Can't treat compliance as a quarter-end activity: RBI DG Swaminathan J

RBI's Swaminathan urges banks to strengthen compliance, operational resilience, data governance, and third-party risk management to prevent disruptions and improve supervision

Banks cannot treat compliance as a quarter-end activity, and must have stronger operational discipline and data governance throughout the year, Reserve Bank of India (RBI) Deputy Governor Swaminathan J said in a speech at the Third Annual Global Conference of the College of Supervisors. The speech, delivered on Friday, was uploaded on the RBI website on Monday.

 

“In a fast-changing environment, backwards-looking compliance checks are necessary but not sufficient. We have to be able to spot weak signals early, test resilience before incidents occur, and intervene before vulnerabilities become an event,” Swaminathan said while emphasising that explaining and fixing an anomaly quickly, once it’s flagged, becomes a marker of control maturity.

   

Commenting that third-party management should be treated as risk management, he said institutions will need better oversight of partners, clearer accountability for incidents, and contracts that support audit, access, and resilience. “The regulated entity cannot outsource responsibility,” he said.

 

Swaminathan said customer grievance is not merely an irritation but often an early warning, and urged banks to find the root cause of complaints and resolve them on time.

 

“Do boards see a clear dashboard of complaint trends, repeat failures, and customer pain points? And, is there a proactive and swift remediation,” he asked.

 

The deputy governor said stability of a bank depends on operational resilience, data integrity, and third-party dependencies as much as it does on capital and liquidity, as lenders might look perfectly healthy on paper and still be one incident away from severe disruption.

 

With a change in the risk landscape in the digital age, he said, there is a need for better tools and a few fundamental principles that will keep supervision grounded as technology evolves, whereby regulation should remain clear on proportionality and accountability of institutions.

 

“Supervision must shift from periodic snapshots to continuous awareness and moving beyond a single institution, taking a sharper view of the ecosystem. There are four supervisory areas that are becoming central in the digital age – across operational resilience and cyber readiness; ecosystem and third-party dependencies; governance of data, models and artificial intelligence (AI); and technology-enabled, continuous supervision including better use of SupTech and analytics,” Swaminathan said.

 

He said in case of a few hours of outage, a serious cyber incident or a breakdown at a key service provider can impair critical services, calling for “deeper engagement with boards and senior management on cyber governance, crisis playbooks, recovery capability, and learning from near misses.” Secondly, he called for near real-time cooperation among supervisors as third-party incidents can transmit disruption at scale, citing the global IT outage of July 2024 as a reminder.

 

Swaminathan also said SupTech can help supervisors identify patterns early, detect anomalies, and focus attention where it matters the most. This will help more on-site and off-site teams to work closely with banks to pick up early signs and take follow-up action faster. “With better data quality and right analytics, supervisors can increasingly connect dots across silos,” he said.

 

“For supervisors, the bar is also rising. We need to remain rooted in the basics while also becoming more familiar with new risk areas. That means building the right mix of skills, including cyber, IT, data, and model expertise, alongside core prudential judgement,” he added.