Banking Regulation, Governance and Professional Ethics

Introduction and context

Commercial and retail banks occupy a uniquely regulated position. They accept repayable funds from the public, operate payment systems, transform short-term deposits into longer-term loans, and often create deposits through lending. These functions generate economic value but also expose depositors, borrowers, investors and the wider economy to liquidity, credit, operational and conduct risks. A bank can therefore be profitable while still being unsafe, unfair or vulnerable to failure.

Banking regulation is the system of laws, supervisory standards and enforcement practices designed to preserve financial stability, protect customers and maintain confidence in financial institutions. Governance concerns how a bank is directed, controlled and held accountable. Professional ethics concerns the values and duties that should guide decisions, including honesty, fairness, competence, confidentiality and responsibility to customers and society.

These fields overlap but are not identical. Regulation establishes minimum enforceable requirements. Governance creates internal structures for sound decision-making. Ethics guides conduct where rules are incomplete, ambiguous or not yet developed. A strong bank needs all three.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain the purposes and processes of bank licensing and prudential supervision.
2. Distinguish capital, liquidity, solvency, conduct and operational requirements.
3. Interpret the main ideas of the Basel regulatory framework and capital adequacy.
4. Explain deposit protection and consumer-protection mechanisms.
5. Evaluate board oversight, risk governance, conflicts of interest and conduct risk.
6. Apply principles of responsible selling, KYC, AML and sanctions compliance.
7. Analyse an applied banking-governance problem and recommend proportionate controls.

1. The architecture of banking regulation

1.1 Why banks require special regulation

Banks are exposed to several forms of interconnected risk:

• Credit risk: a borrower or counterparty fails to meet its obligations.
• Liquidity risk: the bank cannot meet obligations when due without unacceptable loss.
• Market risk: changes in interest rates, exchange rates or asset prices reduce value.
• Operational risk: losses arise from failed processes, people, systems or external events.
• Compliance risk: the bank breaches laws, regulations or supervisory requirements.
• Conduct risk: its behaviour produces unfair outcomes for customers or undermines market integrity.
• Systemic risk: distress at one institution spreads through payment, funding or confidence channels.

A bank’s liabilities are often payable on demand, whereas its assets are loans and securities with longer or uncertain maturities. This maturity transformation is economically useful but creates the possibility of a run. Because one institution’s failure may damage confidence in others, banking supervision has both microprudential and macroprudential dimensions.

Microprudential regulation focuses on the safety and soundness of an individual bank. Macroprudential regulation addresses risks to the financial system as a whole, such as excessive credit growth, common exposures or interconnectedness.

1.2 Licensing and authorisation

A banking licence is a public authorisation to conduct specified activities. It is not merely a commercial registration. The licensing authority normally assesses:

• the proposed business model and financial projections;
• the source and adequacy of initial capital;
• the fitness and propriety of owners, directors and senior managers;
• governance, risk-management and internal-control arrangements;
• information-technology, cybersecurity and business-continuity capabilities;
• AML, customer due-diligence and sanctions systems; and
• the ability to meet reporting and supervisory obligations.

Licensing protects the public by preventing unsuitable owners or weak business models from entering banking. It also defines the permitted scope of activity. A bank may require additional approval to open branches, acquire another institution, undertake securities activities or change control.

A licence is conditional and ongoing. Supervisors may impose limits, require remediation, restrict dividends, replace management or withdraw authorisation when a bank becomes unsafe or persistently non-compliant.

1.3 Supervisory approaches

Supervision combines rules, judgement and evidence. Important tools include:

• Off-site supervision: analysis of regulatory returns, risk indicators, stress tests and management information.
• On-site examination: inspection of files, systems, controls and governance practices.
• Risk-based supervision: directing supervisory resources toward institutions and activities presenting the greatest risk.
• Pillar-based disclosure: requiring public information so that markets and stakeholders can assess risk.
• Prompt corrective action: escalating interventions as financial weakness or control failures become more serious.

Supervision is not a guarantee that no bank will fail. Its purpose is to reduce the probability and impact of failure while ensuring that problems are identified and addressed early.

2. Prudential regulation and Basel standards

The Basel framework, developed by the Basel Committee on Banking Supervision, provides internationally influential minimum standards. It is implemented through national law, so requirements differ across jurisdictions. Basel standards generally address capital, risk coverage, leverage, liquidity, supervisory review and disclosure.

2.1 Capital as a loss-absorbing resource

Capital is the owners’ risk-bearing claim. Unlike deposits and other debt, it does not normally have to be repaid on a fixed date. It absorbs losses before protected depositors and ordinary creditors.

The central capital adequacy relationship is:

Regulatory capital is classified by quality. Common Equity Tier 1 generally consists of common shares, retained earnings and related instruments after regulatory adjustments. Additional Tier 1 instruments can absorb losses while the bank remains a going concern. Tier 2 capital is generally available to absorb losses in resolution or liquidation. The exact composition and deductions are determined by applicable law.

Risk-weighted assets (RWA) adjust exposures according to risk rather than treating every asset equally. A simplified representation is:

Here, Exposure_i is the relevant exposure for asset or category i, Risk weight_i is the applicable percentage, and ∑ means that the weighted exposures are added. The simplified formula assumes that the relevant exposure measure and risk weight have already been determined under the applicable regulatory method. It is not a substitute for detailed Basel rules on collateral, netting, off-balance-sheet conversion factors or model approval.

A high-quality capital ratio can still conceal weaknesses if asset valuations are optimistic, risk weights are inappropriate or capital instruments cannot absorb losses. Consequently, supervisors examine capital quality, concentration, stress resilience and the reliability of reported data.

2.2 Worked example: capital adequacy

Suppose a bank has the following simplified exposures:

Assume eligible regulatory capital is $13 million. The capital ratio is:

This example is intentionally simplified. It assumes the stated risk weights apply, ignores regulatory deductions and does not establish whether 10% satisfies the bank’s jurisdiction-specific minimum, buffers and supervisory expectations.

2.3 Leverage and liquidity

Risk-weighted capital ratios are complemented by a non-risk-based leverage measure. A simplified leverage ratio is:

The exposure measure generally includes on-balance-sheet and specified off-balance-sheet items, subject to regulatory rules. Its purpose is to limit excessive balance-sheet expansion caused by low risk weights or modelling assumptions.

Liquidity regulation addresses whether a bank can survive funding stress. The Liquidity Coverage Ratio (LCR) is conceptually expressed as:

High-quality liquid assets are assets that can be converted into cash quickly with little loss of value. Net cash outflows are calculated under prescribed stress assumptions. The formula applies to the regulatory definition of each component, not simply to all cash and all expected payments.

The Net Stable Funding Ratio (NSFR) compares available stable funding with the stable funding required by a bank’s assets and activities. It addresses structural funding risk over a longer horizon. Liquidity metrics do not eliminate the need for contingency funding plans, intraday liquidity monitoring and credible access to emergency arrangements.

2.4 Supervisory review and disclosure

The Basel framework is commonly explained through three pillars:

1. Minimum capital requirements: quantitative requirements for credit, market and operational risks.
2. Supervisory review: assessment of internal capital adequacy, governance, risk appetite and stress testing.
3. Market discipline: public disclosure that enables informed assessment by investors and other stakeholders.

Stress testing asks how capital, liquidity and earnings would respond to adverse scenarios, such as recession, rising unemployment, falling property prices, cyberattack or deposit outflows. A stress scenario is not a forecast; it is a disciplined tool for examining vulnerabilities.

3. Deposit protection and resolution

Deposit insurance or a deposit guarantee scheme protects eligible depositors up to a specified limit if a bank fails. It serves two principal purposes: protecting smaller depositors who cannot easily assess bank risk and reducing incentives for destabilising withdrawals.

Protection is normally limited by:

• a maximum amount per depositor and institution;
• the definition of eligible deposit accounts;
• exclusions such as certain interbank, government or insider deposits; and
• rules for calculating set-off, joint accounts and foreign-currency deposits.

Deposit protection can create moral hazard: depositors may pay less attention to bank risk, while banks may take greater risks if funding is perceived as protected. This is why deposit insurance must be combined with capital requirements, supervision, risk-based premiums and credible resolution arrangements.

Resolution is the orderly handling of a failing bank while protecting critical functions and limiting public cost. Tools may include sale of business, transfer to a bridge bank, restructuring, bail-in of eligible liabilities or liquidation. Effective resolution planning requires recovery plans, separable systems, reliable data and clear responsibilities among authorities.

4. Consumer protection and conduct risk

Consumer protection recognises that banking customers may have less information, expertise and bargaining power than institutions. Key principles include transparency, suitability or appropriateness where relevant, fair treatment, privacy, complaint handling and access to redress.

4.1 Information and fair treatment

A disclosure is useful only if customers can understand and use it. Banks should present material fees, interest rates, penalties, foreign-exchange margins, renewal terms and risks in clear language and at an appropriate time. Excessive legal wording may satisfy a formal requirement while failing the substantive objective of informed choice.

Fair treatment includes avoiding discrimination, unreasonable barriers to access, unfair contract terms and exploitative collection practices. Accessibility should consider disability, language, digital exclusion and financial vulnerability.

4.2 Conduct risk and responsible selling

Conduct risk is the risk that a bank’s actions or omissions cause poor customer outcomes or damage market integrity. It can arise from incentive systems, product design, sales scripts, weak complaints data or a culture that rewards volume without regard to suitability.

Responsible selling requires the bank to:

• identify the target market and foreseeable customer needs;
• provide accurate, balanced and comprehensible information;
• assess affordability and suitability where required;
• avoid pressure, manipulation and misleading comparisons;
• explain exclusions, risks and total cost;
• monitor sales quality and post-sale outcomes; and
• correct unsuitable sales and compensate customers where appropriate.

A product may be legally available but ethically unsuitable for a particular customer. For example, a complex investment-linked product should not be sold to a customer who cannot understand its volatility, fees or lock-in period merely because the customer meets a formal eligibility test.

4.3 Complaints and customer outcomes

Complaints are not only service problems; they are risk information. A sound complaints system provides accessible channels, acknowledgement, investigation, documented decisions, escalation and independent review where available. Management should analyse root causes rather than treating each complaint as an isolated event.

Useful outcome indicators include cancellation rates, repeat complaints, disputed fees, vulnerable-customer outcomes, product performance against expectations and remediation completion. Incentive schemes should not encourage staff to suppress complaints or prioritise sales over customer welfare.

5. Corporate governance and risk culture

Corporate governance is the framework through which a bank is directed and controlled. Its central purpose is accountable decision-making in the interests of the institution, its stakeholders and the stability of the financial system.

5.1 Board responsibilities

The board should approve strategy, risk appetite, major policies, executive appointments and remuneration principles. It should challenge management constructively rather than merely receive reports. Directors need sufficient banking, risk, accounting and technology expertise, collectively if not individually.

The board should ensure that:

• risk appetite is explicit and consistent with capacity;
• capital and liquidity planning support strategy;
• internal controls and audit are independent and effective;
• conflicts are disclosed and managed;
• regulatory breaches are escalated promptly; and
• culture and conduct are measured, not assumed.

A board committee structure may include audit, risk, remuneration, nomination and conduct or customer committees. Committees support, but do not replace, the board’s ultimate responsibility.

5.2 The three lines model

A practical allocation of control responsibilities is:

1. First line: business units own risks and operate day-to-day controls.
2. Second line: risk management and compliance set frameworks, advise and challenge.
3. Third line: internal audit provides independent assurance to the board.

The model is effective only when authority, resources and escalation rights are real. A compliance department that can advise but cannot access information or escalate serious concerns is not an effective second line.

5.3 Risk appetite and culture

Risk appetite states the types and levels of risk a bank is willing to accept in pursuing objectives. It should be translated into limits, delegated authorities and monitoring indicators. Risk culture is reflected in what employees observe being rewarded, tolerated and punished. Written values have little effect if high-performing staff are excused for misconduct.

6. Conflicts of interest and professional ethics

A conflict of interest occurs when personal, financial or institutional interests could improperly influence professional judgement. Conflicts may be actual, potential or perceived. Examples include an employee approving a relative’s loan, a relationship manager receiving incentives for a product sale, or a bank recommending securities issued by an affiliated company.

Controls include disclosure, recusal, independent review, information barriers, rotation, gifts and entertainment limits, personal-account dealing rules and accurate records. Disclosure alone is insufficient where the conflict is severe; the transaction may need to be prohibited.

Professional ethics in banking includes:

• Integrity: truthful communication and honest records.
• Objectivity: decisions based on relevant evidence rather than favouritism.
• Competence: maintaining technical knowledge and recognising limitations.
• Confidentiality: protecting customer information, subject to lawful disclosure.
• Fairness: considering customer interests and avoiding exploitation.
• Accountability: accepting responsibility and escalating concerns.

Ethical reasoning is especially important in grey areas. A useful decision process is to identify affected stakeholders, applicable law, duties, foreseeable harms, alternatives, conflicts and the decision that could be explained transparently to an independent reviewer.

7. KYC, AML and sanctions compliance

Know Your Customer (KYC) is the process of identifying and understanding a customer. AML controls seek to prevent and detect money laundering and related financial crime. Counter-terrorist-financing controls address funds connected with terrorism. Sanctions compliance prevents prohibited dealings with designated persons, entities, countries, sectors or activities under applicable legal regimes.

7.1 Customer due diligence

Customer due diligence commonly involves:

• identifying and verifying the customer;
• identifying beneficial owners and persons exercising control;
• understanding the purpose and expected nature of the relationship;
• assessing geographic, product, customer and delivery-channel risks; and
• conducting ongoing monitoring and periodic review.

A risk-based approach does not mean abandoning controls for low-risk customers. It means allocating stronger measures where risk is higher, while maintaining a reliable minimum standard for all customers. Enhanced due diligence may be required for politically exposed persons, complex ownership structures, high-risk jurisdictions or unusual transactions.

7.2 Transaction monitoring and reporting

Transaction monitoring seeks patterns inconsistent with a customer’s known profile. Indicators can include rapid movement through multiple accounts, unexplained cash intensity, unusual cross-border transfers, use of nominees, structuring to avoid thresholds and transactions lacking an apparent economic purpose. An indicator is not proof of crime; it triggers investigation and judgement.

Suspicious transaction reporting is made to the competent financial-intelligence authority according to law. Staff must avoid tipping off a customer where prohibited. Records must be accurate, retained for the legally required period and accessible to authorised investigators.

7.3 Sanctions screening

Sanctions systems should screen customers, beneficial owners, counterparties, payment messages and relevant transactions against current lists. Name matching creates false positives because of transliteration, common names and incomplete data. It therefore requires skilled investigation, documented disposition and timely list updates. A bank should never allow commercial pressure to override a legal prohibition.

Technology can improve monitoring, but automated systems create model risk. Poor data, opaque alerts, excessive thresholds and untested machine-learning models can produce both missed risks and overwhelming false positives. Human oversight, validation, explainability, audit trails and controlled access remain essential.

8. Applied case: Meridian Retail Bank

Background

Meridian Retail Bank, an illustrative case, launched a digital personal-loan product. Staff received bonuses based largely on the number and value of loans originated. The bank used automated approval and marketed “fast credit” through mobile notifications.

Problem

Within six months, complaints increased. Some customers did not understand an arrangement fee and variable interest rate. A review found that several loans were unaffordable when existing debts were included. Monitoring also identified multiple accounts receiving funds from unrelated third parties and rapidly transferring them overseas. The compliance team had raised concerns, but business managers delayed action because the product was commercially successful.

Analysis

The case combines conduct, credit, governance and AML risks. The incentive plan encouraged volume rather than sustainable customer outcomes. Product disclosures were technically available but poorly timed and difficult to understand. Affordability controls did not include reliable external debt information. Transaction monitoring was not adequately connected to the new product. Most seriously, the board lacked timely information about complaints and unresolved compliance concerns.

Approach and solution

Meridian should suspend the highest-risk marketing channels, review affected loans and provide remediation where customers suffered loss. It should redesign incentives to include repayment quality, complaint trends and verified customer outcomes, with clawback for misconduct. The product should have a documented target market, plain-language pre-contract information and a cooling-off process where permitted.

The bank should strengthen affordability assessment, test automated decisions for bias and error, and establish transaction-monitoring scenarios suited to digital lending. Alerts require trained investigation, not automatic closure. The chief risk and compliance officers should have direct escalation access to the board risk committee. Internal audit should independently test the remediation and report unresolved issues.

Outcome

Assume the bank implements these measures, identifies 1,200 affected accounts and compensates customers charged fees without adequate disclosure. It also rejects a set of suspicious transactions and files reports with the competent authority. Although short-term loan volumes fall, complaint rates decline, credit losses improve and the board obtains a more reliable view of risk.

Learning points

1. Strong sales growth is not evidence of a sound product.
2. Customer outcomes must be measured after sale, not only at origination.
3. Incentives are governance mechanisms and can create misconduct risk.
4. AML monitoring must reflect product and channel characteristics.
5. Escalation independence is essential when commercial objectives conflict with control concerns.

9. Contemporary developments and limitations

Banking regulation must respond to digital banking, open banking, cloud outsourcing, cryptocurrencies, operational resilience, climate-related financial risk and artificial intelligence. Digital channels increase speed and access but may also increase fraud, identity theft, exclusion and automated discrimination. Outsourcing does not transfer regulatory accountability: the bank remains responsible for critical services, data protection, resilience and oversight of vendors.

Regulation also has limitations. Excessively complex rules can encourage checklist compliance and obscure the underlying risks. Different national regimes may produce gaps or duplicated requirements. Capital standards cannot prevent every form of misconduct, and deposit insurance cannot replace credible supervision. Good governance therefore requires proportionality, evidence, judgement and continuous learning.

Best practice is to combine clear accountability, reliable data, independent challenge, scenario analysis, customer-outcome testing, strong speak-up channels and prompt remediation. Ethical leadership is demonstrated when the bank accepts short-term cost to prevent foreseeable harm.

Chapter Summary

Banking regulation protects depositors, customers, markets and the financial system. Licensing tests whether owners, managers, capital, systems and business plans are suitable before banking begins. Prudential supervision then monitors capital, liquidity, governance and risk on an ongoing basis. Basel standards provide an international framework centred on capital adequacy, risk-weighted assets, leverage, liquidity, supervisory review and disclosure.

Deposit protection reduces the impact of bank failure but must be balanced against moral hazard and supported by effective resolution. Consumer protection requires clear information, fair treatment, suitable products, accessible complaints processes and responsible selling. Conduct risk often arises from incentives, culture and product design rather than from a single dishonest employee.

Corporate governance assigns responsibility to the board, management, control functions and internal audit. Conflicts of interest must be identified, disclosed, managed or prohibited. KYC, AML and sanctions controls require customer identification, beneficial-owner understanding, risk-based due diligence, transaction monitoring, reporting and reliable screening. Technology can improve these controls but introduces data, model and privacy risks. Professional ethics ultimately requires banks to act with integrity, competence, fairness and accountability even where legal rules do not provide a complete answer.

Key Terms

AML: Measures designed to prevent and detect money laundering.

Basel framework: Internationally developed standards for banking capital, supervision, liquidity and disclosure.

Capital adequacy: The extent to which a bank has loss-absorbing capital relative to regulatory exposures.

Conduct risk: Risk of customer harm or market-integrity damage caused by a bank’s behaviour.

Conflict of interest: A circumstance in which competing interests may impair objective judgement.

Corporate governance: Structures and processes for directing, controlling and holding an institution accountable.

Deposit insurance: A scheme protecting eligible deposits up to a specified limit.

KYC: Know Your Customer procedures for identifying and understanding customers.

Liquidity risk: Risk that obligations cannot be met when due without unacceptable loss.

Macroprudential regulation: Regulation addressing risks to the financial system as a whole.

Microprudential regulation: Regulation focused on the safety and soundness of an individual institution.

Pillar 1: Basel minimum capital requirements.

Pillar 2: Supervisory review of capital adequacy and risk management.

Pillar 3: Market discipline through public disclosure.

Prudential regulation: Rules and supervision intended to preserve institutional and financial stability.

Risk appetite: The type and level of risk an institution is willing to accept.

Risk-weighted assets: Exposures adjusted by regulatory risk weights for capital purposes.

Sanctions compliance: Controls preventing prohibited dealings with designated persons, entities or jurisdictions.

Three lines model: Allocation of risk ownership, oversight and independent assurance among business units, control functions and internal audit.

Review Questions

Short Answer Questions

1. Why is banking licensing more than a general business registration?
2. Distinguish microprudential from macroprudential regulation.
3. What is the purpose of risk-weighted assets?
4. Identify three responsibilities of a bank’s board.
5. What is the difference between KYC and transaction monitoring?

Long Answer Questions

1. Explain how capital, liquidity and leverage requirements complement one another.
2. Discuss the benefits and limitations of deposit insurance.
3. Analyse how remuneration systems can create conduct risk.
4. Explain the three lines model and the conditions required for it to work effectively.
5. Discuss the role of professional ethics when legal rules do not clearly determine the correct action.

Analytical / Application Questions

1. A bank’s capital ratio is rising because it has shifted heavily into assets with low regulatory risk weights, while its total leverage has increased. Analyse the possible risks and recommend supervisory responses.
2. A relationship manager recommends an affiliated investment product to a customer and receives a higher bonus for selling it. Identify the conflicts and propose controls.
3. A digital bank experiences rapid international transfers from newly opened accounts. Design a proportionate KYC, sanctions and transaction-monitoring response without automatically treating every customer as criminal.

Multiple Choice Questions with Answers

Question 1

What is the primary purpose of bank licensing?

A. To guarantee that every bank earns a profit

B. To assess whether an applicant is suitable and capable of conducting banking safely

C. To eliminate all competition in financial services

D. To replace ongoing supervision

Correct Answer: B. To assess whether an applicant is suitable and capable of conducting banking safely

Question 2

Which risk concerns a bank’s inability to meet obligations when they fall due?

A. Liquidity risk

B. Market risk

C. Conduct risk

D. Reputational risk

Correct Answer: A. Liquidity risk

Question 3

Using the simplified relationship Capital ratio = Regulatory capital ÷ RWA × 100%, what is the ratio when capital is $12 million and RWA is $120 million?

A. 1%

B. 5%

C. 10%

D. 12%

Correct Answer: C. 10%

Question 4

Which Basel pillar concerns supervisory review?

A. Pillar 1

B. Pillar 2

C. Pillar 3

D. Pillar 4

Correct Answer: B. Pillar 2

Question 5

What is a major potential disadvantage of deposit insurance?

A. It prevents all bank lending

B. It can create moral hazard

C. It eliminates the need for capital

D. It guarantees unlimited protection for every creditor

Correct Answer: B. It can create moral hazard

Question 6

Which function belongs primarily to the third line in the three lines model?

A. Selling loans

B. Setting daily sales targets

C. Independent internal audit

D. Approving customer transactions

Correct Answer: C. Independent internal audit

Question 7

Which is an example of a conflict of interest?

A. An auditor independently testing controls

B. An employee approving a loan to a close relative

C. A customer reading a fee schedule

D. A bank updating its sanctions list

Correct Answer: B. An employee approving a loan to a close relative

Question 8

What is the central purpose of responsible selling?

A. To maximise product volume regardless of customer circumstances

B. To ensure products and advice produce fair and suitable customer outcomes

C. To remove all sales incentives

D. To prevent customers from changing providers

Correct Answer: B. To ensure products and advice produce fair and suitable customer outcomes

Question 9

Which activity is normally part of customer due diligence?

A. Identifying beneficial owners

B. Guaranteeing repayment by every customer

C. Setting monetary policy

D. Eliminating all transaction alerts

Correct Answer: A. Identifying beneficial owners

Question 10

A sanctions-screening alert based on a common name should generally be handled by:

A. Ignoring it automatically

B. Allowing the transaction because the customer complains

C. Conducting documented investigation to determine whether it is a true match

D. Closing every account with a similar name immediately

Correct Answer: C. Conducting documented investigation to determine whether it is a true match