Governance, Regulation, Risk and Ethics

Introduction

Banking depends on confidence. Depositors expect to withdraw funds when required, borrowers expect fair and reliable service, investors expect accurate information, and regulators expect institutions to remain safe and sound. These expectations are interconnected. A bank that suffers weak governance may take excessive risks; poor risk management may cause financial loss; inadequate controls may allow fraud; and unethical conduct may destroy public trust even when the bank remains solvent.

This chapter examines the framework through which banks are directed, supervised and held accountable. It focuses on prudential regulation, capital and liquidity, governance responsibilities, the three-lines model, conduct and operational risk, internal control, audit, conflicts of interest, environmental, social and governance (ESG) considerations, and professional ethics. The discussion applies to both retail and corporate banking.

Learning Objectives

By the end of this chapter, you should be able to:

1. Explain the purpose of prudential regulation and distinguish major regulatory risks.
2. Describe the functions of bank capital, capital adequacy and liquidity management.
3. Explain the responsibilities of the board, senior management and control functions.
4. Apply the three-lines model to practical banking situations.
5. Distinguish credit, market, liquidity, operational, conduct and compliance risks.
6. Explain the role of internal controls, compliance and internal audit.
7. Identify conflicts of interest and appropriate responses.
8. Discuss ESG risks, responsible finance and professional banking ethics.

1. Why Banking Requires Special Governance and Regulation

Banks perform maturity transformation: they accept deposits that may be withdrawn quickly and invest or lend funds over longer periods. They also transform risk, aggregate information about customers and operate payment systems. These functions create benefits but also vulnerabilities.

A bank can fail because of insolvency, when its assets are insufficient to cover its liabilities, or because of illiquidity, when it cannot meet obligations as they fall due even though its assets may exceed liabilities in total. Since banks are connected through payment systems, interbank lending and common asset markets, the failure of one institution can affect others. This is known as systemic risk.

Market discipline alone is insufficient because depositors may not have the information or expertise to assess a bank’s risk. Deposit insurance can protect customers but may create moral hazard: a bank may take greater risks if it believes losses will be absorbed by others. Prudential regulation therefore seeks to reduce the probability and impact of bank failure while allowing banks to provide credit efficiently.

Regulation does not eliminate risk. Rather, it establishes minimum standards, reporting requirements, supervisory expectations and enforcement mechanisms. Effective governance is broader than compliance: it requires responsible decision-making, accountability and a culture in which risks are identified and challenged before they become losses.

2. Prudential Regulation

Prudential regulation is regulation designed to promote the safety and soundness of financial institutions and the stability of the financial system. It generally has two dimensions.

Microprudential regulation focuses on the resilience of an individual bank. It examines capital, liquidity, risk management, governance, asset quality and controls.

Macroprudential regulation focuses on risks arising from the financial system as a whole. It may address credit booms, property bubbles, interconnectedness, concentration and procyclical lending.

Important regulatory objectives include:

• protecting depositors and payment-system users;
• reducing the probability of bank failure;
• limiting excessive leverage and risk concentration;
• ensuring reliable financial and prudential reporting;
• preventing money laundering, terrorist financing and sanctions breaches;
• promoting fair treatment of customers; and
• supporting financial stability and confidence.

The exact rules differ by jurisdiction. Many regulatory systems are influenced by international standards developed through the Basel framework, but local law determines the binding requirements. A bank must therefore understand both international principles and the specific rules of its regulator.

Major Categories of Banking Risk

Risks are not isolated. For example, weak underwriting is a credit-risk problem, but it may also create conduct risk if customers were misled, operational risk if procedures were bypassed, and reputational risk if losses become public.

3. Capital: The Bank’s Loss-Absorbing Capacity

Capital is the financial resources supplied by owners and retained through accumulated profits. It differs from deposits and borrowings because it does not normally have a fixed repayment date and absorbs losses before depositors and other creditors.

Capital serves three principal purposes:

1. It absorbs unexpected losses.
2. It supports confidence among depositors, counterparties and regulators.
3. It permits the bank to undertake business while limiting excessive leverage.

Regulatory capital is commonly classified into tiers. Although definitions depend on applicable law, the broad concept is that higher-quality capital is more permanent and more readily available to absorb losses. Common categories include common equity capital, additional going-concern capital and supplementary capital instruments.

Risk-weighted assets (RWA) adjust exposures according to their perceived risk. A secured exposure to a highly creditworthy counterparty may receive a lower risk weight than an unsecured exposure to a risky borrower. RWA are not the same as total assets.

The basic capital ratio is:

Regulatory capital and RWA must be measured under the relevant regulatory rules and in the same reporting period. The ratio indicates capital relative to assessed risk, not the bank’s total profitability or liquidity.

Worked Example: Capital Adequacy

Assume a bank has qualifying regulatory capital of $84 million and risk-weighted assets of $600 million.

If the applicable minimum is 10%, the bank exceeds that minimum by 4 percentage points. This conclusion assumes that the $84 million is eligible regulatory capital and that the $600 million RWA figure has been calculated correctly. A ratio above the minimum does not guarantee safety: capital may still be inadequate under severe stress, and poor governance may cause rapid deterioration.

A related measure is the leverage ratio, which compares a capital measure with a broader exposure measure rather than risk-weighted assets. It acts as a backstop against excessive leverage and reduces reliance on risk models. Banks also use stress testing to estimate whether capital remains adequate under adverse scenarios such as recession, rising defaults, falling property prices or large market losses.

Capital planning should be forward-looking. Management should consider expected growth, dividend policy, loan losses, regulatory buffers, stress results and access to external funding. Distributing profits when capital is already weak can increase vulnerability.

4. Liquidity and Funding Principles

Liquidity is the ability to meet obligations as they fall due without unacceptable losses. A bank may be profitable but illiquid if customers withdraw deposits and the bank cannot raise funds or sell assets promptly.

Liquidity management involves:

• maintaining high-quality liquid assets;
• monitoring expected cash inflows and outflows;
• diversifying funding sources and maturities;
• limiting dependence on unstable short-term funding;
• testing access to secured and unsecured funding; and
• maintaining a credible contingency funding plan.

A simplified liquidity coverage ratio is:

High-quality liquid assets are assets that can generally be converted into cash quickly with limited loss under stress. Net cash outflows are stressed expected outflows minus eligible inflows, subject to regulatory assumptions and caps. The ratio is a regulatory measure, not a complete liquidity forecast.

Worked Example: Liquidity Coverage

Suppose a bank has $150 million of eligible high-quality liquid assets and estimated 30-day net cash outflows of $120 million.

The bank has liquid assets equal to 125% of the specified stressed net outflows. This does not mean that every withdrawal can be met automatically. The bank must still consider intraday liquidity, collateral requirements, concentration of depositors, market access and longer-term funding stability.

The net stable funding ratio (NSFR) addresses structural funding over a longer horizon by comparing available stable funding with required stable funding. The precise calculation depends on regulatory classifications. In practice, treasury departments combine regulatory ratios with cash-flow projections, early-warning indicators and stress scenarios.

5. Governance Responsibilities

Corporate governance is the system by which an institution is directed, controlled and held accountable. In banking, governance must link business objectives with prudent risk-taking and fair treatment of stakeholders.

The Board of Directors

The board is ultimately responsible for the bank’s strategy, risk appetite, culture and oversight. Its responsibilities generally include:

• approving strategy and risk appetite;
• ensuring that capital and liquidity are adequate;
• appointing, challenging and evaluating senior management;
• overseeing risk management, compliance and internal audit;
• ensuring accurate financial and regulatory reporting;
• monitoring related-party transactions and conflicts of interest;
• promoting ethical behaviour and customer protection; and
• preparing for recovery, resolution and crisis situations.

The board should not manage individual customer accounts or override professional credit processes as a routine matter. Its role is oversight, challenge and accountability.

Senior Management

Senior management implements board-approved strategy. It allocates resources, establishes procedures, operates controls, maintains competent staff and reports significant risks and breaches. Managers remain responsible even when activities are outsourced. Outsourcing transfers an activity, not accountability.

Committees and Independence

Risk, audit, remuneration and conduct committees may support effective oversight. Their precise structure varies according to the size and complexity of the bank. Independent non-executive directors can provide challenge, but independence must be substantive rather than merely formal. A director who has undisclosed financial ties to a supplier may not be able to exercise objective judgment.

A sound governance culture encourages staff to raise concerns without retaliation. Performance targets should not reward misconduct or excessive short-term risk. Remuneration should reflect sustainable performance, risk outcomes and customer impact.

6. The Three-Lines Model

The three-lines model clarifies roles in risk management; it does not remove the responsibility of the board or senior management.

First line: management and business operations. Business units own the risks created by their activities. Relationship managers, branch staff, traders and operations teams must follow procedures, identify issues and operate day-to-day controls.

Second line: risk management and compliance. These functions establish frameworks, advise the business, monitor exposure, challenge decisions and report independently to senior management and the board. Compliance focuses on legal, regulatory and conduct obligations; risk management covers the wider risk profile.

Third line: internal audit. Internal audit provides independent, objective assurance on governance, risk management and controls. It should not design or operate the controls that it later audits.

The board and senior management sit above the three lines as accountable governing bodies. External audit, regulators and other external assurance providers are outside the internal model but may provide additional assurance.

Figure: The three-lines model allocates operational ownership, independent challenge and assurance while preserving board accountability.

The model is effective only when the lines have adequate expertise, authority, resources and access to information. A compliance officer who cannot challenge a profitable but unsuitable product is not performing an effective second-line role.

7. Internal Controls and Audit

Internal control is a process designed to provide reasonable, not absolute, assurance that objectives relating to operations, reporting and compliance will be achieved. Controls may be preventive, detective or corrective.

Examples include:

• segregation of duties between approving, processing and reconciling transactions;
• dual authorization for payments and changes to customer records;
• access controls and authentication;
• reconciliations between subsidiary systems and the general ledger;
• exception reports and transaction limits;
• documented credit approvals;
• physical and cyber-security controls; and
• incident escalation and remediation tracking.

A control must be appropriately designed and actually operate. A policy requiring dual approval is ineffective if staff share passwords or routinely approve transactions without review. Control testing should examine both design effectiveness and operating effectiveness.

Internal audit uses a risk-based plan. It assesses whether governance, controls and risk management are adequate, reports findings according to severity and follows up corrective actions. Audit independence is weakened when auditors design controls, approve transactions or report only to the managers whose work they evaluate. The chief audit executive should have direct access to the audit committee or equivalent governing body.

External audit primarily provides an opinion on financial statements under applicable auditing standards. It is not a substitute for management controls, compliance monitoring or internal audit.

8. Conduct Risk and Customer Protection

Conduct risk is the risk that a bank’s behaviour causes unfair outcomes or harm to customers, markets or the integrity of the financial system. It affects both retail and corporate customers.

Key conduct expectations include:

• products should be designed for an identifiable target market;
• information should be clear, accurate and not misleading;
• fees, interest rates, risks and important conditions should be disclosed;
• customers should not be pressured into unsuitable products;
• complaints should be recorded, investigated and resolved fairly;
• vulnerable customers should receive appropriate support; and
• sales incentives should not encourage manipulation or mis-selling.

For corporate customers, conduct issues may include undisclosed fees, inappropriate hedging products, misuse of confidential information, discriminatory access to credit or pressure to accept unsuitable covenants.

A useful control is the customer-outcome review. Instead of asking only whether a form was completed, the bank asks whether the customer understood the product, whether the product met the stated need and whether complaints or cancellations indicate a wider problem.

9. Operational and Technology Risk

Operational risk arises from inadequate or failed internal processes, people and systems, or from external events. Examples include payment errors, fraud, cyberattacks, system outages, processing failures, model errors, physical disasters and failures by third-party service providers.

Operational-risk management involves identifying critical processes, assessing threats, assigning controls, recording incidents, analysing root causes and testing business continuity. A business continuity plan should identify essential services, recovery priorities, alternative locations or systems, communication arrangements and decision authority.

Technology creates both efficiency and risk. Automated credit scoring may improve consistency but can reproduce biased data or make decisions that staff cannot explain. Artificial intelligence used in fraud detection or customer service should be subject to data-quality controls, access restrictions, human escalation, monitoring for bias and documented accountability. The use of a vendor’s system does not transfer responsibility for legal compliance or customer outcomes.

Cybersecurity requires layered protection, including identity management, least-privilege access, encryption where appropriate, patching, monitoring, staff awareness and tested incident-response procedures. Operational resilience is broader than preventing incidents: it is the ability to continue important services within acceptable tolerances during disruption.

10. Conflicts of Interest

A conflict of interest occurs when a personal, financial or institutional interest could improperly influence professional judgment, or could reasonably appear to do so. Conflicts may be actual, potential or perceived.

Examples include a relationship manager receiving incentives for selling a product that is unsuitable for a client, a director approving a loan to a related company, an employee using confidential merger information to trade, or a procurement officer selecting a supplier owned by a relative.

The standard response is not to conceal a conflict. Appropriate steps may include disclosure, recusal, independent review, reassignment, information barriers, prohibition of the activity or recording the decision in a conflicts register. Disclosure alone may not be sufficient where the conflict is severe or the customer cannot give genuinely informed consent.

Gifts, hospitality and outside employment should be governed by clear policies. Staff must protect confidential information and must not use a customer relationship for personal advantage.

11. ESG and Responsible Banking

ESG considerations are increasingly relevant to lending, investment, operations and disclosure.

Environmental risks include physical risks such as floods and heat, and transition risks arising from changes in technology, regulation, energy prices or consumer preferences. These risks can reduce a borrower’s cash flow or collateral value.

Social risks include labour abuses, unsafe products, discrimination, human-rights violations and community harm. They may create legal, credit and reputational consequences.

Governance risks include corruption, weak boards, poor controls, opaque ownership and unreliable reporting.

Banks should incorporate material ESG factors into customer due diligence, credit analysis, sector limits, collateral assessment, scenario analysis and engagement. They should avoid greenwashing: presenting a product or portfolio as environmentally beneficial without evidence supporting the claim. ESG data may be incomplete, inconsistent or based on estimates, so professional judgment and transparent assumptions are essential.

Responsible banking does not mean refusing every customer exposed to an environmental or social challenge. A bank may support a credible transition plan while imposing measurable targets, reporting requirements and appropriate pricing or limits. The approach should be risk-sensitive and consistent with applicable law.

12. Professional Ethics

Ethics concerns what professionals ought to do, not merely what they are legally permitted to do. Law establishes minimum requirements; ethical conduct also involves honesty, fairness, competence, confidentiality, objectivity and responsibility for consequences.

A professional banker should:

• act with integrity and avoid deception;
• place customer interests and lawful obligations above improper personal gain;
• maintain competence and seek advice when uncertain;
• protect confidential information;
• keep accurate records;
• challenge unreasonable or unsafe instructions;
• report suspected misconduct through appropriate channels; and
• treat customers and colleagues fairly.

Ethical decision-making can be structured through five questions:

1. What are the facts, and what information is missing?
2. Who may be affected, including customers and vulnerable stakeholders?
3. What laws, policies and professional principles apply?
4. Would the decision remain acceptable if publicly disclosed?
5. What advice, escalation or documentation is required?

Whistleblowing arrangements should provide confidential reporting, protection from retaliation and independent investigation. Employees should not be expected to resolve serious misconduct alone. Senior leaders establish ethical culture through their own behaviour, not through policy documents alone.

13. Illustrative Case: Riverside Bank’s Commercial Lending Failure

Background

Riverside Bank expanded rapidly into loans to small construction companies. Relationship managers received large bonuses based on loan volume. The bank’s board approved growth targets but did not set sector concentration limits. The risk function was understaffed, and internal audit had not reviewed the new lending process for two years.

Problem

Several borrowers later defaulted after construction costs increased and property prices fell. An investigation found that some valuations were outdated, affordability analysis was incomplete and exceptions were approved verbally. A manager had also encouraged staff to classify weak applications as renewals, avoiding a higher level of approval.

Analysis

The immediate problem was credit loss, but the underlying failures were broader:

• governance: the board did not challenge rapid sector growth;
• risk appetite: concentration and underwriting limits were unclear;
• conduct: incentives encouraged volume rather than sustainable outcomes;
• operational control: approval evidence and segregation of duties were weak;
• information quality: management reports understated exceptions; and
• audit: independent assurance was insufficient.

The case demonstrates that capital ratios measured before the losses would not, by themselves, prove that governance was effective. A bank can meet a minimum ratio while taking risks that later cause severe losses.

Approach and Solution

Riverside should suspend further high-risk growth, review the portfolio, update valuations and increase provisions where appropriate. It should establish sector limits, require documented credit exceptions, strengthen independent risk review and redesign incentives to include repayment performance and customer outcomes. The board should receive regular concentration, arrears, exception and stress-testing reports. Internal audit should independently test the redesigned process, while compliance should review whether customers were treated fairly.

Outcome

After corrective action, lending growth slowed, early-warning reporting improved and approval exceptions declined. The bank retained viable customers but required credible restructuring plans from distressed borrowers. Senior managers whose conduct contributed to the failures were subject to disciplinary review.

Learning Points

1. Risk ownership begins in the business, not only in the risk department.
2. Incentives are governance mechanisms and can create misconduct.
3. Accurate management information is essential for board challenge.
4. Controls must be evidenced and tested, not merely documented.
5. Capital and liquidity measures complement, but do not replace, sound governance.

14. Challenges and Contemporary Developments

Banks face several continuing challenges. Regulatory requirements can become complex, creating compliance costs and the risk of treating compliance as a checklist. Excessive reliance on models may hide poor data or inappropriate assumptions. Rapid digital banking increases speed and access but can also increase fraud, cyber risk and automated exclusion. Third-party technology providers may become critical points of failure.

Climate change, geopolitical disruption, changing interest rates and new forms of financial crime require forward-looking scenario analysis. Supervisors increasingly expect banks to demonstrate operational resilience, effective risk culture, credible recovery planning and reliable ESG disclosures.

The appropriate response is not to eliminate innovation. It is to apply proportionate governance: define accountability, test systems before deployment, monitor outcomes, maintain human oversight where needed and ensure that senior decision-makers understand the risks they accept.

Best-Practice Checklist

A well-governed bank should:

• maintain a clear board-approved risk appetite;
• align capital and liquidity planning with strategy;
• assign risks to accountable owners;
• preserve independent challenge by risk and compliance functions;
• maintain an adequately resourced internal-audit function;
• test controls and track remediation to completion;
• monitor customer outcomes, complaints and vulnerable customers;
• identify and manage conflicts of interest;
• test cyber, outsourcing and business-continuity arrangements;
• use reliable data and explainable decision processes; and
• reward integrity, competence and sustainable performance.

Chapter Summary

Prudential regulation protects depositors, supports financial stability and limits excessive risk, but it cannot replace responsible governance. Capital provides loss-absorbing capacity, while liquidity enables a bank to meet obligations when due. Capital ratios use regulatory capital and risk-weighted assets; liquidity measures such as the LCR compare eligible liquid assets with stressed cash outflows under specified rules.

The board is accountable for strategy, risk appetite, culture and oversight. Senior management implements controls and reports risks. The three-lines model assigns risk ownership to business operations, independent challenge to risk and compliance, and assurance to internal audit. Effective controls require appropriate design, operation, evidence and follow-up.

Conduct risk concerns customer and market harm; operational risk concerns failures of people, processes, systems or external events. Conflicts of interest must be disclosed, managed or prohibited. ESG factors can affect credit, market, operational and reputational risk, while ethical professionalism requires integrity, competence, confidentiality, fairness and willingness to challenge misconduct. Strong banking institutions combine regulatory compliance with sound judgment and a culture of accountability.

Key Terms

Prudential regulation: Regulation intended to promote the safety and soundness of financial institutions.

Microprudential regulation: Supervision focused on the resilience of an individual institution.

Macroprudential regulation: Supervision focused on risks to the financial system as a whole.

Systemic risk: The possibility that distress in one institution or market spreads through the financial system.

Capital: Financial resources available to absorb losses and support banking activity.

Risk-weighted assets: Assets or exposures adjusted according to regulatory assessments of risk.

Capital adequacy ratio: Regulatory capital expressed as a percentage of risk-weighted assets.

Liquidity risk: The risk that obligations cannot be met when due without unacceptable loss.

LCR: Liquidity coverage ratio comparing high-quality liquid assets with stressed short-term net cash outflows.

Risk appetite: The amount and type of risk an institution is willing to accept.

Three-lines model: Framework separating business ownership, risk and compliance challenge, and internal-audit assurance.

Internal control: A process providing reasonable assurance over operations, reporting and compliance.

Conduct risk: Risk of harm caused by inappropriate behaviour toward customers or markets.

Operational risk: Risk arising from failed processes, people, systems or external events.

Conflict of interest: A circumstance in which personal or institutional interests may improperly influence judgment.

ESG: Environmental, social and governance factors relevant to business and risk decisions.

Greenwashing: Misleading presentation of a product or activity as environmentally beneficial.

Professional ethics: Principles guiding honest, competent, fair and responsible professional behaviour.

Operational resilience: Ability to continue important services during disruption.

Whistleblowing: Reporting suspected wrongdoing through protected internal or external channels.

Review Questions

Short Answer Questions

1. What is the main purpose of prudential regulation?
2. Why is bank capital important?
3. Define liquidity risk and give one example of a liquidity control.
4. What is the role of internal audit in the three-lines model?
5. Give two examples of conflicts of interest in banking.

Long Answer Questions

1. Explain the differences between microprudential and macroprudential regulation.
2. Discuss the responsibilities of the board and senior management in a commercial bank.
3. Explain the three-lines model and identify the limitations of relying on it mechanically.
4. Discuss how conduct risk and operational risk can interact in retail banking.
5. Explain how ESG considerations may affect corporate credit assessment.

Analytical / Application Questions

1. A bank reports $96 million of qualifying capital and $800 million of risk-weighted assets. Calculate its capital ratio and explain what additional information would be needed before judging its resilience.
2. A relationship manager is offered a personal bonus for selling an interest-rate derivative to a small business that does not understand derivatives. Identify the ethical and conduct issues and recommend controls.
3. A digital bank suffers a cyberattack that interrupts payments for six hours. Analyse the responsibilities of the first, second and third lines and recommend immediate and longer-term responses.

Multiple Choice Questions with Answers

Question 1

What is the primary purpose of prudential regulation?

A. To guarantee profits for every bank

B. To promote safety, soundness and financial stability

C. To eliminate all competition between banks

D. To determine the personal income of bank employees

Correct Answer: B. To promote safety, soundness and financial stability

Question 2

A bank has regulatory capital of $50 million and risk-weighted assets of $400 million. What is its capital ratio?

A. 8%

B. 10%

C. 12.5%

D. 20%

Correct Answer: C. 12.5%

Question 3

Which activity belongs primarily to the first line of the three-lines model?

A. Owning and managing risks in business operations

B. Providing independent audit assurance

C. Setting accounting standards for the banking industry

D. Replacing the board of directors

Correct Answer: A. Owning and managing risks in business operations

Question 4

Which formula represents the simplified liquidity coverage ratio?

A. Total assets ÷ total liabilities × 100%

B. Net profit ÷ equity × 100%

C. High-quality liquid assets ÷ net stressed cash outflows × 100%

D. Loans ÷ deposits × 100%

Correct Answer: C. High-quality liquid assets ÷ net stressed cash outflows × 100%

Question 5

Which is an example of conduct risk?

A. A flood damages a branch building

B. A bank sells an unsuitable product using misleading information

C. A server requires a software update

D. A borrower repays a loan early

Correct Answer: B. A bank sells an unsuitable product using misleading information

Question 6

What is the main assurance role of internal audit?

A. To approve every customer loan

B. To operate the bank’s daily payment system

C. To provide independent, objective assurance on governance, risk and controls

D. To set the central bank’s interest rate

Correct Answer: C. To provide independent, objective assurance on governance, risk and controls

Question 7

Which response is generally appropriate when an employee has a serious conflict of interest?

A. Conceal it if the transaction is profitable

B. Disclose and manage it, including recusal or reassignment where necessary

C. Transfer the conflict to a customer

D. Delete records of the relationship

Correct Answer: B. Disclose and manage it, including recusal or reassignment where necessary

Question 8

Which statement best describes operational risk?

A. Risk arising only from changes in share prices

B. Risk that a borrower refuses to repay

C. Risk from failed processes, people, systems or external events

D. Risk that customers earn too much interest

Correct Answer: C. Risk from failed processes, people, systems or external events

Question 9

What is greenwashing?

A. Using paperless banking services

B. Misleadingly presenting an activity as environmentally beneficial

C. Reducing a bank’s cash holdings

D. Auditing environmental data independently

Correct Answer: B. Misleadingly presenting an activity as environmentally beneficial

Question 10

Who retains ultimate accountability for a bank’s strategy and risk appetite?

A. The board of directors

B. An individual teller

C. An external technology supplier

D. A single customer

Correct Answer: A. The board of directors