Banking Risks, Prudential Supervision and Prompt Corrective Action

1. Banks transform risks#

Banks borrow short and lend longer, evaluate thousands of borrowers, hold securities, move payments and depend on complex technology. They earn income partly by managing the uncertainty created by those activities.

Risk is the possibility that an event adversely affects the bank's financial condition, operations, customers or ability to meet obligations.

Risk management does not mean eliminating every risk; that would eliminate ordinary lending. It means identifying, measuring, controlling and monitoring risks within acceptable limits.

2. Credit risk#

A borrower or counterparty fails to pay interest/principal or otherwise perform its obligation.

Example: a bank grants a ₹5 crore term loan to a small factory that later closes due to sustained losses. The bank faces default and potential loss after recovery.

Tools include:

• credit appraisal;
• internal rating and bureau information;
• diversification;
• appropriate security;
• exposure limits;
• monitoring of warning signals;
• restructuring/recovery under lawful frameworks.

Related: Modules 06 and 07.

3. Concentration risk#

Suppose 45% of a bank's loans are exposed to a single industry. Even if individual borrowers seem strong, an industry-wide shock could hurt them simultaneously.

Concentration can arise by:

• borrower or connected group;
• industry;
• geography;
• collateral type;
• funding source;
• technology provider.

Diversification reduces some types of concentration, though it does not remove all systemic risk.

4. Market risk#

Market risk is potential loss from changes in market prices or rates. It includes, under applicable treatment:

• interest-rate movements in trading positions;
• foreign-exchange changes;
• equity and other market prices;
• spread movements.

Example: a bank holds a bond in a market-valued portfolio. If yields rise, bond prices generally fall, causing a valuation loss.

Bond price and market yield typically move in opposite directions.

5. Interest Rate Risk in the Banking Book — IRRBB#

This is distinct from trading-book market risk. A bank may have fixed-rate loans and floating-rate deposits, or vice versa. Interest-rate changes can affect:

• Net Interest Income (NII); and
• the economic value of assets/liabilities.

A mismatch in repricing dates can create risk even when all borrowers make their scheduled payments.

6. Liquidity risk#

Liquidity risk means inability to meet obligations when due without unacceptable losses or costs.

Example: customers withdraw deposits rapidly while most bank assets are long-dated loans. The bank might need emergency funding or sell securities at disadvantageous prices.

Liquidity risk has multiple dimensions:

• funding liquidity;
• market liquidity;
• intraday payments liquidity;
• contingent liquidity demands.

7. Operational risk#

Losses from inadequate/failed:

• people;
• internal processes;
• systems; or
• external events.

Examples:

• employee processing error;
• bank-system outage;
• internal fraud;
• cyberattack;
• natural disaster affecting operations;
• certain legal risk.

Operational risk is not synonymous with 'computer risk' alone.

8. Cybersecurity risk and third-party dependence#

Digital banks rely on:

• Core Banking Solutions;
• payment switches;
• cloud or outsourced technology;
• telecom providers;
• vendors and service partners.

A vendor outage can affect the bank even when the bank's internal code works properly. Strong risk governance uses contracts, monitoring, testing, backup, incident reporting and recovery planning.

See Module 12 for cyber-fraud examples and customer protection.

9. Compliance, legal, conduct and reputation risks#

• Compliance risk: failure to follow applicable statutes/regulations.
• Legal risk: litigation or unenforceable terms can cause loss.
• Conduct risk: inappropriate customer treatment/sales practices.
• Reputational risk: loss of stakeholder confidence after poor conduct, service failures or scandals.

These categories overlap but should not be collapsed into one.

10. Strategic and business risk#

A bank may adopt an unsustainable business model, over-expand or misprice its loans. The consequence may be weak profitability even without a single spectacular operational failure.

Strategic risk calls for board-level evaluation rather than just a daily IT security checklist.

11. Asset–Liability Management — ALM#

Banks manage assets (loans and investments) and liabilities (deposits and borrowing) that differ in:

• maturity;
• interest-rate behaviour;
• liquidity;
• currency;
• optionality.

ALM studies and manages these mismatches. The Asset–Liability Committee (ALCO) typically reviews funding, liquidity, pricing and interest-rate risk within a bank's governance structure.

12. Example: maturity mismatch#

A bank grants a seven-year fixed-rate loan using deposits that frequently reprice after six months. If deposit interest rates rise rapidly:

• income on the loan may remain fixed;
• funding cost increases;
• net interest margin may compress.

This is interest-rate/ALM risk, even when the borrower repays perfectly.

13. Prudential regulation#

Prudential rules are meant to protect the bank and financial system from excessive risk. Important areas include:

• minimum regulatory capital;
• provisioning/asset classification;
• exposure and concentration limits;
• liquidity requirements;
• governance/internal controls;
• risk measurement and disclosure;
• stress testing;
• related-party transaction constraints.

Prudential rules do not guarantee that no bank will ever fail.

14. Supervision vs regulation#

Regulation: sets rules and minimum standards.
Supervision: checks whether a particular institution is safe and compliant, identifies weaknesses and seeks remediation.

A supervisor can combine:

• off-site returns/analytics;
• on-site inspection/examination;
• risk-based supervisory assessment;
• dialogue with board/management;
• corrective measures.

15. Risk-Based Supervision (RBS)#

Risk-based supervision allocates supervisory attention according to a bank's material risks, governance and control weaknesses, rather than checking all institutions as if their risk profiles were identical.

A complex internationally active bank and a small local bank can require very different supervisory emphasis.

16. Board and management responsibilities#

Good banking governance involves:

• board-approved risk appetite and policy;
• segregation of duties;
• credit approval standards;
• independent risk and compliance functions;
• internal audit;
• escalation of exceptions;
• reliable disclosures and reporting.

The board cannot outsource ultimate oversight responsibility simply by appointing a consultant.

17. Three lines of defence — practical model#

One useful conceptual model is:

1. Business/operations: own and manage day-to-day risks.
2. Risk and compliance: set frameworks, challenge and monitor.
3. Internal audit: independently evaluate controls/governance.

This is a governance teaching model; the exact responsibilities depend on bank structure and prevailing standards.

18. Stress testing#

Stress testing asks:

What could happen to the bank's capital, earnings or liquidity under severe but plausible adverse conditions?

Examples:

• severe recession and rising NPAs;
• sudden withdrawal of a major depositor segment;
• steep yield increase;
• cyber outage combined with payment delays.

Stress testing is forward-looking; it supplements historical data.

19. What stress testing cannot do#

A model's result is not a guarantee. Scenarios depend on assumptions and may miss new risks. A bank should combine model outputs with governance, judgement, scenario challenge and recovery planning.

20. Early warning signals#

Weakness can appear before a bank violates minimum capital. Potential signals include:

• accelerating SMA/NPA migration;
• concentrated exposure growth;
• declining capital generation;
• deposit outflows;
• repeated control failures;
• excessive connected lending;
• adverse inspection findings.

Early action is cheaper than waiting until losses overwhelm the bank.

21. Prompt Corrective Action — PCA#

PCA is RBI's structured framework for early supervisory intervention when specified prudential indicators of a bank cross defined thresholds.

Its purpose is to:

• identify deterioration;
• require corrective measures in time;
• conserve resources/capital;
• restore financial health;
• reduce risk to depositors and the system.

PCA does not automatically mean the bank is closed. It is fundamentally an intervention and recovery discipline, not a synonym for liquidation.

22. PCA — indicators#

Under RBI's revised Scheduled Commercial Bank framework issued in 2021 (effective January 2022), important monitored dimensions are:

1. Capital — whether eligible capital buffers are too weak;
2. Asset quality — deterioration in the bank's advances/NPAs;
3. Leverage — excessive balance-sheet exposure relative to Tier 1 capital.

The precise risk thresholds and current operational modifications belong in verified website data. A learner must not blindly use an older 2017 PCA table featuring profitability as if it remained the applicable revised SCB indicator structure.

23. PCA and statutory/legal status#

PCA is an RBI supervisory framework. It exists alongside the Banking Regulation Act, RBI directions, licensing powers and other supervisory measures. Entering PCA is not itself a new Act of Parliament, nor does it cancel a bank's licence automatically.

24. Possible PCA restrictions#

Depending on the applicable framework and severity, measures can involve:

• restrictions on dividend/distributions;
• constraints around expansion or certain business growth;
• restrictions on management compensation or operations as authorised;
• action plans to augment capital;
• tighter provisioning or risk reduction;
• enhanced monitoring.

Actions are risk- and rule-dependent; not every restriction is necessarily imposed on every PCA bank.

25. Different PCA regimes#

The scheduled-commercial-bank PCA framework, NBFC PCA framework, and any applicable urban co-operative-bank supervisory action framework must not be treated as interchangeable.

The revised 2021 SCB PCA framework specifically excluded:

• Small Finance Banks;
• Payments Banks; and
• Regional Rural Banks.

Other frameworks and RBI supervisory powers may address those institutions. Never assume an institution has no regulatory oversight merely because it is excluded from one named framework.

26. PCA vs NPA#

• NPA: classification of a deteriorated bank asset/loan.
• PCA: supervisory intervention addressing a troubled bank/institution.

A bank can have NPAs without being placed under PCA. One large NPA in a loan book does not automatically cause PCA.

27. PCA vs Prompt repayment reminder#

Despite the name, PCA is a regulatory framework for an institution's health. It is not an automated loan-recovery alert to a retail borrower.

28. PCA vs moratorium/merger#

• PCA: corrective supervisory framework.
• Moratorium: restrictions on banking operations under a distinct legal process.
• Merger/reconstruction: structural action under applicable statutory authority.
• Liquidation: winding-up process where applicable.

These may occur in different combinations, but they are not synonyms.

29. What helps a bank exit PCA?#

Broadly, a bank needs to demonstrate sustainable improvement in areas of weakness and fulfil regulatory exit criteria. Examples of remedial efforts include:

• raising eligible capital;
• reducing NPAs through recoveries/resolution;
• lowering concentrated risky exposures;
• improving risk controls;
• strengthening profitability and governance.

RBI determines action under the applicable framework; one good quarter does not guarantee automatic exit.

30. Recovery and resolution planning#

Risk management extends beyond ordinary limits and includes contingency planning:

• liquidity contingency funding;
• business continuity and disaster recovery;
• capital restoration plans;
• communication arrangements;
• recovery options under stress.

These plans should be tested, updated and understood by management.

31. Illustrative mini-case#

Bank Y has:

• rising gross and net NPAs;
• falling CET1;
• accelerated deposit withdrawal;
• weak control findings.

Possible concerns:

An effective supervisor considers their combined effect, not one metric alone.

32. Exam-ready recap#

• Credit risk: inability/unwillingness of counterparty to perform.
• Market risk: price/rate movements.
• Liquidity risk: inability to meet obligations when due.
• Operational risk: process, people, system or external-event failure.
• IRRBB: banking-book interest-rate mismatch.
• ALM: coordinated management of asset/liability maturities, funding and rate risks.
• ICAAP: internal capital adequacy assessment.
• RBS: supervision proportional to risk.
• PCA: RBI early supervisory corrective framework, not automatic closure.

Quick check — BA-14-05#

1. What is the difference between liquidity risk and credit risk?
2. What does ALCO deal with?
3. Which core indicators are named in the revised SCB PCA framework?
4. Is PCA the same as declaring a bank bankrupt?
5. Is a cyber outage only a market risk?

Answers: (1) Liquidity is meeting due cash outflows; credit is counterparty default. (2) ALM/liquidity/interest-rate matters. (3) Capital, asset quality and leverage. (4) No. (5) No; primarily operational/cyber risk, potentially with other consequences.