NRB's 'Paradigm Shift': Flood, Cyber, and AI Risks Now to be Tested in Bank Balance Sheets

For decades, Nepal's banking sector considered unrecovered loans, fluctuating market interest rates, or liquidity (investable funds) shortages as the only major risks. However, addressing the changing global landscape, rapid technological advancements, and the growing environmental crisis, the Nepal Rastra Bank (NRB) has completely redefined the traditional definition of risk. Replacing the old working procedures of 2018, the newly introduced 'Risk Management Guidelines, 2026' now compels banks and financial institutions to proactively assess the potential crises posed by floods, landslides, climate change, cyber-attacks, and Artificial Intelligence (AI) alongside credit and market risks.

Climate Change: Now at the Center of Financial Risk

The recent devastating flood in the Bhotekoshi river not only damaged hydropower and physical infrastructure but also sent a serious message about how vulnerable the banking sector's billion-rupee investments are. Acknowledging this reality, the NRB has for the first time placed 'climate risk' on the list of banks' direct financial risks. According to the new provision, every bank must now form a 'Climate Risk Committee' at the board of directors level, which must hold meetings every quarter.

Now, before investing loans in hydropower, agriculture, or other infrastructure, banks will have to conduct 'stress testing' regarding the potential impacts of floods, landslides, or droughts. This means that when a bank extends a loan to any project or business, looking only at profitability is no longer enough; it must evaluate, before granting the loan, how the borrower's business will survive and how the bank's money will be recovered if a disaster strikes tomorrow.

Strict Monitoring on Technology and AI

As much as the use of technology has made banking services easier, it has increased the risks equally. To regulate this, the NRB has made information technology and cyber security an integral part of institutional risk, rather than leaving it solely to the 'IT Department'. Now, every bank is mandated to establish a 'Security Operations Center' (SOC) for 24/7 cyber security monitoring and a 'Cyber Security Incident Response Team' (CSIRT) to counter sudden cyber-attacks.

Additionally, in case of technical glitches in mobile banking or digital payment services, banks themselves must set clear limits on how long the service can be interrupted (downtime) and within what time it will be resumed (recovery time), and report this to the NRB. On the other hand, the growing use of AI (Artificial Intelligence) and machine learning in the banking sector has also been reined in. The entire responsibility of ensuring transparency, ethics, and security when using AI in areas like customer credit scoring, Anti-Money Laundering (AML) investigations, or KYC (Know Your Customer) procedures has been placed squarely on the banks' shoulders.

Complete Ban on Loopholes Hiding Bad Debts

The new guideline has adopted strict policies to neutralize the tendency of hiding 'Non-Performing Loans' (NPL), a problem that has been smoldering like an underground fire within the financial system. Banks must now keep the department that issues loans or expands business (business unit) completely separate from the department that approves loans (credit approval unit). This is expected to put the brakes on the tendency to indiscriminately distribute loans under the pressure of meeting targets and conflicts of interest.

Likewise, the loophole of hiding NPLs by haphazardly rescheduling or restructuring the loans of borrowers who could not repay their old debts has now been closed. When restructuring a loan, its commercial viability (the basis for the business to recover) must mandatorily be confirmed, and a clear provision for expected credit loss must be made according to the international standard 'NFRS-9'. A mandatory provision has also been added requiring banks to set up a separate 'recovery unit' solely to recover defaulted loans.

Good Governance and the 'Three Lines of Defense'

To strengthen internal governance within banks, the concept of the 'Three Lines of Defense' has been strictly implemented. The first tier will consist of the business unit; the second tier will have an independent risk management department led by the Chief Risk Officer (CRO); and the third tier will house the internal audit department. The Chief Risk Officer has been kept completely independent from the pressure of expanding business and has been given direct access to the board of directors.

Furthermore, discrimination in employee management following a merger or acquisition has also been classified as a serious risk. A clear rule has been introduced that prohibits any form of discrimination regarding career development, voluntary retirement, and benefits among legacy employees post-merger.

Liquidity Crisis Preparedness and Capital Pressure

Learning from how severely liquidity crises have battered banks in the past, the NRB has directed all banks to mandatorily create a 'Contingency Funding Plan'. The risk associated with collecting heavy deposits from a single sector or a limited number of individuals must also be mitigated.

Undoubtedly, implementing all these new provisions will cause the operating costs of banks to soar. Purchasing new technology, establishing cyber security infrastructures, hiring skilled manpower, and forming separate committees may make it extremely challenging for banks currently under pressure regarding their capital adequacy ratio (with an average Tier-1 capital of 9.61% and total capital adequacy of 12.53%) to raise additional capital.

Conclusion: From Post-Disaster Management to Pre-Disaster Precaution

Overall, it appears that the NRB has prioritized the long-term stability of the entire banking system over momentary profits and operating costs. This new guideline steers the Nepali banking sector away from the traditional reactive approach of dealing with a crisis after it occurs, moving towards the international standard of proactive risk mitigation. This step is certain to prove a significant milestone in banking history for improving credit quality and safely navigating changing technologies.