In Part 1, the authors argued that the buck stops at the top, starts at the bottom and gets lost in the middle. The corporate cases showed the music falling out of time despite professional boards and funded control functions. 

Cooperative banks test the same idea, where the instruments themselves are often missing.

The sector is small in assets but large in trust. India had 1,457 urban cooperative banks (UCBs) as of March 2025, with ₹5.84 trillion in deposits. Their number has fallen from 1,926 in 2004 to about 1,500, with no new licences since 2004. In August 2026, the RBIproposed to resume on-tap licensing. Their share of scheduled commercial bank assets slipped from 3.8% in 2017 to 2.5% in 2024.

Half the Orchestra May not have Turned Up
Size tells the story. Under the RBI’s four-tier framework, Tier 1 covers all unit banks, salary-earner banks and any UCB with deposits up to ₹1 billion. In 2024-25, 838 Tier 1 banks held ₹657.60 billion of deposits between them, or about ₹780 million each on average. Tier 3 and 4 banks, fewer than 6% of UCBs by number, held more than half of all deposits.

In a bank of that size, the first line may be one or two managers who sanction loans, record them and report on them, often with personal knowledge of every borrower. The second line may be a nominal compliance role. The third line may be an audit that checks compliance with cooperative law more than it tests risk.

The IIA’s latest paper accepts that smaller organisations will blend roles, but warns of self-review threats when the same person designs, monitors and later evaluates a process. It also sets out what independence needs: a functional reporting line to the board, control over audit scope, unrestricted access to information, its own resources and protection from retaliation. In a small cooperative, any of these may be missing.

The Top is Elected, and Depositors cannot Read the Warning Signs
A cooperative’s board is chosen by its members. That is its democratic strength and its governance weakness: directors are often elected for their standing in the community, not for banking or risk expertise, and election cycles can reward patronage over prudence.

The ultimate stakeholders are depositors who trust the bank because it is local and familiar. They cannot assess concentration or asset quality. 

Two Regulators can Mean No Regulator
Historically, UCBs answered to two authorities: the RBI for banking functions, and the state registrar of cooperative societies, or the Central Registrar for multi-state banks, for management and administration. Responsibility was split, and each could assume the other was watching. One analysis of the sector cites a committee that called dual control one of the most vexing problems of urban cooperative banking.

PMC Bank: The First Line Allegedly Hid the Risk, and No One Else Looked Hard Enough
On 23 September 2019, the RBI restricted Punjab and Maharashtra Co-operative Bank. Its exposure to a single real estate group, HDIL, was over ₹65 billion, or 73% of an ₹88.8 billion loan book. Mumbai Police’s Economic Offences Wing told a court that the bank had replaced 44 HDIL loan accounts with 21,049 fictitious ones when reporting to the RBI, and officials allegedly misled the regulator between 2008 and 2019. Yet the bank had reported a net profit of ₹996.9 million for 2018-19, with deposits of ₹116.2  billion. It was merged into Unity Small Finance Bank on 25 January 2022, more than two years after the restrictions began.

Read through the three lines. The first line allegedly masked the risk. The public record does not show a second line or an audit raising an alarm in time, and the board Chairman and CEO, who allegedly perpetrated the misconduct, did not inform the Board or prompt it to ask the question that mattered. 

Madhavpura and Karuvannur: The Pattern Repeats Across Two Decades
In March 2001, a run began at Madhavpura Mercantile Co-operative Bank in Ahmedabad after rumours of its exposure to stockbroker Ketan Parekh. The RBI later described a ₹12 billion fraud and ₹8 billion of inter-bank deposits that posed a systemic risk. Gujarat’s UCB deposits fell by ₹15 billion in 2001-02. The licence was cancelled only in 2012, by which time the net worth was negative ₹13.16 billion.

Karuvannur Service Co-operative Bank in Kerala, a primary society under the state registrar, shows the same pattern at the village tier. The registrar’s audit found diversion of over ₹1.5 billion, and the Enforcement Directorate alleges loans were disbursed in cash without collateral to individuals and their proxies since 2010. It has attached assets worth ₹1.28 billion. The allegations are being tested in court.

Two decades apart, at different tiers, the story is the same: a structure with no one who had both the incentive and the independence to challenge. It is sad, but true.

2020 Changed the Rulebook. Culture Still has to Change the Game
The Banking Regulation (Amendment) Act, 2020 extended the RBI’s powers over UCBs and multi-state cooperative banks, including the power to supersede boards. But registrars retain a role in administration, and primary agricultural credit societies remain outside the framework.

The RBI has since added the tiered framework, a prompt corrective action framework for UCBs from 1 April 2025, and an umbrella organisation, NUCFDC, registered in February 2024 with ₹1.17 billion of paid-up capital. It has also begun engaging directly with UCB directors and heads of assurance functions. But triggers and umbrella bodies cannot, on their own, build a second line or protect an auditor. The law can give control functions their seats. It cannot make anyone listen.

The Buck Stops at the Top. The Top Must be Able to Hear
Across both parts, one idea has held: the three lines are not a structure but a conversation. In corporate India, the conversation broke because people stopped listening. In cooperatives, it often could not begin because some voices were absent. Five lessons follow.

• Make risk ownership personal. Every material exposure needs a named owner in the first line, with incentives to match.

• Build a second line, even at a small scale. Shared services, sector-level risk support and external specialists can provide what a small bank cannot afford alone.

• Protect audit independence. The head of audit should report functionally to the board or its audit committee, decide the audit scope and be shielded from retaliation, as the IIA’s latest paper sets out.

• Train the top. Elected directors need fit-and-proper standards and basic risk literacy, so they know which questions to ask: who owns this risk, who challenged it, and who checked the challenge.

• Reward escalation. Bad (but true) news must be able to travel upward without penalty.

An orchestra plays only when every instrument is present, in tune and heard by the conductor. For corporates, the work is to listen better. For cooperatives, it begins with making sure the instruments exist.

This is the concluding part of the “Three Lines of Defence in Corporate India” series. 

Read Part 1
Three Lines of Defence: Does the Model Still Defend or Even Hold?
From Satyam to YES Bank, the controls existed on paper. What failed was the flow of truth between the business, risk, audit and the board.