Governance, Ethics, Sustainability and the Future of Banking

Introduction and Context

Banking is founded on trust. Depositors entrust funds to institutions that transform short-term savings into loans, payments and investments. Because banks are highly leveraged, interconnected and dependent on confidence, poor governance or unethical conduct can impose costs on customers, taxpayers and the wider economy. Modern banking governance therefore extends beyond compliance with company law. It includes prudent risk oversight, fiduciary responsibility, ethical culture, financial crime prevention, customer protection, sustainability and readiness for technological change.

This chapter examines how banks can remain safe, fair, responsible and strategically relevant. It links the duties of boards and executives with practical controls, including anti-money-laundering (AML), counter-terrorist-financing (CTF), sanctions screening, whistleblowing and complaint handling. It then considers environmental, social and governance (ESG) risks, climate finance, inclusion, digital currencies, platform banking and future skills.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the purpose and structure of bank governance and fiduciary responsibility.
2. Apply ethical decision-making principles to banking situations.
3. Describe AML, CTF and sanctions-control frameworks.
4. Evaluate whistleblowing, customer-protection and complaint-redress mechanisms.
5. Assess ESG and climate-related financial risks.
6. Explain the role of financial inclusion and green finance.
7. Analyse opportunities and risks associated with digital currencies and platform banking.
8. Identify capabilities required by the future banking workforce.

1. The Governance Architecture of a Bank

1.1 Meaning and purpose

Corporate governance is the system by which an organisation is directed, controlled and held accountable. In a bank, governance must reconcile several interests: shareholders seek sustainable returns; depositors require safety; borrowers require fair access; employees need ethical working conditions; regulators require stability; and society expects lawful and responsible conduct.

The central governance problem arises from separation of ownership and control. Shareholders may own the bank, but directors and managers make most operating decisions. Depositors and other creditors provide substantial funding but usually have limited voting power. Regulation and independent oversight are therefore necessary to reduce conflicts of interest and excessive risk-taking.

Good bank governance normally pursues four outcomes:

• Sound strategy: a clearly defined business model and risk appetite.
• Effective oversight: competent, independent challenge by the board.
• Control integrity: reliable risk management, compliance, audit and reporting.
• Accountability: transparent allocation of responsibility and consequences for misconduct.

1.2 The board and its committees

The board approves strategy, risk appetite, capital planning, remuneration principles and major policies. It appoints and supervises the chief executive and ensures that senior management is fit and proper. Directors are not expected to manage daily transactions; they are expected to question assumptions, understand material risks and verify that management controls are effective.

Important board committees commonly include:

The exact structure depends on law, institutional size and regulatory expectations. Committees support the board; they do not remove the board’s collective responsibility.

1.3 Three lines of responsibility

A widely used control model separates responsibilities into three lines:

1. First line—business and operations: owns customer, credit, market, operational and conduct risks and operates daily controls.
2. Second line—risk and compliance: sets frameworks, monitors adherence, challenges business decisions and reports independently.
3. Third line—internal audit: provides independent assurance on governance, risk management and controls.

External auditors and regulators are important sources of assurance, but they are outside the bank’s internal three lines. A bank cannot outsource accountability by claiming that an auditor or consultant failed to identify a problem.

1.4 Fiduciary responsibility

Fiduciary responsibility is the obligation to act loyally, honestly, carefully and in the interests of the institution and those to whom duties are owed. Directors must avoid undisclosed conflicts, protect confidential information, exercise informed judgement and avoid using their position for personal benefit. In banking, fiduciary reasoning must also recognise the legitimate interests of depositors and the public interest in financial stability.

A practical board decision should ask:

• What is the purpose of the decision?
• What risks arise for depositors, customers and the institution?
• Is management information accurate, complete and timely?
• Are conflicts disclosed and managed?
• Is the decision consistent with law, the bank’s values and its risk appetite?
• Can the rationale withstand regulatory, customer and public scrutiny?

2. Ethics and Conduct in Banking

2.1 Ethics, law and culture

Law establishes minimum standards; ethics asks what responsible conduct requires when rules are incomplete or incentives conflict. A transaction can be technically lawful yet ethically unacceptable—for example, selling a complex product to a customer who cannot understand its risks, or exploiting a vulnerable customer’s urgency.

Ethical culture is shaped by what leaders reward, tolerate and investigate. Codes of conduct are useful only when supported by training, realistic sales targets, transparent remuneration and consequences for misconduct. A culture that celebrates revenue while ignoring customer harm creates predictable ethical failure.

Core ethical principles include:

• Integrity: honesty in statements, records and dealings.
• Fairness: treating customers consistently and avoiding exploitation.
• Competence and care: giving suitable advice and acting diligently.
• Confidentiality: protecting customer information, subject to lawful disclosure.
• Accountability: accepting responsibility and correcting harm.
• Professional independence: resisting improper pressure and conflicts.

2.2 Ethical decision framework

When a difficult decision arises, an employee can apply a five-stage test:

1. Identify affected stakeholders and the potential harm.
2. Separate facts from assumptions and disclose conflicts.
3. Identify legal, regulatory, professional and internal requirements.
4. Compare alternatives using fairness, proportionality and long-term consequences.
5. Document the reasoning, escalate uncertainty and review the outcome.

This framework does not replace professional judgement. It improves the quality and traceability of that judgement.

2.3 Incentives and conduct risk

Sales incentives can encourage unsuitable lending, mis-selling, manipulation of performance data or concealment of complaints. Responsible remuneration should include quality, customer outcomes, risk-adjusted performance and conduct measures—not merely volume or short-term profit. Deferred awards, malus and clawback provisions can make senior managers bear consequences when later information reveals serious misconduct.

3. AML, CTF and Sanctions Controls

3.1 Purpose and risk-based approach

Money laundering is the process of disguising criminal proceeds so that they appear legitimate. Terrorist financing involves collecting or moving funds for terrorist purposes; the money may originate from lawful or unlawful sources. Sanctions are legal restrictions imposed by competent authorities on countries, persons, entities, goods or activities.

A risk-based approach allocates stronger controls to higher-risk relationships and transactions. It does not mean ignoring low-risk customers, nor does it justify blanket exclusion without evidence. The bank should assess customer, product, delivery-channel, geographic and transactional risks.

3.2 Customer due diligence

Customer due diligence (CDD) generally involves:

• identifying and verifying the customer;
• identifying beneficial owners and persons exercising control;
• understanding the purpose and expected nature of the relationship;
• assessing source of funds and, where appropriate, source of wealth;
• screening relevant persons against sanctions, politically exposed person (PEP) and adverse-media information;
• monitoring activity and updating information.

Enhanced due diligence is appropriate for higher-risk situations, such as complex ownership, high-risk jurisdictions, unusual activity, certain correspondent relationships or a PEP relationship. Simplified measures may be permitted for genuinely lower-risk situations under applicable law, but never where prohibited by law or where suspicion exists.

3.3 Transaction monitoring and reporting

Monitoring systems use rules, scenarios, network analysis and increasingly machine learning to identify activity inconsistent with the customer profile. An alert is not proof of crime. It requires investigation, documented reasoning and, where legally required, a suspicious transaction or activity report to the competent financial intelligence unit.

The bank must avoid tipping off a customer that a suspicious report or investigation has been made. Records must be retained for the legally required period, access must be controlled, and personal data must be processed lawfully.

3.4 Sanctions screening

Sanctions controls typically screen customers, beneficial owners, counterparties, payments and relevant trade information. Effective programmes require current lists, carefully calibrated matching, investigation of false positives, escalation of potential matches and controls over payment release. Screening is not only a technology problem: poor data quality, weak ownership analysis and unclear decision rights can cause failures.

3.5 Governance of financial-crime controls

Senior management should establish a financial-crime risk appetite, appoint appropriately empowered compliance officers, resource monitoring and independent testing, and report material weaknesses to the board. Common control failures include incomplete customer records, excessive reliance on automated alerts, weak correspondent-bank due diligence and pressure to onboard profitable customers quickly.

4. Whistleblowing and Speaking Up

Whistleblowing systems allow employees and relevant third parties to report suspected illegality, fraud, corruption, unsafe practices or serious misconduct. A credible system should provide confidential or anonymous reporting where lawful, multiple channels, independent investigation, protection against retaliation, documented outcomes and board-level oversight.

A whistleblowing policy fails if employees believe that reports disappear, confidentiality is unreliable or reporting damages careers. Managers must distinguish a good-faith report from a malicious allegation; an unsubstantiated report is not necessarily a dishonest report. Retaliation—including dismissal, isolation, threats or negative performance treatment—should itself be treated as serious misconduct.

5. Customer Protection and Complaint Redress

5.1 Principles of customer protection

Responsible banking requires clear information, suitable products, fair pricing, privacy, secure transactions, accessibility and special attention to vulnerable customers. Product governance should consider the target market, foreseeable misuse, affordability and the customer’s ability to understand risks.

Digital interfaces create additional concerns. Pre-ticked consent, confusing defaults, dark patterns, excessive notifications and opaque automated decisions can undermine meaningful choice. Accessibility should include language, disability, connectivity and financial-literacy considerations.

5.2 Complaint-redress system

An effective complaint system should:

1. make reporting easy through branches, telephone, digital and accessible channels;
2. acknowledge and log the complaint;
3. investigate independently and preserve evidence;
4. communicate a reasoned decision within required time limits;
5. provide correction, apology, compensation or other remedy where appropriate;
6. offer escalation to an ombudsman, regulator or other external body;
7. analyse root causes and feed lessons into product and control improvements.

Complaint volume alone is a poor performance measure. A bank with fewer complaints may have inaccessible channels or a culture that discourages reporting. Useful indicators include resolution time, repeat complaints, upheld complaints, compensation, vulnerability outcomes and recurrence by product or channel.

6. ESG and Climate-Related Financial Risk

6.1 ESG as a banking issue

ESG factors become financial risks when they affect cash flows, asset values, funding, operating costs, reputation or legal exposure. ESG is not simply charitable activity. It concerns the resilience and responsibility of the bank’s business model.

• Environmental risks: pollution, biodiversity loss, water stress and climate change.
• Social risks: labour conditions, human rights, financial exclusion, customer harm and community effects.
• Governance risks: corruption, weak controls, board failure, data misuse and executive misconduct.

6.2 Physical and transition climate risks

Physical risks arise from climate events and long-term environmental changes, such as floods, storms, heat and drought. They can reduce collateral values, disrupt borrowers’ operations and increase insurance costs. Transition risks arise from changes toward a lower-carbon economy, including carbon pricing, new regulation, technology substitution, changing customer preferences and litigation.

Climate risk can affect traditional risk categories:

6.3 Risk management and scenario analysis

Banks should identify material exposures, establish governance, integrate climate factors into credit and investment decisions, collect reliable data and conduct scenario analysis. A scenario is not a forecast; it is a structured examination of consequences under specified assumptions. Results should inform limits, pricing, portfolio strategy and capital planning, while recognising uncertainty and model limitations.

Greenwashing occurs when environmental claims are exaggerated, vague or unsupported. Green finance therefore requires clear eligibility criteria, use-of-proceeds controls, impact measurement and transparent reporting. A green loan does not become responsible merely because it carries a green label.

7. Financial Inclusion and Green Finance

Financial inclusion means that individuals and enterprises can access and use affordable, useful and safe financial services. Access alone is insufficient: products must be suitable, understandable and reliable.

Banks can promote inclusion through low-cost accounts, proportionate identification procedures consistent with AML law, agent banking, accessible digital payments, responsible microfinance, credit information systems and financial education. However, digital inclusion can fail where customers lack devices, connectivity, identification, literacy or confidence. Human support and cash-access alternatives may remain necessary.

Green finance channels capital toward activities that reduce environmental harm or improve resilience. Examples include renewable-energy lending, energy-efficiency finance, sustainable agriculture, adaptation projects and transition finance. Transition finance is particularly challenging because high-emitting firms may need funding to improve, but banks must distinguish credible transition plans from delay or greenwashing.

8. Digital Currencies, Platform Banking and Data

8.1 Digital currencies

Digital currencies include privately issued crypto-assets, stablecoins and central bank digital currencies (CBDCs). They differ in issuer, legal status, backing, settlement mechanism and risk.

• A crypto-asset may have volatile value and limited legal protection.
• A stablecoin attempts to maintain a reference value but depends on reserve quality, governance, redemption and technology.
• A CBDC is a digital liability of a central bank, subject to the design chosen by the issuing authority.

Potential benefits include faster settlement, programmability and greater payment competition. Risks include cyberattacks, operational failure, privacy concerns, illicit finance, runs on reserve assets, monetary-policy effects and displacement of bank deposits. Banks must not assume that technological novelty removes existing duties of suitability, AML compliance, resilience or consumer protection.

8.2 Platform banking and embedded finance

Platform banking uses application programming interfaces, cloud services, data analytics and partnerships to provide banking or banking-like services through digital platforms. Embedded finance places payments, credit, insurance or savings within non-bank customer journeys.

Benefits may include convenience, lower distribution costs and better personalisation. Risks include unclear accountability, concentration in major technology providers, cyber threats, discriminatory algorithms, data exploitation and the possibility that customers do not know which entity holds responsibility. Contracts must define service levels, data rights, audit access, incident notification, business continuity and exit arrangements.

8.3 AI and responsible innovation

Artificial intelligence can support fraud detection, customer service, credit assessment and compliance monitoring. Yet models may reproduce historical bias, generate inaccurate explanations or make decisions that staff cannot challenge. A responsible AI framework should include a defined purpose, data-quality controls, validation, explainability appropriate to the use, human oversight, monitoring for drift, security, privacy and an appeal mechanism.

9. The Future Banking Workforce

Future bankers will need both technical and human capabilities. Important skills include data literacy, cyber awareness, financial-crime investigation, climate-risk analysis, digital-product design, model governance, regulatory interpretation and ethical judgement. Communication, empathy, negotiation and the ability to explain complex products remain essential.

Banks should use workforce planning, continuous learning, professional certification, internal mobility and diverse recruitment. Automation may remove repetitive tasks but can increase the importance of exception handling and accountability. Employees must understand not only how a system works, but also when it should not be trusted.

10. Integrated Applied Case: Meridian Bank

This is an illustrative case.

Background

Meridian Bank, a medium-sized retail and commercial bank, rapidly expanded mobile lending through a technology partner. At the same time, it marketed a portfolio of “green” loans and relied on automated transaction monitoring.

Problem

Three warning signs emerged. First, the partner’s model approved a lower proportion of applicants from certain districts, but management had not tested whether the result reflected inappropriate proxy discrimination. Second, several corporate borrowers labelled green had no verified environmental-use reporting. Third, a compliance analyst reported that alerts involving a profitable correspondent customer were being closed without adequate investigation. The analyst later experienced exclusion from important meetings.

Analysis

The bank faced interconnected governance, conduct, financial-crime, ESG and operational risks. The board had approved growth targets but had not defined clear risk limits for algorithmic lending or green claims. Compliance lacked sufficient independence, and the whistleblowing process did not protect the reporter. The three lines had become blurred because the technology partner performed activities that the bank treated as outside its responsibility.

Approach and solution

The board established a special committee and required management to:

1. suspend affected lending decisions pending an independent fairness and validation review;
2. provide affected applicants with explanations and a human review route;
3. verify green-loan eligibility, use of proceeds and borrower reporting;
4. reopen the correspondent alerts and report suspicious activity where required;
5. investigate retaliation and protect the whistleblower;
6. revise contracts to require audit access, data controls and incident reporting;
7. strengthen compliance staffing and provide direct reporting to the risk committee;
8. link executive remuneration to customer, control and sustainability outcomes.

Outcome

The review found that the model used variables correlated with location and produced unjustified differences in approval rates. Some green loans lacked evidence of eligible expenditure. The correspondent relationship required enhanced due diligence. Meridian compensated affected customers where harm was established, corrected its marketing, improved monitoring and introduced quarterly board reporting.

Learning points

Technology and outsourcing do not transfer accountability. Ethical culture, customer redress, AML control and sustainability claims must be governed as connected parts of the business model. Growth is responsible only when it is supported by evidence, challenge and effective remedy.

11. Challenges and Limitations

Governance systems cannot eliminate all risk. Boards may suffer from groupthink, information overload or inadequate expertise. ESG data may be incomplete and climate scenarios uncertain. AML systems can generate excessive false positives, while automated models can encode bias. Strong controls may increase onboarding time and cost, potentially excluding legitimate customers if applied without proportionality. Privacy and financial-crime obligations may also create tension that requires lawful, carefully documented judgement.

A further limitation is regulatory fragmentation. Definitions of green finance, digital assets, beneficial ownership and consumer rights may differ between jurisdictions. Banks operating internationally need a coherent global control baseline while adapting to local law.

12. Best-Practice Checklist

A responsible bank should:

• maintain a competent, diverse and appropriately independent board;
• define risk appetite and assign clear accountability;
• align incentives with sustainable customer and risk outcomes;
• operate independent risk, compliance and internal-audit functions;
• apply risk-based CDD, transaction monitoring and sanctions controls;
• protect whistleblowers and investigate reports fairly;
• provide accessible complaints and effective remedies;
• integrate climate and ESG risks into strategy and risk management;
• substantiate green claims and report impacts transparently;
• govern third parties, data, AI and cyber resilience;
• design inclusive products without weakening lawful controls;
• invest continuously in professional skills and ethical leadership.

Chapter Summary

Bank governance protects trust by combining competent board oversight, fiduciary responsibility, independent control functions and transparent accountability. Ethical banking requires more than legal compliance: it requires fairness, competence, integrity and attention to customer outcomes. AML, CTF and sanctions controls should be risk-based, intelligence-led and supported by strong data, escalation and reporting arrangements. Whistleblowing and complaint-redress systems provide essential mechanisms for detecting harm and correcting it.

ESG and climate issues affect credit, market, operational, liquidity and reputational risk. Financial inclusion and green finance can support sustainable development when products are affordable, suitable and supported by credible evidence. Digital currencies, platform banking and AI create opportunities but also raise questions about privacy, resilience, accountability and bias. The future banker therefore needs financial expertise combined with data literacy, technological understanding, ethical judgement and the courage to challenge unsafe decisions.

Key Terms

AML: Controls designed to prevent and detect money laundering.

Beneficial owner: The natural person who ultimately owns or controls a customer or entity.

Board governance: The system through which a bank is directed, supervised and held accountable.

CDD: Customer due diligence used to identify and understand customers and their risks.

Climate risk: Financial risk arising from physical climate effects or transition to a lower-carbon economy.

Conduct risk: Risk that bank behaviour causes unfair customer or market outcomes.

CTF: Measures designed to prevent and detect terrorist financing.

Fiduciary responsibility: Duties of loyalty, care, honesty and proper purpose owed by persons entrusted with responsibility.

Financial inclusion: Access to affordable, useful, safe and suitable financial services.

Greenwashing: Misleading or unsupported environmental claims.

Green finance: Finance directed toward environmental improvement, sustainability or climate resilience.

PEP: A politically exposed person whose public position may create heightened corruption or financial-crime risk.

Platform banking: Delivery of banking services through digital platforms, partnerships and integrated technologies.

Risk appetite: The level and types of risk a bank is willing to accept in pursuing its objectives.

Sanctions screening: Checking relevant parties and transactions against official sanctions restrictions.

Three lines model: Allocation of risk ownership, oversight and independent assurance among business, control and audit functions.

Whistleblowing: Reporting suspected wrongdoing through protected internal or external channels.

Climate transition risk: Risk caused by policy, technology, market or legal changes during the move to a lower-carbon economy.

Review Questions

Short Answer Questions

1. What are the principal responsibilities of a bank’s board?
2. Distinguish between customer due diligence and enhanced due diligence.
3. Why is whistleblower protection important to bank governance?
4. Identify two ways climate risk can affect credit risk.
5. What is greenwashing?

Long Answer Questions

1. Explain the three lines model and evaluate its usefulness in a commercial bank.
2. Discuss how remuneration systems can create or reduce conduct risk.
3. Describe the main components of an effective AML and sanctions-control framework.
4. Explain the relationship between financial inclusion, customer protection and digital banking.
5. Evaluate the governance challenges created by platform banking and artificial intelligence.

Analytical / Application Questions

1. A bank’s automated lending model rejects applicants from one region at twice the rate of other applicants. Design a governance and investigation process before the model is used further.
2. A corporate customer claims that its loan finances renewable energy but refuses to provide use-of-proceeds evidence. Advise the bank on the ethical, governance and risk-management response.
3. An employee reports that suspicious transactions involving a major customer are routinely closed without review and then suffers workplace retaliation. Analyse the bank’s immediate actions, reporting duties and control reforms.

Multiple Choice Questions with Answers

Question 1

Which function is primarily responsible for independent assurance on a bank’s governance, risk management and controls?

A. The sales department

B. The first line business unit

C. Internal audit

D. The treasury desk

Correct Answer: C. Internal audit

Question 2

What is the main purpose of a risk-based AML approach?

A. To apply identical controls to every customer

B. To allocate stronger controls to higher-risk situations

C. To eliminate all low-value accounts

D. To replace customer identification with automated screening

Correct Answer: B. To allocate stronger controls to higher-risk situations

Question 3

Which statement best describes fiduciary responsibility?

A. A duty to maximise short-term sales regardless of harm

B. A duty to act loyally, carefully and in the proper interests of the institution and relevant stakeholders

C. A duty to disclose every customer transaction publicly

D. A duty that applies only to external auditors

Correct Answer: B. A duty to act loyally, carefully and in the proper interests of the institution and relevant stakeholders

Question 4

Which is an example of transition risk?

A. A flood damaging a bank branch

B. A cyberattack on a payment system

C. A new carbon regulation reducing the value of a high-emission borrower’s assets

D. A customer forgetting a password

Correct Answer: C. A new carbon regulation reducing the value of a high-emission borrower’s assets

Question 5

Why should a bank maintain a complaint-redress system?

A. Only to reduce advertising costs

B. To identify harm, provide remedies and learn from recurring problems

C. To prevent customers from contacting regulators

D. To replace internal audit

Correct Answer: B. To identify harm, provide remedies and learn from recurring problems

Question 6

Which feature is essential to a credible whistleblowing programme?

A. Automatic dismissal of every person named in a report

B. Guaranteed publication of all allegations

C. Protection against retaliation and independent investigation

D. Restriction of reports to direct supervisors only

Correct Answer: C. Protection against retaliation and independent investigation

Question 7

What is greenwashing?

A. Financing any profitable company

B. Making environmental claims that are exaggerated, vague or unsupported

C. Using electronic records for loan applications

D. Screening a customer against a sanctions list

Correct Answer: B. Making environmental claims that are exaggerated, vague or unsupported

Question 8

Which is a principal governance risk in platform banking?

A. There can never be third-party dependence

B. Customers may be unclear about which entity is accountable for the service

C. Digital platforms eliminate cyber risk

D. Outsourcing automatically transfers legal responsibility

Correct Answer: B. Customers may be unclear about which entity is accountable for the service

Question 9

A suspicious transaction alert is best understood as:

A. Proof that a customer has committed a crime

B. A trigger for investigation and documented assessment

C. A reason to disclose the investigation to the customer immediately

D. A substitute for customer due diligence

Correct Answer: B. A trigger for investigation and documented assessment

Question 10

Which capability is increasingly important for future banking professionals?

A. Avoiding all technology-related work

B. Data literacy combined with ethical and regulatory judgement

C. Focusing exclusively on sales volume

D. Treating automated model outputs as unquestionable

Correct Answer: B. Data literacy combined with ethical and regulatory judgement