Governance, Regulation, Ethics and Professional Conduct

Introduction and context

Banking is built on trust. Customers deposit money because they expect it to be safeguarded, transactions to be processed accurately, personal information to remain confidential, and complaints to be handled fairly. Regulators, owners, managers and employees therefore share responsibility for maintaining a sound and trustworthy banking system.

Governance, regulation, ethics and professional conduct are related but distinct. Governance is the system by which a bank is directed, controlled and held accountable. Regulation consists of legally enforceable requirements established by public authorities. Ethics concerns principles of right conduct, including honesty, fairness and avoidance of harm. Professional conduct is the application of these principles and institutional rules in daily work.

This chapter presents a practical foundation for banking employees. Although specific laws differ between jurisdictions, the underlying principles are broadly applicable. Employees must always consult the laws, regulatory notices, institutional policies and approved procedures applicable in their country and bank.

Learning objectives

By the end of this chapter, a learner should be able to:

1. Explain the relationship between governance, regulation, ethics and professional conduct.
2. Describe the responsibilities of boards, management, control functions and operational staff.
3. Apply regulatory principles, internal policies and segregation of duties to banking activities.
4. Explain accountability, confidentiality, consumer protection and fair treatment.
5. Use an ethical decision-making process when faced with workplace dilemmas.
6. Recognise conflicts of interest, suspicious conduct, misconduct and control weaknesses.
7. Respond professionally to complaints, errors, fraud risks and technology-related challenges.

1. The governance architecture of a bank

A bank is not governed only by its chief executive or branch manager. It operates through a layered architecture of authority and control.

1.1 The board of directors

The board is responsible for overall direction, oversight and accountability. It normally approves strategy, risk appetite, major policies and the control framework. It appoints and supervises senior management and should ensure that the bank has adequate capital, liquidity, risk management and compliance arrangements.

A board should not perform routine teller or credit-approval duties. Its role is oversight rather than operational execution. Effective boards ask whether management has identified significant risks, whether controls operate as intended, and whether problems are reported honestly and promptly.

1.2 Senior management

Senior management implements the strategy approved by the board. It allocates resources, establishes procedures, sets performance expectations and creates a culture in which employees can raise concerns. Management is accountable for translating broad regulatory obligations into workable processes, training and monitoring.

1.3 The three-lines model

A useful governance model separates responsibilities into three lines:

The model does not remove responsibility from business staff. A compliance officer may advise on a requirement, but a branch employee remains responsible for following the approved procedure. Internal audit evaluates controls; it does not operate them on behalf of management.

1.4 Accountability and the control environment

Accountability means that a person can explain what was done, why it was done, what authority existed, and what evidence supports the action. A strong control environment includes:

• clear job descriptions and approval limits;
• reliable records and audit trails;
• competent staffing and continuing training;
• independent challenge and escalation;
• disciplinary consequences for deliberate violations; and
• protection for good-faith reporting of concerns.

A bank’s culture is especially important. If employees believe that sales targets matter more than customer welfare or legal compliance, formal policies may be ignored. Ethical culture is therefore a control, not merely a public-relations concept.

2. Regulation and internal policy

2.1 Purpose of banking regulation

Banking regulation seeks to protect depositors, preserve financial stability, reduce financial crime, support fair markets and promote confidence in payment systems. Common regulatory areas include:

• licensing and prudential supervision;
• capital, liquidity and risk management;
• customer identification and anti-money-laundering controls;
• consumer protection and complaint handling;
• data protection and confidentiality;
• payment-system security;
• market conduct and prevention of fraud; and
• reporting and record retention.

Regulation creates minimum requirements. A bank may adopt stricter internal standards where appropriate, but it may not use internal policy to justify conduct prohibited by law.

2.2 Law, regulation, policy and procedure

These sources of authority should be distinguished:

When sources appear to conflict, the employee should stop and escalate the issue rather than choose the easiest interpretation. The hierarchy depends on the jurisdiction, but legal and regulatory requirements generally take priority over internal convenience.

2.3 Risk-based regulation

Modern supervision often uses a risk-based approach. This means controls should reflect the likelihood and potential impact of a risk. A high-value, unusual international transfer may require more scrutiny than a routine low-value payment, although no transaction should be treated carelessly.

Risk-based does not mean discriminatory or arbitrary. Enhanced scrutiny should be based on documented risk factors—such as transaction pattern, product, geography or customer profile—not on protected characteristics or personal stereotypes. Decisions must be consistent, explainable and reviewable.

3. Segregation of duties and operational control

Segregation of duties prevents one individual from controlling an entire transaction from initiation to concealment. Ideally, different people perform or approve incompatible activities such as:

1. custody of assets;
2. recording a transaction;
3. authorising the transaction; and
4. reconciling the resulting records.

For example, a branch employee who receives cash should not be the only person who records, approves and reconciles that cash. In a loan process, the person who originates a loan should not have unrestricted authority to approve, disburse and alter repayment records.

3.1 Compensating controls

Small branches may not have enough staff for complete separation. In that case, compensating controls may include dual control, supervisor review, surprise cash counts, automated access logs, independent reconciliation and rotation of duties. A lack of staff does not remove the risk; it requires documented alternative controls.

3.2 Maker-checker control

The maker-checker principle requires one employee to prepare or enter an instruction and another authorised employee to verify and approve it. The checker must perform a real review, not merely click an approval button. Evidence should show who checked what, when, and against which source documents.

3.3 Access control

Access should follow the principle of least privilege: each user receives only the access required for assigned duties. Shared passwords, unattended sessions, unauthorised overrides and borrowing another employee’s credentials weaken accountability. Access rights should be reviewed when an employee changes role or leaves the bank.

4. Confidentiality, privacy and information security

Bank employees handle identity documents, account balances, transaction histories, credit information and sometimes sensitive personal circumstances. Confidentiality requires that information be accessed, used and disclosed only for a legitimate, authorised purpose.

The principle of confidentiality does not mean concealing wrongdoing from regulators or law-enforcement authorities. A bank may be legally required to disclose information through an authorised process. Employees should refer requests to the designated legal, compliance or information-governance function.

Good practice includes:

• confirming identity before discussing an account;
• using approved communication channels;
• avoiding customer discussions in public areas;
• locking screens and securing printed documents;
• checking recipients before sending messages;
• never sharing passwords or one-time authentication codes; and
• reporting suspected breaches immediately.

A customer’s family member, employer or friend is not automatically entitled to account information. Authority must be verified through the bank’s approved process.

5. Consumer protection and fair treatment

Consumer protection recognises that banking customers may have less information and bargaining power than the institution. Core principles commonly include transparency, suitability or responsible lending, fair treatment, privacy, security and accessible complaint resolution.

5.1 Transparency

Customers should receive information about material fees, interest, terms, risks, eligibility requirements and consequences of missed payments in a form they can reasonably understand. A technically accurate disclosure can still be unfair if important costs are hidden in complex language or presented too late.

5.2 Responsible service and lending

Employees should not encourage a customer to purchase a product that is unsuitable for the customer’s needs or apparent ability to use it responsibly. Sales incentives must not encourage misrepresentation, unnecessary fees or pressure selling. In lending, affordability assessment and responsible documentation protect both the customer and the bank.

5.3 Accessibility and vulnerability

Customers may experience disability, illness, low financial literacy, language barriers, age-related vulnerability or temporary distress. Fair treatment may require reasonable assistance, accessible communication, additional time, or referral to a specialist team. Assistance must not become unauthorised control over the customer’s account.

5.4 Complaints

A complaint is valuable information about possible service failure or control weakness. A professional response involves listening without argument, recording the issue accurately, acknowledging the customer’s concern, explaining the next step and escalating according to the complaint procedure. Employees must not discourage complaints, retaliate against complainants or promise an outcome they cannot authorise.

6. Ethics and professional conduct

6.1 Ethical principles

Important banking ethics include:

• Integrity: being honest and refusing deception.
• Objectivity: making decisions without improper personal influence.
• Fairness: treating comparable customers consistently and avoiding exploitation.
• Competence: performing only work for which one is trained and authorised.
• Confidentiality: protecting information entrusted by customers and the bank.
• Responsibility: correcting errors and escalating risks.
• Respect: communicating courteously and without discrimination.

Ethics extends beyond compliance. An action may technically fit a rule while violating its purpose. For example, placing a material fee in an obscure document may satisfy a narrow disclosure requirement but fail the ethical duty of transparency.

6.2 Conflicts of interest

A conflict exists when personal interests could influence, or appear to influence, professional judgment. Examples include processing a loan for a relative, accepting an expensive gift from a supplier, steering a customer toward a product because of personal commission, or using confidential information for investment.

The correct response is usually disclosure, withdrawal from the decision where necessary, and compliance with the bank’s gifts and conflicts policy. Concealing a conflict is often more serious than the conflict itself.

6.3 Gifts, inducements and bribery

A modest promotional item may be acceptable under policy, while cash, lavish hospitality or a benefit linked to a decision may be improper. Employees should ask: Would the benefit influence my judgment? Would a reasonable observer think it did? Can I disclose it openly? When uncertain, decline or seek written guidance before accepting it.

6.4 Whistleblowing and speaking up

Employees should report suspected fraud, bribery, manipulation of records, customer abuse, retaliation or serious control failure through approved channels. Reports should be factual and made in good faith. The employee should preserve relevant evidence, avoid investigating beyond authority, and not warn a person who may be involved where doing so could compromise an investigation.

7. Ethical decision-making in practice

A practical decision framework is:

1. Identify the facts: What happened, who is affected and what evidence exists?
2. Identify the obligations: Which laws, regulations, policies, contracts and professional duties apply?
3. Identify stakeholders: Consider the customer, bank, colleagues, regulator and wider public.
4. Identify conflicts and harms: What benefit, pressure or bias may distort judgment?
5. Consider options: Include refusing, pausing, escalating, correcting or disclosing.
6. Choose and document: Select the lawful, fair and proportionate option and record the rationale.
7. Review: Ask whether the outcome reveals a process or training weakness.

A useful test is publicity: would the decision remain defensible if accurately reported to a regulator, customer or newspaper? This is not a substitute for legal analysis, but it can reveal hidden ethical concerns.

8. Applied case: the urgent transfer request

This is an illustrative fictional case.

Background

Maya, a customer-service officer, receives a call from a person claiming to be the managing director of a business customer. The caller requests an urgent transfer to a new overseas beneficiary. The caller knows the account number and recent payment details and pressures Maya by saying that failure to act will cause a major commercial loss.

Problem

The request conflicts with the customer’s normal payment pattern. The beneficiary is new, the amount is large, and the caller asks Maya to bypass the usual second approval because the director is travelling. Maya is also aware that the branch is measured on rapid service.

Analysis

The relevant risks include impersonation, fraud, money laundering, unauthorised payment and breach of segregation of duties. Familiar account information does not prove identity. The request for an exception is itself a warning sign. Speed and sales performance cannot override authentication and approval requirements.

Approach and solution

Maya should not process the transfer or disclose internal fraud-detection information. She should follow the approved verification process, explain courteously that additional authentication is required, and escalate the case to the fraud or compliance team. She should preserve call details and system evidence, avoid making accusations, and ensure that any legitimate instruction is independently confirmed through an authorised channel. If the bank’s procedure requires account restriction or customer contact, that action should be taken by authorised staff.

Outcome

The bank discovers that the caller used information obtained from a compromised email account. The payment is stopped, the customer’s credentials are reset, and monitoring is increased. A post-incident review identifies a need for stronger staff training on social engineering and clearer escalation instructions.

Learning points

The case demonstrates that customer service is not the same as unquestioning compliance. Professional service protects the customer even when protection requires delay. Segregation of duties, independent authentication, escalation and accurate records work together as a control system.

9. Technology, automation and emerging risks

Digital banking and artificial intelligence can improve speed, consistency and fraud detection, but they do not eliminate accountability. Automated systems may produce false positives, exclude legitimate customers, expose data or reproduce bias in historical information.

Employees should understand the limits of automated decisions. Important controls include human review for exceptional or adverse decisions, access restrictions, model validation, audit logs, data-quality checks, vendor oversight and clear customer communication. Staff must not paste confidential customer information into unauthorised generative-AI tools or use automated output without verification.

Cybersecurity threats include phishing, malware, credential theft, SIM-swap fraud, synthetic identities and social engineering. Security is a shared professional duty: employees should verify unusual requests, report incidents promptly and never bypass controls merely because a request appears urgent.

10. Challenges and limitations

Rules cannot anticipate every situation. Excessive bureaucracy may delay legitimate service, while excessive flexibility may create fraud and inconsistency. Risk-based controls require judgment and can be applied unfairly if criteria are undocumented. Segregation of duties can be difficult in small branches. Confidentiality can conflict with duties to report crime. Automation can improve detection but may obscure reasons for decisions.

These tensions require proportionality, documentation, escalation and periodic review. A sound system does not seek zero risk—an unrealistic objective—but seeks risks that are understood, controlled and transparently managed.

Best-practice checklist for banking employees

Before completing a significant transaction or decision, ask:

• Am I authorised and adequately trained?
• Have I verified the customer, instruction and supporting evidence?
• Is the transaction consistent with the customer’s profile and the bank’s rules?
• Has an independent person reviewed or approved it where required?
• Am I protecting confidential information?
• Could a conflict, incentive or pressure affect my judgment?
• Have I recorded the action sufficiently for later review?
• If something seems unusual, have I paused and escalated it?

Chapter Summary

Bank governance distributes responsibility among the board, management, operational staff, control functions and internal audit. Regulation establishes enforceable minimum standards, while internal policies and procedures translate those standards into daily work. Effective controls depend on clear authority, segregation of duties, maker-checker review, least-privilege access, reliable records and independent challenge.

Ethical banking requires more than technical compliance. Integrity, fairness, competence, confidentiality, responsible service and respect shape decisions involving customers and colleagues. Consumer protection requires transparent information, responsible product and lending practices, reasonable support for vulnerable customers and accessible complaint handling. Conflicts of interest, gifts, bribery, fraud and suspicious requests must be disclosed, refused or escalated through approved channels.

Professional conduct is demonstrated when employees protect customers even under pressure, acknowledge errors, preserve evidence, respect confidentiality and accept accountability. Technology can strengthen banking controls, but human judgment, governance and oversight remain essential.

Key Terms

Accountability: Responsibility to explain and justify actions and decisions.

Board of directors: Body responsible for strategic direction and oversight of the bank.

Compliance: Conformance with applicable laws, regulations, policies and procedures.

Confidentiality: Protection of information from unauthorised access or disclosure.

Conflict of interest: A situation in which personal interests may improperly influence professional judgment.

Consumer protection: Measures designed to ensure fair, transparent and safe treatment of customers.

Control environment: The culture, structures and expectations supporting effective internal control.

Due diligence: Reasonable investigation and verification before accepting or continuing a relationship or transaction.

Ethics: Principles concerning right, fair and responsible conduct.

Governance: The system by which an organisation is directed, controlled and held accountable.

Internal audit: An independent assurance function that evaluates governance, risk management and controls.

Least privilege: Giving a user only the access necessary for assigned duties.

Maker-checker: Separation between preparing an action and independently verifying or approving it.

Professional conduct: Behaviour expected of a competent, responsible and trustworthy banking employee.

Regulation: An enforceable requirement established by an authorised public body.

Risk-based approach: Applying control intensity in proportion to assessed likelihood and impact of risk.

Segregation of duties: Dividing incompatible responsibilities among different people or controls.

Three-lines model: Separation of operational risk ownership, specialist oversight and independent assurance.

Review Questions

Short Answer Questions

1. What is the difference between regulation and internal policy?
2. State two reasons why segregation of duties is important.
3. What does confidentiality require of a banking employee?
4. Give two examples of a conflict of interest.
5. What are the three lines in the three-lines governance model?

Long Answer Questions

1. Explain how the board, senior management, operational employees, compliance and internal audit contribute to bank governance.
2. Discuss the relationship between consumer protection, transparency and ethical conduct.
3. Explain the maker-checker principle and describe how it can be supported in a small branch.
4. Analyse why a technically legal action may still be ethically unacceptable.
5. Describe a professional process for receiving and escalating a customer complaint.

Analytical / Application Questions

1. A teller is asked by a senior manager to process a transaction for the manager’s relative without the normal supporting documents. Identify the risks and explain the appropriate response.
2. A customer sends an email containing account details and asks an employee to change the destination of a regular payment immediately. Apply the ethical decision-making framework to this situation.
3. A bank’s automated fraud system repeatedly blocks transactions from a particular customer group. Explain the governance, consumer-protection and technology controls that should be considered before continuing to rely on the system.

Multiple Choice Questions with Answers

Question 1

Which function is primarily responsible for independent assurance over a bank’s controls?

A. Front-office operations

B. Internal audit

C. Sales management

D. Cash custody

Correct Answer: B. Internal audit

Question 2

What is the main purpose of segregation of duties?

A. To increase sales commissions

B. To ensure every employee performs every task

C. To reduce the opportunity for error or fraud to remain undetected

D. To eliminate the need for records

Correct Answer: C. To reduce the opportunity for error or fraud to remain undetected

Question 3

Which action best demonstrates the principle of least privilege?

A. Giving all staff administrator access

B. Sharing one branch password

C. Giving each employee only the system access required for assigned duties

D. Allowing former employees to retain access temporarily

Correct Answer: C. Giving each employee only the system access required for assigned duties

Question 4

A customer’s friend asks for the customer’s account balance. What should the employee do first?

A. Disclose it because the friend sounds credible

B. Verify the friend’s legal authority through the approved process

C. Provide an approximate balance

D. Ask the friend to guess the balance

Correct Answer: B. Verify the friend’s legal authority through the approved process

Question 5

Which situation is most clearly a conflict of interest?

A. Following a published procedure

B. Attending mandatory compliance training

C. Approving a loan application submitted by an employee’s close relative

D. Escalating a suspicious transaction

Correct Answer: C. Approving a loan application submitted by an employee’s close relative

Question 6

What is the correct response to an unusual urgent transfer request that seeks to bypass normal approval?

A. Process it immediately to provide good service

B. Ignore all verification requirements for senior customers

C. Pause, apply authentication and escalation procedures

D. Ask the caller to send a less detailed email

Correct Answer: C. Pause, apply authentication and escalation procedures

Question 7

Which statement best describes risk-based regulation?

A. Every transaction must receive identical scrutiny

B. Controls should reflect the likelihood and potential impact of risk

C. Low-value transactions never require controls

D. Employees may ignore written procedures when busy

Correct Answer: B. Controls should reflect the likelihood and potential impact of risk

Question 8

Which is an ethical responsibility beyond merely following minimum rules?

A. Hiding material fees in complex documents

B. Using confidential data for personal benefit

C. Providing information in a fair and understandable manner

D. Discouraging customers from making complaints

Correct Answer: C. Providing information in a fair and understandable manner

Question 9

What is the principal role of the second line in the three-lines model?

A. Owning every operational transaction

B. Providing specialist oversight and challenge

C. Replacing the board of directors

D. Holding all physical cash

Correct Answer: B. Providing specialist oversight and challenge

Question 10

Why should employees be cautious when using artificial-intelligence tools in banking?

A. AI outputs are always legally binding

B. Automation can create privacy, bias, accuracy and accountability risks

C. AI eliminates the need for human review

D. AI makes audit trails unnecessary

Correct Answer: B. Automation can create privacy, bias, accuracy and accountability risks