# Bank compliance function directions 2026: a credit team view

> RBI's 2026 compliance function directions for commercial banks: who is covered, what the text requires, and where it touches credit teams.

Source page: https://creditbrief.in/posts/bank-compliance-function-directions-2026
Published: 2026-11-06
Publisher: CreditBrief

RBI's Compliance Function Directions, 2026 took effect on issuance, July 31, 2026, for commercial banks, and the text gives no transition period. They set no underwriting criteria. They reach credit teams through new product clearance, vetting of internal circulars, compliance testing and staff accountability.

## The direction at a glance

| Item | What the text says |
|---|---|
| Name | Reserve Bank of India (Commercial Banks - Compliance Function) Directions, 2026 |
| Reference | RBI/DoS/2026-27/408, DoS.CO.PPG.2/11.01.005/2026-27 |
| Effect | Immediately upon issuance (para 2) |
| Covers | Banking companies, corresponding new banks and the State Bank of India (para 3) |
| Expressly excluded | Small Finance Banks, Payments Banks and Local Area Banks (para 3) |
| Earlier instructions | Repealed, as communicated in circular DoS.CO.PPG.66/11.01.005/2026-27 of the same date (para 76) |

Everything below applies only to the banks covered. Other lenders should not read it as their rule.

The text does not list what changed from the earlier instructions. This piece therefore describes what the Directions require, not what is new.

## Why it matters for underwriters

The Directions define compliance risk as the risk of legal or regulatory sanctions, material financial loss or reputational loss from failing to follow laws, regulations, rules, related self-regulatory organisation (SRO) standards and applicable codes of conduct.

That risk sits in credit processes as much as anywhere else. Para 52 says compliance is not the Compliance Department's job alone and should pervade the bank.

The table separates binding wording from softer wording. The last column is general working practice, not RBI text.

| Para | Requirement | Wording | On a credit desk |
|---|---|---|---|
| 17(11), 35 | Compliance Department approval process for new products and processes; compliance risks analysed and mitigants in place before launch | Should | Bring compliance in before the product note is final, not at sign-off |
| 35 | Intensive monitoring of all new products for the first six months | Shall | Agree early which credit data feeds the monitoring |
| 33 | Compliance vets the bank's guidelines and circulars before they reach operational units | Shall | Route credit circulars through vetting before release |
| 34 | Compliance Department is the reference point for clarifying regulatory guidelines | Shall | Ask, and keep the answer on record |
| 36 | Function-wise compliance manuals approved by the Chief Compliance Officer (CCO), if operating manuals lack compliance sections | Shall | Check whether your credit manual has such a section |
| 39 | Sufficient and representative compliance testing, with results placed before the Board, Audit Committee of the Board (ACB) or MD & CEO | Shall | Expect credit files and processes to be in scope where the programme covers them |
| 44 | Staff accountability examined for all compliance failures | Shall | Keep a clear trail of who approved what |
| 44 | Due weightage to compliance record in performance appraisal | May | Check how your bank applies it |

## How it works

**Governance.** The Board has overall responsibility and reviews the Compliance policy at least annually (paras 6, 7). Compliance and Internal Audit must be kept separate (para 10). The MD & CEO ensures an independent function exists (para 11).

**Structure.** The bank decides the structure based on its branch network, size, complexity and products (para 20). A Compliance Department sits at the Head Office under the CCO (para 21). Each Head Office department, controlling office and branch or Strategic Business Unit has a distinct compliance function, with designated officials reporting to the CCO (para 23).

**Reporting lines and pay.** Compliance staff in operating units may report to unit management, but they also need a line through to the CCO for compliance work (para 26). Their pay shall not be related to the business line they cover, though it can generally relate to the bank's overall financial performance (para 27).

**Cadence.**

| When | What | Para |
|---|---|---|
| At least annually | Main compliance risks identified and assessed, with plans to manage them | 14(1) |
| Quarterly | Board or ACB reviews the Compliance function | 9 |
| Annually | Detailed review placed before the Board or ACB | 9, 47 |
| Monthly | Report on compliance risk position may go to senior management or MD & CEO | 48 |
| Promptly | Material compliance failures reported to the Board or ACB | 14(3) |
| At least once in three years | Independent external review of the quality assurance and improvement program | 53 |

**The CCO.**

| Test | Requirement | Para |
|---|---|---|
| Selection | Fit and proper criteria, a Board-constituted selection committee, final decision by the Board | 56 |
| Age | Not more than 55 at appointment, unless continuously associated with the Compliance function from before completing 55 | 58 |
| Experience | At least 15 years in banking or financial services, with at least five in Audit, Finance, Compliance, Legal or Risk Management | 59 |
| Tenure | Minimum fixed tenure of not less than three years; early transfer or removal only in exceptional circumstances, with explicit prior Board approval | 61, 62 |
| Rank | Preferably General Manager or equivalent, not below two levels from the MD & CEO | 63 |
| Independence | No reporting relationship with business verticals and no business targets | 66 |
| Dual hatting | No role that brings a conflict of interest, especially a business role | 67 |

For regional, zonal and business heads, para 59 matters. Risk Management there includes control functions within the business lines, so five or more years of such responsibility can meet the five-year condition. The 15-year condition and the other tests still apply.

**Technology.** The bank shall implement integrated, enterprise-wide, workflow-based tools (para 74). They must escalate non-compliance, record approval by the competent authority for deviations or delays in compliance submission, and give senior management a unified dashboard. The bank may choose the tool based on its size and complexity (para 75).

## India specifics

**Legal basis.** RBI issued the Directions under Section 35-A of the Banking Regulation Act, 1949. RBI describes the principles as aligned with the Basel Committee framework and adapted to the Indian operating environment.

**Supervisory follow-through.** The Monitorable Action Plan (MAP) and Risk Mitigation Plan (RMP) are prescribed after the Annual Financial Inspection or Risk-Based Supervision (RBS) process. Compliance units shall devise a time-bound strategy for them, and the bank shall comply well before the next supervisory cycle starts or within the prescribed period (para 46). Where a MAP or RMP point sits in a credit process, expect the owner to be asked for dated progress.

**Other regulators.** Compliance also covers directions from regulators such as IRDAI and SEBI where the bank's activities go beyond banking. The text's example is a bank acting as a corporate agent distributing insurance. Any discomfort another regulator conveys must be brought to RBI's notice (para 50).

**Group view.** A group or enterprise-wide programme covers the parent and its subsidiaries (para 19). If your bank has a lending subsidiary, expect its compliance information to feed the group view.

**Foreign banks.** A foreign bank operating through branches sets up the Compliance Department at its Controlling or Head Office in India (para 21). Under the branch model, the Regional or Head Office of Compliance is treated as equivalent to the Board for CCO appointment (para 56).

**Disclosure.** Non-compliance with regulatory guidelines, administrative actions against the bank and corrective steps should be disclosed in the annual report (para 43).

**Repeal.** Actions taken under the repealed instructions stay governed by them, and approvals granted under them are deemed governed by these Directions. Accrued liabilities, penalties and proceedings are not affected (para 77).

## Worked example, made-up numbers

Bank A, a covered bank, launches a new MSME term loan product on January 1, 2027. The six-month monitoring window therefore runs to June 30, 2027.

The Directions set no sample size, exception rate or trigger. Bank A's numbers below are invented, and these limits vary by institution. Bank A tests files monthly and escalates any month above a 4.0% exception rate.

| Month | Files tested | Exceptions | Rate | Above 4.0%? |
|---|---|---|---|---|
| January | 120 | 6 | 5.0% | Yes |
| February | 150 | 9 | 6.0% | Yes |
| March | 150 | 3 | 2.0% | No |
| April | 180 | 5 | 2.8% | No |
| May | 180 | 4 | 2.2% | No |
| June | 200 | 4 | 2.0% | No |
| Total | 980 | 31 | 3.2% | |

How to read it:

- The 3.2% total hides the early problem. January and February both breach the trigger, so look at the monthly trend first.
- Say the February exceptions trace to one unclear instruction in the product note. The credit owner asks Compliance for a clarification, and the corrected note goes through vetting before release.
- Bank A's compliance team then tests whether the rate falls. It drops to 2.0% in March.
- Separately, someone must decide whether any exception is a material compliance failure, which would need prompt reporting to the Board or ACB. A rate alone does not answer that question.

## Pitfalls

- **Treating all wording as equal.** Shall, should and may appear side by side. The monthly report and appraisal weightage use may, while staff accountability uses shall.
- **Assuming a variant is not new.** The text does not define new product. Ask Compliance and record the answer.
- **Mixing up products and processes.** The approval and pre-launch analysis language covers both. The six-month monitoring sentence names only new products.
- **Confusing testing with audit.** Compliance tests compliance (para 39), but compliance staff must never be given audit or inspection duty (para 24). Internal Audit in turn audits the Compliance function (para 54).
- **Reading para 68 too narrowly.** The CCO shall not sit on a committee that creates a conflict, including one dealing with purchases or sanctions, and any membership may be advisory only. The text does not explain sanctions further, so check how your bank applies this to credit committees. Para 72 separately says the CCO should be on new product committees.
- **Reading para 74 as a credit deviation rule.** The deviations there relate to compliance. The Directions do not set credit policy deviation limits, which vary by institution.
- **Leaving old references in manuals.** Earlier instructions stand repealed. The Compliance policy should cover periodic updates to operational manuals (para 17(10)).

## Checklist

- Confirm your institution falls within para 3 before applying any of this.
- Find out who the designated compliance official is for your department or office.
- Check that your credit manual has a compliance section, or that a CCO-approved function-wise manual exists.
- Confirm credit circulars and guidelines go through compliance vetting before release.
- For any new product or process, get compliance input before launch and record the mitigants.
- For any new product, confirm who owns the six-month monitoring and what data credit provides.
- Know how to report a suspected breach and how it gets escalated in your bank's compliance tool.
- Track any MAP or RMP point your team owns against its date.
- Replace references to repealed instructions in credit documents, with help from Compliance.

## Sources

- [Reserve Bank of India (Commercial Banks - Compliance Function) Directions, 2026](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13645), rbi.org.in, accessed 2026-11-06

Indicative only. Verify against your institution's policy.