RBI issues revised guidance note to extend operational risk norms to NBFCs, co-op banks

The Reserve Bank of India (RBI) on Tuesday updated its 'guidance note' on operational risk management for the financial sector. It extended the guidance note to the regulated entities, which included non-banking finance companies and primary urban cooperative banks, as well as central cooperative banks. Earlier, the guidance issued in 2005 was aimed only at commercial banks. It was repealed later. 

The RBI said: "Basel Committee on Banking Supervision (BCBS) felt that further work was necessary to strengthen banks’ ability to withstand operational risk-related events such as pandemics, cyber incidents, technology failures, and natural disasters, which could cause significant operational failures or widespread disruptions in financial markets.”

Under the new guidelines, the RBI charted three lines of defence model wherein business units form the first line of defence, organisational operational risk management function (including compliance function) forms the second line of defence, and the last is the audit function.

The note said that an operational disruption can threaten the viability of a regulated entity (RE), impact its customers and other market participants, and ultimately have an impact on financial stability.

“It can result from man-made causes, Information Technology (IT) threats (e.g., cyber-attacks, changes in technology, technology failures, etc.), geopolitical conflicts, business disruptions, internal/external frauds, execution/delivery errors, third-party dependencies, or natural causes,” the RBI said. 

The RBI said the guidance note intends to promote and further improve the effectiveness of operational risk management of the REs, and enhance their operational resilience given the interconnections and interdependencies, within the financial system, that result from the complex and dynamic environment in which the REs operate.

Until recently, the predominant operational risks that REs faced emanated from vulnerabilities related to increasing dependence and rapid adoption of technology for provision of financial services and intermediation. However, the financial sector's growing reliance on third-party providers exacerbated by the Covid-19 pandemic with greater reliance on virtual working arrangements, has highlighted the increasing importance of operational risk management and operational resilience.