Risks facing UCBs no longer confined by size or geography: RBI DG

RBI Deputy Governor Swaminathan J says growing reliance on technology and third-party providers exposes smaller banks to cyber, digital fraud and operational risks

Urban co-operative banks (UCBs) may be small in size but face increasingly complex risks as they rely more on technology and third-party service providers for critical banking operations, Reserve Bank of India (RBI) Deputy Governor Swaminathan J said.

 

“The institution may be small, but the risk environment around it can be much larger,” Swaminathan said in a keynote address on August 7. He said UCBs’ risks were no longer confined to their physical size or geographical presence, with cyber incidents, digital fraud and failures at technology service providers potentially disrupting banking services.

 

“Many UCBs depend on outside service providers for their Core Banking Solution, payment applications, data centres and other important services. This is often both necessary and efficient. It allows smaller institutions to access technology and expertise that may be difficult or expensive to build entirely on their own,” he said.

 

 

“However, this also changes the nature of the bank. Some of the activities that are critical to the functioning of the bank may now be performed outside the bank,” he added.

 

The deputy governor asked boards and senior management of UCBs to assess their dependence on external technology providers and their ability to manage associated risks.

 

“This raises a simple but important question for every Board and every CEO: how much of my bank today actually sits outside my bank?” Swaminathan said, asking banks to examine which systems are operated by external providers and what would happen if a critical provider became unavailable for a few hours or a day.

 

He stressed that outsourcing did not transfer responsibility for risk management away from the bank.

 

“The service provider may operate the system, but responsibility for understanding the risks, putting appropriate safeguards in place and ensuring continuity of critical services continues to rest with the bank,” he said.

 

Swaminathan said cyber threats and digital fraud did not distinguish between large and small banks. “A cyber attacker does not distinguish between a large bank and a small bank. A digital fraud does not slow down because the bank has fewer branches. And a vulnerability in a common technology platform can affect several institutions at the same time,” he said.

 

The RBI deputy governor said UCBs could use common infrastructure and sector-level arrangements to overcome constraints arising from their smaller scale. The UCB sector comprises more than 1,400 institutions, many of which face similar technology, skills and operational challenges.

 

“Co-operation among institutions” could help build capabilities that individual banks may find difficult to develop on their own, he said, adding that the National Urban Co-operative Finance and Development Corporation (NUCFDC), the umbrella organisation for the sector, could play an important role.

 

“Individual scale can, therefore, be supplemented by collective capability,” Swaminathan said.