Banking regulation and supervision in India: laws, norms and PCA

This topic is unusual: it is both a Paper III chapter and a description of the job you are applying for. Many Grade B officers spend their careers in the RBI's regulation and supervision departments. Examiners know this, so questions tend to ask why a rule exists and what it achieves, not just what it says. If you can connect each rule to a risk it controls, you can answer almost any question here.

Regulation versus supervision

The two words are often used together, but they are different jobs.

• Regulation is rule-making: who may open a bank, how much capital and liquidity it must hold, how much it may lend to one borrower, and how its board must be structured.
• Supervision is checking: whether banks follow the rules and how risky they actually are, through off-site returns, on-site inspections and follow-up action.

Good rules with weak supervision fail, and strong supervision cannot fix bad rules. Most bank failures show a gap in one or the other.

The legal foundation

The RBI's powers over banks come mainly from two Acts.

A few other laws complete the picture. The Deposit Insurance and Credit Guarantee Corporation Act, 1961 insures deposits up to ₹5 lakh per depositor per bank (the limit since 2020). The Payment and Settlement Systems Act, 2007 covers payment systems. SARFAESI (2002) and the IBC (2016) govern recovery and resolution.

Two recent amendments matter for the exam:

• Banking Regulation (Amendment) Act, 2020: brought cooperative banks much more fully under RBI regulation on management, capital, audit and resolution, after governance failures in some urban cooperative banks.
• Banking Laws (Amendment) Act, 2025: allows up to four nominees for a deposit account, raises the "substantial interest" threshold in a company from ₹5 lakh to ₹2 crore, and extends the maximum tenure of cooperative bank directors (other than the chair and whole-time directors) from eight to ten years.

Prudential norms: the rulebook

Prudential norms are rules that keep a bank safe whatever its business model.

Worked example: exposure limits

Under the RBI's Large Exposures Framework, a bank's exposure to a single counterparty is capped at 20% of its Tier 1 capital (the board may allow up to 25% in exceptional cases), and to a group of connected counterparties at 25% of Tier 1 capital.

A bank has Tier 1 capital of ₹24,000 crore.

1. Single counterparty limit = 20% of 24,000 = ₹4,800 crore.
2. With board approval in exceptional cases, 25% of 24,000 = ₹6,000 crore.
3. Group limit = 25% of 24,000 = ₹6,000 crore.
4. If three companies of one group owe ₹2,500 crore, ₹2,200 crore and ₹1,800 crore, the group exposure is ₹6,500 crore. That is ₹500 crore over the limit, even though each company alone is within the single-counterparty cap.

The point: concentration risk is measured across connected borrowers, because they tend to fail together.

How supervision works

The RBI's supervision is overseen by the Board for Financial Supervision (BFS), set up in 1994. In 2019 the RBI created unified Departments of Regulation and Supervision covering banks, cooperative banks and NBFCs, so that one institution type is not supervised more lightly than another.

• Off-site monitoring: banks file regular returns; analysts watch trends in capital, asset quality, liquidity and concentration, with early-warning indicators.
• On-site inspection: examiners test loan files, provisioning, systems and controls. Annual Financial Inspection used to rate banks on the CAMELS framework (Capital, Asset quality, Management, Earnings, Liquidity, Systems).
• Risk-based supervision: more supervisory attention goes to banks with higher risk and systemic importance. The RBI's current model is called SPARC (Supervisory Programme for Assessment of Risk and Capital).
• Enforcement: directions, monetary penalties, restrictions on business, removal of managers, and in the last resort supersession of the board or a reconstruction scheme.

Prompt Corrective Action (PCA)

PCA is a set of pre-announced triggers. When a bank breaches them, restrictions follow automatically, so that supervisory action is not delayed or negotiated. The revised framework for banks took effect on 1 January 2022 and tracks three indicators.

Mandatory actions rise with each threshold: restrictions on dividends and profit remittance at threshold 1, on branch expansion at threshold 2, and on capital expenditure (other than technology upgrades) at threshold 3. The RBI can add discretionary measures such as limits on risky lending, a management review or a special audit.

Worked example: placing a bank under PCA

A bank reports CRAR 10.4%, CET1 7.6%, net NPA 9.8% and a leverage ratio above the minimum.

1. CRAR 10.4% is below 11.5% but above 9%: threshold 1.
2. CET1 7.6% is below 8% but above 6.375%: threshold 1.
3. Net NPA 9.8% is between 9% and 12%: threshold 2.
4. The bank is placed under PCA, and the most severe breach decides the actions. Here that is threshold 2, so it faces dividend restrictions and a bar on new branches, plus whatever discretionary steps the RBI adds.

Consumer protection

• RBI Integrated Ombudsman Scheme, 2021: merged the separate ombudsman schemes for banks, NBFCs and digital transactions into "one nation, one ombudsman". A customer must first complain to the entity and can approach the ombudsman if there is no reply within 30 days or the reply is unsatisfactory.
• Limited liability for fraud: a customer has zero liability for an unauthorised electronic transaction caused by a third-party breach if they report it within three working days; liability is limited if they report it later.
• Fair practices codes on charges, recovery conduct and disclosure, and the Internal Ombudsman mechanism within large banks.

Model answer outline (15 marks)

Question: "The RBI's supervisory framework has shifted from compliance checking to risk-based supervision." Discuss with reference to recent reforms.

1. Introduction: regulation versus supervision; the RBI's mandate under the BR Act and RBI Act.
2. The old approach: periodic inspection, CAMELS ratings, focus on rule compliance.
3. Why it changed: hidden NPAs, governance failures in some private and cooperative banks, the growth of NBFCs.
4. The new approach: risk-based supervision (SPARC), unified supervision across entity types, early-warning analytics, PCA triggers, scrutiny of governance and assurance functions.
5. Legal backing: the 2020 amendment for cooperative banks; powers to remove managers and supersede boards.
6. Challenges: data quality, supervisory capacity, fintech partnerships and cyber risk.
7. Conclusion: supervision now aims to find problems before they appear in the balance sheet.

Short model answer (10 marks)

Question: Explain the Prompt Corrective Action framework and its purpose.

Prompt Corrective Action is a framework under which the RBI imposes pre-defined restrictions on a bank whose financial position breaches set thresholds. The revised framework for banks, effective January 2022, tracks capital (CRAR and CET1), asset quality (net NPA ratio) and leverage (Tier 1 leverage ratio). Each indicator has three risk thresholds.

Once a bank crosses a threshold, mandatory actions follow: restrictions on dividends at the first level, on branch expansion at the second, and on capital expenditure at the third. The RBI may also restrict lending to risky segments, require a capital plan or order a special audit.

The purpose is early and predictable intervention. Because triggers are announced in advance, supervisors cannot delay action and banks know the consequences of weak capital. It protects depositors and pushes owners to recapitalise. The cost is that restricted banks lend less, which can hurt credit growth in their regions. PCA is therefore best seen as a bridge to recovery, and banks exit once they meet the thresholds on a sustained basis.

Practice questions

1. Under which section of the Banking Regulation Act does the RBI license banks?
   • Section 22.
2. What is the current deposit insurance cover per depositor per bank?
   • ₹5 lakh, set in 2020.
3. Which three indicators does the revised PCA framework for banks track?
   • Capital (CRAR and CET1), asset quality (net NPA) and leverage.
4. A bank's Tier 1 capital is ₹15,000 crore. What is its normal single-counterparty exposure limit?
   • ₹3,000 crore (20%).
5. Which body within the RBI oversees supervision?
   • The Board for Financial Supervision, set up in 1994.
6. Within how many days must a customer report a third-party electronic fraud to have zero liability?
   • Three working days.

What to do next

• Write the section numbers of the BR Act from memory: 20, 22, 24, 35, 35A, 36AA, 36ACA and 45.
• Redo the PCA example for a bank with CRAR 8.8% and net NPA 5%.
• Read the Basel norms guide for the capital ratios behind PCA.
• Then read the NPA and IBC guide and the RBI functions guide.