सुशासनको दाबी, भित्र छ संकट: राष्ट्र बैंकको प्रतिवेदनले खोल्यो बैंकिङ क्षेत्रको वास्तविक अनुहारNepal's Banks Are Hiding Bad Loans, Funneling Credit to Directors, and Running ATMs on Obsolete Software. The Central Bank's Own Report Says So.

Kathmandu, June 15 — Nepal's commercial banks present themselves well. Annual reports speak of governance frameworks. Websites carry declarations of transparency. Board meetings produce resolutions on risk management. The language is polished, the commitments are emphatic, and the self-portrait is flattering.

Then Nepal Rastra Bank published its Bank Supervision Report 2024/25 — and the portrait cracked.

The report, produced by the central bank's own Bank Supervision Department, documents what inspectors found when they actually walked into banks and looked at the books. What they found was not a sector living up to its own rhetoric. It was a sector hiding bad loans, routing credit to connected parties, giving chief executives perks that violate regulatory guidelines, and running critical financial infrastructure on decade-old software that the manufacturer abandoned years ago.

The report's foreword, written by Department Executive Director Dirgha Bahadur Rawal, describes the banking sector as the economy's primary pillar and affirms the department's commitment to financial stability, strong corporate governance, and risk-based supervision aligned with international best practice. It is a confident statement of purpose.

The findings that follow tell a different story.

Loan Rollovers: How Bad Debt Disappears on Paper

The most widespread and structurally dangerous practice the report identifies is what it calls loan rollovers. When a borrower cannot repay principal or interest, a bank is supposed to classify that loan as non-performing and set aside provisions accordingly. Instead, inspectors found, banks were issuing new loans to the same borrowers to pay off the old ones — making a defaulted loan look current on paper.

The timing was not accidental. These fresh disbursements were concentrated at the ends of quarters, precisely when financial statements are prepared. The effect was to suppress non-performing loan ratios, inflate reported profits, and leave investors, depositors, and regulators looking at numbers that did not reflect reality.

The consequence of this practice is already visible in the aggregate. Commercial banks' non-performing loan ratio climbed from 3.94 percent to 4.44 percent in a single year. Analysts who have tracked Nepal's banking sector note that these figures, even after regulatory scrutiny, likely understate the actual level of stress in the system.

Some banks went further. Loans that should have been classified as watchlist, substandard, or doubtful were kept in the performing category, and the required provisions were not set aside. The reported health of the institution was, in these cases, a fiction.

The Director's Account

The report's most serious finding may be this: in multiple cases, loan funds were transferred to the accounts of bank directors or persons connected to them shortly after disbursement.

This is not a technical compliance failure. This is a fundamental corruption of the purpose of a bank.

Nepal's Banking and Financial Institutions Act requires banks to ensure that loans are used for the purposes for which they were sanctioned. In practice, the report found, most banks rely entirely on borrowers' self-declarations. Physical verification of loan end-use is rarely conducted. External credit ratings are not obtained for large borrowers. Audited financial statements are not required for loans above five million rupees. The bank's money leaves, and no one follows where it goes.

The combination of absent monitoring and loans flowing to connected parties creates conditions for a form of institutional self-dealing that is difficult to detect and, as this report makes plain, has been difficult to stop.

What the CEO Gets

Nepal Rastra Bank does not typically comment on executive compensation in granular terms. This report does.

Inspectors found that some banks had written domestic workers and personal security guards into the chief executive's employment contract — payable by the bank. Some contracts included unusually generous termination compensation clauses that conflict with the central bank's own guidelines. These arrangements, the report notes, were agreed to by boards that are supposed to represent the interests of shareholders and depositors.

Beyond compensation, the report found that key positions — deputy chief executive, assistant general manager — have been left vacant for extended periods at some institutions. Female directors required under company law have not been appointed. Remuneration policies, a basic governance requirement, have not been formulated. The absence of these structures is not incidental. It reflects boards that are not fully functional and management teams that operate without adequate oversight.

The Watchdog That Reports to the Watched

Risk management and internal audit functions exist in every bank. Their entire purpose is to provide independent oversight of management. The report found that in practice, at many institutions, they are not independent at all.

The performance appraisals of chief risk officers and heads of internal audit are being conducted by the chief executive officer himself — the very person these functions are supposed to scrutinize. The structural conflict this creates is obvious. An auditor who depends on the CEO for career advancement does not conduct audits the same way an independent one would.

Internal audit departments are understaffed. Qualified personnel are scarce. Thousands of unresolved audit observations sit in backlogs, managed not by experienced staff but by trainees. The function exists on paper. Its practical independence does not.

Windows 7 and the Single Key

Nepal's banking system runs on technology that, in several institutions, has not been meaningfully updated in years.

Multiple banks are operating ATMs on Windows 7 — an operating system Microsoft discontinued in January 2020. Machines running unsupported software receive no security patches. Every day they operate is a day a known vulnerability goes unaddressed.

The report's findings on operational security are equally alarming. Some branches are not retaining CCTV footage for the required ninety days. Trainees and outsourced staff have been granted access to core banking systems. The maker-checker system — a basic dual-authorization control for foreign currency transactions — is not being implemented. And in some branches, a single individual holds the vault key and operates the vault alone, violating the four-eyes principle that exists precisely to prevent internal theft.

These are not edge cases. They are patterns found across the sector.

Boards That Cannot Keep Up

The report raises pointed questions about how boards of directors actually function. At some banks, a single board meeting contains more than one hundred agenda items. No board can give meaningful attention to risk exposure, liquidity management, and financial health when it is moving through a hundred items in a sitting. The implication is that governance is being performed rather than practiced — that the meetings happen, the minutes are recorded, and the serious decisions are made elsewhere.

Board-level audit committees, which are supposed to provide independent financial oversight, are being attended by executive board members — a structural compromise of the independence these committees are meant to preserve.

What the Report Concludes

Nepal Rastra Bank identifies ten major challenges facing the banking sector: controlling regulatory arbitrage, ensuring risk management independence, monitoring loan end-use, improving data quality, strengthening internal audit, enhancing cyber security, and building a more effective integrated risk-based supervision system.

The central bank's conclusion is direct. Traditional inspection — verifying that paperwork is in order — is no longer sufficient. The risks within the banking system are interconnected and growing. Real improvement in governance, transparency, and accountability inside individual institutions is not optional. It is a precondition for financial stability.

That conclusion carries weight precisely because of who is making it. This is not a critique from outside the system. This is Nepal Rastra Bank — the regulator, the supervisor, the institution responsible for the sector's health — documenting, in its own words and its own report, the gap between what Nepal's banks say they are and what they actually are.

The findings are on paper. The question that remains is whether the response will be.