Indian Banking Needs Better Governance, Not Simply More Regulation

Recent governance and regulatory actions involving the senior management of leading banks have once again brought banking governance into public discussion. While individual cases will always have their own facts and circumstances, they also provide an opportunity to ask a broader question: are there deeper structural issues within our banking system that deserve attention? In my view, the answer is yes.

The first challenge is the chronic underinvestment in core technical competencies, particularly in credit risk measurement, market risk management and risk governance. Modern banking has become intensely technical. Whether it is Expected Credit Loss (ECL), Basel standards, treasury risk, securitisation, derivatives, model risk or climate-related financial risks, banks increasingly operate in an environment where sophisticated judgement is as important as technology. Yet many institutions continue to believe that investments in software, artificial intelligence and algorithms can substitute for investments in experienced professionals. They cannot.

Technology is an exceptional enabler, but it cannot replace domain expertise. Models must be designed, challenged, calibrated and interpreted by people who understand their limitations. Every major financial crisis has demonstrated that models fail not because the mathematics is wrong, but because human judgement around assumptions, governance and oversight is inadequate.

India has witnessed this before. The derivatives disputes following the 2008 global financial crisis significantly affected confidence in the domestic derivatives market. Many disputes centred on allegations of mis-selling, resulting in years of litigation across Indian and overseas courts. More recently, the AT1 bond episode demonstrated that complex financial instruments require both robust governance within banks and appropriate suitability assessments for investors. These events occurred years apart and involved different products, yet they underline the same lesson: sophisticated financial products demand equally sophisticated risk governance.

Independent Assurance
The second issue lies in the quality of independent assurance. Boards, regulators and investors necessarily depend upon assurance functions to obtain an objective view of whether systems, controls and governance are working as intended. However, assurance exercises too often become compliance-oriented rather than expertise-driven. They satisfy procedural requirements without necessarily providing genuine insight into emerging risks.

This is particularly concerning because modern banking risks are increasingly specialised. Evaluating an ECL framework, validating treasury controls or assessing model governance requires deep technical expertise built over many years. Such assignments cannot be approached merely as checklist exercises. Independent assurance must be sufficiently experienced, technically respected and professionally confident to challenge senior management whenever necessary. The objective is not to criticise management, but to protect it by identifying weaknesses before they evolve into regulatory concerns or business failures.

The third challenge is cultural. Many organisations continue to reward deference to hierarchy more than independent thinking. Such structures may deliver operational efficiency during stable periods by embedding a strong chain of command, but they become less effective when institutions face rapidly changing regulatory expectations and increasingly complex financial products.

Boards and senior executives today operate under significantly greater personal accountability than ever before. This makes it even more important that they are surrounded by individuals willing, and encouraged, to express technically sound but inconvenient opinions. Strong organisations are rarely built by 'yes-men'. They are built by competent professionals who possess both the expertise and the independence to question assumptions, escalate concerns and recommend corrective action, even when those recommendations are uncomfortable.

Peter Senge captured this phenomenon succinctly in The Fifth Discipline when he observed: "Today's problems come from yesterday's solutions." Organisational structures that worked well in a less complex banking environment may no longer be adequate for today's highly regulated, model, risk and technology intensive financial system.

The gap is often even wider in smaller institutions, where specialised technical capability remains limited. At the same time, it is beyond dispute that sophistication is no longer optional. It is essential to the safety and stability of every financial system. Regulatory expectations continue to evolve rapidly, covering areas such as ECL implementation, model risk management, operational resilience, cyber risk and governance.

The answer is not simply more regulation around governance. India already has built in recent years a comprehensive regulatory framework for that. The greater need is for stronger execution through investment in people, technical capability and genuinely independent expert assurance. Banks should view assurance not as a regulatory obligation but as a strategic investment that safeguards the institution, its board and its senior management.

Recent regulatory actions should therefore be viewed not merely as isolated enforcement events but as reminders of a broader truth. Sustainable governance is built on capable people, robust processes and a culture that values informed challenge. Algorithms can strengthen decision-making, but they cannot replace professional judgement. Ultimately, the resilience of any financial institution depends not only on the sophistication of its systems but also on the quality, independence and courage of the people entrusted with operating them.