RBI/DOR/2026-27/__
DOR.GOV.REC.No.__/18.10.014/2026-27

June xx, 2026

Reserve Bank of India (Urban Co-operative Banks - Governance) Second Amendment Directions, 2026

The Reserve Bank had issued Reserve Bank of India (Urban Co-operative Banks - Governance) Directions, 2025 on November 28, 2025.

2. At present, the regulatory instructions with respect to control / assurance functions viz. risk management, compliance and internal audit are contained in various directions / circulars. With a view to strengthening the governance framework for these functions and to ensure greater clarity, consistency and harmonisation in the instructions pertaining to these functions, it has been decided to review and consolidate them under these directions.

3. Accordingly, in exercise of the powers conferred by Section 35A read with Section 56 of the Banking Regulation Act, 1949, and all other provisions / laws enabling Reserve Bank of India in this regard, the Reserve Bank being satisfied that it is necessary and expedient in the public interest so to do, hereby issues the Directions hereinafter specified.

(1) These Directions shall be called the Reserve Bank of India (Urban Co-operative Banks - Governance) Second Amendment Directions, 2026.

(2) These Directions shall come into effect on January 1, 2027.

(3) These Directions shall modify the Reserve Bank of India (Urban Co-operative Banks - Governance) Directions, 2025 (hereinafter called as ‘the said Directions’) in the manner as specified hereinafter.

(i) Sub-paragraph (1) of paragraph 4 of the said Directions shall be deleted.

(ii) Before sub-paragraph (2) of paragraph 4 of the said Directions, the following shall be inserted, namely:

“(1a) ‘Assurance’ means those activities which provide independent confirmation and confidence to the Board or its committees on the compliance of business functions with the internal control environment as well as the applicable laws, rules and regulations.

(1b) 'Board’ means the Board of Directors or the governing body of a UCB, by whatever name called, to which the direction and control of the management of affairs of the UCB is entrusted.

(1c) ‘Compliance’ means the state of being in accordance with the applicable laws, regulations, rules, directions issued by the Reserve Bank, self-regulatory organisation standards, codes of conduct applicable to a UCB’s activities and with the internal control systems laid down to comply with the foregoing.

(1d) ‘Compliance Culture’ means the set of values, attitudes, and behaviours that are promoted and demonstrated throughout the organisation, ensuring that adherence to laws, regulations, internal standards, and ethical norms is routinely prioritised and embedded throughout the organisation’s operations and decision-making.

(1e) ‘Compliance Function’ means policies, processes, procedures, systems, and personnel dedicated for compliance.

(1f) ‘Compliance Risk’ means the risk of legal or regulatory sanctions, material financial loss, or loss to reputation a UCB may suffer as a result of its failure to comply with laws, regulations, rules, directions given by Reserve Bank, related self-regulatory organization standards, and codes of conduct applicable to its activities.

(1g) ‘Control Functions’ means those functions that have a responsibility independent from business functions to provide objective assessment, reporting and/or assurance. This includes Risk Management Function, Compliance Function and Internal Audit Function.”

(iii) After sub-paragraph (2) of paragraph 4 of the said Directions, the following shall be inserted, namely:

“(2a) ‘Internal Audit Function’ means an activity that provides independent assurance to the Board or its committees on the quality and effectiveness of the UCB’s internal control, risk management and governance systems and processes.

(2b) ‘Internal Audit Plan’ means the document that defines the scope, coverage, areas, frequency, etc. of internal audit.

(2c) ‘Internal Controls’ means a set of rules and controls governing a UCB’s organisational / operational structure, including reporting processes and functions.

(2d) ‘Risk Appetite’ means the aggregate level and types of risk a UCB is willing to assume, decided in advance and within its risk capacity, to achieve its strategic objectives and business plan.

(2e) ‘Risk Limits’ means specific quantitative measures or limits that allocate the aggregate risk appetite across business functions, legal entities, specific risk categories, concentrations and other measures.

(2f) ‘Risk Management’ means the processes established to ensure that all risks and associated risk concentrations are identified, measured, analysed, managed, mitigated, monitored and reported on a timely as well as comprehensive basis.

(2g) ‘Risk Management Function’ means policies, processes, procedures, systems and personnel dedicated for Risk Management.”

(iv) The title of Chapter-II, viz., “Constitution of Board and Appointment of Directors” shall be modified to “Constitution of Board and Appointment of Directors / Managing Director / Chief Executive Officer”.

(v) After paragraph 8, the following shall be inserted, namely:

“8A. The appointment, reappointment, and termination of appointment of a Managing Director / Chief Executive Officer (MD / CEO) shall, in terms of Section 35B(1)(b) read with Section 56 of the Banking Regulation Act, 1949, require the previous approval of the RBI.

8B. Applications in this regard, along with the requisite documents as indicated on the PRAVAAH portal (https://pravaah.rbi.org.in), shall be submitted to the RBI through the portal, at least four months before the expiry of tenure of the incumbent MD / CEO.”

(vi) In paragraph 16 of the said Directions, for the words, symbols and brackets “Since the primary responsibility of risk management lies with the Board, a UCB with an asset size of ₹5000 crore or above (as on March 31 of the previous year)”, the words, symbols and brackets “A UCB having total assets of ₹5000 crore or above (as per the audited balance sheet as on March 31 of the previous financial year)” shall be substituted.

(vii) After Chapter V of the said Directions, the following new Chapter shall be added, namely:

“Chapter V-A Control Functions: Risk Management, Compliance, and Internal Audit

A. General

17A. A UCB having total assets of ₹5000 crore or above (as per the audited balance sheet as on March 31 of the previous financial year) shall establish Risk Management Function, commensurate with its size, complexity, and risk profile, headed by a Chief Risk Officer (CRO).

17B. Every UCB shall establish Compliance and Internal Audit functions, commensurate with its size, complexity and business profile, headed by a Chief Compliance Officer (CCO) and a Head of Internal Audit (HIA), respectively.

17C. A UCB shall have policies for each of the three control functions, viz. Risk Management, Compliance and Internal Audit, clearly articulating the objectives, roles and responsibilities of each function. These policies shall be approved by the Board and reviewed periodically.

17D. The above functions shall -

(1) have the necessary authority and autonomy to discharge their responsibilities effectively.

(2) be independent of the business lines, free from conflicts of interest and business targets. Accordingly, they shall neither be involved in revenue generation nor have the remuneration of their staff linked to the business area being overseen.

(3) have unrestricted access to all business areas and records.

(4) not be outsourced, being core activities. However, external experts may be engaged under the oversight of CRO/CCO/HIA for specialised tasks without diluting the accountability of the functions.

17E. As part of the overall corporate governance framework, the Board is responsible for overseeing the control functions. The Board must set the ‘tone at the top’ and ensure that these functions are adequately resourced and maintain their independence. Further, the Board or RMCB / ACB, as applicable, shall review control functions on an ongoing basis to ensure their continued relevance and effectiveness.

17F. The Risk Management and the Compliance functions shall be subject to regular internal audit. A Tier 4 UCB shall also subject its Risk Management Function to periodic external review, to benchmark the practices and strengthen the effectiveness of the function.

B. Appointment of CRO, CCO and HIA

17G. A UCB shall adhere to the following terms for appointment of CRO, CCO and HIA:

(1) Appointing authority and rank: A UCB shall appoint / designate suitably senior employees, not more than two levels below the MD / CEO, as CRO, CCO and HIA, with the approval of the Board.

Provided that Tier 1 and Tier 2 UCBs may appoint / designate suitably senior employees as CCO / HIA in accordance with their internal policies.

(2) Knowledge / Experience: CRO, CCO and HIA shall possess adequate domain knowledge and relevant experience in the respective fields, commensurate with the size, complexity and risk profile of the UCB.

(3) Age: The age limits for CRO, CCO and HIA to hold office shall be prescribed by the UCB as a part of its internal policy.

(4) Tenure: CRO, CCO and HIA shall ordinarily be appointed for a fixed tenure of not less than three years.

(5) Premature transfer / removal: Any transfer or removal of CRO, CCO and HIA prior to the completion of the stipulated tenure shall be subject to the approval of the Board.

(6) External Hiring: If considered necessary, suitably experienced and competent external candidates may be hired as CRO, CCO or HIA. However, consultants, advisors, part time auditors or individuals who are neither on the rolls of the UCB nor have a contractual employer-employee relationship with the UCB shall not be appointed / designated as CRO, CCO or HIA.

C. Independence of CRO, CCO, and HIA

17H. CRO, CCO and HIA shall function with independence, objectivity and free from conflict of interest. In particular, CRO, CCO and HIA shall –

(1) functionally report to the Board or the respective Board Committee and administratively report to MD / CEO.

(2) not be assigned business targets or have their remuneration linked to the performance of any business line.

(3) meet the Board or the respective Board Committee at least once in a quarter, without the presence of the Senior Management (including the MD / CEO / WTD). Even otherwise, they shall have direct and unrestricted access to the Board or the respective Board Committee to enable them to communicate concerns without management interference.

(4) have their final performance review carried out by the Board or the respective Board Committee.

D. Risk Management Function

17I. The Board shall ensure an effective oversight over the UCB’s Risk Management Function. The Board / RMCB shall clearly define the role and responsibilities of the CRO, subject to the following:

(1) The CRO shall be primarily responsible for overseeing the development and implementation of the UCB’s Risk Management Function. This shall include enhancements to risk management systems, policies, processes, quantitative models, reports, etc. to ensure that the bank’s risk management capabilities are effective, to fully support its strategic objectives and risk-taking activities.

(2) The CRO shall be an adviser to the authority to whom powers have been delegated to assume risk, e.g., sanctioning credit, making investments, etc. The advice of the CRO shall be supported with proper rationale.

(3) The CRO shall be an invitee to the meetings of the credit sanction / approval committee, without any voting rights in the proceedings thereof.

(4) Assumption of any risk / exposure, contrary to the advice of the CRO, without incorporating adequate risk mitigation measures, shall rest with the next higher authority in the delegation matrix, except where the risk assuming authority is the Board. All such cases shall be reported to the Board / RMCB.

17J. The Risk Management Function shall –

(1) be responsible for overseeing that the UCB operates within its risk appetite and for assessing risks and related issues, independent of the business lines.

(2) implement a bank-wide risk strategy aligned with the Board-approved risk appetite, including clear risk limits and structured allocation of risk parameters to business units and risk takers.

(3) ensure robust information infrastructure to support accurate capital and liquidity assessments, granular risk monitoring at business-unit levels, and consolidated reporting across the UCB to enable strategic planning and compliance with risk tolerance thresholds.

(4) continuously evaluate risk exposures against defined limits, challenge decisions proposed / taken by the business functions and promptly escalate critical issues to senior management and the Board / RMCB, ensuring timely adjustments to maintain alignment with risk appetite.

(5) enhance the capability of business line managers to identify and assess the risks critically rather than relying on the surveillance conducted by it.

17K. The Board shall ensure an effective oversight over bank’s compliance risk.

17L. The Senior Management shall be responsible for effective management of a UCB’s compliance risk, including communication of the compliance policy throughout the bank and ensuring that it is observed in letter and spirit. Further, Senior Management shall also be responsible for embedding compliance in the business strategy while ensuring that risks of non-compliance are identified and mitigated, and for promoting compliance culture. Reviews and reporting should be regular and meaningful, with frequency based on the risk profile of the UCB.

17M. A UCB shall maintain a compliance programme supported by an annual compliance risk assessment placed before the Board or the ACB. The Compliance Function shall monitor and test compliance by inter-alia performing sufficient and representative compliance testing.

17N. The Compliance Function shall –

(1) ensure adherence to statutory and regulatory requirements, fair customer treatment, and sound market conduct. The CCO shall be the nodal point of contact between the bank and the RBI.

(2) proactively identify, assess, and manage compliance risks, and provide independent assurance to the Board or the ACB on the effectiveness of compliance policies, controls, and remediation of breaches, to be in state of compliance and for the improvement in compliance culture.

(3) vet internal policies and communications, act as a reference point for regulatory interpretation, and coordinate with other control / assurance functions such as Risk Management and Internal Audit, while maintaining its independence.

F. Internal Audit Function

17O. The Board shall have an effective internal audit framework, proportionate to the UCB’s risk profile with adequate resources and independence. Staff posted to the Internal Audit Function should ordinarily have a tenure of at least three years.

17P. The Senior Management shall be responsible for ensuring effectiveness of the Internal Audit Function. It must facilitate the independence of audit, provide full access and act promptly on audit findings. The Senior Management shall ensure that internal auditors have sufficient knowledge and training appropriate to the entity’s risks.

17Q. The Internal Audit Function shall provide independent evaluation of governance, risk management, compliance, internal controls, business lines, support functions, outsourced activities, etc., ensuring assurance across the entire organisation. All significant activities shall be audited over a defined cycle (ordinarily not exceeding three years), with high-risk areas reviewed more frequently.

17R. The Internal Audit Function shall –

(1) follow systematic methodologies aligned with professional standards, using tools such as data analytics, thematic reviews, and automated monitoring, with proper documentation.

(2) coordinate with risk management, compliance, and external auditors while retaining independent judgment, ensuring clear distinction of responsibilities.

17S. A UCB shall adopt Risk-Based Internal Audit (RBIA) approach, focusing on areas of higher risk, materiality, systemic relevance, and supervisory concerns as given in Annex I-a.

Provided that for a UCB having total assets of less than ₹500 crore (as per the audited balance sheet as on March 31 of the previous financial year), the adoption of the RBIA approach shall be voluntary.

G. Intimation to the Reserve Bank

17T. A UCB shall ensure compliance with the following intimation requirements:

(1) CRO: Any appointment (including interim appointment and re-appointment), premature transfer, removal, exit or change in tenure of the CRO shall be reported to Department of Supervision, RBI, within five working days. Reporting of appointment including interim appointment and re-appointment shall be accompanied with a profile of the CRO.

(2) CCO and HIA: Any appointment (including interim appointment and re-appointment), premature transfer, removal, exit, or change in tenure of CCO or HIA in a Tier 3 or Tier 4 UCB shall be reported to Department of Supervision, RBI at least five working days in advance. Intimation of appointment / interim appointment / re-appointment shall be accompanied with the candidate’s profile and a confirmation from the competent authority that the candidate is fit and proper for the position. The appointment may be communicated to the candidate only after the lapse of five working days from the date of receipt of intimation by the Reserve Bank, provided no communication to the contrary is received from the Reserve Bank.

(viii) Chapter VII (Appointment of Key Officers) of the said Directions shall be deleted.

(Scenta Joy)
Chief General Manager