The Reserve Bank of India has consolidated regulatory instructions requiring commercial banks to establish dedicated control functions headed by a chief risk officer (CRO), chief compliance officer (CCO) and head of internal audit (HIA). According to reports from Business Standard, the amended directions will come into effect from January 1, 2027, marking a significant shift in how banks manage risk and compliance functions.
Under the revised framework, the CRO, CCO and HIA will ordinarily be appointed for a fixed tenure of at least three years, with any premature transfer or removal requiring board approval. As reported by Business Standard, the central bank mandates that these officials be appointed from among senior officials not more than two levels below the managing director and chief executive officer (MD & CEO). They will report functionally to the board or relevant board committee and administratively to the MD & CEO.
The RBI has mandated that the three control functions must operate independently of business lines, remain free from business targets, and have unrestricted access to all business areas and records. According to the revised directions, banks will be required to frame board-approved policies defining the objectives, roles and responsibilities of each function. The CRO will be an invitee to meetings of credit sanction and approval committees without voting rights.
Under the new framework, the CROs, CCOs and HIAs will meet the board or relevant board committee at least once every quarter without the presence of senior management. As reported by Business Standard, their final performance review will be carried out by the board or respective board committee. The RBI has also prescribed that any appointment, reappointment, removal or exit of a CRO will have to be reported to the RBI within five working days, while banks must provide prior intimation for chief compliance officers and heads of internal audit.
The revised framework mandates that banks maintain an annual compliance risk assessment and adopt a risk-based internal audit framework covering all significant activities. According to Business Standard, high-risk areas will be subject to more frequent reviews. Any decision to assume risk contrary to the CRO's advice, without adequate risk-mitigation measures, will require approval by the next higher authority in the delegation matrix and reporting to the board or risk management committee.
