Will chief compliance officers check misgovernance in banks?

In the wee hours of September 11, the Reserve Bank of India (RBI) issued a notice asking all banks to appoint a Chief Compliance Officer (CCO). This is in continuation of the RBI’s earlier notices of asking banks to appoint Chief Risk Officer (CRO) in 2017, and the NBFCs in 2019.

There is some background to this new CCO notice. In June, the RBI released a discussion paper on governance of banks. The paper was a reaction to several cases of misgovernance reported across the banking sector. The paper identified lack of compliance as one of the key governance risks in banks. The RBI in turn had taken a leaf from BIS’s Guidelines on Corporate governance principles for banks released in 2015. The BIS had mentioned three lines of defence for banks: business strategy as first line, risk and compliance as second line, and internal audit as the third line.

The central bank defined compliance risk as ‘the risk of legal or regulatory sanctions, material financial loss, or loss to reputation a bank may suffer because of its failure to comply with laws, regulations, rules, related self-regulatory organisation standards and codes of conduct applicable to its activities’. The paper mentioned appointment of CCO as a first step to mitigate these risks. The RBI has gone ahead and implemented this suggestion, and asked banks to appoint the CCOs.

The RBI says banks need to build an ‘effective compliance culture, independent corporate compliance function and a strong compliance risk management programme at bank and group level’. It sees compliance as an independent function which will be headed by a CCO. The board of the bank will first specify a compliance policy which spells out the philosophy, culture, incentive and accountability behind the compliance. The CCO, in turn, will apprise the board of the developments in their bank on complying of the compliance policy, and report on these matters regularly to the board.

To ensure this two-way process, the position of the CCO has to be a part of senior management. Accordingly, the RBI has mentioned that the CCO position ‘shall be a senior executive of the bank, preferably in the rank of a General Manager (or an equivalent position) and should not be below two levels from CEO level’. It has also specified that the candidate should be recruited from the market, so that insiders are not appointed and the objective is compromised. The bank’s board will have to seek approval from the RBI before appointment/dismissal of the CCO. The CCO should not also be a ‘dual hatting’ position whereby other roles, especially of conflicts of interest, are also given to the person.

One thing which the RBI could have paid more attention is the tenure of appointment. It says the tenure should be ‘minimum fixed tenure of not less than 3 years’. Though, this direction is better than appointment of the CROs where the central bank allowed the board to establish tenure lengths which leads to randomness. However, to say not less than three years also leads to randomness, and most likely banks will opt for a 3-year period which will be a very short tenure.

Compliance cultures need longer time-periods especially in the initial years. Ideally, the RBI should have specified the tenure length of any number above of five years. A longer tenure helps the new person to first understand the existing system and then make appropriate policies.

For dismissal/removal before the tenure, the RBI says that this will be allowed ‘only in exceptional circumstances with the explicit prior approval of the Board after following a well-defined and transparent internal administrative procedure’. Again, this is not very clearly defined.

Somehow in most of our policy directions, we are unable to make proper ‘appointment rules’ leading to short-term appointments and removals without much explanation; similar appointment terms plague the functioning of the RBI and other regulators.

Coming back to the CCO, the ball is now in the banks’ court. The senior management of the respective banks will have to create a new senior position and even comply with the position as well. The BIS mentions both risk and compliance as second lines of defence and banks first created position of the CRO and will now have to create one for the CCO as well. The banks will have to make a very clear separation of roles of the two positions to avoid a conflict.

In the June discussion paper, the RBI had noted the possibility of profile of the CCO clashing with that of company secretary which has a similar role. Banks appoint company secretaries as they are a company and will now have to appoint the CCOs as well as they are regulated by the RBI. The central bank mentioned that though the CCOs and company secretaries shall have separate roles, they are expected to work closely with each other.

To sum up, it is interesting to note how compliance has become a specialist function in banks. There was a time when one assumed compliance and risk management to be part of core culture of banks. This assumption is no more valid as the culture of banks has not just eroded but also become one of the biggest concerns for policymakers. It has to be seen whether the CCOs can help restore culture and values in the Indian banking system.

Amol Agrawal is faculty at Ahmedabad University. Views are personal.