etc."

### EC6 — Access to group-wide information and inspection powers
- Principle: "The supervisor has the power to request and receive any relevant information from banks, as well as any entities in the wider group, irrespective of their activities, where the supervisor believes that it is material to the condition of the bank or banking group, or to the assessment of the risks of the bank or banking group or is needed to support resolution planning. This includes internal management information."
- Description and findings:
  - "The BR Act allows the RBI to request and receive any relevant information from banks and other supervised entities belonging to the banking group, but not from nonsupervised entities. (Section 27 of the BR Act)."
  - "However, the Section 29(A)(2) of the BR Act, 1949 authorizes RBI to undertake inspections of any associate enterprise of a bank and its books of accounts, jointly with the authority regulating such associate enterprise. It is expected to remedy the gap to some extent regarding the access to call for information for any entity in the banking group."
  - "The inspections of overseas subsidiaries of Indian banks are undertaken by virtue of powers under Section 29(A)(2), in association with the host supervisor (wherever the host authority consents to participate in such inspections) or by RBI alone."
  - "In addition, the banks that are required to disclose consolidated financials, as per Accounting Standard 21, submit a return on Consolidated Prudential Report (CPR). Financial conglomerates submit Financial Conglomerates returns (FinCon). Branches of foreign banks having subsidiaries of their overseas parent bank submit certain consolidated prudential details but not the consolidated financials."

### EC7 — Inspection access to records and personnel
- Principle: "The supervisor has the power to access all bank records for the furtherance of supervisory work. The supervisor also has similar access to the bank’s Board, management, and staff, when required."
- Description and findings:
  - "Section 35 of the BR Act, 1949, the bank is supposed to make available all books of account to the RBI for inspection. The banks are also expected to provide access to its Board, management, and staff when required by the RBI."
  - "The RBI has the general power to issue directions under the BR Act (Section 35A) where necessary in the interest of banking policy, in the public interest or where the business of the bank is conducted in a manner detrimental to the interest of the depositors."
  - "Section 27 (2) of the BR Act also empowers the RBI to direct a banking company at any time to furnish it, within such time as the RBI may specify, with such statements or information as it deems necessary."

*cr1804 - Section 29 of the BR Act prescribes the format for preparing the financial*

### Section 35 (2) of the BR Act also gives the RBI access to every director, officer, or

### Section 35 (2) of the BR Act also gives the RBI access to every director, officer, or employee of a bank and requires these persons to provide the RBI with any statements or information the RBI examiners may require.

### Legal powers and enforcement mechanisms (EC8–EC12)
- Section 35 (2) of the BR Act gives the RBI access to every director, officer, or employee of a bank and requires them to provide any statements or information RBI examiners may require.
- Submission of erroneous information to the RBI results in penalties as specified in Section 46 (1) of the BR Act; penalties have been imposed on banks for lapses in reporting.
- RBI does not normally impose sanctions on employees or senior management for misreporting.
- The validity and integrity of prudential returns are periodically verified upon submission by a designated statistics division and are subjected to verification during onsite visits.
- Section 30 (1B) of the BR Act allows the RBI to direct a special audit of the banking company’s account; the RBI may appoint a person duly qualified or direct the auditor of the bank to conduct a special audit.
- Expenses of such a special audit are to be borne by the bank (Section 30-1C of the BR Act).
- Prudential returns are to be signed off by a member of senior management (the compliance officer and/or the bank’s CEO).
- The Offsite Surveillance and Monitoring System (OSMOS) has been operationalized in 1995–96.
- Offsite returns are collected, validated, and processed online in XBRL under a centralized environment with data storage/retrieval through a central server and Business Intelligence tools.
- The Committee for Direction on Banking Statistics (CDBS), convened by the Department of Statistics and Information Management (DSIM), periodically reviews basic statistical returns; the last CDBS meeting referenced was held in October 2016.
- The Return Governance Group (RGG) vets introduction/modification/rationalization/standardization of returns; chaired by the executive director in charge of the Department of Regulation; last RGG meeting referenced was held on November 10, 2016.
- External experts are rarely used except auditors; when auditors are used for special examinations, roles, scope, and conflicts of interest are set out in contracts and monitored by the RBI.
- There are no comprehensive guidelines/criteria for hiring third parties to conduct supervisory tasks or for assessing the quality of their work.
- There is no explicit requirement that external experts (other than auditors) promptly report material shortcomings to the RBI; statutory auditors must highlight material matters in the Long Form Audit Report (LFAR) and report frauds of Rs 1 crore and above directly to the RBI.
- The RBI periodically reviews the offsite reporting framework to incorporate new data requirements (see EC9, EC12).

### Findings on supervisory information validity, integrity, and governance (EC9–EC12)
- The RBI validates prudential returns periodically and automatically upon each submission.
- Bank submissions are verified during onsite visits; submission of incorrect or incomplete information is treated as non-submission and leads to penalty under Section 46 of the BR Act.
- Reporting errors and issues impacting data quality are reflected through higher risk scores and/or invocation of penal clause.
- RGG functions include vetting new returns, approving modification/addition/deletion of elements, rationalization, and standardization of code masters.
- The RBI has processes to periodically review returns; offsite reporting framework is reviewed to address changes in regulation, supervisory requirements, users, and reporting entities.

### Assessment of Principle 10 (Information sharing and confidentiality)
- Assessment re Principle 10: Largely Compliant.
- Comments and observations:
  - RBI collects a wide range of offsite returns at frequencies ranging from fortnightly to an annual basis; supervisory information can also be collected on an ad-hoc basis.
  - The quantity and types of data collected vary based on group structures and business profiles.
  - RBI validates prudential returns periodically and automatically; onsite verification complements offsite validation.
  - Inter-departmental groups exist for introduction/modification of returns.
- Shortcomings identified:
  - Most prudential supervisory returns are submitted on a solo basis apart from a few; authorities should consider enhancing collection of data for consolidated supervision in terms of granularity and frequency (e.g., data collection of group-wide asset classification, quarterly CPR, etc.).
  - There are no explicit guidelines/criteria for hiring third parties who conduct supervisory tasks to assess quality of their work or obliging them to promptly report material shortcomings; issuance of such guidelines could be contemplated if third-party use increases.

### Corrective and sanctioning powers (Principle 11; EC1–EC7)
- Principle 11 summary: The supervisor acts at an early stage to address unsafe and unsound practices and has an adequate range of supervisory tools, including ability to revoke or recommend revocation of banking licenses.
- EC1 (raising supervisory concerns; remedial requirements):
  - Supervisory concerns from offsite and onsite analyses are promptly raised with banks for information and remediation.
  - RBI uses a structured risk assessment process as part of the RBS, supported by annual scoring to judge risk of failure and impact on depositors, systemic stability, and the economy.
  - Scorecard indicators reflect bank condition and risks plus size, interconnectedness, substitutability, and complexity; aggregate scores run on a scale of 1 to 4.
  - SPARC scorecard cannot be updated by the EWS output of 17 indicators; quarterly risk-profile updates are made based on available information. If an outlier among the 17 EWS indicators indicates potential supervisory concern, it will be reflected in the next annual scoring exercise; in the meantime the supervisor can act on emerging issues.
  - RBI requires bank management to share examination reports with the bank’s Board.
  - For serious infractions, RBI requires a bank to prepare and submit a written risk mitigation plan (RMP) with specific milestones; SSM monitors actions against the plan.
- EC2 (range of supervisory tools):
  - RBI defines four levels of intensity—Levels 1 to 4—roughly defined as “baseline monitoring,” “close monitoring,” “active oversight,” and “corrective actions.”
  - Supervisory actions range from enhanced dialogue and periodic feedback to intrusive actions: enhanced offsite reporting, focused scrutiny of specific risk areas, specified restrictions on operations, requirements for prior supervisory approval for specific activities, etc.
- EC3 (power to act when regulatory thresholds breached):
  - RBI has a PCA regime specifying mandatory and discretionary supervisory actions when trigger points are breached; triggers are defined in terms of CRAR, Net NPA, and ROA (capital, NPAs, and profits).
  - The PCA framework is under revision; amendments will make the framework more stringent and change the capital measure from Tier 1 plus Tier 2 to CET1.
  - The PCA framework was revised with effect from April 13, 2017; in the revised PCA framework parameters monitored include CRAR, Net NPA, ROA and CET1 along with leverage ratio. There are three risk thresholds and breach of each thresholds would invite certain mandatory and discretionary actions.
  - Reference: “The Scheme for Prompt Corrective Action,” December, 2002.
- EC4 (range of early-stage measures; PCA specifics):
  - The 2002 RBI PCA Scheme associates specific actions with different trigger levels. For CRAR the PCA trigger ranges are defined as 6–9 percent, 3–6 percent, and below 3 percent.
  - For CRAR less than 9 percent, but equal or more than 6 percent, Structured (Mandatory) PCA Actions include:
    - Submission and implementation of capital restoration plan by the bank;
    - The bank will restrict expansion of its risk-weighted assets;
    - The bank will not enter into new lines of business;
    - The bank will not access/renew costly deposits and CDs; and
    - The bank will reduce/skip dividend payments.
  - Discretionary PCA Actions for similar ranges include:
    - The RBI will order recapitalization;
    - The bank will not increase its stake in subsidiaries;
    - The bank will reduce its exposure to “sensitive” sectors like capital market, real estate or investment in nonSLR securities;
    - The RBI will impose restrictions on the bank on borrowings from inter-bank market; and
    - The bank will revise its credit/investment strategy and controls.
  - As CRAR falls into lower ranges, some discretionary actions become mandatory and additional corrective requirements are imposed; same applies for NPA and ROA triggers.
  - CRAR requirements focus on capital adequacy; NPA requirements focus on asset portfolio quality; ROA requirements address overhead expenses and earnings.
  - Some structured and discretionary actions are specified as actions of the RBI and the central government (e.g., when CRAR is between 3 percent and 6 percent, discretionary actions include “Bank/Government [can] take steps to bring in new Management/Board”).
  - The PCA framework has been in place since 2002 and was undergoing substantial revision; the revised PCA framework has since been introduced in April, 2017.
  - The RBI can and does take supervisory actions outside the PCA framework; the PCA scheme reserves the right to require “any other action...in the interest of the concerned bank or in the interest of its depositors.”
- EC5 (sanctions on management and board):
  - The PCA framework provides Structured Actions and Discretionary Actions that RBI may initiate for banks breaching triggers in terms of CRAR, Net NPA, and ROA.
  - Section 36 AA of the 1949 Act gives the RBI authority to remove officers of a private sector bank; discretion is broad and has been used in practice, but it does not extend to PSBs (except directors appointed by private shareholders).
- EC6 (ring-fencing powers):
  - RBI coordinates supervision of financial conglomerates including banks with other financial regulators.
  - RBI regulations call for ring fencing the bank within a non-operating financial holding company (NOFHC) from liabilities of companies outside the NOFHC owned by NOFHC shareholders.
  - RBI cannot unilaterally ring fence a bank completely from losses in other parts of a financial conglomerate at the time such losses materialize, but guidelines limit intra-group exposures and equity investment in subsidiaries, limiting contagion from nonbank affiliates.
- EC7 (cooperation on resolution):
  - Problem situations severe enough to call for resolution of a PSB would be coordinated with the MOF of the central government.
  - The RBI and other nonbank financial regulatory agencies have undertaken to “... endeavour to work together to develop resolution and recovery plans (RRPs) for ...” (text continues in source).

*cr1804 - Section 35 (2) of the BR Act also gives the RBI access to every director, officer, or employee of a bank and requires these persons to provide the RBI with any statements or information the RBI examiners may require.*

### Section 2 (C)(3) of the Guidelines for Licensing New Banks in the Private Sector, February 2013.

### Section 2 (C)(3) of the Guidelines for Licensing New Banks in the Private Sector, February 2013.

### Additional criteria: AC1 — Laws or regulations guard against the supervisor unduly delaying appropriate corrective actions
- Description and findings re AC1:
  - RBI has well established policies, principles and processes to identify supervisory concerns and take appropriate corrective actions in a timely manner.
  - RBI is also accountable to GOI.

### Additional criteria: AC2 — Coordination with supervisors of non-bank entities when taking formal corrective action
- Description and findings re AC2:
  - The MOU between the domestic financial regulatory agencies that established the Inter-Regulatory Forum encourages each regulator to notify the Principal Regulator of a conglomerate of any regulatory actions they take regarding parts of the conglomerate.

### Assessment of Principle 11 — Summary judgment and key findings
- Overall assessment: Largely Compliant
- Comments and bullet findings:
  - The RBI has an adequate range of supervisory tools for timely responses to most issues, including the ability to revoke the license of a private sector bank.
  - Processes help in detecting issues quickly and raising them with the bank, including with their Board. Supervisors can then monitor risk mitigation plans and follow-up on any shortfalls (EC1).
  - The RBI has an appropriate set of supervisory tools (EC2).
  - The RBI has the power to take timely risk mitigating actions (EC3).
  - The RBI has specific options for escalating these actions (EC4).
  - The RBI can take corrective actions against members of management and the Board of a private bank (EC5).
  - The RBI can coordinate corrective actions against nonbank entities in financial conglomerates to protect the bank. Ring-fencing a bank from nonbank liabilities within a group might not be an option in times of stress, but intra-group exposures are limited by regulation (EC6).
  - The RBI cooperates with other agencies as needed to resolve problem situations.
- Identified legal/policy gaps and recommendations:
  - Under the current PCA regime, some of the more stringent actions under PCA are for action by the “government/RBI” (EC4).
  - Decisions to revoke any banking license are subject to government appeal (EC5).
  - Recommendation: Legislation should be amended to give the RBI full authority to revoke a bank license without appeal to the GOI; and to ensure it can act independently with respect to PCA enforcement.
  - Recommendation: The revisions to the PCA triggers and capital definitions should be implemented soon.

### Principle 12 — Consolidated supervision: objectives and overview
- Principle statement:
  - "An essential element of banking supervision is that the supervisor supervises the banking group on a consolidated basis, adequately monitoring and, as appropriate, applying prudential standards to all aspects of the business conducted by the banking group worldwide."

### Essential criteria: EC1 — Understanding group structure and material activities
- Description and findings re EC1:
  - The RBI conducts supervision of banking group-level activities through analysis of the consolidated financials required by the Accounting Standards Board for consolidation (AS21 of Accounting Standards in India) and as reported in the annual Consolidated Prudential Report (CPR).
  - Cross-border consolidated supervision of banking groups is conducted through supervisory colleges, supervisory cooperation MoUs, and inspection of overseas operation of Indian banks.
  - The RBI coordinates supervision and regulation of the five bank-led large financial groups designated “financial conglomerates.”
  - The RBI supervises all the subsidiaries of such bank-led financial groups in conjunction with the relevant domestic securities, pension, and insurance sectoral regulator—the SEBI, the PFRDA, and the IRDA respectively.
  - Financial conglomerates are defined as firms that are active in more than one of these financial sectors.
  - Examples and structural notes:
    - The SBI is the largest financial conglomerate. It consists of five associates banks, and eight overseas banking subsidiaries/joint ventures, NBFCs, insurance companies, and pension funds. Only the five associates have been merged with the parent SBI with effect from April 1, 2017.
    - The ICICI Bank and the PNB have overseas banking subsidiaries. All the others only have nonbank activities in subsidiaries of the bank.
  - The RBI has the authority to supervise any associate enterprise of a banking company jointly with its regulator. This includes the conduct of joint onsite inspections whenever the RBI judges necessary. Joint onsite inspections, however, are not common in practice.
  - Coordination mechanism:
    - To coordinate cross-industry regulation and supervision, the Inter-Regulatory Forum on Financial Conglomerates (IRF-FCs) of the Financial Stability and Development Council (FSDC) was set up in August 2012.
    - The IRF-FC uses “lead regulators” to monitor financial conglomerates. The RBI is the lead regulator for all financial conglomerates that include a bank.
    - The IRF-FC is headed by the deputy governor of the RBI (in charge of the Department of Banking Supervision), and other sectoral regulators are represented at the executive director level.
    - Since it was established, it has met, on average, more than once every quarter.
    - An MoU was signed between the members in March 2013, addressing consolidated supervision and monitoring of financial conglomerates.
  - Reporting:
    - At the end of each quarter, intra-group exposures are reported to the RBI, which are constrained by guidance.
    - During the quarter, the RBI’s SSM has access to Board and management reports regarding intra-group transactions.
    - If sectoral supervisory teams decide coordinated action is needed, it can be escalated to the IRF-FC for discussion and approval.
    - For cross-border supervision, the RBI has an extensive network of cross-border relationships with regulatory authorities in other countries.

### Essential criteria: EC2 — Prudential standards and consolidated reporting
- Description and findings re EC2:
  - Prudential standards have been set up on capital, liquidity risk, large exposures, and exposures to related parties at the group level.
  - The RBI collects and analyzes financial and other information in the form of semi-annual prudential reports (CPR) on a consolidated basis (See CP 10 EC1).
  - Banks with foreign operations are required to disclose financials that consolidate those operations in their Consolidated Prudential Report.

### Essential criteria: EC3 — Oversight of foreign operations (partial content)
- The source begins EC3 but the excerpt ends before completing the EC3 description and findings.

*Source: Section 2 (C)(3) of the Guidelines for Licensing New Banks in the Private Sector, February 2013.*

### Section 29(A) (2) of the 1949 Act, revised January 2013.

### Section 29(A) (2) of the 1949 Act, revised January 2013

### Cross-border supervision framework and supervisory cooperation
- A framework for Cross-border Supervision and Supervisory Cooperation was put in place during 2010.
- Indian banks are operating in 54 foreign jurisdictions.
- Formal arrangements such as MoUs on supervision are in place for 43 overseas supervisory authorities, up from 2 in 2011.
- Supervisory colleges were established during 2012–14 for all six major Indian banks having significant overseas operations (State Bank of India, ICICI Bank, Bank of India, Bank of Baroda, Axis Bank, and Punjab National Bank).
  - The colleges meet at least once in two years, with as needed communications in between.
  - In February 2017 meetings of the Supervisory Colleges of State Bank of India, ICICI Bank Ltd., Axis Bank Ltd. and Punjab National Bank were held at Mumbai.
    - Thirty-six host supervisors from 19 overseas banking supervisory authorities participated in the supervisory college of the State Bank of India.
    - Sixteen supervisors from 10 overseas banking supervisory authorities and 10 supervisors from six authorities participated in the supervisory colleges of ICICI Bank Ltd., and Axis Bank Ltd.
    - Ten supervisors from 5 overseas banking supervisory authorities participated in the supervisory college of Punjab National Bank.
    - Representatives from the SEBI, the IRDA, and the PFRDA also participated in several colleges.
- Between 2012 and 2015, 36 cross-border inspections were held by the RBI in 23 jurisdictions.
- The FSDC is Chaired by the Finance Minister and its members include the heads of all Financial Sector Regulators (RBI, SEBI, PFRDA, IRDA) and the Secretary, Department of Financial Services (DFS) among others. The Council meets roughly every six months.

### Home-host relationships (Principle 13): information sharing, coordination, crisis cooperation
- MoUs envisage information shall be shared “to the extent reasonable and subject to any relevant statutory provisions, including those restricting disclosure.”
- MoUs provide for:
  - Exchange of information on licensing, fitness and propriety, material supervisory concerns, penalties, enforcement actions.
  - Cooperation on onsite inspections; host authority may, if mutually agreeable, take part in onsite inspections in its jurisdiction.
  - Crisis management provisions: authorities should consider possible solutions together and inform counterparts on crisis arrangements, including assessments of systemic impact, liquidity, solvency, contingency funding plans, and deposit insurance arrangements.
  - Article 18a of the MoU: authorities shall seek together possible solutions for issues and barriers that may come up (including coordinated media responses as a practical template).
- Findings:
  - Home and host supervisors share appropriate information on a timely basis bilaterally and through colleges; informal cooperation with non-MoU countries is effective and collegial.
  - Home and host supervisors coordinate and plan supervisory activities; 36 cross-border inspections by RBI (2012–2015) in 23 jurisdictions.
  - The MoUs contain a section on crisis management but there has been no occasion to test the crisis management provisions in reality.
  - The RBI has not required banks to prepare recovery plans, nor has the RBI prepared resolution plans (see CP8 EC7).
  - Where appropriate, home supervisor develops group resolution plan and shares necessary information; currently not implemented.
  - Host establishments in India of foreign banks are subject to identical laws, rules, regulations and supervision as domestic banks.
  - RBI always issues prior notification regarding plans for onsite inspections at overseas offices of Indian banks to the host supervisor.

### Supervision of foreign operations and consolidated/group supervision (Principles EC3–EC8)
- RBI requires Indian head offices to have unimpeded access to pertinent local information from foreign branches and subsidiaries.
- RBI guidance issued on soft and hard skills needed by bank officials posted overseas; GOI ‘Guidelines on placement of bank officials in Overseas Branches’ followed by Indian PSBs.
- The RBI assesses effectiveness of host country supervision via: supervisory colleges; home-host relationships governed by formal/informal arrangements; periodic onsite inspection of overseas operations.
- Between 2012–2015, the RBI conducted onsite inspection of select overseas branches of Indian banks in major jurisdictions; results feed into each bank’s annual supervisory RAR.
- The RBI conducts consolidated supervision through analysis of consolidated financials and supervisory returns (EC2); monitors intra-group exposures and transactions.
  - Intra-group exposures are reported to the RBI and are constrained by guidance (“Guidance on the Management of Intra-Group Transactions and Exposures,” February 2014).
  - The RBI’s SSM has access to Board and management reports regarding intra-group transactions.
- The power of the RBI to take corrective action under section 35A of the 1949 Act may extend to overseas activities to protect depositors or the banking company.
- RBI supervises banks on a solo basis and conducts consolidated supervision on banking groups based on half-yearly CPRs and other information.

### Corporate governance (Principle 14): legal framework, supervisory assessment, deficiencies
- Bank governance framework is provided by the Companies Act 2013 (CA) to the extent not inconsistent with the Bank Regulation (BR) Act; PSB governance arrangements are provided by specific Banking Companies Acts and the State Bank of India Act.
- Per Art. 179 CA, the governing body of a bank is the Board. The functions of chairman and CEO have been split recently by the RBI.
- For PSBs:
  - Government (through the MOF) appoints full-time Board members, including the CEO and the chairman; part-time Board members are appointed by the Board, except two ex officio members nominated by MOF and RBI.
  - Government-appointed practices give rise to potential conflicts and limit PSB Boards’ role in selection of senior management.
- Fit-and-proper requirements:
  - Circular of May 23, 2011 established a fit-and-proper test requiring annual written declarations by directors and CEOs (e.g., no pending prosecutions, prior company liquidation, not under attention of another regulator; CEO must declare loans and defaults).
  - Art. 10B BR Act specifies CEO qualifications; Art. 10A BR Act specifies Board skills-mix (at least 51 percent with experience in specified fields).
  - All whole-time directors and non-executive chairmen must be vetted by the RBI as fit and proper.
- Governance assessment via SPARC (risk-based supervision):
  - SPARC governance assessment uses 59 parameters across Board functioning, senior management, internal audit, and risk management; graded on a scale of 1–4.
  - Onsite inspections review Board minutes and governance practices.
- Remuneration and compensation:
  - RBI sets remuneration standards for private bank CEOs; PSB CEO compensation subject to government rules.
  - RBI has introduced governance guidelines including “claw-back” provisions.
- Powers to require changes in Board/management:
  - Art. 10B (6) authorizes the RBI to require replacement of unfit CEOs or Board members (subject to appeal under Art. 10B (7)).
  - Art. 36 (I) (d) (v) authorizes the RBI to order management changes in private banks; for PSBs only government may change senior management.
- Assessment and rating:
  - Assessment of Principle 14: Materially non-compliant.
  - Comments highlight that appropriate rules on fitness and propriety exist for private and foreign banks but RBI’s limited authority over PSBs and government appointment practices result in weak accountability and potential conflicts of interest.
  - The presence of RBI and MOF officials on PSB Boards creates supervisory conflicts when RBI must assess Board performance.
- Recommendations provided in the assessment:
  - Over the near-term, the BBB should be empowered to appoint and remove senior management of PSBs and assume the role presently carried out by the MOF.
  - Over the longer term, banking laws should be changed to empower the RBI and the Boards of PSBs to exercise the same responsibilities for PSBs as apply to private banks.
  - The requirement that PSB Boards include ex officio RBI officials should be eliminated to remove conflicts of interest.
  - Consider adopting model Board charters to better define terms of reference for Board members, including the non-executive member nominated by the government.
  - The intrusive powers of the RBI to determine parameters of bank lending policies (by virtue of section 21 BR Act) may need to be reconsidered for legal certainty.

### Key supervisory powers, practices, and gaps (Principles 12–15 highlights)
- RBI can supervise every part of any Indian banking group or bank-led financial conglomerate and monitor prudential standards on a consolidated basis for certain items (concentration, capital, liquidity).
- RBI has authority under section 35A of the 1949 Act to take corrective action extending to overseas activities.
- Gaps identified:
  - RBI has not required banks to prepare recovery plans nor prepared resolution plans itself (CP8 EC7).
  - No explicit MoU undertaking to develop agreed communications strategy, although informal contacts allow ad hoc coordination; authorities advised to include language in MoUs or parallel arrangements to strengthen coordinated media response mechanisms in crises.
  - Shell banks are not permitted in India; no explicit rules apply to loan generation offices or booking offices of foreign banks in India.
  - No obligation for Board members to independently inform the RBI of adverse information beyond internal annual covenants, though SSM reviews covenants during onsite inspections.

*Section 29(A) (2) of the 1949 Act, revised January 2013 — extracted content unit.*

### Introduction to the Guidance on Risk Management Systems in Banks, October 1999.

### Introduction to the Guidance on Risk Management Systems in Banks, October 1999

### Overview of governance and supervisory focus
- Emphasis on clear delegation of authority; and the need for periodic review and evaluation of the risk function.
- Under the SPARC framework, the bank’s risk governance is assessed as part of a broader review of governance and oversight controls, focusing on Board and senior management oversight and control.
- Guidance addresses the Board’s responsibility to oversee:
  - risk management practices, procedures and systems;
  - the reporting framework to Board;
  - internal communication of the risk management strategy, corporate values, professional standards and codes of conduct set out by the Board.
- Supervisors examine whether information flowing to the Board is enough for them to understand regulatory and supervisory issues.
- Uncertainties related to risk measurement are addressed at different points in supervision. Individual guidance on each major risk type addresses the quality of risk reporting. Operational risk guidance also addresses control and compliance risks faced by the risk function itself.

### EC2 — Comprehensive bank‑wide risk management processes
- The supervisor requires banks to have comprehensive risk management policies and processes to identify, measure, evaluate, monitor, report and control or mitigate all material risks. The supervisor determines that these processes are adequate:
  a. to provide a comprehensive “bank-wide” view of risk across all material risk types;
  b. for the risk profile and systemic importance of the bank; and
  c. to assess risks arising from the macroeconomic environment affecting the markets in which the bank operates and to incorporate such assessments into the bank’s risk management process.
- Description and findings re EC2:
  - The RBI requires banks to have a comprehensive risk measurement and reporting framework. 107
  - The SPARC requirements direct supervisors to look at whether the framework for the design and implementation of risk management policies and practices is appropriate for the nature and size of the bank’s businesses.
  - Supervisors must check whether these are periodically reviewed and whether the policies and practices are updated with changes in the business of the bank, the regulatory environment and internal and external events.

### EC3 — Documentation, review, and communication of risk strategies and limits
- The supervisor determines that risk management strategies, policies, processes and limits are:
  a. properly documented;
  b. regularly reviewed and appropriately adjusted to reflect changing risk appetites, risk profiles and market and macroeconomic conditions; and
  c. communicated within the bank.
- The supervisor determines that exceptions to established policies, processes and limits receive the prompt attention of, and authorization by, the appropriate level of management and the bank’s Board where necessary.
- Description and findings re EC3:
  - Banks are required to document important policies and processes related to risk management. Documentation requirements are laid out in guidance for each major risk type.
  - The RBI requires banks to review and evaluate risk management strategies, policies, processes and limits periodically. For important policies, minimum frequency and level of review are prescribed.
  - In its periodic Inspections for Supervisory Evaluation (ISE), the RBI reviews corporate governance issues, including how risk management approaches are updated and communicated across the bank. Limits and their exceptions are also reviewed at that time. The framework for communication to the senior management and other employees of risk management strategy is also assessed.
  - The RBI does track exceptions and ensure that they are properly authorized at the appropriate level. Exceptions throughout the risk management process are treated as an operational risk.

### EC4 — Board and senior management understanding of risk, capital, and liquidity
- The supervisor determines that the bank’s Board and senior management obtain sufficient information on, and understand, the nature and level of risk being taken by the bank and how this risk relates to adequate levels of capital and liquidity. The supervisor also determines that the Board and senior management regularly review and understand the implications and limitations (including the risk measurement uncertainties) of the risk management information that they receive.
- Description and findings re EC4:
  - One vehicle through which Boards and senior management obtain information about the level of risk and its relation to capital is the required Internal Capital Adequacy Assessment Process. That involves senior management and Board review.
  - The ICAAP must be commensurate with the bank’s size, level of complexity and scope of operations.
  - The RBI requires bank Boards to address risk issues periodically. They would be expected to consider policies concerning credit, operational, market and liquidity risks as well as assessing the independence of the risk function.
  - The RBI uses the SPARC framework to assess whether Boards get the information they need for effective decision making and their understanding of the business environment and risks faced by the bank is adequate.

### EC5 — Internal assessment of capital and liquidity adequacy
- The supervisor determines that banks have an appropriate internal process for assessing their overall capital and liquidity adequacy in relation to their risk appetite and risk profile. The supervisor reviews and evaluates banks’ internal capital and liquidity adequacy assessments and strategies.
- Description and findings re EC5:
  - Drawing on Basel II requirements, banks are required to conduct a periodic ICAAP exercise, prepare a document that captures all material risks on a forward-looking basis and plan capital accordingly.
  - Their assessments are subject to a supervisory review and evaluation process (SREP) which is a part of the SPARC process.

### EC6 — Model use, limitations, and validation
- Where banks use models to measure components of risk, the supervisor determines that:
  a. banks comply with supervisory standards on their use;
  b. the banks’ Boards and senior management understand the limitations and uncertainties relating to the output of the models and the risk inherent in their use; and
  c. banks perform regular and independent validation and testing of the models.
- The supervisor assesses whether the model outputs appear reasonable as a reflection of the risks assumed.
- Description and findings re EC6:
  - The RBI draws a distinction between models used for regulatory capital purposes and those that are used only for risk management purposes, with the former expected to be subjected to stronger and more consistent review and validation.
  - The RBI requires that banks’ independent validation function should conduct validation, test the models and report the results to a relevant committee. Banks’ internal and external auditors are expected to validate models.
  - For banks in parallel run and as a part of approval process for migration to advanced approaches of credit, market and operational risks, the RBI examines model inputs, outputs, and assumptions. They use their own benchmark models and compare models across banks.
  - Modelling requirements are set by risk type. They expect internal model manuals to emphasize the importance of understanding the limitations of specific models and how they are maintained as circumstances change. Banks are required to have appropriate processes to approve model introduction and subsequent modification.
  - Model risk is assessed as part of Pillar II controls under business risk assessment, including:
    - bank Board approved policies for model risk,
    - the processes for identification, monitoring, reviewing and reporting model risk; and
    - the model risk management framework.
  - Under the SPARC framework, the process of banks’ identification, monitoring, reviewing, and reporting of model risk is assessed by RBI as well as bank’s Board approved policy for model risk.

### EC7 — Information systems and reporting adequacy
- The supervisor determines that banks have information systems that are adequate (both under normal circumstances and in periods of stress) for measuring, assessing and reporting on the size, composition and quality of exposures on a bank-wide basis across all risk types, products and counterparties. The supervisor also determines that these reports reflect the bank’s risk profile and capital and liquidity needs, and are provided on a timely basis to the bank’s Board and senior management in a form suitable for their use.
- Description and findings re EC7:
  - Various guidance notes and circulars on advanced approaches prescribe that banks are expected to have adequate information systems for measuring, assessing, and reporting on different sorts of risks.
  - For instance, the RBI requires that banks in parallel run should ensure that there is regular and comprehensive reporting of its operational risk profile, risk exposures and loss experience to the Board, senior management and business unit management. 108
  - Requirements for the MIS for risk measurement are included in the Automated Data Flow project the RBI has underway. It does not, however, have comprehensive and separate requirements for risk management MIS.

*Introduction to the Guidance on Risk Management Systems in Banks, October 1999 (cr1804).*

### references to either “MIS” or “management information.”

### cr1804 - references to either “MIS” or “management information.”

### Risk governance and Board oversight (EC8, EC10)
- Supervisor determines banks have adequate policies and processes to ensure Boards and senior management understand risks in new products, material modifications and major management initiatives, and that such major activities require Board or specific committee approval (EC8).
- RBI requires banks to consider new product risk; new product approval typically involves the risk department.
- Banks must appoint a senior compliance officer to ensure new products conform to regulatory guidelines (Guidance on the Compliance Function, April 20, 2007).
- Boards are required to review the operational risk management framework regularly to manage operational risks arising from external market changes and from new products, activities or systems.
- RBI supervisors regularly assess Board documents and meet with selected Board members, including heads of risk and audit committees, but do not as a rule meet with the Board as a whole or individual non-executive directors. The report notes such meetings are useful to confirm Boards and senior management understand all material risks (EC8).
- RBI guidelines prescribe a governance structure for risk management which includes a requirement for a CRO; the CRO should be independent of business lines and report directly to the CEO/Board (EC10).
- For public companies, senior officers, including the CRO, cannot be dismissed without prior Board approval; it is unclear whether a similar requirement applies for PSBs. A revision on April 21, 2017 clarified related issues.

### Risk management functions and standards (EC9, EC11)
- RBI prescribes that banks have risk management functions covering all material risks; the Risk Management Committee assures adequate resources are assigned to mitigate risks (EC9).
- Boards must establish clear lines of management responsibility, accountability and reporting; separation of responsibilities and reporting lines between risk control, business lines and support functions is required to avoid conflicts of interest.
- RBI requires the CRO to report directly to both the CEO and the Board of directors.
- Internal risk-based audit plans should subject every activity/location, including the risk management function, to risk assessment.
- RBI issues guidance on major risk types: Guidance Note on Credit Risk Management (October 2002); Guidance Note on Market Risk Management (March 2002); Guidance Note on Management of Operational Risk (October 2005); ALM System (February 1999); Guidelines on Liquidity Risk Management (November 2012); Guidelines on Basel III liquidity standards—LCR and related disclosures (2014, amendments in 2016); Draft IRRBB guidelines (February 2017) based on BCBS April 2016 standards (EC11).

### Contingency arrangements and stress testing (EC12, EC13)
- Banks must prepare contingency plans for bank-specific or market crisis scenarios, documenting plans for asset sales, market access, restructuring maturity and composition of assets and liabilities, and alternative sources of liquidity (para 8.2.13 of Risk Management Systems in Banks, October 7, 1999) (EC12).
- Banks are required to prepare business process continuity plans to deal with operational risks (Operational Risk Management—Business Continuity Planning, April 15, 2005).
- RBI’s principle guidance requires contingency plans for various circumstances but does not specifically flag recovery or resolution planning; the report recommends supplementing contingency planning guidance with specific guidance on recovery and resolution planning.
- Boards are responsible for overseeing stress testing programs; Guidelines on Stress Testing (December, 2013) reflect BCBS 'Principles for Sound Stress Testing Practices and Supervision' (May 2009) (EC13).
- Stress testing requirements and findings:
  - Stress testing must be integrated into risk governance, risk management, the ICAAP (including buffer assessment) and decision making.
  - Stress testing policy should include remedial actions and assessment of feasibility of corrective actions in stress situations.
  - Banks must periodically review stress testing framework qualitatively and quantitatively; framework should be subjected to at least annual reviews.
  - Banks with total risk-weighted assets of more than Rs 500 billion are required to include feedback effects in their stress testing programs.
- Supervisor assesses and requires corrective action if material deficiencies are identified in a bank’s stress testing program or if results are not adequately used in decision-making.

### Internal pricing, new product approval, and other risks (EC14, AC1)
- Asset liability management guidelines require banks to have an internal funds transfer pricing model based on current market rates; banks must incorporate liquidity costs, benefits and risks in internal pricing, performance measurement and new product approval processes for all significant business activities (EC14).
- Banks must use the marginal cost of funds lending rate methodology (MLCR) for determining interest rates on loans.
- Risk Based Supervision guidelines require banks to use their risk policies and limits in selecting borrowers and pricing loans.
- Compensation is not risk-based in the PSBs, though some have risk-based performance assessment.
- RBI requires banks to have policies and processes for assessing other material risks such as reputational and strategic risks; banks are advised to develop methodologies to measure reputational risk in terms of credit, liquidity, market and other risks and to include reputational risk scenarios in regular stress tests (AC1).
- Under Pillar II, RBI examiners assess other material risks including strategic and reputational risks.

### Assessment findings, gaps, and policy recommendations
- Assessment of Principle 15: Largely Compliant.
- The RBI does:
  - determine that banks have Board-approved appropriate risk management strategies (EC1);
  - require comprehensive risk policies and frameworks to be comprehensive (EC2);
  - require the risk management framework be well documented, internally communicated and evolves appropriately (EC3);
  - ensure Boards and senior management obtain the information they need to assess capital adequacy (EC4);
  - examine the level of capital and liquidity and the processes banks use to ensure adequacy (EC5);
  - ensure models used for risk measurement are appropriate, validated and used under strong governance (EC6);
  - ensure that the risk management function has resources, independence, Board access and authority (EC9);
  - require prior Board approval for dismissing a CRO (EC10);
  - issue guidance on each major risk type (EC11);
  - require banks to have contingency plans (EC12);
  - require banks to stress test (EC13); and
  - assess how banks account for risks in internal pricing, performance measurement and new product approval (EC14).
- Identified gaps:
  - RBI does not impose specific requirements for robust risk management MIS, as opposed to implicit requirements derived from measurement, aggregation and reporting of different risk types in normal times (EC7).
  - RBI does not have a specific requirement in its principle guidance on risk for recovery or resolution plans (EC12).
  - RBI supervisors do not routinely meet with the Board as a whole or with individual non-executive directors to confirm understanding of risks associated with material business changes (EC8).
- Recommendations:
  - The RBI should consider specific and separate requirements for robust risk management MIS.
  - The RBI should institute the practice of supervisors meeting regularly with individual Board members.
  - The RBI should consider supplementing its contingency planning guidance with specific guidance on recovery and resolution planning.

### Capital adequacy (start of EC1)
- RBI regulations on banks’ capital adequacy are laid down in Master Circular Basel III Capital Regulation of July 1, 2015.
- Framework covers Pillar 1 Minimum Capital Requirement methodology of Basel III, Pillar 2 Supervisory Review and Evaluation Process, Pillar 3 Disclosure and Market Discipline, and includes Capital Conservation Buffer Framework, Leverage Ratio Framework, and Countercyclical Capital Buffer Framework.
- Framework applies to scheduled banks, including PSBs and private sector banks, except regional rural banks and cooperative banks.
- For credit risk: Standardized approach; operational risk: Basic Indicator Approach; market risk: Standardized Duration Approach.
- RBI is reviewing bank applications for the Advanced Internal Ratings Based Approach (A-IRB); no authorizations have been granted pending validation and parallel runs.
- On a solo and consolidated basis, banks are required to maintain a minimum 9 percent risk-weighted CAR.
- Minimum ratio of Core Equity Tier 1 (CET1) to risk-weighted assets: 5.5 percent.
- Overall Tier 1 capital (T1) to risk-weighted assets: no less than 7 percent.
- Minimum overall ratio of Tiers 1 and 2: 9 percent.
- Additional CET1 requirement for systemically important banks set since April 1, 2016, to be fully operative after phasing-in until April 1, 2019.
- Including a capital conservation buffer of 2.5 percent, and additional Tier 1 capital of 1.5 percent, the total minimum risk-weighted CAR could add up to 11.5 percent, to enter into force April 1, 2019.
- CET1 components defined in the Master Circular.

*Source: cr1804 - references to either “MIS” or “management information.”*

### Annex 1;

### Annex 1

### Components of Common Equity Tier 1 (CET1) and regulatory adjustments
- CET1 includes:
  - (ii) Stock surplus (share premium) resulting from the issue of common shares;
  - (iii) Statutory reserves;
  - (iv) Capital reserves representing surplus arising out of sale proceeds of assets;
  - (v) Other disclosed free reserves, if any;
  - (vi) Balance in Profit & Loss Account at the end of the previous financial year;
  - (vii) Banks may reckon the profits in current financial year for CRAR calculation on a quarterly basis provided the incremental provisions made for NPAs at the end of any of the four quarters of the previous financial year have not deviated more than 25 percent from the average of the four quarters;
  - (viii) While calculating capital adequacy at the consolidated level, common shares issued by consolidated subsidiaries of the bank and held by third parties (i.e., minority interest) which meet the criteria for inclusion in Common Equity Tier 1 capital; and
  - (ix) Less: Regulatory adjustments.

### Additional Tier 1 (AT1) capital elements
- Additional Tier 1 capital will consist of the sum of the following elements:
  - (i) Perpetual Non-Cumulative Preference Shares (PNCPS), which comply with the regulatory requirements;
  - (ii) Stock surplus (share premium);
  - (iii) Debt capital instruments eligible for inclusion in Additional Tier 1 capital, which comply with the regulatory requirements;
  - (iv) Any other type of instrument generally notified by the RBI;
  - (v) Additional Tier 1 instruments issued by consolidated subsidiaries of the bank and held by third parties which meet the criteria for inclusion; and
  - (vi) Less: Regulatory adjustments/deductions.

### Tier 2 capital elements
- Tier 2 capital consists of:
  - (i) Provisions or loan-loss reserves held against future, presently unidentified losses; these provisions must be freely available to meet losses which subsequently materialize, and are permitted to a maximum of 2.5 percent of credit risk-weighted assets;
  - (ii) Debt Capital Instruments issued by the banks;
  - (iii) Preference Share Capital Instruments;
  - (iv) Stock surplus (share premium) resulting from the issue of instruments included in Tier 2 capital;
  - (v) Tier 2 capital instruments issued by consolidated subsidiaries of the bank and held by third parties; and
  - (vi) Revaluation reserves at a discount of 55 percent.

### Cross-holdings and peer assessment
- Reciprocal cross-holdings of capital across financial institutions will be fully deducted as they might artificially inflate the capital position of banks.
- In June 2015, the Basel Committee issued a report on the peer assessment of India’s compliance with the Basel capital adequacy framework under its Regulatory Consistency Assessment Program. This assessment found India to be in compliance with the requirements of the Basel III risk-based capital adequacy framework (bis.org/bcbs/publ/d320.pdf).

### EC2 — Minimum capital adequacy requirements and phasing-in
- The current minimum CAR is 9 percent of risk-weighted assets, based on the standardized approach.
- Phasing-in process and required total capital including the capital conservation buffer:
  - Per March 31, 2017 banks should have total capital including the capital conservation buffer, of 10.25 percent,
  - per March 31, 2018: 10.875 percent,
  - and per March 31, 2019: 11.5 percent.

### EC3 — Supervisor powers on capital charges and coverage of risks
- The supervisor has the power to impose a specific capital charge and/or limits on all material risk exposures, including risks not adequately transferred or mitigated through transactions (e.g., securitization transactions).
- Both on-balance sheet and off-balance sheet risks are included in the calculation of prescribed capital requirements.
- Description and calculation notes:
  - Art. 35A of the BR Act authorizes the RBI to issue bank-specific directions, including directions to apply a specific capital surcharge and/or limit on exposures.
  - Off-balance sheet items: the risk-weighted amount of an off-balance sheet item that gives rise to credit exposure is generally calculated by means of a two-step process:
    - (a) the notional amount of the transaction is converted into a credit equivalent amount, by multiplying the amount by the specified credit conversion factor or by applying the current exposure method; and
    - (b) the resulting credit equivalent amount is multiplied by the risk weight.
  - Where the off-balance sheet item is collateralized or guaranteed, credit risk mitigation guidelines may apply.
  - Banks are required to hold regulatory capital against all securitization exposures, including those arising from the provision of credit risk mitigants to a securitization transaction, investments in asset-backed securities, retention of a subordinated tranche, and extension of a liquidity facility or credit enhancement.

### EC4 — Reflecting risk profile and systemic importance; D-SIB framework
- The prescribed capital requirements reflect the risk profile and systemic importance of banks in the context of the markets and macroeconomic conditions in which they operate and constrain the build-up of leverage in banks and the banking sector.
- The RBI’s “Framework for Dealing with Domestic Systemically Important Banks” (July 22, 2014):
  - Two banks designated as D-SIBs: State Bank of India and ICICI Bank (Industrial Credit and Investment Corporation of India).
  - The RBI reviews the D-SIB list annually.
  - Each D-SIB is awarded a Systemic Importance Score, on the basis of which additional CET1 requirements are imposed.
  - Banks with more than 2 percent of GDP in assets are considered D-SIBs, as are the largest five foreign banks in India.
  - Scoring weights: Size 40 percent; interconnectedness 20 percent; substitutability 20 percent; complexity 20 percent.
  - Level 3 assets (mark-to-model valuation) are not taken into the score.
  - Based on their score, banks are placed in a “bucket.”
  - SBI is in bucket 3 and will incur a charge of 0.6 percent additional CET1.
  - ICICI Bank is in bucket 1 and incurs a charge of 0.2 percent additional CET1.

### EC5 — Use of internal assessments (IRB/AMA) and supervisory approval
- The supervisor approves the use of banks’ internal assessments of risk as inputs to the calculation of regulatory capital subject to qualifying standards and supervisory oversight:
  - Approval requires adherence to rigorous qualifying standards.
  - Any cessation of use or material modification of models/processes requires supervisor approval.
  - The supervisor must have capacity to evaluate internal assessment processes.
  - The supervisor can impose conditions on approvals and can revoke approval if standards are not maintained.
- RBI implementation and practices:
  - RBI permits banks to use the Internal Ratings Based Pillar 1 capital adequacy methodology following application, validation, and RBI approval.
  - RBI evaluates internal assessments using qualitative and quantitative criteria, imposed on a continuous basis.
  - Currently, all Indian banks are under standardized approaches; some banks are under parallel run for advanced approaches for credit risk management and operational risk management.
  - A parallel run is approved by the RBI only after satisfying rigorous qualifying criteria; models are strenuously scrutinized during parallel run before final approval.
  - As of now, none of the Indian banks are using advanced approaches for capital computation purposes.
  - Four highly qualified RBI staff are tasked with review and assessment of banks’ IRB models; they report to a general manager in the RBI.
  - Circulars cited: December 22, 2011 (Implementation of the Internal Ratings Based Approaches for Calculation of Capital Charge for Credit Risk) and April 27, 2011 (Implementation of the Advanced Measurement Approach (AMA) for Calculation of Capital Charge for Operational Risk).
  - IRB credit risk approach: Appendix 1 to the circular sets out qualitative and quantitative criteria, including ability to quantify risk, produce meaningful assessments, meaningful differentiation of risk, and reasonably accurate and consistent quantitative estimates of risk.
  - Additional requirements for banks wishing to use their own estimates for Exposure at Default and Loss Given Default; banks must demonstrate systems and processes to produce these quantitative elements.
  - Guidelines provided for rating system design, pooling of retail exposures, and grading of borrowers.
  - AMA for operational risk: qualitative and quantitative criteria, requirement for a well-documented Operational Risk Management System (ORMS), integration of ORMS with general risk management, adequate estimation of risks including tail loss events, and inclusion of relevant internal and external loss data.
  - Post-approval changes in models/processes require regulator approval; banks must inform supervisors about material changes with impact studies.
  - RBI has the power to revoke approval and/or take supervisory/regulatory actions if qualifying standards or conditions are not met on an ongoing basis.

### EC6 — Forward-looking capital management and ICAAP/SREP
- The supervisor has the power to require banks to adopt a forward-looking approach to capital management (including stress testing), and to require:
  - a. to set capital levels and manage available capital in anticipation of possible events or changes in market conditions that could have an adverse effect; and
  - b. to have in place feasible contingency arrangements to maintain or strengthen capital positions in times of stress, as appropriate in the light of the risk profile and systemic importance of the bank.
- RBI guidance and legal powers:
  - Circular of March 26, 2008 lays down extensive guidelines on implementation of Pillar 2 of Basel II, including ICAAP and the Supervisory Review Process (SREP).
  - Banks are required to have a Board-approved policy on an Internal Capital Adequacy Assessment Process (ICAAP) and to assess the capital requirement as per ICAAP, on a forward-looking basis.
  - Banks’ systems must be able to identify all material risks to the bank’s operations.
  - Banks must submit an updated ICAAP every year.
  - ICAAP should be prepared on a solo basis for each banking entity and at the consolidated bank level.
  - As part of the ICAAP, banks shall periodically conduct stress tests, particularly for material risk exposures, to evaluate potential vulnerability to unlikely but plausible events or market movements.
  - ICAAP should form an integral part of management and decision-making culture, including internal allocation of capital, credit decision processes, product pricing, expansion plans, and budgets.
  - Per Section 35A of the Bank Regulation Act the RBI has the legal power to impose upon individual banks a specific capital charge on, and/or limit any material risk exposures, based on the RBI’s assessment of the quality of individual banks’ ICAAP.
  - The RBI can impose a general increase in the capital requirements for an individual bank by virtue of Section 35A.

*Source: Annex 1 (excerpts).*

### Section 11.8 of the Pillar 2 Guidelines, cited above, the RBI requires banks to have

### cr1804 - Section 11.8 of the Pillar 2 Guidelines, cited above, the RBI requires banks to have

### Forward-looking capital planning and ICAAP (Section 11.8 / Pillar 2)
- RBI requires banks to have forward looking ICAAPs “to ensure banks maintain adequate capital” taking into account potential future developments relevant to its risk profile, such as strategic plans, macroeconomic factors etc., including the likely future constraints in the availability and use of capital.
- Banks must have an explicit approval by their Boards for their capital plan, which should outline i.e., a “general contingency plan for dealing with divergences and unexpected events.”
- Banks should conduct stress tests and scenario analyses to be able to have a reasonable view of potential future risks.

### Assessment Criterion AC1 — Capital framework for non-internationally active banks
- Finding: For non-internationally active banks, capital requirements, including the definition of capital, the risk coverage, the method of calculation, the scope of application and the capital required, are broadly consistent with the principles of the applicable Basel standards relevant to internationally active banks.
- Description and findings: The RBI Master Circular is in line with the Basel standards for capital adequacy. All scheduled banks in India, with the exception of the regional rural banks and cooperative banks, are subject to the same capital adequacy framework.

### Assessment Criterion AC2 — Distribution of capital within banking groups
- Requirement: The supervisor requires adequate distribution of capital within different entities of a banking group according to the allocation of risks.
- Description and findings:
  - The RBI Licensing of New Banks in the Private Sector guidelines (February 22, 2013) require setting up of a Non-Operating Financial Holding Company (NOFHC) for financial groups.
  - Risk based capital requirements are to be applied to the NOFHC on a consolidated basis.
  - A bank shall comply with CAR requirements on two levels:
    - (a) consolidated (“group”) level: capital adequacy requirements after consolidating assets and liabilities of subsidiaries/joint ventures/associates, etc., except those engaged in insurance and any nonfinancial activities; and
    - (b) standalone (“solo”) level CAR requirements: capital adequacy based on individual capital strength and risk profile.
  - Overseas operations of a bank through its branches are covered in both consolidated and standalone scenarios.
  - The RBI has authority under Section 35A of the BR Act to require capital additions for any licensed banking entity within a group if the entity is non-compliant with risk based capital adequacy minima.
  - Limitation: RBI does not have an explicit provision in its regulation to require NOFHC or banking group to distribute capital throughout the group or NOFHC.
- Assessment of Principle 16: Compliant
- Comments:
  - RBI is implementing the Basel III capital adequacy framework, working with selected banks to approve Advanced approaches and parallel runs.
  - The RBI framework, including the current capital definition, is appropriate.
  - The framework was considered compliant by the Basel Committee’s Regulatory Consistency Assessment Program in 2015.

### Principle 17 — Credit risk (overview)
- Principle: Supervisor determines banks have an adequate credit risk management process covering full credit lifecycle (underwriting, evaluation, ongoing management) and taking into account risk appetite, risk profile and market and macroeconomic conditions, including counterparty credit risk.

### Essential Criterion EC1 — Bank-wide credit risk management processes
- Requirement: Laws, regulations, or the supervisor require banks to have appropriate credit risk management processes providing a comprehensive bank-wide view of credit risk exposures consistent with bank size, risk appetite and capital strength.
- Description and findings:
  - October 1999 RBI Circular on Risk Management Systems in Banks prescribes key areas of risk management.
  - October 2002 Guidance Note on Credit Risk Management refines the 1999 Circular.
  - Circular covers risk management structure, credit risk, counterparty credit risk, off-balance sheet exposures, interbank risk, market risk, liquidity risk, interest rate risk in the banking book, operational risk and internal controls.
  - Framework must cover credit-equivalent off balance sheet exposure, counterparty credit risk, settlement risk and transfer risk.
  - Bank’s credit risk strategy document should be Board-approved.
  - Requirements include a high-level Credit Policy Committee, a credit risk management committee, and a credit risk management department.
  - Risk-management function must identify, monitor, and measure risk; verifiable risk pricing methods; loan review mechanism and portfolio management; Board-approved loan policy; delegation of powers for credit approval; credit risk rating system.
  - Review of credit risk should take place twice per year by independent loan review officers.
  - Banks must produce information on expected and unexpected losses and formulate a loan review policy.

### Essential Criterion EC2 — Board approval and review of credit risk strategy
- Requirement: Board approves and regularly reviews credit risk strategy and significant policies; senior management implements them.
- Description and findings:
  - October 1999 Circular requires Board approval for credit risk strategy and other risk policies.
  - 2002 Guidance Note provides guidance on credit risk modelling, strategy development, review, mitigation through limits, tracking NPLs and credit concentration.
  - For large NPLs shared across banks, a “Joint Lenders Forum” must be formed under the 2014 Framework for Revitalizing Distressed Assets to develop a Corrective Action Plan.
  - Board must adopt strategy; senior management implements it.
  - Compliance is checked during onsite inspections and under SPARC risk-based supervision.
  - Priority Sector Lending (PSL) program: banks must meet RBI-imposed targets for lending to priority sectors, which interferes with commercial underwriting and contributes to moral hazard.
- Recommendation:
  - RBI should consider reviewing PSL policy including targets and scope of application to allow banks flexibility in meeting PSL targets if proposed projects do not meet banks’ commercially based risk management strategies and processes.

### Essential Criterion EC3 — Controlled credit risk environment and supporting systems
- Requirements include:
  - a. well-documented and effectively implemented strategy and sound policies and processes for assuming credit risk, without undue reliance on external credit assessments;
  - b. well defined criteria and processes for approving new exposures and renewing/refinancing existing exposures, with appropriate approval authority;
  - c. effective credit administration policies (borrower ability/willingness to repay, monitoring documentation, covenants, collateral, asset grading/classification);
  - d. effective information systems for aggregation and reporting to Board and senior management;
  - e. prudent credit limits consistent with risk appetite, risk profile and capital strength;
  - f. exception tracking and reporting processes; and
  - g. effective controls around use of models to identify and measure credit risk and set limits.
- Description and findings:
  - RBI Guidance Note details organizational structure, Board-approved policies, limits, MIS, procedures for control and risk reporting, and regular reviews.
  - Creation of the Credit Repository of Information on Large Credits (CRILC) significantly enhanced risk management capabilities.
  - Banks have access to credit bureaus.
  - Under SPARC, banks must furnish 75 detailed qualitative information parameters on credit risk control once every year (examples listed in source).
  - Implementation is covered during regular onsite inspections; full-scope examinations for most banks except 32 banks under Small Bank Variant Model.
  - 2002 Guidance Note requires banks to have an MIS to measure and manage all aspects of credit risk; credit risk policy must include risk identification, measurement, grading, aggregation, reporting and risk control/mitigation.

### Essential Criterion EC4 — Monitoring total indebtedness and FX unhedged risk
- Requirement: Banks must monitor total indebtedness of entities and risk factors that may result in default, including significant unhedged foreign exchange risk.
- Description and findings:
  - Banks can access RBI’s CRILC to assess overall indebtedness of large clients and their exposures to other banks.
  - Other credit bureaus in India are available.
  - Guidance requires banks to assess and develop framework for borrowers with foreign exchange exposure and no natural hedge.
  - Guidance requires banks to maintain higher provisions and RWAs for borrowers facing risk from unhedged foreign currency exposures.

### Essential Criterion EC5 — Credit decisions free of conflicts of interest
- Requirement: Banks must make credit decisions on an arm’s length basis free of conflicts of interest.
- Description and findings:
  - Art. 10 B of the BR Act disqualifies bank managers and Board members if they have interests in other companies.
  - Fit-and-proper criteria require declaration of substantial interests; disclosure should lead to disqualification where appropriate.
  - Art. 2.1.2.1 of Master Circular on Loans and Advances (July 1, 2015) reaffirms art. 20(1) of the BR Act restricting loans to directors and firms with special interests.
  - Art. 2.1.2.2 prohibits granting a loan or advance to or on behalf of any director, or to any company in which a director has an interest.

### Essential Criterion EC6 — Board or senior management decision for major exposures
- Requirement: Credit policy must require Board or senior management decision for major exposures exceeding certain amount or percentage of capital, or exposures that are especially risky or outside mainstream activities.
- Description and findings:
  - Master Circular—Exposure norms (July 2, 2012) sets exposure ceilings:
    - single borrower: 15 percent of capital
    - borrower group: 40 percent of capital
  - Exposures exceeding thresholds must be approved (e.g., by Credit Approval Committee).
  - Capital funds for denominator comprise Tier I and Tier II capital as defined under capital adequacy standards.
  - Exceptions for infrastructure projects:
    - single borrower may exceed 15 percent by additional 5 percent (i.e., up to 20 percent);
    - borrower group may exceed 40 percent by additional 10 percent (i.e., up to 50 percent).
  - Board approval needed to increase exposure up to a further 5 percent of capital funds (bringing ceiling to 25 percent).
  - Special cases for oil companies:
    - Starting May 29, 2008, single borrower exposure limit raised to 25 percent of bank capital for oil companies issued Oil Bonds (do not have SLR status) by the GOI.
    - In exceptional circumstances, paragraph 2.1.1.3 of the Master Circular allows an additional 5 percent for oil companies, bringing single borrower ceiling up to 30 percent.

### Essential Criterion EC7 — Supervisor access to credit portfolio information and officers
- Requirement: Supervisor has full access to information in credit and investment portfolios and to bank officers involved in credit risk.
- Description and findings:
  - Art. 27 BR Act requires banks to submit prudential returns to RBI on a quarterly basis.
  - RBI may request and obtain any information relevant to supervision at any time.
  - RBI has access to all Board members, managers and staff through SPARC risk-based supervision and inspection.

### Essential Criterion EC8 — Inclusion of credit exposures in stress testing
- Requirement: Banks must include credit risk exposures in stress testing programs.
- Description and findings:
  - Banks perform scenario analysis for Interest Rate Risk per 1999 Guidelines on Risk Management Systems in Banks.
  - RBI circular “Guidelines on Stress Testing” (December 2, 2013) stipulates stress testing as integral to ICAAP, requiring rigorous, forward-looking stress testing identifying severe events or market changes.
  - ICAAP stress testing provides senior management with understanding of material risks.
  - Stress testing should be central to identifying, measuring, and controlling funding and liquidity risks and assessing liquidity profile and adequacy of liquidity buffers in stress.

### Assessment of Principle 17
- Overall assessment: Largely compliant
- Comment: Mandatory PSL targets constrain banks’ independent, risk-based credit allocation and can lead to risk accumulation; recommendation to review PSL policy (see EC2).

### Principle 18 — Problem assets, provisions and reserves (overview)
- Principle: Supervisor determines banks have adequate policies and processes for early identification and management of problem assets and maintenance of adequate provisions and reserves.

### Essential Criterion EC1 — Policies and processes for problem assets, asset classification, provisioning and write-offs
- Requirement: Laws, regulations or the supervisor require banks to formulate policies and processes for identifying and managing problem assets and to regularly review problem assets and asset classification, provisioning and write-offs.
- Description and findings:
  - RBI has a broad range of regulations on asset classification and provisioning intended to ensure uniform and consistent application.
  - Criteria consider period asset has remained nonperforming, availability of security and realizable value.
  - Applicable documents include:
    - “Master Circular on Prudential Norms on Income Recognition, Asset Classification and Provisioning Pertaining to Advances” (July 2015) (MCCP)
    - Guidance Note on Risk Management systems in Banks (1999) (GNRM)
    - Guidance Notes on Management of Credit Risk and Market Risk (2002) (GNMC)
    - Master Circular on Prudential Norms for Classification Valuation and Operation of Investment Portfolio by Banks, July 1, 2015 (MCIP)
  - Loan Review Mechanisms:
    - Section 3.2.6. GNRM requires loan review mechanisms for large value accounts and a loan review policy to assess loan loss provision, portfolio quality, etc.
    - Loan reviews are designed to provide feedback on credit sanction effectiveness and identify incipient deterioration; at least 40 percent of the portfolio should be subject to Loan Review Mechanism in a year.
  - Risk Management Structure:
    - Section 2 of GNRM requires a Board-level Risk Management Committee, a Credit Policy Committee/Credit Risk Management Committee to formulate policies on loan review, asset quality and provisioning.
    - Ongoing monitoring with half-yearly or quarterly ratings; formal MIS to detect deteriorating assets at an early stage.
  - Special Mention Accounts (SMA) classification (MCCP section 26.1):
    - SMA-0: no more than 30 days overdue but with signs of incipient stress
    - SMA-1: overdue 31–60 days
    - SMA-2: overdue 61–90 days (see EC9 in source)
  - Definition of NPA:
    - By Art. 2 of MCCP, an asset becomes nonperforming after 90 days past due.
  - NPA categories and provisioning (as defined in source):
    - Standard | Nonperforming Assets | Substandard | Doubtful | Loss
    - Overdue days: 0–90 days | 3–15 months | Over 15 months | No timeframe defined
    - Provisioning rate of outstanding amount:
      - Standard assets: 0.25–2% depending on types of assets, irrespective of security
      - Substandard: Unsecured: 25%; Secured: 15%
      - Doubtful: Unsecured: 100%; Secured:
        - For doubtful up to 1 year: 25%
        - For doubtful >1 year and up to 3 years: 40%
        - For doubtful >3 years:100%
      - Loss: 100%
  - Additional provisions:
    - Standard assets general provision rates: between 0.25 percent and 1 percent (2 percent in the case of housing loans with teaser rates).
    - Section 4.2.7. MCCP: when one credit facility for a borrower becomes NPA, all the client’s facilities become NPA.
  - April 2017 provision: RBI prescribed Board-approved policy for making provisions for standard assets at rates higher than regulatory minimum based on evaluation of risk and stress in various sectors.

*Source: cr1804 - Section 11.8 of the Pillar 2 Guidelines, cited above, the RBI requires banks to have*

### Section 4.2.9. MCCP stipulates that fraudulent NPAs need to be 100 percent written

### Section 4.2.9. MCCP stipulates that fraudulent NPAs need to be 100 percent written off over at most 4 quarters, without prior classification as substandard, doubtful or loss

### MCCP requirement and timing for write-off
- The MCCP stipulates that fraudulent NPAs need to be 100 percent written off over at most 4 quarters, without prior classification as substandard, doubtful or loss.
- An asset becomes nonperforming when payment has not taken place after 90 days after the due date.

### Special situations and regulatory forbearance (MCCP section 4 and related provisions)
- The MCCP (section 4) recognizes categories of special situations that may entail deviations from original loan contract conditions and from general MCCP loan classification rules. Examples include:
  - 4.2.4: An asset should not be considered nonperforming “merely due to the existence of some deficiencies which are temporary in nature...including non-renewal of the limits on the due date” (e.g., working capital account).
  - 4.2.10: Overdue bank loans under the on-lending program to Primary Agricultural Credit Societies/Farmers’ Service Societies are considered in default only after one or two full crop seasons, depending on the frequency of the crop, and only the on-lent loan actually in default becomes NPA, and not—all other exposures to the PACS/FSS.
  - 4.2.11: Overdue advances against term deposits and other financial assets, i.e., life insurance policies are not considered NPA, if there is sufficient margin in the accounts.
  - 4.2.12.ii: Interest on housing loans where interest is payable after recovery of the principal is not overdue measured from the start of the loan, but only after missing a due date once interest payments start.
  - 4.2.13: Other priority sector agricultural loans become overdue only after one or two crop seasons of nonpayment.
  - 4.2.13.ii: In case of natural calamities, banks are encouraged to convert short term loans into longer maturity loans, or otherwise reschedule them to avoid classification as NPA.
  - 4.2.13.iv: Payment schedules of rural housing loans should be linked to crop schedules.
  - 4.2.14: Credit facilities backed by government guarantees, even when overdue, are classified as NPA only when the government repudiates the guarantee.
  - 4.2.15.3: For project loans where completion is delayed for legal and other extraneous reasons, delay will not be regarded as restructuring, provided the new DCCO falls between one and two years after financial closure; the loan remains classified as “standard,” with a standard provision of 0.4 percent.
  - 4.2.15.3.ii: Banks may restructure project loans through a revision of the DCCO for longer periods while retaining “standard” classification, if:
    - It is an infrastructure project in arbitration or court case, maximum extension of four years;
    - If it is an infrastructure project delayed beyond promoters’ control, maximum extension of three years;
    - If it is a non-infrastructure loan (other than commercial real estate), maximum extension of two years.
  - 4.2.15.3.v: Infrastructure projects under implementation where appointed date is delayed due to concession authority inability do not need to be treated as restructuring if:
    - the project is an infrastructure loan in a public private partnership;
    - loan disbursement has not yet started;
    - the revised DCCO is duly recorded in a revised contract;
    - project viability has been reassessed; and
    - the authorities have agreed.
  - 4.2.15.4: Change in ownership with injection of funds to revive a stalled project may permit DCCO extension up to two years without changing asset classification if conditions (e.g., inadequacies of current promoters, high probability of revival under new owner, expertise of new owner, project viability) are met.
  - 4.2.15.5.ii: Change in repayment schedule caused by increase in project outlay due to increase in project scope is not treated as restructuring provided certain conditions are met (e.g., increase takes place before original DCCO and bank considers project viable).
  - 4.2.15.5: In all cases of restructuring where regulatory forbearance has been extended, banks’ Boards need to satisfy themselves as to the viability of the project and the restructuring plan.
  - 4.2.18.ii: In case of nonpayment due to well documented transfer or political risk, classification is made only one year after the start of the transfer delay.
  - 4.2.19: New loans to enterprises in the context of a rehabilitation approved by the Board for Industrial and Financial Reconstruction can become NPAs only after one year after disbursement, even if earlier facilities to the project were already NPA.

### Asset classification categories, migration timelines and provisioning percentages
- Classification categories and migration timelines:
  - A nonperforming loan (90 days overdue) is classified as “substandard” when it has remained an NPA for a period less than or equal to 12 months.
  - A loan is classified “doubtful” when the loan has remained in the substandard category for a period of 12 months.
  - The classification “Loss” is applied when the amount has not been written off wholly but is considered uncollectible.
- Provisioning guidance (MCCP Sections 5.2, 5.3 and 5.4):
  - Secured portions of substandard assets are provisioned for 15 percent.
  - Unsecured substandard exposures are provisioned at 25 percent.
  - If cash flows from financed infrastructure projects flow into an escrow account, provisions of 20 percent are considered adequate.
  - For loans classified as “standard,” a standard provision of 0.4 percent is indicated in project delay cases described in 4.2.15.3.
- On NPA treatment:
  - When a loan becomes an NPA, accrued interest is backed out of the income statement and further accrual stopped.
  - In case of a restructured loan, unpaid interest payments can be capitalized up to a certain period.
  - Provisions are tax deductible to a limit set by the Income Tax Act 1961.

### Special situation materiality and reporting gaps
- Assessors note some special situations reach materiality warranting systematic supervisory monitoring.
- Based on data collected by the RBI at one point in time, infrastructure and non-infrastructure project loans with delayed DCCO accounted for almost 19 percent of total impaired loans and advances.
- The special situation loans are not reported separately under the asset classification and provisioning returns, although some elements are captured through other prudential returns and through the Central Repository of Information on Large Credits (CRILC) reporting system for large borrowers.
- The RBI does not collect full quantitative information about amounts involved in each of the special cases mentioned.

### Supervisory framework, processes and tools (SPARC, GNCM, GNRM, MCIP)
- Supervisory responsibilities and actions:
  - The supervisor determines the adequacy of a bank’s policies and processes for grading/classifying assets and establishing provisioning levels (EC2).
  - The supervisor may use external experts; the supervisor reviews external experts’ work to determine adequacy.
  - RBI examiners assess classification, provisioning and write-off procedures of individual loans on a sampling basis and determine adherence to RBI guidelines.
  - The RBI receives the long-form audit report and analyzes the work carried out by external auditors.
  - Examples of supervisory actions include instructions to implement internal mechanisms to classify accounts as nonperforming, to upgrade NPAs only after full payment, strengthen credit monitoring, review collateral management, confirm amounts of restructured loans and make appropriate provisions, and tighten recovery mechanisms targeting high-value NPAs.
  - From April 2018, India will be converging toward IFRS 9 which requires forward-looking provisioning, based on expected losses.
- The SPARC process and on-/offsite supervision:
  - In the SPARC process, banks provide information on policies and processes for grading, classifying, and provisioning; SSMs determine adequacy during on-/offsite supervision.
  - Scope of asset quality assessment includes credit risk rating process, provisioning policy, write-off of NPAs, valuation of collateral, Joint Lender Forum mechanism, flexible structuring, appraisal quality and moratorium.
  - Retail and SME accounts are tested at portfolio level; large value accounts are subject to Loan Review Mechanisms.
  - At least 40 percent of the portfolio should be subject to the Loan Review Mechanism in a year.
  - The SPARC system collects balance sheet data on loan classification and provisions and makes NPAs and provisions risk factors in a bank’s risk rating.
- Reporting and information access:
  - Banks report NPAs and provisioning to RBI on a quarterly basis.
  - Sections 27 and 35 of the BR Act provide RBI the right to obtain information and perform inspections, including ad hoc inspections.
  - RBI has access to internal and external auditors and can send a delegate to attend bank Board meetings where provisions are discussed.
  - Quarterly returns specify provisions made; banks must disclose provisions in annual and quarterly financial statements.

### Early warning, off-balance sheet exposures, collateral valuation and related rules
- Special Mention Accounts (SMA) as early warning:
  - SMA-0: accounts with signs of incipient stress, although there are no overdues longer than 30 days; illustrative signs include delay of 90 days or more in submission of stock statement/other stipulated operating control statements or in credit monitoring or financial statements; actual sales/operating profits falling short of projections accepted for loan sanction by 40 percent or more; reduction of Drawing Power by 20 percent or more after a stock audit; evidence of diversion of funds; drop in internal risk rating by 2 or more notches in a single review; increase in frequency of overdrafts; borrower reporting stress; promoter(s) pledging/selling shares due to financial stress, etc.
  - SMA-1: accounts where principal and/or interest are overdue between 31-60 days.
  - SMA-2: accounts where principal and/or interest are overdue for between 61-90 days. SMA-2 loans are reported to the Central Repository of Information on Large Credits (CRILC).
- Off-balance sheet exposures and provisioning (EC3):
  - In section 5 of the GNRM, banks must develop frameworks for managing off-balance sheet products (forex forward contracts, swaps, options, etc.).
  - Banks classify off-balance sheet exposures into three categories: full risk (credit substitutes—stand-by letters of credit, money guarantees, etc.), medium risk (not direct credit substitutes—bid bonds, letters of credit, indemnities and warranties), and low risk (reverse repos, currency swaps, options, and futures).
  - MCCP Section 5.9.12 rules for provisioning for derivatives: “credit exposures, computed as per the current mark-to-market value of the contract, arising on account of the interest rate and foreign exchange derivative transactions, credit default swaps and gold, shall also attract provisioning requirements as applicable to the loan assets in the “standard” category, of the concerned counterparties.”
- Collateral valuation and review (EC8):
  - Circular “Valuation of Properties—Empanelment of Valuers” requires a Board approved policy on valuation of collateral.
  - Two appraisals from independent appraisers are required for properties above a certain value.
  - In cases of NPAs with balance of Rs 5 crore and above, collateral must be reviewed annually by external appraisers.
  - Immovable properties pledged in favor of the bank must be subjected to valuation once in three years by appraisers appointed by the bank.
  - Value of risk mitigants is reviewed by banks every quarter when NPAs and provisions are reported to the RBI.

### Reclassification and restructured loan rules
- Reclassification of a restructured loan:
  - Reclassification can take place only after one year’s uninterrupted payment record for principal and interest, starting when the first restructured payment has fallen due on the loan with the longest grace period after restructuring.
- Treatment of interest and accruals:
  - When a loan becomes an NPA, accrued interest is backed out of the income statement and further accrual stopped.
  - In case of a restructured loan, unpaid interest payments can be capitalized up to a certain period.

### Supervisory powers and remedial actions (EC7)
- The supervisor assesses adequacy of classifications and provisions for prudential purposes.
- If classifications are inaccurate or provisions inadequate, the supervisor can require the bank to:
  - Adjust classifications of individual assets;
  - Increase levels of provisioning, reserves or capital; and
  - Impose other remedial measures.
- Section 35A of the BR Act provides RBI general powers to give binding directions to banks to prevent conduct detrimental to depositors or prejudicial to the banking company; in practice RBI has used enforcement measures (e.g., required banks to phase in, by March 2017, additional provisions after the 2015 AQR).

*Extracted from: cr1804 - Section 4.2.9. MCCP stipulates that fraudulent NPAs need to be 100 percent written off over at most 4 quarters, without prior classification as substandard, doubtful or loss*

### Section 3.2.5. of the GNRM stipulates that banks need to have a credit risk

### cr1804 - Section 3.2.5. of the GNRM stipulates that banks need to have a credit risk

### Credit risk governance, CRMD and Loan Review Mechanism (LRM)
- Section 3.2.5. of the GNRM requires banks to have a credit risk management department (CRMD) responsible for periodic monitoring of the portfolio.
- Per the GNRM, banks could consider quantitative ceilings on aggregate exposure by sector or rating categories.
- Per 3.2.6. of the GNRM banks must have a Loan Review Mechanism (LRM) to:
  - promptly identify weak loans and initiate timely corrective action;
  - evaluate overall portfolio quality and identify problem areas;
  - provide information about the adequacy of loan loss provisions;
  - assess adequacy of and adherence to loan policies and procedures;
  - provide top management with information on credit administration, risk evaluation and post sanction follow up.
- The GNRM requires banks to have a strong MIS.
- RBI Circular on Calendar of Reviews (May 14, 2015):
  - financial reports and their integrity are critical Board meeting themes, including NPA management and integrity of the provisioning process;
  - the LRM must be annually evaluated by the Board;
  - RBI routinely reviews minutes of Board meetings to assess quality and scope of Board activities;
  - RBI requests and reviews extensive information on Board’s oversight under SPARC, including reporting framework to ensure timely, relevant, correct and complete information for effective decision making;
  - RBI can send a delegate to attend bank Board meetings where provisions are discussed (EC 6).

### Valuation, classification and provisioning (EC11)
- Supervisor requirement: valuation, classification and provisioning, at least for significant exposures, are conducted on an individual item basis; supervisors require banks to set an appropriate threshold for identifying significant exposures and to regularly review that threshold.
- Description and findings:
  - RBI regulations on valuation, asset classification and provisioning apply at the individual item level, even for small retail exposures.
  - RBI requires loan reviews of high value loans usually within three months of sanction/renewal, or more frequently when deterioration indicators are present.
  - Banks are required to review at least 40 percent of the portfolio every year under the loan review mechanism.
  - Banks determine scope of the review to assess appropriateness of loan classification and provisions, generally covering the great majority of the loan portfolio in value.
  - Banks must present a half-yearly credit audit to the RBI based on internal review processes (SPARC system).
  - Loan selections are reviewed on an individual basis and sampling is refreshed with each review.
- Assessment of Principle 18: Largely compliant.
- Findings and numeric indicators:
  - Provision for restructured accounts where DCCO deferment allowed: increased from 2.75 percent to 5 percent.
  - The 2015 AQR covered 93 percent of the loans on the banks’ books.
  - Coverage level since mid-2015 increased from 37 percent to 42 percent.
- Identified weaknesses:
  - Multiple "special situation" advance categories can extend periods beyond contractually agreed payment dates before expected cash flow resumes; lack of systematic reporting on magnitude of special cases complicates monitoring.
  - Need to reassess special loan categories that confer asset classification benefits and to develop reporting tools to monitor materiality, trend and build-up of risks in special situations.
  - RBI should ensure parameters of asset classification and provisioning regulations (i.e., provisioning rates and categories of impairment) remain realistic and periodically undertake deeper reviews of actual losses, cure rates, and performing exposures, and back test provisioning percentages.
  - RBI should align practices and regulations with evolving good practices on NPLs and forbearance (reference to Basel Committee developments noted).

### System-wide risk assessment, CRILC, FSU and supervisory actions (EC12)
- EC12 requires the supervisor to regularly assess trends and concentrations in risk and risk build-up across the banking sector, consider adequacy of provisions/reserves at bank and system level, and account for concentration in banks’ risk mitigation strategies.
- Description and findings:
  - RBI has a Financial Stability Unit (FSU) which, as part of preparation of half-yearly Financial Stability Reviews, assesses build-up of risk across the banking sector; FSU findings feed macroprudential policy and are shared with Banking Supervision Department and inspectors.
  - SPARC framework includes parameters providing data on exposures to significant sectors; SSMs consider FSU findings and review NPAs and provisioning as part of SPARC.
  - CRILC database (RBI-operated credit bureau/registry) strengthens system-wide risk identification; inputs provided by banks following RBI instruction; accessible to inspectors and banks.
  - Inspectors evaluate banks’ actions to prevent default risk.
  - The 2015 AQR revealed considerable additional NPAs and need for additional provisions despite use of above mechanisms.
  - Special situation loans mentioned in EC1 are not reported separately as formal supervisory returns for regular monitoring of trends and build-up of relevant risks.

### Concentration risk and large exposure limits (Principle 19; EC1–EC3)
- Legal and regulatory framework:
  - Rules laid down in Circular on Risk Management Systems in Banks (October 7, 1999), Guidance Notes on Management of Credit Risk and Market Risk (October 12, 2002), Master Circular “Exposure Norms” (July 2, 2012), and Circular “Large Exposures Framework” (December 1, 2016) (to take effect on April 1, 2019).
  - Banks required to formulate policies on prudential limits on large exposures, concentration monitoring and evaluation; portfolio managers should be appointed to monitor these risks.
  - Off-balance sheet instruments (swaps, FX forwards, options, etc.) are included in calculation of large exposures and concentration of risk; banks report large exposures and risk concentration on a consolidated basis to RBI; reviewed during onsite inspections and entered into SPARC.
- CRILC assists tracking large exposures and lending to individual borrowers, sectors and groups or connected parties.
- EC2: Banks’ systems are required to provide data for quarterly reporting of large exposures and concentration of risks to RBI; breaches reported internally to Risk Management Committee and Board; onsite inspections produce exception reports integrated into SPARC.
- EC3: Thresholds and exceptions:
  - Large exposures to a single borrower limited to 15 percent of regulatory capital (Tier 1 +2), and exposures to a group to percent. 
  - Exceptions and exemptions allowed under regulation:
    - Exposure to central counterparties is excluded;
    - Single borrower and group limits can be raised to respectively 20 percent and 45 percent with approval of the bank’s Board;
    - For infrastructure projects, the limits can be raised to 20 percent and 50 percent;
    - For oil companies with oil bonds, the limit is 25 percent which can be raised to 30 percent;
    - For loans to nonbank finance companies that lend to infrastructure projects, the limit can be raised to as high as 20 percent;
    - No limit applies to lending to “sick or weak” industrial units, provided these are under rehabilitation;
    - No limit applies to borrowers who are under specific RBI determined limits for lending to the “food credit” program;
    - Loans guaranteed by the government are not subject to limits, nor loans against cash collateral, or loans to the National Bank for Agriculture and Rural Development (NABARD).
  - Off-balance sheet items are brought under exposure limits using a system of “credit conversion factors” (CCFs) set depending on duration of the contracts:
    - Contracts of less than one year carry a CCF of 0.5 percent;
    - for 1–5 years: (text ends).

### Key findings and policy recommendations (extracted)
- Strengthen monitoring and reporting on “special situation” loan categories to quantify materiality, trend and build-up of related risks and provide factual basis for remedial action.
- Reassess special loan categories that confer asset classification benefits and consider amending them to avoid weakening loan classification, provisioning adequacy, cash flow, liquidity management and profitability.
- Periodically review and back test provisioning percentages, actual losses and cure rates; adjust regulatory parameters (provisioning rates and impairment categories) if necessary.
- Align RBI practices and regulations with evolving international good practices on NPLs, forbearance and definitions of restructuring.
- Consider a more proactive approach to ensure banks, via adequate provisioning, have proper incentives to tackle NPAs and free up balance sheets for productive lending.
- Continue use and enhancement of SPARC, FSU analysis and CRILC data to detect system-wide risk build-up and inform supervisory action.

*Source: cr1804 - Section 3.2.5. of the GNRM stipulates that banks need to have a credit risk*

### 1.0 percent, above 5 years: 3 percent. Foreign exchange and gold contracts each

### cr1804 - 1.0 percent, above 5 years: 3 percent. Foreign exchange and gold contracts each

### Concentration risk rules and CCFs
- Foreign exchange and gold contracts each carry CCFs of respectively 2, 10 percent and 15 percent.
- Lease, hire and factoring exposures are together limited to 10 percent of total loans.
- The supervisor regularly obtains information that enables concentrations within a bank’s portfolio, including sectoral, geographical and currency exposures, to be reviewed.

### Reporting and identification of concentrations (EC4)
- Banks report all their large exposures on a quarterly basis.
- Reporting templates allow identification of large exposures and group exposures.
- Sectoral, geographical and foreign exchange exposures can be distinguished in reporting.
- Regulation does not set sectoral limits; banks are required to set sectoral limits according to their professional judgment in their internal systems.
- These internally set limits will be verified in onsite inspections.

### Definition and supervisor discretion for groups (EC5)
- Laws or regulations explicitly define, or the supervisor has the power to define, a “group of connected counterparties” to reflect actual risk exposure; the supervisor may exercise discretion in applying this definition on a case by case basis.
- The definition of “group” and the identification of borrowers belonging to specific industrial groups is left to the assessment of the banks/financial institutions.
- Membership of a group may be decided on the basis of relevant information available to the bank; the guiding principle is commonality of management and effective control.
- The definition of “group” is stipulated in the RBI circular from December 1, 2016, but will only become effective from the date when the circular will be implemented in full by April 1, 2019.

### Prudent limits on large exposures (EC6)
- The RBI’s large exposure rules of December 1, 2016, in section 4.1 define “large exposure” as: “the sum of all exposure values of a bank to a counterparty or group of connected counterparties is defined as a large exposure if it is equal to, or above 10 percent of a bank’s eligible capital base (Tier 1 capital).”
- Limit for a single counterparty: the sum of all the exposure values of a bank to a single counterparty must not be higher than 20 percent of the bank’s available eligible capital base at all times.
- Exceptional cases: Board of banks may allow an additional 5 percent exposure of the bank’s available eligible capital base; Banks shall lay down a Board approved policy in this regard.
- Limit for groups of connected counterparties: must not be higher than 25 percent of the bank’s available eligible capital base at all times.
- Section 7.1 requires that both off- and on-balance sheet exposures, in the banking as well as the trading book, plus counterparty credit risk, should be taken into account.
- The circular will be implemented in full by April 1, 2019; the RBI states that the limits are already applied de facto.
- Under the RBI’s current circular of 2012, any credit exposure to a single borrower is not to exceed 15 percent of a bank’s regulatory capital, and exposure to a group is not to exceed 40 percent of a bank’s regulatory capital.
- RBI requires banks to submit detailed information on large exposure limit through supervisory returns.
- Under the SPARC framework, banks are required to report control information parameters including process for reporting breaches in exposure limits, process for fixing limits and controlling exposure to counterparties, etc.
- The RBI assesses that senior management of banks monitors these limits and that they are not exceeded on a solo or consolidated basis during the offsite supervision and onsite inspection.

### Stress testing requirements (EC7)
- “Guidelines on Stress Testing,” of December 2, 2013, section 3.1 “Credit risk,” provide for stress testing:
  - Single borrower exposure by assuming the default of the largest single borrower, the top two single borrowers, and the top three.
  - Exposure to groups by assuming the default of the top three group entities, the top five, and the entire group.
  - Sectoral concentration risk by assuming the top, top three, and top five borrowers in a particular sector.
- Banks are divided into three categories according to balance sheet totals; expectations vary by category:
  - Smallest group: simple sensitivity analyses of the specific risk types to which it is most exposed; consider interactions between risks.
  - Middle group: multifactor sensitivity analysis and simple scenario analyses; qualitative analysis with respect to reverse stress testing; both qualitative and quantitative analysis of correlations among risk types and feedback effects.
  - Largest group: undertake a variety of stress testing approaches from simple portfolio based sensitivity analyses to complex macro scenario driven firm-wide exercises; include rigorous firm-wide stress tests covering all material risks and entities, and interactions between different risk types; regularly conduct reverse stress testing; internationally operating banks should conduct stress tests at consolidated level and discuss stress testing issues with concerned regulators.

### Additional criteria (AC1)
- In respect of credit exposure to single counterparties or groups of connected counterparties, banks are required to adhere to:
  - (a) 10 percent or more of a bank’s capital is defined as a large exposure; and
  - (b) 25 percent of a bank’s capital is the limit for an individual large exposure to a private sector non-bank counterparty or a group of connected counterparties.
- Minor deviations from these limits may be acceptable, especially if explicitly temporary or related to very small or specialized banks.
- The RBI’s large exposure and risk concentration rules of December 1, 2016, are referenced for these criteria.

*Source: cr1804 - 1.0 percent, above 5 years: 3 percent. Foreign exchange and gold contracts each*

### section 4.1 and 5 define “large exposure” and set the limit following the Basel

### cr1804 - section 4.1 and 5 define “large exposure” and set the limit following the Basel

### Large exposures (Principle 19)
- A new Large Exposures (LE) Framework was issued on December 1, 2016; the circular will be implemented in full by April 1, 2019 (See EC6).
- Under the circular of 2012, basic limits prescribed:  
  - 15 percent of regulatory capital (Tier 1 +2) per individual borrower.  
  - 40 percent basic limit for exposures to a group. (See EC3).
- Current rules before full LE framework implementation include exceptions allowing large exposures up to 50 percent of capital base (example: infrastructure project loans).
- RBI states it already applies the new limits in practice; banks must gradually adjust exposures to comply by April 1, 2019 and should avoid taking additional exposure or should reduce exposure where at or above limits prior to that date.
- Recommendation: RBI should monitor banks’ practice more closely, take supervisory action as needed during introduction of new large exposure rules, and reduce/remove as much as possible the current exceptions to the basic limits.
- Assessment of Principle 19: Largely compliant.

### Transactions with related parties (Principle 20) — overview
- Supervisor requires transactions with related parties to be on an arm’s length basis, monitored, controlled/mitigated, and write-offs to follow standard policies and processes.
- Definitions and rules are scattered across multiple documents: Indian Accounting Standard 18; RBI Guidelines on Management of Intra-Group Transactions and Exposures (February 2014); RBI Master Circular–Loans and Advances–Statutory and Other Restrictions.
- Assessment of Principle 20: Largely Compliant.

### Principle 20 — Key findings by Essential Criteria (EC)

- EC1 (definition of related parties):
  - Related-party rules are dispersed across several standards/guidelines; examples include:
    - Indian Accounting Standard 18: defines parties related if one has the ability to control or exercise significant influence; includes affiliates, enterprises under common control, individuals who control or significantly influence the enterprise, key management personnel and relatives.
    - RBI Guidelines on Management of ITE (Feb 2014): prudential definition to be interpreted with accounting standards; includes SPV/SIV/conduits based on actual ownership/control/significant influence/beneficial interest; primarily for group entities but includes individual related parties as “group entity”.
    - RBI Master Circular-Loans and Advances: restrictions on loans to directors and relatives; prior Board approval required for relatives; reporting of loans approved to senior officers and relatives to the Board.
- EC2 (arm’s length terms required):
  - ITE guidelines (paras 4.1–4.2) require Board-approved policy, regular review/reporting of material ITEs, and that terms/credit standards of intra-group transactions are substantially the same as for comparable third-party transactions; procedures for resolving conflicts of interest and arm’s-length principle required.
- EC3 (Board approval and exclusion for conflicts):
  - Regulation 23(2) of Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) (2015) requires prior approval of the Board’s Audit Committee for all RPTs (applicable to listed banks).
  - ITE guidelines (para 4.3) require inconsistencies with third-party benchmarks to be put to the Board with justifications.
  - No explicit requirement that write-off of related-party exposures be subject to prior Board approval under the ITE guideline.
- EC4 (preventing beneficiaries from participating in process):
  - ITE guidelines require Board-approved policy, reviewed at least annually.
  - Master Circular para. 2.2.1.6: directors with interest must disclose, not be present unless required for information, and shall not vote; officers cannot sanction credit to their relative while exercising sanction powers.
  - RBI states annual onsite inspection verifies policies/processes and compliance controls for RPTs.
- EC5 (limits, capital deduction, collateralization):
  - ITE guidelines (paragraph 3) prescribe intra-group exposure limits (extend to related parties). Paragraph 4.4.11: intra-group exposures beyond permissible limits subsequent to March 31, 2016, would be deducted from Common Equity Tier 1 capital.
  - Intra-group exposure limits (Paragraph 3.3):  
    - a. Single Group Entity Exposure  
      - i. 5 percent of Paid-up Capital and Reserves in case of nonfinancial companies and unregulated financial services companies;  
      - ii. 10 percent of Paid-up Capital and Reserves in case of regulated financial services companies.  
    - b. Aggregate Group Exposure  
      - i. 10 percent of Paid-up Capital and Reserves in case of all nonfinancial companies and unregulated financial services companies taken together;  
      - ii. 20 percent of Paid-up Capital and Reserves in case of the group i.e., all group entities (financial and nonfinancial) taken together.
  - Unclear whether ITE limits are applied to RPTs between a bank and its major individual shareholder or family.
- EC6 (identification, monitoring, reporting, independent review):
  - ITE guidelines (para 4.6) require systems and controls for identifying, monitoring, managing and reviewing intra-group exposures (extend to related parties).
  - Paragraph 4.2: material intra-group transactions to be examined by internal auditors and checked by statutory auditors on a sample basis.
  - Where group terms are inconsistent with benchmarks, must be reported to the Board (para 4.3).
  - RBI can require additional internal controls and more robust monitoring during onsite examinations under SPARC framework.
  - ITE guidelines do not apply to transactions with directors, senior officers, and relatives; Master Circular applies but lacks comparable detailed requirements.
- EC7 (supervisor obtains aggregate exposure information):
  - ITE guidelines (para 9) require banks to prepare and submit a list of group entities (domestic and overseas with material transactions during last three financial years) and report inclusions/exclusions.
  - RBI reviews aggregate intra-group exposures and compliance via prudential return; exposures to directors and senior officers are reported through the report on connected lending and reviewed quarterly by each SSM of DBS.

### Principle 20 — Recommendations / Areas for improvement
- Consolidate definitions and regulations/guidelines on RPTs into a single document to provide a clear framework.
- Consider explicitly requiring Board approval prior to write-off of related-party exposures above a specified level to ensure arm’s-length treatment.
- Clarify application of ITE limits to RPTs involving major individual shareholders or family.

### Country and transfer risks (Principle 21)
- RBI circular on Risk Management Systems in Banks — Guidelines on Country Risk Management by banks in India (February 2003) requires banks to formulate CRM policies covering domestic and foreign operations, direct and indirect country risk, and to monitor and make provisions per guidelines.
- For each country where a bank’s net funded exposure is 1 percent or more of its total assets, the bank must formulate a CRM Policy including contingency plans and exit strategies.
- Boards may set regional exposure limits; Board decides grouping and guidelines (Paragraph 12).
- Transfer risk considered a component of country risk per Guidance Note on Credit Risk (October 2002).
- RBI conducts assessments during onsite examinations under SPARC (at least once during 12–18 month supervisory cycle) and requires quarterly prudential return on country exposure and maturity.

### Principle 21 — Key findings by Essential Criteria (EC)
- EC1: CRM policies required, cover exposures where net funded exposure is 1 percent or more of total assets; contingency plans and exit strategies required.
- EC2: CRM policies and processes must be Board-approved and periodically reviewed; RBI reviews during SPARC onsite examinations.
- EC3: Guidelines require internal controls and audits for country risk processes; Boards should review exposures quarterly and report significant deterioration without waiting for quarterly review; banks report country exposures in excess of 1 percent of total assets on a quarterly basis; banks required to set country exposure limits as a percentage of regulatory capital (Tier 1 and Tier 2).
- EC4: RBI prescribes provisioning requirement on net funded country exposures on a graded scale ranging from 0.25 to 100 percent, following ECGC seven-grade risk classification; provisioning required when bank’s net funded exposure is 1 percent or more of total assets. Short-term exposures (< 180 days) may receive a lower level of provisioning (e.g., 25 percent of the requirement). Country risk provisions are in addition to asset classification provisions; provision for ‘loss assets’ and ‘doubtful assets’ including country risk provision may not exceed 100 percent of the outstanding.
  - Risk Category / ECGC Classification / Provisioning Requirement (in percent):  
    - Insignificant / A1 / 0.25  
    - Low / A2 / 0.25  
    - Moderate / B1 / 5  
    - High / B2 / 20  
    - Very high / C1 / 25  
    - Restricted / C2 / 100  
    - Off-credit / D / 100
- EC5: Stress testing for country and transfer risk is required (Paragraph 15); stress testing should include assessment of impact of alternative outcomes to underlying assumptions.
- EC6: RBI obtains quarterly data on country exposures in excess of 1 percent of total assets; RBI reviews prudential returns and has power under Section 27 of BR Act to call for additional information; formal comprehensive analysis has been rare.
- Assessment of Principle 21: Compliant.
- Recommendation: Strengthen group-wide country/transfer risk management by collecting consolidated data across regulated and unregulated entities of banking groups and financial conglomerates.

### Market risk (Principle 22)
- RBI Guidance Note on Market Risk Management (March 2002) requires Board articulation of market risk policies, limits, review mechanisms and reporting/auditing systems; requires bank-wide view of market risk and risk measurement systems capturing all material sources.
- RBI issued detailed guidelines on market risk as part of Basel II and Basel 2.5 (February 2010) and on advanced approach for market risk (IMA) in April, 2010. Guidelines on stress testing require stress testing of market risk factors.
- Banks must have ICAAP covering interest rate risk in banking book and use stress testing and scenario analysis.
- Onsite examinations under SPARC assess Board-approved objectives and risk appetite, permissible products and currencies for trading, authority delegation for limit breaches, and stress test details.

### Principle 22 — Key findings by Essential Criteria (EC)
- EC1: Market risk management processes required to be consistent with bank risk appetite/profile and macro conditions; boards must articulate roles/responsibilities.
- EC2: Boards must approve market risk strategies/policies; adherence assessed under SPARC.
- EC3: Requirements include effective information systems, appropriate market risk limits (Factor Sensitivities, Value at Risk), exception tracking, model controls, and allocation policies for trading book exposures. Specific operational requirements: daily calculation of sensitivities, mandatory VaR and sensitivity limits, management action triggers/Stop-loss, Middle Office independence, model documentation and validation.
- EC4: Valuation requirements: HFT positions valued at least monthly; AFS positions marked-to-market at least quarterly (Master Circular—Prudential Norms for Classification, Valuation and Operation of Investment Portfolio by banks, July 2015). Model certification and validation requirements; valuation adjustments for less liquid positions required for regulatory capital purposes (para. 8.8.2).
- EC5: Banks must consider valuation adjustments and hold appropriate market risk capital. All banks follow standardized approach; India’s minimum requirements on market risk capital are higher than Basel standards (example: forex risk capital charge is 9 percent in India vs. 8 percent under Basel II).
- EC6: Stress testing programs include market risk elements (RBI Guidelines on Stress Testing, December 2013); banks required to carry out minimum prescribed stress tests as part of ICAAP; RBI assesses compliance during onsite examinations.
- Assessment of Principle 22: Compliant.
- Comments: Trading activity in India is relatively limited and simple; major investments are in government securities. Banks may migrate to Internal Modelling Approach (IMA) subject to supervisory approval; five applications submitted and under review. A revised market risk framework will come into effect in January 2019.

### Interest rate risk in the banking book (Principle 23)
- RBI guidelines require banks to have an interest rate risk framework with internal limits on earnings at risk (EaR) and volatility in market value of equity (MVE); Board must approve aggregate limits and review periodically.
- Risks must be measured and limits set using both Market Value of Equity and a Duration Gap Approach to gauge risk to net interest income and economic value.
- Revised guidelines on stress testing include interest rate risk in the banking book as a risk factor to be covered by stress testing.
- (Further EC details for Principle 23 continue beyond the supplied extract.)

*Source: cr1804 - section 4.1 and 5 define “large exposure” and set the limit following the Basel*

### Chapter 2 of Guidance Note on Market Risk Management October, 2002.

### Chapter 2 of Guidance Note on Market Risk Management October, 2002

### Interest rate risk in the banking book (Principle 23)
- Regulatory developments and standards:
  - RBI issued updated draft guidelines on Interest Rate Risk in the Banking Book (IRRBB) in February 2017 based on BCBS standards published April 2016.
  - An “outlier” level of IRRBB is defined as 15 percent (formerly at 20 percent) of total capital. Limits in Indian banks are typically between 7 to 12 percent.
  - Guidelines strengthen requirements for an interest rate risk strategy linked to each bank’s ICAAP process and for RBI supervision during the SREP.
- Governance and oversight (EC2 / EC3):
  - The Asset Liability Committee (ALCO) consisting of the bank's senior management including CEO is responsible for adherence to Board limits and deciding business strategy in line with risk tolerance.
  - The RBI regularly reviews management of IRRBB as part of Market Risk under the SPARC framework.
  - SSMs determine whether IRRBB is: taken into account in business strategies; limit utilization is reasonable; measured and monitored through suitable methodologies (manual or system based); and reported/monitored at appropriate levels and frequency.
  - Banks must validate interest rate risk models periodically; integrity of data, assumptions, parameters and model methodology must be checked; interest rate risk management system must be independently audited under the Audit Committee.
  - RBI assesses: risk measures for IRRBB, senior management awareness of model methodology/assumptions/limitations, timely review of policies and rates, independent model validation, appropriateness of measurement methodologies to size and spread of banking book, limits and monitoring frequency, MIS framework, and factor of limit utilization/breaches in business decisions.
- Stress testing and scenarios (EC4):
  - Banks must include analysis of changes in interest rates on economic value and EaR in stress testing, covering parallel shocks, yield curve twists, yield curve inversions, basis risk, and other relevant scenarios.
  - Banks must measure vulnerability to loss in stressed market conditions including breakdown of key assumptions and consider results when setting limits and policies.
  - Possible stress scenarios may include changes in the general level of interest rates, e.g., a change in the yield by 200 and 300 basis points or more in a year; yield curve risk; changes in volatility of market rates; earlier withdrawal of core portion of current account deposits.
  - Onsite examinations assess compliance with scenario analysis and stress testing requirements.
- Supervisory reporting and measurement (AC1 / AC2):
  - Guidelines on Duration Gap Analysis require banks to report impact on the MVE to different interest rate shocks; reports are collected monthly via the SPARC system on sensitivity of economic value and earnings to IRRBB.
  - RBI’s ICAAP guidance requires banks to capture all material risks including IRRBB on a forward-looking basis and plan capital accordingly.
  - RBI has specialized examiners assessing IRRBB; banks’ assessments are subject to supervisory review under SPARC.
- Assessment:
  - Assessment of Principle 23: Compliant.
  - Comment: Through successive guidance since 1999 RBI has raised standards requiring banks to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk in the banking book.

### Liquidity risk (Principle 24)
- Regulatory framework and ratios (EC1):
  - RBI issued liquidity risk management guidelines in 1999 with updates in 2007, 2010, and 2012.
  - June 2014: RBI issued guidelines on Basel III Liquidity Standards—Liquidity Coverage Ratio (LCR), Liquidity Risk Monitoring Tools and LCR Disclosure.
  - LCR requirement effective since January 1, 2015 and expected to reach 100 percent coverage by January 1, 2019.
  - RBI issued a NSFR draft proposing minimum requirement of 100 percent in January 2018 without phase-in arrangements.
  - Statutory reserve requirements:
    - CRR: maintain average daily balance not less than 4 percent of total net demand and term liabilities (NDTL) (Section 42 of RBI Act, 1934).
    - SLR: maintain SLR prescribed at 20.5 percent of total NDTL (Section 24 of BR Act, 1949). (Note: SLR has been reduced in July 2017 from 20.5 percent to 20 percent of NDTL.)
  - Banks report compliance fortnightly to monthly.
  - RBI allows inclusion of Indian State Government Securities (State Development Loans, SDL) in HQLA buffer; 2015 RCAP review concluded SDL cannot be considered sovereign debt securities in line with Basel standard; RBI has not rectified this rule.
- Coverage of on- and off-balance sheet risks (EC2):
  - Effective January 1, 2015, on- and off-balance sheet risks are included in LCR calculation.
  - ALM and structural liquidity guidance require inclusion of on- and off-balance sheet risks; banks must adopt statement of structural liquidity (SSL) under ALM System; prepare domestic SSL daily and report fortnightly; SSL for overseas operations reported quarterly.
  - Banks slot assets/liabilities including off-balance sheet items into 10 time buckets; regulatory limits of 5 percent, 10 percent, 15 percent, and 20 percent specified for the first four time buckets.
- Liquidity management framework and governance (EC3 / EC4 / EC5):
  - November 2012 RBI guidelines require a sound liquidity management framework, Board responsibility, ALCO oversight, limits setting, and liquidity stress testing.
  - Para. 13: Board or delegated committee should oversee establishment and approval of liquidity policies, strategies, procedures and review at least annually.
  - Paras. 35–38: banks must develop intra-day liquidity strategy, monitor expected daily gross inflows/outflows, ensure arrangements for intraday funding, and have policies for unexpected disruptions.
  - Structural liquidity guidelines require adherence to prudential limits on short-time buckets and arrangements to bridge gaps.
  - SPARC reviews annually: Board-approved policy; framework/process for approvals of new processes/material changes.
  - Funding strategy requirements (para. 12, 41, 42, 9, 28):
    - Banks required to have funding strategies, prudential limits, systems for measurement/assessment/reporting, stress testing framework/contingent funding plan, and periodic review of assumptions.
    - Funding diversification: maintain ongoing presence in funding markets, gauge capacity to raise funds, avoid over-reliance on single source, implement diversification via limits by tenor, counterparty, secured vs. unsecured, instrument type, currency, geography, securitization, etc.
    - ALCO role includes deciding desired maturity profile and mix of incremental assets and liabilities; decide source and mix of liabilities or sale of assets; develop view on future interest rate movements and funding mixes; regularly review funding strategy.
    - Para 28: banks with high concentration of wholesale deposits (wholesale deposits defined as Rs 15 lakh or higher threshold approved by Board) must frame policies to contain liquidity risk; monitor high value deposits like Rs 1 crore or more.
  - HQLA: LCR requirements indirectly require a cushion of high quality, unencumbered, liquid assets.
- Contingency funding plans and stress testing (EC6 / EC7):
  - Paras 52–54: banks required to prepare formal Contingency Funding Plans (CFP), blueprint for asset sales, market access options, restructuring maturity/composition of assets/liabilities, conduct periodic liquidity stress testing; CFP must be tested regularly and reviewed by Board at least annually.
  - CFP must specify actions, timing, who can take them, escalation procedures, internal coordination and communication, and how to contact external parties (supervisors, central banks, payments system operators).
  - Prudential Guidelines (Para. 13.7) and December 2013 Stress Testing guidelines (Para. 3.3) require banks to perform stress tests under normal, bank-specific crisis, and market-crisis scenarios; results to guide mitigating actions, liquidity cushion, and adjustments to liquidity profile.
  - Para. 3.2: banks must qualitatively and quantitatively review stress testing framework annually; Para 1.1.4: perform stress tests at least every six months.
  - Annual onsite examination under SPARC reviews CFPs and stress testing.
- Foreign currency liquidity (EC8):
  - Para 69: banks required to measure, monitor and control liquidity positions in major currencies; establish aggregate and individual gap limits for each currency with RBI approval; manage FX liquidity and interest rate risk through maturity and position analysis and fixing net open positions approved by RBI.
  - Onsite inspections review diversification of funding sources via top 10 or 20 funding sources.
- Encumbered assets and disclosure (AC1):
  - No supervisory requirement on banks’ levels of encumbered balance-sheet assets or disclosure requirements; banks are not allowed to issue covered bonds.
  - Banks’ investments in government securities (up to SLR limit) are mostly not encumbered.
  - RBI requires quarterly “statement of available unencumbered assets” and assesses levels of unencumbered assets regularly.
- Assessment:
  - Assessment of Principle 24: Largely Compliant.
  - Comments:
    - RBI maintains SLR of 20.5 percent in parallel with LCR requirement of 80 percent (100 percent by January 2019) as regulatory liquidity ratios; SLR requires banks to hold substantial portion of assets in cash, gold, government securities, and SDLs.
    - RBI can recalibrate SLR in times of stress to facilitate liquidity management.
    - Material gap: inclusion of SDL in level 1 HQLA; RCAP concluded SDL not sovereign under Basel standards and inclusion materially upwardly affects LCR and hampers international comparability; RBI has not rectified this.
    - CP 24 (EC1) requires liquidity requirements not lower than Basel standards; RBI should consider reviewing/enhancing liquidity regulation to align more with Basel.

### Operational risk (Principle 25)
- Regulatory requirements and framework (EC1 / EC2 / EC3):
  - RBI Guidance Note on Management of Operational Risk 2005 requires banks to have policies and procedures describing operational risk management elements, proportionate to size and complexity.
  - Para. 2.7: operational risk framework should articulate what constitutes operational risk, appetite and tolerance, key processes to manage OR; degree of formality commensurate with risk profile; independent evaluation by internal audit and capital allocation addressed.
  - Board responsibility: Board of directors primarily responsible for effective management of operational risk; approve framework and review periodically; ensure internal audit coverage.
  - SPARC used to assess implementation effectiveness annually; assessment covers compliance risk, people risk, process risk, external risk, IT-financial risk, and IT-operational risk.
  - Governance review includes delegation of responsibilities, and effective implementation of policies and procedures.
  - Limitation: SPARC is basically solo-focused, limiting discussion across banking group operations.
- Business continuity, disaster recovery and IT (EC4 / EC5 / EC6):
  - Circular on Business Continuity Plans (BCP) issued 15 April 2005 requires contingency and business continuity plans; Board/top management responsibility; periodic review.
  - BCP guidance (paras. 5 and 6) requires consideration of wide-area disasters, interdependencies, and testing at frequent intervals.
  - BCP/DR Circular (February 16, 2006) advises testing BCP/DR at least on an annual basis; for critical systems testing at half-yearly intervals and comprehensive testing making DR site primary for a short period.
  - Information Security Auditors must audit effectiveness of BCP and periodic testing; top management to review annually and forward reports to Board.
  - RBI guidance June 26, 2013 on BCP, VAPT and information security; guidance on cyber risks to raise awareness.
  - Guidance Note on Management of Operational Risk 2005 (Para.6.10) requires investment in processing technology, information security, IS audit, IT operations, and system development commensurate with scope of activities.
  - April 2011 guidance on nine IT areas: IT governance, information security, IS audit, IT operations, IT services outsourcing, cyber fraud, BCP, customer awareness, legal aspects.
  - RBI established Reserve Bank Information Technology (ReBIT) Pvt Ltd for advanced cyber security and supervision capabilities.
  - SPARC includes focused IT examinations and cyber risk issues.
  - Operational risk reporting (EC6): Guidance Note requires regular reporting of critical risk issues and mitigations to senior management and Board; reports to include internal financial, operational, compliance data and external market information.
- Incident reporting and outsourcing (EC7 / EC8):
  - Master Directions on Frauds-Reporting and Monitoring, July 2015: banks must report incidents of fraud periodically (from within a week to quarterly); fraud classification in Paragraph 2.2 lists seven categories.
  - No explicit regulatory requirement for banks to immediately notify RBI of developments affecting operational risk when incidents other than fraud occur; formal reporting protocol has limited applicability.
  - November 3, 2006 guidelines on outsourcing require Board-approved comprehensive outsourcing policy covering selection, materiality, delegation, monitoring, contingency plans, contractual protections, and due diligence.
  - For critical outsourced activities banks must consider contingency plans and alternative providers; onsite SPARC examinations review vendor agreements, controls, and outsourcing policies/procedures.
- Identifying common points of exposure (AC1):
  - RBI does not currently identify common points of exposure to operational risk (e.g., common service providers); RBI has started interacting with major service providers to assess issues.
- Assessment:
  - Assessment of Principle 25: Largely Compliant.
  - Comments:
    - No banks in India allowed to use AMA; all banks use BIA; seven run parallel for TSA and three for AMA.
    - As of December 2016, RWAs for operational risk averaged 8.5 percent of total RWAs.
    - Gaps:
      - No explicit regulatory requirement/formal offsite returns for banks to keep RBI apprised of operational risk developments other than fraud.
      - SPARC’s solo focus limits group-wide operational risk discussion.
      - Limited loss data accumulation (other than fraud) since all banks currently use BIA; strengthening loss data collection across banks would be useful.
    - Recommendation: RBI should regularly interact with major service providers to assess operational risk vulnerabilities.

### Internal control and audit (Principle 26)
- Internal control framework requirements (EC1):
  - 1999 Guidance Note on Risk Management Systems requires well-established internal control system including segregation of duties, clear reporting lines and operating procedures; techniques of self-assessment and effective internal systems to detect problems.
  - Guidance Note on Risk Based Internal Audit issued December 2002 and SPARC provide extensive supervisory guidelines on inspection of internal control and audit functions.
  - SPARC assesses controls across six business risk categories (credit, market, liquidity, operational non-IT, operational IT, other Pillar II risks) and judges gaps relative to inherent risk and desired control level.
  - SPARC compendium lists 22 attention points (“control parameters”) on internal audit and control including internal audit charter, Board oversight, follow-up frameworks, performance evaluation, staff skills, independence, coverage of critical areas (IT, key units, branches, outsourced activities), methodology for audit plan, access to records, and requirement for internal audit to opine on effectiveness and adherence to procedures.
- Supervisory assessment:
  - Inspectors are required to review and include all 22 aspects in reports; various RBI guidance and circulars supplement these requirements.  

*Source: Chapter 2 of Guidance Note on Market Risk Management October, 2002 (extracts on Principles 23–26 and related findings for India).*

### references to internal systems to ensure proper administration and the necessary

### cr1804 - references to internal systems to ensure proper administration and the necessary

### Internal control, compliance, and internal audit (EC2–EC5)
- Guidance note on Credit Risk Management of October 2002: each bank should set up a Credit Risk Management Department (CRMD), independent of the Credit Administration Department; CRMD responsibilities include measuring, controlling, and managing credit risk within limits set by the Board/CRMC, enforcing compliance with risk parameters and prudential limits, building risk assessment systems and developing management information systems.
- RBI guidelines on concurrent audit: contemporaneous examination of transactions to establish sound internal accounting functions and effective controls; aims to preclude serious errors and fraudulent manipulations.
- EC2: supervisor determines an appropriate balance in skills and resources of back office, control functions, and operational management relative to business origination units; back office and control staff must have sufficient expertise and authority and, where appropriate, access to the bank’s Board.
- RBI Guidance Note on Risk Based Internal Audit of December 2002: Internal Audit Department should be provided with appropriate resources and staff with requisite skills; periodic training; tasks may be outsourced to bring in additional expertise.
- EC3: supervisor determines banks have an adequately staffed, permanent and independent compliance function; staff suitably trained, experienced, and with sufficient authority; Board exercises oversight of the compliance function.
  - SPARC Risk Discovery Process: structured assessment of compliance culture and level of compliance with regulatory guidance.
  - Internal audit and control risk areas covered in SPARC manual include:
    - Process of sensitization of the Board on risk management, products, etc.;
    - Process by which the Board ensures implementation of its directions;
    - Reporting framework to provide the Board with timely, relevant, correct, and complete information;
    - Framework to ensure Board members are cognizant of regulatory and supervisory regime;
    - Reporting framework to ensure senior management is provided with timely, relevant, accurate and complete information;
    - Framework for oversight by Board, ACB, other Board committees and senior management with respect to internal audit;
    - Framework for reporting and follow-up on resolution of internal audit findings and recommendations to ACB/management;
    - Framework for training/development of internal audit staff.
  - SPARC is the basis for onsite inspections and production of an RAR reporting explicitly on the quality of control and identifying shortcomings; subsequent inspections review implementation of RBI directives.
- EC4: supervisor determines banks have an independent, permanent and effective internal audit function charged with:
  - (a) assessing whether existing policies, processes and internal controls are effective, appropriate and sufficient for the bank’s business; and
  - (b) ensuring that policies and processes are complied with.
  - SPARC inspectors assess Board processes to ensure risk management practices limit potential risks to prudent levels, reporting frameworks to the Board, the compliance framework, and Board implementation processes.
- EC5: internal audit function requirements:
  - a. sufficient resources, suitably trained staff with relevant experience;
  - b. appropriate independence with reporting lines to Board or audit committee and status to ensure senior management acts on recommendations;
  - c. kept informed timely of material changes to risk management strategy, policies or processes;
  - d. full access to staff, records, files or data of the bank and its affiliates, when relevant;
  - e. employs a methodology that identifies material risks run by the bank;
  - f. prepares an audit plan reviewed regularly, based on its own risk assessment and allocates resources accordingly;
  - g. has the authority to assess any outsourced functions.
  - Onsite examination reviews: deployment of personnel with requisite skill sets, training/development framework, performance evaluation framework, findings on performance evaluation, independence processes, framework for development and review of risk management policies, assessment of staffing and necessary skills in business units, communication framework for risk management strategy and codes of conduct.
- Assessment of Principle 26: Compliant.
  - Comments: RBI has a comprehensive framework for internal control and audit and detailed parameters reviewed during SPARC onsite inspections; quality and effectiveness of internal audit and control score is included in overall bank risk rating; banks report number and qualifications of internal audit staff as part of SPARC.

### Financial reporting and external audit (Principle 27: EC1–EC9, AC1)
- Principle 27 overview: supervisor determines banks maintain adequate and reliable records, prepare financial statements in accordance with accounting policies and practices widely accepted internationally, publish information that fairly reflects financial condition and performance, and have adequate governance and oversight of external audit.
- EC1: Board and management responsible for preparing financial statements in accordance with accounting policies widely accepted internationally and supported by recordkeeping systems; robust systems for collection, collation and submission of accurate data and information timely are essential.
  - Current accounting framework governed by the Accounting Standards (AS) issued by the ICAI; ICAI has issued extensive auditing standards covering principles, quality control, documentation, fraud and error, audit evidence, analytical procedures, reliance on internal auditor.
  - ICAI certification required to practice.
  - RBI issues supplementary instructions on income recognition, asset classification, valuation, investment portfolio, etc.
  - Section 31 of the BR Act requires publication of audited balance sheet and profit and loss accounts with auditors’ report; banks must publish annual accounts in a newspaper where the bank has its principal office and in abridged form in additional newspapers/journals for wider coverage.
  - Master Circular “Prudential Guidelines on Capital Adequacy and Market Discipline, Part C Market Discipline”: banks must disclose Pillar III disclosures of Basel II.
  - Commercial banks are listed and must publish unaudited quarterly results per listing requirements.
  - Banks prepare standalone and consolidated financial statements in accordance with accounting standards.
  - The IFRS converged Indian Accounting Standards (Ind-AS) shall be effective for banks only from April 01, 2018 and are as such currently not applicable.
  - Bank records and internal audit are basis for external auditor’s work; auditors reported overall experience with quality of internal audit as satisfactory.
  - Art. 27 BR Act prescribes monthly returns in form determined by the RBI.
  - SPARC requires robust quality data; inspections comment on data quality; deficiencies in RAR are action points for banks.
  - Banks submit prudential returns on assets, liabilities, off-balance sheet exposures, asset quality, and capital adequacy; these returns are inputs used by SSM teams and offsite analysis functions.
  - RBI authority to hold management accountable for reliable financial record-keeping and power to impose penalties or directions under Sections 47A and 35A of the Bank Regulation Act.
  - SPARC methodology requires analysis of Board and management oversight of internal audit, skills, independence, coverage, full access, and delivery of opinion on effectiveness and adherence to controls.
- EC2: supervisor holds Board and management responsible that annual public financial statements bear an independent external auditor’s opinion from an audit conducted in accordance with internationally accepted auditing practices and standards.
  - Section 29 BR Act: balance sheet and profit and loss statement shall be signed by CEO and directors.
  - Section 30 BR Act mandates audit of balance sheet and profit and loss account prepared under Section 29 by duly qualified auditors who prepare a report.
  - RBI requires compliance with accounting standards; qualifications in financial statements for non-compliance will be viewed seriously by RBI.
  - Audit-signed balance sheets and income statements must be publicly displayed on the bank’s premises.
- EC3: supervisor determines banks use valuation practices consistent with internationally accepted accounting standards; fair value estimation framework subject to independent verification and validation; banks document significant differences between valuations for financial reporting and regulatory purposes.
  - Fair value of balance sheet items is verified by bank’s internal audit and external auditor in annual audit.
  - Banks required to use valuation rules set by ICAI and RBI norms for valuation of collateral.
  - Internal accounting and audit functions obliged to operate consistently with IFRS-convergent Indian accounting and auditing standards when preparing for external audit; these standards refer to need to use fair value valuations.
  - Accounting standards distinguish between values for regulatory reports to RBI and those for public disclosure.
- EC4: laws/regulations or supervisor have power to set scope of external audits and standards requiring risk and materiality based approach.
  - ICAI has issued extensive audit guidelines on scope and materiality; government notification gives them force of law.
- EC5: supervisory guidelines/local auditing standards determine audits cover loan portfolio, loan loss provisions, non-performing assets, asset valuations, trading and other securities activities, derivatives, asset securitizations, consolidation and off-balance sheet vehicles, and adequacy of internal controls over financial reporting.
  - Supervisory guidelines, reporting requirements, and public financial statement formats require these areas be covered; these are key data points for SPARC; external auditors must state an opinion on quality of internal accounting and auditing systems.
- EC6: supervisor has power to reject and rescind appointment of external auditor deemed to have inadequate expertise or independence.
  - RBI maintains a list of accepted and duly qualified bank auditors; only external auditors on RBI’s list may audit banks.
  - Art. 30 (1) (A): appointment or removal of external auditor requires prior approval from RBI, giving RBI power to decide auditor suitability; auditors required to obtain certificate of practice from the Institute of Chartered Accountants of India.
- EC7: supervisor determines banks rotate external auditors (firm or individuals) from time to time.
  - Current RBI instructions prescribe rotation of audit firms every 3–4 years.
  - Auditors can be reappointed in same private and foreign bank after a two-year cooling-off period.
  - For reappointment in the same PSB, the cooling-off period is nine years.
- EC8: supervisor meets periodically with external audit firms to discuss common issues.
  - RBI meets at least once a year with the external auditor of a bank and holds annual conferences with bank auditors to discuss events and developments in banks and accounting and auditing.
- EC9: supervisor requires external auditor to report to supervisor matters of material significance; laws/regulations provide auditors who make such reports in good faith cannot be held liable for breach of confidentiality.
  - External auditor may draw attention of RBI to matters of material significance once financial statements have been issued; until that moment external auditor is not authorized to inform the supervisor per appointment letter from RBI to the auditor.
  - Companies Act, section 143 (13), states auditor will not be sanctioned for performing duties under law, including reporting cases of fraud, provided done in good faith.
- AC1: supervisor power to access external auditors’ working papers where necessary.
  - This power is not explicitly laid down in statute nor regulation.
- Assessment of Principle 27: Largely compliant.
  - Comments:
    - Accounting and auditing professions are of high quality; accounting standards applicable to banks are comprehensive.
    - Preparation of financial statements based on IFRS-convergent Indian Accounting Standards will start April 1, 2018, including IFRS 9 on expected losses.
    - AQR in 2015 showed firms incurred additional losses after stricter assessment of compliance with loan classification and provisioning regulations; “true and fair view” required by law appeared to need significant adjustments despite accounts being signed off by management and auditors.
    - RBI has conducted conversations with accounting and auditing professions.
    - Relationship between auditor and regulator needs provision for immediate reporting of material issues, not only after publication of statements.
    - Regulators need power to access auditors’ working papers when needed.
    - Laws/regulations should explicitly authorize external auditor to inform RBI of concerns before annual statements finalized and published.
    - RBI needs explicit authority to obtain information at any time from external auditor and access external working papers as needed.

### Disclosure and transparency (Principle 28 — start)
- Principle 28 overview: supervisor determines banks and banking groups regularly publish information on consolidated and, where appropriate, solo basis that is easily accessible and fairly reflects financial condition, performance, risk exposures, risk management strategies and corporate governance policies and processes.
- EC1 (opening): laws, regulations or supervisor require periodic public disclosures of information by banks on consolidated and, where appropriate, solo basis that adequately reflect the bank’s true financial condition and performance and adhere to standards promoting comparability, relevance, reliability and timeliness of information disclosed.
  - Description and findings re EC1 begin with: Building on the publication of the annual financial statements, mandated by

*Italic: IMF country report content provided in the source document.*

### Section 31 of the BR Act, the RBI has developed a set of disclosure requirements,

### cr1804 - Section 31 of the BR Act, the RBI has developed a set of disclosure requirements,

### Disclosure framework and legal basis
- Building on Section 31 of the BR Act, the RBI has developed a set of disclosure requirements to allow market participants to assess key information on capital adequacy, risk exposures, risk assessment processes and business parameters, to provide a comparable, consistent and understandable disclosure framework.
- Banks are required to comply with Accounting Standard 1 on Disclosure of Accounting Policies, issued by the ICAI.
- The enhanced disclosures are incorporated in the Balance Sheet and Profit & Loss Account of banks and in ‘Notes to Accounts’, per Master Circular on “Disclosure in Financial Statements—Notes to Accounts,” of July 1, 2015.
- In addition to the 16 detailed prescribed schedules to the balance sheet, Notes to Accounts broaden disclosure.

### Provisions (required disclosures)
- Provisions and contingencies—banks are required to disclose in the “Notes to Accounts” information on provisions and contingencies, including provisions for depreciation on investment, on NPAs, and general provisions on standard assets, provisions toward tax liabilities, and others.
- April 2017 Circular: requires a disclosure in the notes to the accounts every time the difference between bank’s audited provisions and RBI’s mandated provisions following a supervisory review is greater than 15 percent. This is supposed to have a disciplining effect and carries a high reputational risk for auditors.
- Additional prescribed items:
  - General provisions over total assets;
  - Draw-downs from reserves; and
  - Provision Coverage Ratio (PCR) - ratio of provisioning to gross NPAs.

### Risk concentration (required disclosures)
- Concentration of deposits: total deposits of 20 large depositors and percentage of the deposits to total deposits of the bank.
- Concentration of loans: total loans to 20 largest borrowers and percentage of the advance to total advances of the bank.
- Concentration of other exposures: total exposure to 20 largest borrowers/customers and percentage of the exposures to total exposure of the bank on borrowers/customers.
- Concentration of NPAs: Total exposure to top four NPA accounts.
- Sectoral NPAs: agriculture and related sectors, industry (micro, SME, and large), services, and consumer loans.
- NPA dynamics: additions, recoveries, reclassification, write-offs from gross NPAs, as well as the final position as on the date of the financial statement.
- Assets, NPAs, and revenue abroad: total assets, total NPAs, and total revenue.
- Sponsored off-balance sheet SPVs (consolidated).

### Additional disclosures (required or encouraged)
- Capital, broken down into Tier I/II capital, percentage of shareholdings by the government, amount of subordinated debt raised as Tier II capital.
- Asset quality with details on NPAs, restructurings, and assets sold to the securitization/reconstruction company for assets (AMC).
- Details of NPAs sold, and provisions on standard assets.
- Asset liability management giving the maturity pattern of certain items of assets and liabilities, such as deposits, advances, investments, borrowings, foreign current assets, and foreign currency liabilities.
- Sectoral breakdown, e.g., exposures to real estate sector, capital market.
- Country risk exposure.
- Cases of single borrower limit (SGL)/group borrower limit (GBL) exceeded by the bank.
- Unsecured advances.

### Publication, accessibility, and frequency
- The annual financial statements must be published in a newspaper in the area where the bank has its headquarters, as well as, in an abridged form, in additional newspapers and journals.
- Disclosure takes place on a quarterly basis.
- The RBI requires that customers can easily access the relevant information from the bank’s websites.
- Bank websites must mandatorily include information on grievance-redressal procedures.

### Supervisor requirements and enforcement (EC2–EC5, AC1 highlights)
- EC2: Required disclosures include both qualitative and quantitative information on a bank’s financial performance, financial position, risk management strategies and practices, risk exposures, aggregate exposures to related parties, transactions with related parties, accounting policies, and basic business, management, governance and remuneration. Scope and content are commensurate with risk profile and systemic importance.
  - At a minimum, the items listed in the RBI circular mentioned under EC1 should be disclosed in the ‘Notes to Accounts’.
  - Disclosure on 43 areas of key significance are required.
  - RBI disclosures supplement, and do not replace, other disclosure requirements under relevant legislation or accounting and financial reporting standards.
- EC3: Laws, regulations, or the supervisor require banks to disclose all material entities in the group structure.
  - Paragraph 4.6 of the Master Circular: a parent company should consolidate the financial statements of all subsidiaries—domestic as well as foreign—except those specifically permitted to be excluded under the accounting standards.
  - Reasons for not consolidating a subsidiary should be disclosed in the CFS. Consolidation perimeter is decided by management and the external auditor, based on accounting standards.
  - A bank may acquire more than 20 percent of voting power in the borrower entity as security for loans, so long as significant influence is not exercised.
- EC4: The RBI effectively reviews and enforces compliance with disclosure standards.
  - RBI issues instructions on display of service charges, interest rates, services offered, product information, time norms for banking transactions, and grievance-redressal mechanism.
  - Inspections/visits observed non-display by many banks; RBI reinforced instructions in a new circular.
  - RBI enforces disclosure rules typically through an adverse remark in the inspection report, discussed with the bank. Every quarter the RBI verifies whether required disclosures have been made.
- EC5: The RBI regularly publishes aggregate information on the banking system to facilitate public understanding and market discipline.
  - RBI website publications include: “Profile of Banks,” bi-weekly web publication “Scheduled Banks,” “Financial Stability Report” (published twice annually), yearly “Report on Trends and Progress on Banking in India,” RBI Annual Report (section on banking supervision), Weekly Statistical Supplements, Monthly Statistical Bulletins, and a Database on the Indian Economy with sectoral deployment of bank credit.
- AC1: Disclosure requirements promote information that helps understand a bank’s risk exposures during a reporting period, e.g., average exposures or turnover.
  - Bank-by-bank information is posted on the RBI’s website on a quarterly basis, based on banks’ periodic reports to the RBI.
  - Quarterly publication by banks of their financial statements and supplementary disclosures as required by the RBI enable adequate public information.

### Assessment summary
- Assessment of Principle 28: Compliant.
- Comments: Building on the publication of the annual financial statements mandated by Section 31 of the BR ACT, the RBI has developed a set of disclosure requirements, which allow market participants to assess key information on capital adequacy, risk exposures, risk assessment processes and business parameters, to provide a comparable, consistent, and understandable disclosure framework. The RBI website also offers a wide range of information and data on the banking system in India.

*Source: cr1804 - Section 31 of the BR Act, the RBI has developed a set of disclosure requirements,*

### Section 4 of the RBI Master Direction on KYC requires that REs shall frame a KYC

### cr1804 - Section 4 of the RBI Master Direction on KYC requires that REs shall frame a KYC

### KYC policy governance and board oversight (Section 4 and Section 8)
- REs shall frame a KYC policy duly approved by the Board of directors of the REs or any committee of the Board to which power has been delegated (See EC1).
- Section 8 (‘Compliance of KYC policy’) requires REs to ensure compliance through:
  - Specifying who constitute ‘senior management’ for KYC compliance;
  - Allocation of responsibility for effective implementation of policies and procedures;
  - Independent evaluation of the compliance functions of REs’ policies and procedures, including legal and regulatory requirements;
  - Concurrent/internal audit system to verify compliance with KYC/AML policies and procedures;
  - Submission of quarterly audit notes and compliance to the Audit Committee.

### Supervision, onsite examination, and thematic reviews (SPARC and DBS)
- RBI examiners ensure during onsite examination that banks comply with AML/KYC policies.
- Under the SPARC framework, examiners assess:
  - Framework for identification, investigation, monitoring, reporting and prevention of KYC/AML issues; and
  - Methodology for solving KYC/AML related issues and non-compliances by the bank.
- The DBS conducts thematic reviews on KYC-related matters. During the last three years, seven scrutinies were undertaken by the DBS across banks, mainly on KYC-related violations/irregularities. The follow-up actions were disclosed in the RBI press release.

### Beneficial ownership and customer types (deficiencies identified)
- The RBI Master Direction does not highlight in the Definitions section that banks are required to identify beneficial ownership when the customer is an individual.
- Banks have clear procedures for obtaining beneficial ownership information of corporate customers, but are less effective in identification of beneficial ownership where the customer is an individual carrying out transactions on behalf of another person.
- This gap is noted as a deficiency given common money-laundering use of front men to obscure beneficial owners. (EC3)

### Suspicious activity reporting, fraud reporting, and fraud monitoring (EC3)
- Suspicious transactions are reported only to the Financial Intelligence Unit-IND (FIU-IND).
- Banks are not required to report suspicious activities to the RBI, but RBI supervisors have access to suspicious transaction reports during onsite inspection.
- RBI Master Direction on “Frauds—Classification and reporting” dated July 01, 2016 provides framework for detecting and reporting frauds early and related actions (reporting to investigative agencies, examining staff accountability, fraud risk management).
- Banks report frauds to RBI as and when fraud is detected. On receipt, RBI examines aspects related to the fraud and advises banks to:
  - report the case to CBI/police/Serious Fraud Investigation Office;
  - examine staff accountability and complete proceedings against erring staff expeditiously;
  - take steps to recover the amount involved in the fraud and claim insurance where applicable;
  - streamline system procedures to prevent recurrence.
- Banks must update subsequent developments through quarterly returns.
- Banks submit Fraud Monitoring Returns (FMR) and data based on the Frauds Reporting and Monitoring System (FRMS).
- Frauds amounting to more than Rs 1 lakh are to be reported on a case-by-case basis in accordance with para. 3 of the Master Circular. Frauds of less than Rs 1 lakh are to be reported to the RBI in consolidated form by category.
- A Central Fraud Registry (CFR) was made operational in January 2016 as a searchable online central database for use by banks for frauds above Rs 1 lakh.
- The Master Direction on Frauds that requires banks to report frauds is not sufficiently broad to meet EC3, which requires reporting of suspicious activities and incidents of fraud when material to safety, soundness, or reputation of banks.

### Information sharing and cooperation with FIU-IND (EC4)
- The RBI informs FIU-IND about gross violations of AML/CFT instructions by banks.
- An MOU between FIU-IND and RBI signed in August 2012 sets out cooperation including:
  - laying down procedure and manner of reporting to FIU-IND under the PML Rules;
  - conducting outreach and training for reporting entities;
  - upgradation of skill levels in the banking industry;
  - assessment of AML/CFT risks and vulnerabilities in the financial sector;
  - identification of red flag indicators for STRs;
  - monitoring compliance of reporting entities with PMLA obligations;
  - compliance with relevant international standards.
- FIU-IND and RBI hold quarterly meetings to discuss mutual issues, trends in reporting, and cases where sanctions have been imposed.
- RBI shares gist/extracts of inspection reports with FIU-IND where gross violations of KYC/PMLA were noticed.

### Customer due diligence (CDD) program and requirements (EC5)
- The RBI Master Direction on KYC covers: Customer Acceptance Policy, Risk Management, CDD Procedure, Identification of Beneficial Owner, Ongoing Due Diligence, Enhanced and Simplified Due Diligence Procedure, Record Management, Reporting Requirements to FIU-IND, Requirements/obligations under International Agreements, Communications from International Agencies and Other Instructions.
- Essential elements of the CDD management program include:
  - (a) Customer Acceptance Policy: Section 9 requires REs to frame a Customer Acceptance Policy; Section 10 prohibits opening accounts in anonymous/fictitious names or where appropriate CDD cannot be applied.
  - (b) Customer Identification Procedure (CIP) and ongoing due diligence: Chapter V and Part V of Chapter VI require ongoing due diligence, aligning extent of monitoring with customer risk category; periodic review of risk categorization at least once in six months; Section 38 mandates Periodic Updation.
  - (c) Monitoring and recognition of unusual/suspicious transactions: Section 36 mandates monitoring of large and complex transactions, transactions exceeding thresholds for account categories, high account turnover inconsistent with balances, deposit of third party cheques followed by large cash withdrawals. Rule 7 of PML Rules, 2005 requires REs to furnish information to FIU-IND per Rule 3. Section 50 requires robust software that throws alerts when transactions are inconsistent with risk categorization.
  - (d) Enhanced due diligence on high-risk accounts: extent of monitoring aligned to risk category; periodic review at least once in six months; Sections 40–42 detail enhanced due diligence for non-face-to-face customers, PEPs, and client accounts opened by professional intermediaries.
  - (e) Accounts of Politically Exposed Persons (PEPs): Section 41 allows REs to establish relationships with PEPs provided sufficient information (including sources of funds, accounts of family members and close relatives) is gathered, identity verified before acceptance, decision to open account taken at senior level, all such accounts subjected to enhanced ongoing monitoring, and senior management approval required if an existing customer becomes a PEP. CDD measures for PEPs apply where a PEP is a beneficial owner.
  - (f) Record Management: Section 46 requires:
    - maintain transaction records (domestic and international) for at least five years from date of transaction;
    - preserve identification records and addresses for at least five years after business relationship ends;
    - make identification records and transaction data available to competent authorities on request;
    - maintain records prescribed under PML Rule 3 to permit reconstruction of individual transactions (nature, amount and currency, date, parties);
    - evolve systems to retrieve data easily and maintain records in hard or soft format.
- Objective: prevent banks being used for money laundering or terrorist financing and to enable banks to know customers and manage risks prudently.
- Reviews by SSMs under SPARC assess compliance with these guidelines.
- Gaps identified:
  - RBI requirements relating to foreign PEPs do not specifically require banks to have appropriate risk-management systems to determine whether the customer or beneficial owner is a PEP, or to examine the customer’s source of wealth (in addition to source of funds), and do not cover associates.
  - No specific provision requiring enhanced CDD measures for domestic PEPs; domestic PEPs are not specifically referred to in the RBI Master Direction on KYC.

### Correspondent banking (EC6)
- Section 64 requires banks to have a policy approved by their Boards or a committee headed by the chairman/CEO/MD to lay down parameters for approving correspondent banking relationships, including:
  - gather sufficient information on respondent bank’s business, management, AML/CFT compliance, purpose of account, third-party users, and regulatory/supervisory framework in respondent bank’s home country;
  - post facto Board approval at its next meeting for committee-approved proposals;
  - clearly document responsibilities of each bank in the correspondent relationship;
  - for payable-through-accounts, correspondent bank must be satisfied respondent bank has verified identity of customers with direct access and undertakes ongoing due diligence on them;
  - correspondent bank must ensure respondent bank can provide relevant customer identification data immediately on request;
  - correspondent relationship shall not be entered into with a shell bank;
  - ensure correspondent banks do not permit their accounts to be used by shell banks;
  - be cautious with correspondent banks in jurisdictions with strategic deficiencies or insufficient FATF implementation;
  - ensure respondent banks have KYC/AML policies and apply enhanced due diligence for transactions through correspondent accounts.
- RBI verifies adherence during onsite examinations.
- Gap: no explicit requirement that banks must not establish or discontinue correspondent relationships with banks that do not have adequate controls against criminal activities or are not effectively supervised by relevant authorities.

### Controls, internal audit, compliance function, and staffing (EC7, EC9, EC10)
- Section 8 requires:
  - independent evaluation of compliance functions including legal and regulatory requirements;
  - submission of quarterly audit notes and compliance to the Audit Committee.
- Internal/concurrent audit must verify KYC/AML compliance at branches; Audit Committee must be informed quarterly; audit reports must be made available to RBI on request or during inspections.
- REs should ensure internal audit is staffed adequately with individuals well versed in policies and procedures.
- Appointment of Principal Officer (PO) from senior management as contact point for AML issues; PO responsible for monitoring and reporting transactions, liaison with enforcement agencies and timely submission of CTR, STR, counterfeit notes reports, and reporting of nonprofit receipts over Rs 10 lakh to FIU-IND.
- Section 71 requires banks to implement adequate screening mechanisms in recruitment and ongoing employee training with differentiated focus for frontline, compliance, and new customer staff.
- RBI conducts onsite examinations under SPARC, assesses compliance with KYC/AML and factors observations into RAR; supervisory actions initiated where necessary.
- The RBI conducts onsite examinations under SPARC to assess roles and responsibilities of Independent Vigilance Unit, procedure for staff-related fraud referrals to vigilance, and mechanisms for detection, prevention and reporting of staff-related frauds.
- Reporting of financial fraud is well established; however, it is unclear whether RBI requires banks to report any problems related to abuse of banks’ financial services beyond fraud reporting (AML/CFT encompasses wider predicate crimes).

### Legal powers and penalties (EC8)
- KYC guidelines issued by RBI under Section 35A of the BR Act; contraventions attract penalties under Section 46 of the BR Act.
- Over the last two years, KYC related penalties of 3,250 Lakhs were imposed by RBI on 17 banks in India.

### Records, retention, and access for authorities
- Records and transaction data must be maintained in accordance with Section 46 and PML Rules, 2005:
  - at least five years retention from date of transaction for transaction records;
  - identification records preserved for at least five years after business relationship ends;
  - make identification records and transaction data available to competent authorities upon request;
  - maintain data enabling reconstruction of individual transactions (nature, amount and currency, date, parties).

*Source: https://www.imf.org/-/media/files/publications/cr/2018/cr1804.pdf*

### Section 14 of the PMLA 2002 states that banking companies or their officials would

### cr1804 - Section 14 of the PMLA 2002 states that banking companies or their officials would

### Legal protections and designated agencies
- Section 14 of the PMLA 2002: banking companies or their officials would not be liable to any civil or criminal proceedings against them for furnishing any information to the appropriate authority under the Act.
- GOI resolution dated April 21, 2004: authorized the Central Vigilance Commission (CVC) as the ‘Designated Agency’ to receive written complaints or disclosure on any allegation of corruption or of misuse of office and recommend appropriate action.
  - CVC jurisdiction restricted to employees of the central government or of any corporation established by it or under any Central Act, government companies, societies or local authorities owned or controlled by the central government. Staff in the PSB is protected in this regard.
- Protected Disclosures Scheme for Private Sector and Foreign Banks (April 2007): private sector bank staff is also not liable to discretionary proceedings under that scheme.

### Supervisory cooperation and information sharing (EC12, EC13)
- EC12: Supervisor cooperates with relevant domestic and foreign financial sector supervisory authorities or shares information related to suspected or actual criminal activities where this information is for supervisory purposes.
  - The RBI has signed an MoU with the FIU-IND for sharing information (see EC 4).
  - Cooperation for sharing information on suspected or actual criminal activities for supervisory purposes with other domestic supervisory authorities can be accommodated in the IRF/FSDC framework.
- Section 56 (1b) of the PMLA 2002: GOI may enter into an agreement with the government of a foreign country for exchange of information for prevention of any offence under the Act or under the corresponding law in force in that country or investigation of a case relating to any offence under the above Act.
  - RBI supervisory department has entered into MoUs with supervisors of 40 countries for sharing supervisory information.
  - Secrecy provisions in the BR Act do not apply where Section 71 of the PMLA has an overriding effect in case of inconsistencies with other law in force at that point in time.
- EC13: Supervisor has in-house resources with specialist expertise for addressing criminal activities and regularly provides information on risks of money laundering and the financing of terrorism to banks.
  - The main function of the FIU-IND: receive cash/suspicious transaction reports, analyze them and disseminate relevant financial information to intelligence/enforcement agencies and regulatory authorities.
  - RBI issued Master Direction on “Frauds—Classification and reporting” containing all details/aspects relating to frauds to facilitate faster dissemination of information by the RBI to banks (see EC3).
  - RBI issues caution advice—general in nature—as necessary for preventing and controlling frauds having systemic impacts.

### Assessment of AML/CFT and supervisory shortfalls (Principle 29 and related findings)
- Assessment of Principle 29: Largely Compliant.
- Key shortcomings identified by assessors:
  - The RBI Master Direction does not highlight in the Definitions section that banks are required to identify beneficial ownership where the customer is an individual. This is a deficiency because money laundering often uses front men to obscure beneficial owners.
  - The RBI’s requirements relating to foreign PEPs are not fully in line with international standards:
    - Do not specifically require banks to have appropriate risk-management systems to determine whether the customer or the beneficial owner is a PEP.
    - Do not require examination of the customer’s source of wealth (in addition to the source of funds).
    - Coverage does not apply to associates.
    - No specific requirement imposed on banks regarding treatment of customers who are domestic PEPs165 or persons entrusted with prominent functions by an international organization.
    - In line with FATF Recommendation 12, banks should be required to: take reasonable measures to determine whether a customer or beneficial owner is a domestic PEP or a person entrusted with a prominent function by an international organization; and, where there is a higher risk business relationship, to take enhanced due diligence measures (i.e., obtain senior management approval before establishing or continuing the business relationship; take reasonable measures to establish the source of wealth and source of funds; and conduct enhanced monitoring of that relationship).
  - Master Direction on Frauds is focused on financial fraud reporting but:
    - Financial fraud is only one type of predicate crime among AML/CFT concerns.
    - The Master Direction is not sufficiently broad to meet EC3 which requires reporting of suspicious activities and incidents of fraud when such activities/incidents are material to the safety, soundness or reputation of the banks.
    - It is unclear if the RBI formally requires banks under its regulations to report all problems related to the abuse of the bank’s financial services (EC10).
    - Recommendation: RBI should broaden its response to address money laundering reporting issues, not just fraud.
  - No explicit requirement for banks to avoid establishing correspondent relationships or discontinue existing ones with banks that do not have adequate controls against criminal activities and are not effectively supervised by relevant authorities.
    - RBI KYC master direction stipulates that correspondent relationships shall not be entered into with a shell bank166, but this is not comprehensive enough to capture the broad requirement of the relevant Core Principle (e.g., non-shell banks could still lack adequate controls).

### Summary compliance excerpts from Basel Core Principles (selected Principles 1–14)
- Core Principle 1. Responsibilities, objectives and powers — LC
  - No material gaps in coverage of the Indian system of bank supervision and regulation; legal framework gives RBI powers to authorize banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions.
  - Laws and regulations updated frequently; new arrangements for group regulation and supervision; formal relationships with overseas supervisors including colleges for six largest internationally active banks.
  - Note: legislation does not define safety and soundness clearly and unambiguously as RBI’s first priority for supervision.
- Core Principle 2. Independence, accountability, resourcing and legal protection for supervisors — MNC
  - RBI has budgetary autonomy and adequate resources; transparent about its core purpose; gives public account of activities; operational independence in most respects; legal protection for RBI and its officers.
  - However: RBI does not have full discretion to take supervisory actions over PSBs; central government powers in RBI Act can supersede RBI decisions; RBI governor appointed for a maximum term and may be dismissed at will by the government without disclosed reasons.
- Core Principle 3. Cooperation and collaboration — C
  - Framework for cooperation comprehensive and effective, but recommendation to include more explicit provisions in applicable bills, acts, and regulations to support mutual recovery and resolution actions and related authorities.
- Core Principle 4. Permissible activities — C
  - Permissible activities for banks are defined; use of the word “bank” controlled; deposit taking largely confined to banks; central government can impose nonbanking activities.
- Core Principle 5. Licensing criteria — LC
  - RBI is licensing authority; guidance and processes adequate; potential concern about ultimate beneficial ownership—difficulty in establishing it should be grounds for rejecting a license.
- Core Principle 6. Transfer of significant ownership — C
  - RBI generally has power to review transfers of significant ownership; approval required for private sector banks; can, in principle, block transfer for a PSB if judged unsafe.
- Core Principle 7. Major acquisitions — C
  - RBI can approve or reject major acquisitions; can impose prudential conditions; supervises banking groups and cross-border operations.
- Core Principle 8. Supervisory approach — LC
  - Shift toward risk-based approach; RBS framework (SPARC) mixes onsite and offsite tools but early in implementation; SSMs for specific banks increase understanding; enforcement link between SPARC assessments and supervisory actions is weak; resolution powers and tools limited; no assessment of resolvability or recovery/resolution plans.
- Core Principle 9. Supervisory techniques and tools — LC
  - Comprehensive range of tools; importance of CRILC database; no detailed formal guidelines defining penal actions if RAR action points not addressed; bottom-up stress testing under development.
- Core Principle 10. Supervisory reporting — LC
  - RBI can require submission of supervisory information; validation and verification processes; penalties for erroneous submissions.
  - Most prudential returns are submitted on a solo basis rather than consolidated; no explicit guidelines/criteria for hiring third parties who conduct supervisory tasks or obliging them to report material shortcomings promptly.
- Core Principle 11. Corrective and sanctioning powers of supervisors — LC
  - Adequate range of supervisory tools; ability to revoke banking license or recommend revocation; processes to detect issues and escalate; can take corrective actions against private bank management and Board.
  - Under current PCA regime some stringent actions under PCA are for action by the “government/RBI”; decisions to revoke banking license are subject to government appeal.
- Core Principle 12. Consolidated supervision — C
  - RBI can supervise every part of Indian banking groups and financial conglomerates; monitor intra-group exposures; use MoUs and supervisory colleges for foreign operations; some prudential standards monitored on a consolidated basis.
- Core Principle 13. Home-host relationships — C
  - Framework functioning adequately; active cross-border supervision; many MoUs concluded and negotiations ongoing; cross-border inspections conducted.
- Core Principle 14. Corporate governance — MNC
  - Rules on fitness and propriety and internal governance in place for private and foreign banks.
  - Influence RBI may exercise and limited legal authority to hold PSB Boards accountable lead to a low overall rating.
  - Under law and custom, RBI not in position to hold PSB Boards accountable for assessing/replacing weak senior management and government-appointed Board members.
  - Government’s role in appointing senior management and board members creates potential interference.
  - Presence of RBI and MOF officials on PSB Boards complicates supervisor’s ability to assess and take action against board members.
  - PSB Board has limited role in selection of senior management; MoF involved in selecting CEO, chairman and full time executive directors, subject to RBI approval for fit-and-proper standard.

*cr1804 - Section 14 of the PMLA 2002 states that banking companies or their officials would*

### 15. Risk management

### 15. Risk management

### Observations on RBI practices
- The RBI does:
  - determine that banks have Board-approved appropriate risk management strategies;
  - require comprehensive risk policies and frameworks to be comprehensive;
  - require the risk management framework be well documented, internally communicated and evolves appropriately;
  - ensure the Boards and senior management obtain the information they need to assess capital adequacy;
  - examine the level of capital and liquidity and the processes banks use to ensure adequacy;
  - ensure models used for risk measurement are appropriate for use, validated and developed and used under strong governance;
  - ensure that the risk-management function has the resources, independence, Board access, and authority it needs;
  - require prior Board approval for dismissing a CRO;
  - issue guidance on each major risk type;
  - require banks to have contingency plans;
  - require banks to stress test; and
  - assess how banks account for risks in internal pricing, performance measurement and new product approval.

- Supervisory engagement:
  - RBI supervisors regularly assess Board documents and meet with selected members of Boards, including the heads of the risk and audit committees.
  - Supervisors do not as a rule meet with the Board as a whole, or with the non-executive directors individually.
  - Such meetings are useful to confirm that Boards and senior management understand the risks associated with any material change to the business.

### Identified gaps and limitations
- MIS and recovery/resolution:
  - The RBI does not impose specific requirements for robust risk management MIS, as opposed to implicit requirements derived from requirements for such measurement, aggregation and reporting of different risk types in normal times.
  - The RBI does not have a specific requirement in its principle guidance on risk for recovery or resolution plans.

- Board interaction:
  - Lack of routine meetings with Boards as a whole or with non-executive directors individually limits confirmation that Boards understand material business risks.

### Relevant cross-references from adjacent sections (contextual findings)
- Credit risk (CP17):
  - All banks need to follow guidelines and meet targets on priority sector lending, which compromises banks’ independent, risk-based credit allocation policies and strategies and may lead to risk accumulation.

- Problem assets, provisions, and reserves (CP18):
  - Current systems and processes to monitor asset classification and provisioning could be considered broadly adequate.
  - The 2015 AQR and the 2015 Master Circular on loan classification and provisioning revealed significant under-recognition of NPAs and under-provisioning, leading to a need for capital reinforcement in many banks.
  - Current coverage with provisions improved slightly but seems on the low side given persisting high vulnerabilities in the corporate sector.
  - Weaknesses include recognition of several special situation advances that extend repayment beyond contractual dates, complexity of multiple treatment cases, and lack of systematic reporting on magnitudes of these special cases.
  - The introduction of IFRS9 provides an opportunity to strengthen loan classification and provisioning rules; RBI needs to systematically review credit risk parameters (i.e., loss rates, recovery rates, etc.) across the banking system to ensure that the parameters of the asset classification and provisioning regulations (i.e., provisioning rates and categories of impairment) remain realistic.

### Recommended actions (from Table 3)
- Consider specific and separate requirements for robust risk management MIS.
- Institute the practice of supervisors meeting regularly with Board members, especially non-executive directors.

*Source: cr1804 - 15. Risk management*

### 19. Concentration risk

### 19. Concentration risk

### Key supervisory recommendations
- Expedite the introduction of the new large exposure rules, monitor banks’ practice more closely and take supervisory action (as needed), and reduce/remove as much as possible the current exceptions to the basic limits.
- Include in the regulation the explicit requirement for Board approval prior to related-party exposure (beyond a specified level) write-offs.

### Transactions with related parties
- Review the regulation to clarify that an appropriate exposure limit is placed to major individual shareholders and families.
- Consider issuing a consolidated document to compile the regulations on RPT.

### Country and transfer risks
- Consider strengthening group-wide country risk management framework by collecting such data on a consolidated basis.

### Liquidity risk
- Review and enhance the regulation on liquidity risk management to be more aligned to Basel standards (e.g., Indian State Government Securities are not considered as sovereign debt securities in the context of the Basel standards).

### Operational risk
- Expand formal reporting protocol for the bank to keep RBI appraised of development of affecting operational risk (e.g., incident reports other than fraud).
- Strengthen supervision in collecting/accumulating good-quality loss data.

### Financial reporting and external audit
- The laws and/or regulations should explicitly authorize the external auditor to inform the RBI of any concerns at any time, also before the annual statements have been finalized and published.
- Amend legislation to ensure that the RBI has the explicit authority to obtain information at any time from the external auditor and access the external auditor's working papers, as needed.

### Abuse of financial services / AML/CFT
- Amend the laws/or regulation on domestic PEPs to address limited applicability of EDD for them. There is no specific provision with regard to domestic PEPs (and PEPs of international organizations). The RBI’s requirements relating to foreign PEPs also need to be enhanced to be fully in line with the international standards.
- Include in the KYC Master Direction explicitly that banks are required to identify beneficial ownership where the customer is an individual, since this constitutes a deficiency given that money laundering activities often involve the engagement of front men to obscure the identity of beneficial owners.
- Broaden its reporting requirements to address money laundering issues, not just fraud. Fraud is only one type of money generating criminal activity.

### Reference notes cited
- For instance, “Prudential treatment of problem assets, definitions of nonperforming exposures and forbearance,” BCBS, April 2017.

### Authorities’ response to the assessment (summary of paragraphs 67–71)
- The Indian authorities express gratitude to the joint IMF-World Bank FSAP mission team led by Marina Moretti (Mission Chief) and Aurora Ferrari (Team Leader) for the conduct of the FSAP in 2017 and see the FSAP as an opportunity for improvement.
- India is a bank-dominated economy and the authorities will give special importance to the Detailed Assessment Report (DAR) of the Basel Core Principles (BCP). The Basel Committee on Banking Supervision (BCBS) published the revised BCP in September 2012 after the completion of the India FSAP mission in 2011; the authorities remain committed to compliance with BCP 2012.
- Several banks in India, especially the Public Sector Banks (PSBs), are facing asset quality problems reflected in their stressed assets. The Reserve Bank of India, in close coordination with the Government of India, are according high priority to addressing this problem.
- India is moving towards a new state-of-the-art bankruptcy regime. Making use of the recently enacted Insolvency and Bankruptcy Code, 2016 (IBC), the Reserve Bank of India has identified several accounts that are non-performing and asked banks to follow-up with the National Company Law Tribunal (NCLT) for resolution/insolvency in accordance with the time-bound process laid down in the Code. The move is expected to make a significant dent to quantum of NPAs starting next year.
- Banks have been asked to disclose any material divergence (above a threshold of 15 percent) in their own and supervisory assessments on the NPAs and in additional provisioning requirements (as ratio of net profits after tax).
- The Reserve Bank of India had earlier conducted an Asset Quality Review of the banks and has since internalized the process strengthening the regular inspections buffeted by continuous monitoring of NPAs and their recognition helped by the Central Repository of Information on Large Credits (CRILC).
- RBI had withdrawn regulatory forbearance since April 2015 and now requires bank to make same provisioning on restructured standard assets as for the NPAs.
- The authorities state that these moves have helped usher in an era of transparency and improved discipline and will go a long way in resolving the problem of bad loans in India. The Government of India has sought, through its Indradhanush plan, to revitalize PSBs through capital infusion and improved governance.
- On specific aspects:
  - Regarding risk accumulation stemming from the mandatory Priority Sector Lending (PSL) allocations (CP17), the authorities submit that the scope for penetration of bank led financial services to the segments classified under PSL is immense, offers scope for innovative lending strategies to diversified pools of borrowers which may reduce risk accumulation, and that experience has been that the asset quality of PSL assets is better than some non-PSL asset categories.
  - On inclusion of the State Development Loans (SDLs) in HQLA (CP24), the authorities clarify SDLs are issued as state government bonds and have slotted SDLs under HQLA 1 as they meet the necessary qualitative characteristics of HQLA. They argue SDLs have qualities superior to HQLA-2B assets and suggest consideration of which HQLA category SDLs should be slotted into, proposing at minimum HQLA-2A if not HQLA-1.
  - As regards broadening RBI reporting requirements to address money-laundering issues (CP29), authorities note RBI regulations require suspicious transaction reports to be filed with the FIU-IND, and that banks put in place a robust AML detection and reporting framework. The Indian authorities are further looking into the requirements with a view to further strengthen its implementation.

*Source: cr1804 - 19. Concentration risk (IMF country report content).*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2018/cr1804.pdf_