What changed
RBI replaced its 2005 Guidance Note on Operational Risk Management with a new, comprehensive framework based on BCBS 2021 principles. The new note explicitly adds operational resilience as a key objective, covering disruptions from IT threats, geopolitical conflicts, pandemics, and climate change. It adopts a principle-based, proportionate approach for all regulated entities.
What it means for you
Banks must now integrate operational resilience into their risk management frameworks, ensuring they can withstand and recover from disruptions while continuing critical operations. The guidance emphasizes managing third-party and technology risks, which have grown post-pandemic. Regulatory capital requirements for operational risk remain unchanged, but the bar for risk governance and business continuity has been raised.
What you must do
- Review and update your Operational Risk Management Framework to align with the new principle-based guidance.
- Assess and strengthen business continuity plans for critical operations, covering cyber, third-party, and natural disaster scenarios.
- Enhance board and senior management oversight of operational risk and resilience, documenting risk appetite and tolerance.
- Map interdependencies with third-party providers and ensure robust vendor risk management processes.
- Prepare for proportionate implementation based on your bank's size, complexity, and risk profile.
Who it affects
All commercial banks (Scheduled, RRBs, Urban Co-op Banks, etc.), Risk management teams, Board of Directors and senior management, IT and cybersecurity departments, Third-party vendor management teams
Does this guidance change operational risk capital requirements?
No, the guidance explicitly states that operational risk regulatory capital requirements will continue to be governed by existing applicable guidelines.
Is this a one-size-fits-all mandate?
No, RBI has adopted a proportionate approach, allowing flexibility based on the RE's size, nature, complexity, and risk profile.
What happens if there is a conflict between this guidance and other RBI instructions?
Relevant RBI instructions issued from time to time will prevail over this guidance note.