A bank is a business that takes risks for a living. It borrows short from depositors and lends long to firms and households, it holds bonds whose prices move every day, and it runs computers, branches and payment systems that can fail. Profit comes from taking these risks deliberately and at a fair price. Losses come from taking them by accident. Risk management is the set of people, rules and numbers that keeps the first from turning into the second. This final part of the series explains the main types of risk a bank faces, who is responsible for controlling them, and the tools used to measure them, with worked examples of expected loss, Value-at-Risk, duration and gap analysis. It then covers the newer risks (models, climate and cyber), how the RBI supervises all of this, and ends with a map of Parts 21 to 40.
In the news
- 23 Oct 2026: Operational risk capital rules finalised. The RBI issued the Commercial Banks (Forthcoming Instructions) Second Amendment Directions, 2026, setting the implementation date for the Basel III Standardised Approach to operational risk and mapping its "business indicator" to banks' financial statements. Why it matters for the exam: operational risk capital moves from a simple share of gross income to a new formula, along with the rest of the revised Basel III package from 1 April 2027.
- 21 Sep 2026: New market risk capital rules. The RBI issued the Commercial Banks (Minimum Capital Requirements for Market Risk) Directions, 2026, aligning market risk capital with revised Basel III from 1 April 2027. The draft of February 2023 had proposed a Simplified Standardised Approach, and transition scalars have applied since 1 April 2024. Why it matters for the exam: Indian banks compute market risk capital with standardised formulas, not their own VaR models.
- 31 Jul 2026: Compliance, audit and cyber directions. The RBI issued separate directions for commercial banks on the compliance function, the internal audit function (risk-based internal audit) and cyber security and technology risk, all effective on issue. The cyber directions require the Chief Information Security Officer to report to the executive in charge of risk management, not the head of IT. Why it matters for the exam: these are now the rulebooks for the second and third lines of defence.
- 30 Jun 2026: Banks pass the stress test. The June 2026 Financial Stability Report put banks' GNPA ratio at 1.8% and CRAR at 17.7% in March 2026. Under two adverse scenarios, GNPA of 46 major banks rose to about 3.8% and 4.1% by March 2028, but aggregate capital stayed above the minimum. Why it matters for the exam: macro stress tests are the system-wide version of the stress testing every bank must do.
- 24 Jun 2026: Draft guidance on model risk. The RBI released draft "Guidance on Regulatory Principles for Model Risk Management", covering all models used by banks, NBFCs and other regulated entities, including AI/ML and third-party models. Comments closed on 24 July 2026. Why it matters for the exam: model risk is now treated as a risk type of its own.
- 10 Jun 2026: Draft to harmonise control functions. The RBI proposed amendment directions to bring the rules on risk management, compliance and internal audit together across banks, NBFCs and other entities, with a proposed start of 1 January 2027. CROs, CCOs and heads of internal audit would get a fixed tenure of at least three years and report functionally to the Board. Why it matters for the exam: it codifies the independence of the three control functions.
- 27 Apr 2026: ECL and new credit risk rules. Final directions moved commercial banks to expected credit loss provisioning and a revised standardised approach for credit risk, both from 1 April 2027. Why it matters for the exam: ECL turns PD, LGD and EAD from risk-department jargon into accounting numbers.
- Jan 2026: Climate disclosures put on hold. Reuters reported that the RBI had paused its plan to make banks disclose climate-related financial risks, although the final guidelines were said to be ready. The draft framework dates from 28 February 2024. Why it matters for the exam: climate risk rules in India are still at the draft stage for disclosure.
What a bank means by "risk"
Risk is the chance that actual results differ from expected results, usually for the worse. Banks distinguish two kinds of loss:
- Expected loss (EL): the average loss a bank expects over a year, for example from a portfolio of loans. It is a cost of doing business and is covered by pricing and provisions.
- Unexpected loss (UL): losses above the average in a bad year. These are covered by capital. This is why Basel capital rules (Part 27) are about unexpected loss, while the new ECL provisioning rules are about expected loss.
A bank does not try to avoid risk. It sets a risk appetite: the amount and type of risk the Board is willing to accept to meet its business goals. The appetite is turned into limits (on exposures, sectors, maturity gaps, trading positions) that managers must stay within.
The main types of risk
| Risk | What it means | Main Indian rules or tools |
|---|---|---|
| Credit risk | A borrower or counterparty fails to pay | Credit rating, PD/LGD/EAD, provisioning, Basel credit RWAs |
| Market risk | Prices of bonds, equities, currencies or commodities move against the bank's trading positions | Duration, VaR, position limits, market risk capital |
| Liquidity risk | The bank cannot meet outflows without large losses | LCR, NSFR, structural liquidity statement |
| Interest rate risk in the banking book (IRRBB) | Changes in rates hit net interest income or the economic value of equity | Repricing gaps, ΔNII and ΔEVE, outlier test |
| Operational risk | Losses from failed processes, people, systems or external events, including legal risk | Three lines of defence, loss data, op-risk capital |
| Concentration risk | Too much exposure to one borrower, group or sector | Large Exposures Framework, sector limits |
| Compliance risk | Penalties or losses from breaking laws, rules or codes | Compliance function under a CCO |
| Reputational risk | Loss of trust from customers, investors or regulators | Governance, conduct rules, disclosure |
| Cyber and technology risk | Attacks, data breaches or IT failures | Cyber directions (July 2026), CISO, incident reporting |
| Climate risk | Physical damage (floods, heat) and transition losses (carbon-heavy borrowers) | Climate finance directions (2025), draft disclosure framework |
Two points help in exam answers. First, the categories overlap: a cyber attack is an operational risk that can quickly become a liquidity and reputational problem, as the bank runs abroad in 2023 showed (Part 29). Second, credit risk is by far the largest for Indian banks, because loans are the largest part of their balance sheets (Part 24).
Concentration risk has a hard limit. Under the Large Exposures Framework, a bank's exposure to a single counterparty cannot exceed 20% of Tier 1 capital (25% with Board approval in exceptional cases), and to a group of connected counterparties 25% (see Part 15).
Governance: who owns risk
The Board and its committees
The Board sets the risk appetite and is ultimately responsible for risk. It works through committees, of which two matter most here:
- the Risk Management Committee of the Board (RMCB), which oversees the risk framework and to which the Chief Risk Officer has direct access; and
- the Audit Committee of the Board (ACB), which oversees internal audit and, often, compliance.
The RBI's June 2026 draft for payments banks spells out the kind of rules expected for the RMCB: a majority of non-executive directors, an independent director in the chair, and meetings at least once a quarter with a quorum of three.
The three lines of defence
The standard way to organise control is the three lines of defence. The RBI's Guidance Note on Operational Risk Management and Operational Resilience (30 April 2024), which applies to banks, co-operative banks, AIFIs and NBFCs, describes them this way:
- First line: business units. The branches, credit, treasury and operations staff who take risks own them. They must identify, manage and report the risks in their own activities.
- Second line: independent risk management and compliance. A functionally independent risk function (headed by the CRO) sets policies, measures risk and challenges the first line. The compliance function (headed by the CCO) checks adherence to laws and rules.
- Third line: internal audit. It provides independent assurance to the Board that the first two lines work. Auditors must not run the processes they review.
Outside the bank sit the statutory auditors and the RBI's supervisors, sometimes called a "fourth line".
The same 2024 note has 17 principles under three pillars: Prepare and Protect, Build Resilience, and Learn and Adapt. It replaced the 2005 note, which covered only scheduled commercial banks.
The Chief Risk Officer
The RBI first laid down rules for bank CROs in a circular of 27 April 2017 (DBR.BP.BC.No.65/21.04.103/2016-17). Note the year: it is sometimes wrongly dated 2021. The core rules, carried into the consolidated directions and the June 2026 draft, are:
- The CRO is a senior official, not more than two levels below the MD & CEO, appointed with Board approval.
- Fixed tenure of not less than three years. Premature transfer or removal needs Board approval.
- No business targets. The CRO's pay must not depend on business performance, and the CRO cannot hold a business role.
- Reporting: functionally to the Board or RMCB, administratively to the MD & CEO. The June 2026 draft adds that control heads should meet the Board or committee at least once a quarter without senior management present.
- Voice, not veto. The CRO attends credit sanction committees as an invitee without a vote. If a decision is taken against the CRO's advice without enough mitigation, the June 2026 draft sends it to the next higher authority and requires the Board or RMCB to be told.
- Any change in the CRO must be reported to the RBI's Department of Supervision within five working days.
The Chief Compliance Officer
The RBI's circular of 11 September 2020 on compliance functions in banks was the turning point. It set a minimum three-year tenure for the CCO, removal only in exceptional cases with Board approval, a selection committee of the Board, and a ban on business roles. Those rules are now in the Commercial Banks (Compliance Function) Directions, 2026, issued on 31 July 2026:
- The CCO is selected through a Board-constituted committee, must be no more than 55 years old at appointment and needs at least 15 years of experience, including five in audit, finance, compliance, legal or risk.
- A minimum fixed tenure of three years, with removal only in exceptional cases and with prior Board approval.
- No "dual hatting": the CCO cannot take on roles that create conflicts of interest, especially business roles.
- The bank must tell the RBI before appointing, transferring or removing the CCO.
- The Board reviews the compliance policy at least once a year, and the Board or Audit Committee reviews the compliance function every quarter. Compliance risk is assessed at least annually.
The companion Internal Audit Function Directions, 2026 of the same date require risk-based internal audit (RBIA): audit effort is planned by risk, with high-risk areas audited more often, and the internal audit function cannot be fully outsourced.
Capital planning and stress testing
ICAAP
Basel capital rules work on three pillars (see Part 27). Pillar 1 sets minimum capital for credit, market and operational risk. Pillar 2 asks each bank to assess all its risks, including those Pillar 1 ignores, through an Internal Capital Adequacy Assessment Process (ICAAP). The RBI reviews it through the Supervisory Review and Evaluation Process (SREP) and can ask for more capital. Pillar 3 is market discipline through disclosure.
An ICAAP covers risks such as concentration, IRRBB, liquidity, reputational and strategic risk, and asks whether the bank's capital is enough for its plans over the next few years, under both normal and stressed conditions. It is Board-approved.
Stress testing
A stress test asks "what if?" Banks run three kinds:
- Sensitivity tests: one factor moves, for example interest rates rise by 200 bp or the top five borrowers default.
- Scenario tests: several factors move together in a plausible bad story, such as a recession with higher rates and a weaker rupee.
- Reverse stress tests: start from failure (capital falls below the minimum) and work backwards to find what would cause it.
The RBI runs system-wide macro stress tests for the FSR (Part 15). The June 2026 FSR's two adverse scenarios pushed the GNPA ratio of 46 major banks to about 3.8% and 4.1% by March 2028, with aggregate capital still above the minimum.
Worked example: a simple credit stress test
A bank has risk-weighted assets of ₹2,00,000 crore and total capital of ₹32,000 crore, so its CRAR is 32,000 ÷ 2,00,000 = 16%. It has loans of ₹1,50,000 crore.
- Shock: 5% of loans turn bad = 0.05 × 1,50,000 = ₹7,500 crore of new NPAs.
- Loss: with 40% provisioning, the hit to capital is 0.40 × 7,500 = ₹3,000 crore (ignoring tax and any fall in RWAs).
- New CRAR: (32,000 − 3,000) ÷ 2,00,000 = 29,000 ÷ 2,00,000 = 14.5%, still above the 11.5% that includes the conservation buffer.
- Reverse stress test: to fall to 11.5%, capital must drop to 0.115 × 2,00,000 = ₹23,000 crore, a loss of ₹9,000 crore. At 40% provisioning that needs 9,000 ÷ 0.40 = ₹22,500 crore of new NPAs, or 15% of the loan book.
Measuring credit risk
PD, LGD and EAD
Modern credit risk is measured with three numbers:
- Probability of default (PD): the chance that the borrower defaults within a year. It comes from the bank's internal rating or an external rating (Part 36).
- Loss given default (LGD): the share of the exposure lost if default happens, after recoveries from collateral and resolution (Part 26). The Basel foundation approach uses 45% for senior unsecured corporate loans.
- Exposure at default (EAD): how much the borrower owes when it defaults. For a credit line, EAD includes part of the undrawn amount, using a credit conversion factor (CCF), because borrowers in trouble draw down their lines.
Expected loss = PD × LGD × EAD.
Worked example: expected loss on a credit line
A company has a working capital limit of ₹100 crore, of which ₹80 crore is drawn. The bank's model gives it a one-year PD of 2%, LGD of 45%, and a CCF of 50% on the undrawn part.
- EAD = drawn + CCF × undrawn = 80 + 0.50 × 20 = ₹90 crore
- EL = PD × LGD × EAD = 0.02 × 0.45 × 90 = ₹0.81 crore, or ₹81 lakh
- EL as a share of exposure = 0.02 × 0.45 = 0.9%. The bank's interest rate must include a credit spread of at least 0.9% just to cover average losses, before capital costs and expenses.
If the borrower pledges property that cuts LGD to 25%, EL falls to 0.02 × 0.25 × 90 = ₹0.45 crore. Collateral works on LGD, not PD: it does not make default less likely, only less costly.
From EL to ECL
Under the ECL rules from 1 April 2027 (Part 25), a performing loan (Stage 1) carries a provision for 12 months of expected loss, close to the PD × LGD × EAD figure above. If credit risk rises significantly (Stage 2) or the loan is impaired (Stage 3), the provision covers lifetime expected loss, subject to RBI floors. The 90-day NPA rule stays.
Measuring market risk
Duration
For a bond portfolio, the key sensitivity is modified duration: the approximate percentage fall in price for a 1 percentage point rise in yield.
Change in value ≈ − modified duration × value × change in yield.
Worked example. A bank holds government securities worth ₹10,000 crore with a modified duration of 4.5. After the MPC raised the repo rate by 25 bp on 7 October 2026 (Part 4), suppose yields rise by the same 0.25 percentage points. The loss is about 4.5 × 10,000 × 0.0025 = ₹112.5 crore. A portfolio with duration 2 would lose only ₹50 crore. Treasuries manage this risk by shortening duration when they expect rates to rise.
Value-at-Risk
Value-at-Risk (VaR) answers one question: how much could we lose over a given period, at a given confidence level, in normal markets? "One-day 99% VaR of ₹14 crore" means the bank expects to lose more than ₹14 crore on only about 1 day in 100.
Worked example (illustrative). A trading portfolio is worth ₹500 crore, and its daily returns have a standard deviation of 1.2%. Assuming returns are normally distributed, the 99% one-tailed z-value is 2.33.
- One-day 99% VaR = 500 × 0.012 × 2.33 = ₹13.98 crore
- Ten-day VaR (square-root-of-time rule) = 13.98 × √10 = 13.98 × 3.162 = ₹44.2 crore
- Over a year of 250 trading days, a loss larger than the one-day VaR should happen on about 250 × 1% = 2.5 days.
Supervisors check VaR models by back-testing: counting the days when actual losses exceeded VaR. Under the Basel "traffic light" test with 250 days at 99%, 0 to 4 exceptions is green, 5 to 9 yellow and 10 or more red.
VaR has well-known weaknesses. It says nothing about how big losses are beyond the cut-off, and the normal distribution understates extreme days ("fat tails"). This is why the revised Basel market risk framework replaced VaR with Expected Shortfall (the average loss in the worst 2.5% of cases) for banks that use internal models. In India, banks compute regulatory market risk capital using standardised formulas, now under the September 2026 directions; VaR remains a key internal tool for limits. The RBI itself uses VaR, conditional VaR and stress tests to manage the market risk on India's forex reserves (Part 17).
Asset liability management (ALM)
ALM manages the mismatch between a bank's assets and liabilities in maturity (liquidity risk) and in repricing (interest rate risk). It is run by the Asset Liability Committee (ALCO) of senior management, within limits set by the Board. India's formal ALM system dates from 1999.
The structural liquidity statement
The Statement of Structural Liquidity puts every inflow and outflow into time buckets, from next day up to over five years, and shows the gap in each. The RBI caps the net cumulative negative mismatch in the short buckets as a share of cumulative outflows:
| Bucket | Maximum cumulative negative gap |
|---|---|
| Next day | 5% of cumulative outflows |
| 2–7 days | 10% |
| 8–14 days | 15% |
| 15–28/30 days | 20% |
The 2012 circular labels the fourth bucket 15–28 days, and the November 2025 consolidated directions label it 15–30 days. If a limit is breached, the bank must show how it will fund the gap (for example through market borrowing, repo or the LAF).
Worked example. A bank expects next-day outflows of ₹2,000 crore and inflows of ₹1,850 crore. The negative gap is ₹150 crore, which is 150 ÷ 2,000 = 7.5% of outflows, above the 5% limit. It must cut the gap by at least ₹50 crore, to 5% × 2,000 = ₹100 crore, or explain how it will fund it. The 30-day stress view of the same problem is the LCR (Part 28).
Interest rate risk in the banking book
The banking book holds loans, deposits and investments held to maturity. Its interest rate risk is measured two ways:
- Earnings view (ΔNII): how much net interest income changes over the next year when rates move. This depends on repricing gaps: rate-sensitive assets (RSA) minus rate-sensitive liabilities (RSL) in each time bucket.
- Economic value view (ΔEVE): how much the present value of all assets minus all liabilities changes.
The RBI's final IRRBB guidelines of 17 February 2023, aligned with the Basel standard, replaced the 2010 rules. They prescribe standardised interest rate shock scenarios and an outlier test: a bank whose ΔEVE exceeds 15% of Tier 1 capital (earlier 20% of net worth) may face extra capital or corrective action. The rules sit in the November 2025 Forthcoming Instructions directions, with the start date to be notified separately.
Worked example: a repricing gap
An illustrative bank has ₹1,000 crore of rate-sensitive assets and liabilities (₹ crore):
| Bucket | RSA | RSL | Gap (RSA − RSL) | Cumulative gap |
|---|---|---|---|---|
| Up to 3 months | 300 | 450 | −150 | −150 |
| 3–6 months | 150 | 200 | −50 | −200 |
| 6–12 months | 150 | 150 | 0 | −200 |
| 1–3 years | 200 | 120 | +80 | −120 |
| 3–5 years | 120 | 50 | +70 | −50 |
| Over 5 years | 80 | 30 | +50 | 0 |
The one-year cumulative gap is −₹200 crore: more liabilities than assets reprice within a year. This is liability-sensitive, typical of a bank funded by short-term deposits.
- Simple estimate: if all rates rise by 1 percentage point, NII over the year changes by about −200 × 0.01 = −₹2 crore.
- Refined estimate, allowing for when in the year each bucket reprices (midpoints of 1.5 and 4.5 months, so the new rate applies for 10.5 and 7.5 months): −150 × 0.01 × 10.5/12 − 50 × 0.01 × 7.5/12 = −1.3125 − 0.3125 = −₹1.63 crore.
- If rates fall, the same bank gains. A bank expecting cuts would want a negative gap; one expecting hikes would shrink it.
This is why the October 2026 repo hike helps banks with mostly floating-rate (EBLR-linked) loans: their assets reprice faster than their term deposits (Part 24).
Operational risk
Operational risk covers losses from failed processes, people, systems or external events, including fraud, legal risk and outages. Fraud and cyber attacks are covered in Part 39. Two developments matter now:
- Capital. Until the new rules start, most banks use the Basic Indicator Approach: capital equal to 15% of average positive annual gross income over the previous three years. For gross income of ₹800, ₹900 and ₹1,000 crore, the charge is 0.15 × 900 = ₹135 crore. The Basel III Standardised Approach, based on a "business indicator" built from financial statements, takes over on the revised Basel III timetable, with details finalised on 23 October 2026.
- Resilience. The 2024 guidance note asks banks to identify their critical operations, set impact tolerances and map dependencies, including on third parties. The July 2026 cyber directions add six-monthly vulnerability assessments, disaster-recovery drills that run the backup site as the main site for a full business day, and reporting of cyber incidents on the RBI's DAKSH platform within six hours.
Newer risks: models and climate
Model risk
Banks rely on models for credit scores, PD and LGD estimates, VaR, ALM behaviour, fraud detection and, increasingly, AI. A model can be wrong because of bad data, wrong assumptions or misuse. The RBI's draft guidance of 24 June 2026 covers all models, including AI/ML and third-party models, across their life cycle, from development and independent validation to monitoring and retirement. It builds on the RBI's August 2024 draft on model risk in credit and the FREE-AI report. Part 20, central banking and AI, covers the AI side in detail. As of 24 October 2026, the final version had not been issued.
Climate risk
Climate change hurts banks in two ways:
- Physical risk: floods, cyclones and heatwaves damage borrowers' assets and incomes, especially in agriculture and coastal areas.
- Transition risk: carbon-heavy borrowers (coal, thermal power, steel, cement) lose value as policy, technology and demand shift.
India's rules are still developing:
- Feb 2024 draft disclosure framework. On 28 February 2024 the RBI released a draft Disclosure framework on Climate-related Financial Risks for commercial banks (other than LABs, payments banks and RRBs), Tier-IV UCBs, AIFIs and top- and upper-layer NBFCs. It used four pillars: governance, strategy, risk management, and metrics and targets. Reuters reported in January 2026 that the RBI had put the mandate on hold.
- Nov 2025 climate finance directions. On 28 November 2025 the RBI issued the Commercial Banks – Climate Finance and Management of Climate Change Risks Directions, 2025, which consolidate existing climate-related instructions such as the green deposit framework.
- Climate stress tests. In October–November 2022 the RBI ran a pilot climate vulnerability assessment and stress test (VAST) with 15 banks. It found that credit loss potential rose substantially under physical and transition risk, for example by 66.1% under a flood scenario. It was exploratory and set no capital requirement. Guidance on climate scenario analysis and stress testing was announced in 2024 but had not been finalised.
How the RBI supervises risk
From 1998 to about 2013, the RBI rated banks on CAMELS (capital adequacy, asset quality, management, earnings, liquidity, systems and controls), a backward-looking, point-in-time model. It then moved to risk-based supervision (RBS) under the Supervisory Program for Assessment of Risk and Capital (SPARC). RBS rates each bank on both the probability that it gets into trouble and the impact if it does, and sets the intensity of supervision accordingly. A large, risky bank gets more attention than a small, safe one.
Today a single Department of Supervision runs an annual Inspection for Supervisory Evaluation, continuous off-site monitoring through DAKSH, and supervisory ratings (Part 18). Supervisors review the bank's ICAAP and stress tests under Pillar 2. When capital, asset quality or leverage cross set thresholds, the Prompt Corrective Action framework applies (Part 15).
Why risk management fails
The bank failures in Part 29 and the bad loan cycle in Part 25 show the usual causes:
- Weak second line. The risk function exists on paper but cannot say no to the business. This is why the RBI insists on CRO tenure, independent pay and direct access to the Board.
- Concentration. Too much lending to one group or sector (infrastructure in the 2010s, real estate at PMC Bank).
- Liquidity mismatch. Funding long assets with short or flighty money, as at IL&FS in 2018.
- Model and data failure. Models trained on good times underestimate PD and LGD in bad times.
- Governance failure. Boards that do not understand the risks they approve.
The common thread is that measurement alone is not enough. Numbers such as PD, VaR and gaps are only useful if someone independent has the authority to act on them.
Series B in one map: Parts 21 to 40
This is the last part of the series on banking and financial institutions. Each part looked at one piece of the system.
How banks work. Part 21 mapped the structure of Indian banking and Part 22 compared public and private banks. Part 23 explained how banks create money, and Part 24 how they earn it through the net interest margin. ALM and IRRBB in this part are the risk side of that margin.
Bad loans and their resolution. Part 25 covered NPAs, Part 26 the IBC and Part 37 asset reconstruction companies and bad banks. This is credit risk after it has gone wrong; PD, LGD and ECL are how banks try to see it coming.
Safety rules. Part 27 on Basel III capital, Part 28 on the LCR and NSFR, Part 29 on why banks fail and Part 30 on deposit insurance set out the defences that sit behind each bank's own risk management.
Beyond the big banks. Part 31 on NBFCs, Part 32 on microfinance and inclusion, Part 33 on small finance and payments banks and Part 34 on co-operative banks and RRBs. The June 2026 draft extends the same control-function rules to most of these entities.
Directing and pricing credit. Part 35 on priority sector lending and Part 36 on rating agencies and credit bureaus: the inputs to PD estimates and to the sectoral mix of a loan book.
Change and risk. Part 38 on mergers, Part 39 on fraud and cyber security and this part on risk management show how the system adapts. For the central bank's side of the story, the RBI's policy tools, balance sheet and supervision, see Series A, starting with Part 1.
Common exam traps
EL vs UL. Expected loss is covered by pricing and provisions; unexpected loss is covered by capital.
Collateral reduces LGD, not PD. A guarantee or mortgage lowers the loss if default happens. It does not make default less likely.
VaR is not the worst case. A 99% one-day VaR of ₹14 crore means losses should exceed ₹14 crore on about 1 day in 100. It says nothing about how large those losses are. Expected Shortfall does.
Negative gap and rising rates. A bank with a negative one-year repricing gap (more RSL than RSA) loses NII when rates rise and gains when they fall.
CRO circular year. The RBI's CRO guidelines for banks date from 27 April 2017. The compliance function circular is 11 September 2020, now replaced by directions of 31 July 2026.
Second line vs third line. Risk management and compliance are the second line. Internal audit is the third. Business units are the first.
CRO has no vote. The CRO sits on credit committees as an invitee without voting rights, but an overruled CRO's advice must be escalated.
Climate disclosure is not yet mandatory. The 2024 framework is a draft. The November 2025 directions cover climate finance and existing climate instructions.
Key facts at a glance
| Expected loss | PD × LGD × EAD; covered by pricing and provisions |
| Basel foundation LGD | 45% for senior unsecured corporate exposures |
| Three lines of defence | Business units; risk and compliance; internal audit |
| Op-risk guidance note | 30 Apr 2024; 17 principles, 3 pillars; replaced 2005 note |
| CRO guidelines (banks) | 27 Apr 2017; tenure at least 3 years; no business targets |
| Compliance circular | 11 Sep 2020; replaced by Compliance Function Directions, 31 Jul 2026 |
| CCO | Max age 55 at appointment; 15 years' experience; tenure at least 3 years |
| Control functions draft | 10 Jun 2026; proposed start 1 Jan 2027 |
| Model risk draft | 24 Jun 2026; all models incl. AI/ML and third-party |
| Market risk directions | 21 Sep 2026; effective 1 Apr 2027 |
| Op-risk Standardised Approach | Details finalised 23 Oct 2026; Basel III package from 1 Apr 2027 |
| IRRBB guidelines | 17 Feb 2023; outlier test 15% of Tier 1 capital |
| Structural liquidity limits | 5%, 10%, 15%, 20% of cumulative outflows (next day to 15–30 days) |
| Large exposures | 20% of Tier 1 (single), 25% (group) |
| Climate | Draft disclosure framework 28 Feb 2024; VAST pilot 2022 with 15 banks |
| Supervision | CAMELS (1998–2013), then risk-based supervision (SPARC) |
Exam corner: what to remember
- EL = PD × LGD × EAD; EAD = drawn + CCF × undrawn.
- Duration rule: change in value ≈ − modified duration × value × change in yield.
- VaR = value × σ × z; z = 2.33 for 99% and 1.65 for 95%; scale by √(days).
- Gap = RSA − RSL; ΔNII ≈ cumulative gap × change in rate.
- Three lines: business (1), risk and compliance (2), internal audit (3).
- CRO: 2017 circular, at least three years, two levels below MD & CEO at most, functional reporting to the Board or RMCB.
- CCO: 2020 circular, now the 31 July 2026 directions; no dual hatting; RBI told in advance of changes.
- Pillar 2 = ICAAP + SREP; stress tests: sensitivity, scenario and reverse.
- 2026 rule changes: control functions draft (10 June), model risk draft (24 June), compliance, audit and cyber directions (31 July), market risk (21 September), operational risk (23 October).
- RBS replaced CAMELS-based supervision; it weighs both the probability and the impact of failure.
For exam-specific syllabus and pattern details, see our pages for RBI Grade B, SBI PO and IBPS PO.
Test yourself
In the three lines of defence model, the internal audit function is the:
Show answer
Answer: (c) Internal audit gives independent assurance to the Board; risk management and compliance form the second line.
A loan has EAD of ₹50 crore, PD of 3% and LGD of 40%. Its expected loss is:
Show answer
Answer: (a) EL = 0.03 × 0.40 × 50 = ₹0.6 crore.
A bank's one-year cumulative repricing gap is −₹500 crore. If interest rates rise by 50 bp, its net interest income over the year changes by roughly:
Show answer
Answer: (b) ΔNII ≈ −500 × 0.005 = −₹2.5 crore; a negative gap loses when rates rise.
In September 2026, the RBI issued directions on minimum capital requirements for which risk, effective 1 April 2027?
Show answer
Answer: (b) The Market Risk Directions were issued on 21 September 2026; the credit risk directions came in April 2026.
Under RBI rules, a bank's Chief Risk Officer is appointed for a fixed tenure of at least:
Show answer
Answer: (c) At least three years, with premature removal needing Board approval.
Which RBI instrument, issued on 31 July 2026, replaced earlier instructions such as the 2020 circular on the role of the Chief Compliance Officer?
Show answer
Answer: (a) The Compliance Function Directions were issued on 31 July 2026, alongside directions on internal audit and cyber security.
A trading portfolio of ₹200 crore has a daily standard deviation of returns of 1%. Its one-day 99% VaR (z = 2.33) is about:
Show answer
Answer: (c) VaR = 200 × 0.01 × 2.33 = ₹4.66 crore.
Pledging collateral against a loan mainly reduces its:
Show answer
Answer: (b) Collateral raises recoveries, so it lowers LGD; it does not change the chance of default.
In the RBI's Statement of Structural Liquidity, the net cumulative negative mismatch in the next-day bucket should not exceed what share of cumulative outflows?
Show answer
Answer: (a) The limits are 5%, 10%, 15% and 20% for next day, 2–7 days, 8–14 days and 15–28/30 days.
The RBI's draft guidance on model risk management, released on 24 June 2026, applies to:
Show answer
Answer: (c) It covers all models across their life cycle at banks, NBFCs, co-operative banks, AIFIs, ARCs and credit information companies.
Further reading
- RBI, Guidance Note on Operational Risk Management and Operational Resilience (30 April 2024): the clearest official statement of the three lines of defence, with all 17 principles.
- RBI, Commercial Banks (Compliance Function) Directions, 2026: the current rulebook for the compliance function and the CCO.
- RBI, draft Commercial Banks (Governance) Second Amendment Directions, 2026: the June 2026 draft on risk, compliance and audit as "control functions", with the CRO's role spelt out.
- RBI, Commercial Banks (Forthcoming Instructions) Directions, 2025: the IRRBB framework, the Standardised Approach to operational risk and SA-CCR in one place.
- RBI, Financial Stability Report, June 2026: the macro stress tests and the system-wide view of credit, market and liquidity risk.
- RBI Bulletin, "Climate Stress Testing and Scenario Analysis: Navigating Uncharted Waters" (January 2024): how climate stress tests work and what the 2022 VAST pilot found.
- RBI, Liquidity Risk Management by Banks (7 November 2012): the source of the structural liquidity limits and the wider liquidity risk framework.
Sources
- RBI press release 2026-2027/1380, 23 October 2026: Forthcoming Instructions Second Amendment Directions on operational risk; business indicator mapping; revised Basel III from 1 April 2027 (accessed 24 October 2026)
- RBI press release 2026-2027/1158, 21 September 2026: Market Risk Directions, effective 1 April 2027; draft of 17 February 2023; transition scalars since 1 April 2024 (accessed 24 October 2026)
- RBI, Commercial Banks (Compliance Function) Directions, 2026: date 31 July 2026; CCO age, experience, tenure, no dual hatting, prior intimation to the RBI, quarterly review, annual compliance risk assessment (accessed 24 October 2026)
- TeamLease RegTech, Internal Audit Function Directions, 2026: issued 31 July 2026, effective on issue; RBIA; no full outsourcing (accessed 24 October 2026)
- DSCI brief on the RBI cyber security directions for commercial banks, 2026: issued 31 July 2026; CISO reports to the risk executive; six-hour incident reporting on DAKSH; DR and testing rules (accessed 24 October 2026)
- TaxGuru, RBI press release 2026-2027/431 of 10 June 2026: draft harmonisation of control functions; comments to 9 July 2026; start 1 January 2027; tenure, reporting, CRO as non-voting invitee, five-working-day reporting, RMCB rules for payments banks (accessed 24 October 2026)
- RBI, draft Commercial Banks (Governance) Second Amendment Directions, 2026: CRO tenure, reporting lines and role in credit committees (accessed 24 October 2026)
- Union Bank of India stock exchange filing, 25 November 2021: cites RBI circular DBR.BP.BC.No.65/21.04.103/2016-17 dated 27 April 2017 on CROs (accessed 24 October 2026)
- DT Next, 11 September 2020: RBI guidelines on the compliance function and CCO; three-year tenure; no business roles (accessed 24 October 2026)
- RBI, Guidance Note on Operational Risk Management and Operational Resilience: three lines of defence, 17 principles, three pillars, applicability (accessed 24 October 2026)
- RBI press release on the FSR, 30 June 2026: GNPA 1.8%, CRAR 17.7%, stress test results (accessed 24 October 2026)
- RBI press release 2026-2027/528, 24 June 2026: draft Guidance on Regulatory Principles for Model Risk Management; scope; comments by 24 July 2026 (accessed 24 October 2026)
- RBI, Commercial Banks (Forthcoming Instructions) Directions, 2025: 28 November 2025; IRRBB chapter; operational risk Standardised Approach; effective dates to be notified (accessed 24 October 2026)
- EY, Navigating the latest RBI guidelines on IRRBB (May 2023): final IRRBB guidelines of 17 February 2023; outlier test of 15% of Tier 1 capital (earlier 20% of net worth); 1999 RBI ALM guidelines (accessed 24 October 2026)
- RBI, Liquidity Risk Management by Banks, 7 November 2012: structural liquidity limits of 5%, 10%, 15% and 20% (accessed 24 October 2026)
- RBI press release 2023-2024/1958, 28 February 2024: draft Disclosure framework on Climate-related Financial Risks, 2024; scope; comments to 30 April 2024 (accessed 24 October 2026)
- TeamLease RegTech, Climate Finance and Management of Climate Change Risks Directions, 2025: issued 28 November 2025; applies to commercial banks other than SFBs, payments banks and LABs (accessed 24 October 2026)
- Business Standard (Reuters), January 2026: RBI puts climate disclosure plan on hold (accessed 24 October 2026)
- RBI Bulletin, 18 January 2024: 2022 VAST pilot with 15 banks; 66.1% rise in flood-related credit loss potential; no capital assessment (accessed 24 October 2026)
- Business Standard, November 2019: CAMELS from 1998 to 2013, replaced by risk-based supervision under SPARC (accessed 24 October 2026)