The Nepal Rastra Bank (NRB), the banking sector regulator, has introduced a new directive on risk management, which makes it mandatory for banks and financial institutions to appoint a chief risk officer, formulate strategies to identify and manage risks, and develop a credit risk rating system to evaluate worthiness of borrowers.

The new directive has divided banking sector’s risks into seven categories: credit, operational, liquidity, market, interest rate, foreign exchange and others. Market and other risks are two new categories added to the list by the regulator. Previously, risks were divided into five categories: credit and investment, operational, liquidity, interest rate and foreign exchange.

“The new directive on risk management is comprehensive and as per the international standard,” said Narayan Prasad Paudel, spokesperson and head of the Banks and Financial Institutions Regulation Department of the NRB. “Proper implementation of the directive will help banks and financial institutions to identify risks, measure exposure to those risks, and control and mitigate such risks.”

Risks are inherent in all types of banking activities. The challenge for banking institutions is to build a robust system that could identify and manage those threats effectively. Some of the pillars for sound risk management, as identified by the directive, are: oversight by board of directors and senior management, adequacy of policies and processes, effective risk management function, reliable information system, and effective internal control mechanisms and limit.

The new directive has made board of directors of banks and financial institutions fully responsible for risk management. The board has, thus, been directed to design a risk management strategy based on risk appetite and risk-bearing capacity of the institution.

This strategy should be used as a guiding document to frame appropriate policies and guidelines to immediately thwart material risks present in the system, says the directive. These policies and guidelines, which should be implemented by the management, must be reviewed at least once a year and updated if necessary. Also, the board and senior management must review the report on risk management at least once every three months, adds the directive.

To execute these tasks effectively, the new directive has called on banks and financial institutions to create separate units to identify and deal with different risks. If the size and business volume of institutions are big, these units could be merged to form a separate risk management division, says the directive. Banking institutions should ensure there is no conflict of interest between risk management division and other divisions that promote business activities, adds the directive.

The risk management division, according to the directive, should be led by chief risk officer or an official deputed to the similar post. The chief risk officer or person appointed to similar post should be allowed to work independently. They must report directly to the risk management committee under the board of directors.

“However, risk management division should not be made solely responsible for managing and thwarting risks,” says the directive, adding, “Risk management should be integral part of every banking activity.”

The directive has also made it mandatory for commercial and development banks to develop credit risk rating system to evaluate credit worthiness of borrowers.

Reputation and trustworthiness of clients and their businesses must be given priority while evaluating credit worthiness, says the directive, adding, “BFIs should submit all measures, policies and strategies adopted to manage all material risks to the NRB’s Supervision Department within a month of completion of every fiscal year.”