Regulation, Governance and Banking Ethics

Introduction

Retail and rural banking operates at the intersection of public trust, commercial risk and social policy. Banks mobilise household savings, extend credit to consumers, farmers and micro-enterprises, process payments, distribute government benefits and increasingly make decisions through digital platforms. These activities create substantial benefits, but also expose customers and institutions to fraud, discrimination, privacy loss, over-indebtedness, money laundering and operational failure.

Regulation therefore performs more than a compliance function. It establishes minimum prudential standards, protects depositors and customers, preserves financial stability, promotes fair access and disciplines managerial discretion. Governance converts those rules into institutional accountability, while ethics addresses conduct that may be legal yet unfair, exploitative or inconsistent with the fiduciary character of banking.

This chapter uses the Indian banking environment as its principal reference point, particularly the Reserve Bank of India (RBI), priority-sector lending and rural banking requirements. Exact regulatory thresholds, reporting formats and timelines change; practitioners must therefore consult the latest RBI directions, statutory rules, Financial Action Task Force (FATF) standards and applicable laws.

Learning objectives

After studying this chapter, the learner should be able to:

1. Explain the relationship between prudential regulation, consumer protection, governance and ethics.
2. Apply risk-based KYC and AML/CFT controls to retail and rural banking.
3. Evaluate fair-lending, priority-sector and financial-inclusion obligations.
4. Design controls for data governance, digital banking and outsourcing.
5. Assess the roles of the board, senior management, control functions and internal audit.
6. Analyse regulatory trade-offs through an applied rural-banking case.

1. The regulatory architecture of banking

1.1 Why banking requires special regulation

Banks are highly leveraged intermediaries. They promise customers immediate or near-immediate access to deposits while investing in loans and securities whose value and liquidity are uncertain. A bank failure can therefore damage depositors, payment systems and confidence in other institutions. Retail customers usually possess less information and bargaining power than banks, making disclosure and conduct rules necessary. Rural customers may face additional barriers: distance, low literacy, irregular income, weak connectivity and dependence on informal intermediaries.

Banking regulation pursues four connected objectives:

• Safety and soundness: capital, liquidity, asset-quality and risk-management requirements.
• Market integrity: controls against fraud, manipulation, money laundering and terrorist financing.
• Customer welfare: transparency, responsible sales, grievance redress and privacy.
• Developmental inclusion: access to affordable credit and services, including priority sectors and underserved regions.

These objectives can conflict. A strict documentation rule may reduce fraud but exclude a legitimate low-income customer. Aggressive financial inclusion may increase access but weaken underwriting. Effective regulation is consequently risk-sensitive rather than merely rule-intensive.

1.2 Principal institutions and instruments

The RBI regulates and supervises banks and many payment and financial-service activities. The Banking Regulation Act, the Reserve Bank of India Act, the Prevention of Money Laundering Act and rules made under it, consumer-protection and data-protection legislation, and RBI directions form important parts of the framework. Deposit insurance, administered through the Deposit Insurance and Credit Guarantee Corporation, supports depositor confidence subject to statutory limits and conditions. Other regulators may be relevant where banks distribute securities, insurance or pension products.

Regulatory instruments include:

• licensing and authorisation;
• prudential directions and supervisory inspections;
• capital and liquidity standards;
• customer-service and outsourcing directions;
• reporting, disclosure and record-retention rules;
• enforcement, penalties and corrective action;
• ombudsman and grievance mechanisms.

A useful compliance hierarchy is: legislation, binding regulations and directions, supervisory expectations, internal policies, procedures and evidence. An internal policy cannot authorise conduct prohibited by law, and a checklist cannot substitute for judgement.

2. Prudential regulation in retail and rural banking

2.1 Capital and risk absorption

Capital absorbs unexpected losses and protects depositors. A simplified capital adequacy relationship is:

Eligible regulatory capital includes the forms recognised by applicable prudential rules. Risk-weighted assets (RWA) assign different weights to exposures according to credit, market and operational risk. The ratio is not a measure of profitability; it is a solvency buffer. Minimum ratios, capital definitions, buffers and deductions must be taken from current regulatory standards, including applicable Basel-based requirements.

Rural portfolios may contain concentration risk, weather-related risk, commodity-price risk and correlated repayment stress. A loan book can appear diversified by borrower count but remain concentrated by crop, district, employer or local economic shock. Boards should therefore monitor concentration by geography, sector, borrower type and product.

2.2 Credit risk and asset quality

Credit risk is the possibility that a borrower will fail to meet contractual obligations. Sound retail underwriting considers verified income or cash flow, existing indebtedness, repayment capacity, collateral where relevant and the purpose of credit. It should not rely mechanically on collateral: poor-quality collateral can create false comfort, while responsible unsecured lending can be appropriate when cash flow is strong.

Asset classification, provisioning, restructuring and write-off rules are prescribed by applicable regulation. Management must not conceal stress through repeated evergreening, artificial renewals or inappropriate restructuring. Early-warning indicators include missed instalments, declining deposits, repeated overdraft use, insurance lapses, crop damage, employer distress and unusual account activity.

A basic expected-loss logic is:

Probability of Default (PD) is the probability of default over a specified horizon; Loss Given Default (LGD) is the proportion of exposure not recovered after default; Exposure at Default (EAD) is the amount outstanding or expected to be drawn at default. This expression is a risk-management framework, not a replacement for the provisioning method legally required in a jurisdiction. The three inputs must refer to compatible time horizons and definitions.

2.3 Liquidity and operational resilience

Retail banks require sufficient high-quality liquid resources to meet withdrawals, payment obligations and unexpected outflows. Rural branches may face cash logistics, connectivity and disaster risks. Business-continuity plans should cover alternate channels, cash replenishment, power failure, telecommunications disruption, cyberattack, flood, drought and pandemic conditions. Testing must demonstrate that the plan works, not merely that a document exists.

Operational risk arises from failed processes, people, systems or external events. Common rural vulnerabilities include biometric failure, agent misconduct, duplicate customer records, unauthorised fee collection and weak physical security. Incident reporting should capture near misses as well as realised losses.

3. Governance: accountability beyond compliance

3.1 The three-lines model

A practical governance model separates responsibility without isolating functions:

1. First line—business and operations: owns customer outcomes and risks created by products, lending and distribution.
2. Second line—risk and compliance: establishes frameworks, challenges decisions, monitors breaches and advises management.
3. Third line—internal audit: provides independent assurance to the board or audit committee.

The model fails if the first line treats compliance as someone else’s job, if the second line lacks authority, or if internal audit reports to the business it is meant to assess.

3.2 Board and senior-management duties

The board should approve risk appetite, customer-conduct standards, AML policy, outsourcing policy, data-governance principles, remuneration design and crisis-management arrangements. It should receive information that is timely, accurate and sufficiently disaggregated to identify vulnerable customers and rural concentration.

Senior management translates board policy into products, systems, staffing and controls. It is accountable for regulatory reporting, remediation and a culture in which employees can escalate concerns without retaliation. A board that receives only aggregate growth figures may miss rising complaints, declining underwriting quality or agent misconduct.

Useful board indicators include complaint volumes and resolution times, fraud losses, suspicious-transaction alerts, KYC exceptions, collection practices, rejected and approved applications by customer segment, third-party incidents, data breaches, policy breaches and overdue remediation actions. Metrics must be interpreted carefully: a low complaint count may indicate excellent service—or an inaccessible complaint channel.

3.3 Fit, proper and incentive governance

Directors and senior officers require integrity, competence, independence and sufficient time for their responsibilities. Conflicts of interest should be disclosed, recorded and managed through recusal or independent approval. Sales incentives should reward sustainable customer outcomes, not only disbursement, fee income or account opening. Clawbacks, quality gates and complaint-adjusted performance measures can reduce harmful sales behaviour.

4. Consumer protection and fair lending

4.1 Fair treatment across the product life cycle

Fair treatment begins before product design and continues through closure. Banks should assess whether a product is suitable for its target segment, disclose material costs in understandable language, obtain valid consent, process applications consistently, communicate adverse decisions where required and offer accessible redress.

Important practices include:

• clear disclosure of interest, fees, penalties, insurance and third-party charges;
• no coercive bundling or unauthorised deductions;
• communication in locally understood languages where feasible;
• accessible channels for persons with disabilities and low digital literacy;
• respectful, lawful collection practices;
• prompt correction of unauthorised transactions;
• transparent grievance escalation.

Fair lending does not require identical outcomes for all applicants. It requires legitimate, relevant and consistently applied criteria. A credit model may use repayment capacity, verified cash flow and relevant risk variables, but should not encode prohibited discrimination or use opaque proxies for caste, religion, gender, disability or other protected characteristics where such discrimination is unlawful or unethical.

4.2 Responsible recovery

Recovery is legitimate, but intimidation, public shaming, repeated harassment, contact with unrelated persons and misleading threats are unethical and may violate law or regulatory directions. Agents must be trained, identifiable and supervised. Vulnerability—such as illness, disaster, bereavement or severe financial distress—may require escalation to hardship or restructuring processes rather than coercion.

4.3 Grievance redress

An effective system has visible entry points, acknowledgement, case ownership, time-bound resolution, root-cause analysis and independent escalation. Complaints should be classified by product, channel, branch, agent and customer vulnerability. The purpose is not simply to close cases; it is to correct processes and prevent recurrence.

5. KYC and AML/CFT

5.1 Risk-based customer due diligence

Know Your Customer (KYC) establishes who the customer is, who controls an account, the purpose and expected nature of the relationship, and whether activity is consistent with the known profile. Customer Due Diligence (CDD) should be proportionate to risk. Enhanced due diligence is appropriate for higher-risk situations, including certain politically exposed persons, complex ownership structures, unusual cross-border activity or unexplained transaction patterns. Simplified measures may be permitted for lower-risk categories only where regulation allows.

Core controls generally include:

• customer identification and verification using permitted documents or systems;
• beneficial-owner identification for legal persons and arrangements;
• understanding the purpose and expected activity;
• sanctions and relevant watch-list screening;
• ongoing transaction monitoring;
• periodic or event-driven KYC updating;
• secure record retention and audit trails;
• suspicious-transaction reporting to the competent authority where required.

KYC is not a one-time form. It is a continuing risk assessment. A rural customer with limited formal documentation should not be automatically treated as criminal, but alternative legally permitted verification and proportionate monitoring must be used.

5.2 AML/CFT risk and controls

Money laundering commonly involves placement, layering and integration, although transactions may not follow these stages neatly. Terrorist financing can involve small amounts and funds from legitimate sources. Therefore, transaction size alone is an inadequate detection rule.

A risk assessment should consider customer, product, channel and geographic risks. Red flags may include rapid movement through dormant accounts, unexplained cash deposits followed by transfers, multiple accounts controlled by one person, transactions inconsistent with agricultural income, mule-account patterns and use of agents to fragment activity. A red flag is not proof of crime; it triggers investigation under documented procedures.

Employees must avoid tipping off customers about a suspicious report. AML systems should balance detection quality with false-positive management. Excessive alerts overwhelm investigators; weak thresholds miss genuine risk. Model governance, scenario validation and periodic tuning are essential.

6. Data governance, cybersecurity and digital ethics

Bank data is both an operational asset and a source of customer vulnerability. Governance requires a defined purpose, lawful basis, data minimisation, accuracy, access control, retention limits, secure disposal and accountability. Sensitive information should be encrypted where appropriate, accessed on a need-to-know basis and logged for review.

A sound data-governance framework assigns data owners, custodians and stewards; classifies information; defines retention and deletion rules; manages consent and customer rights; and establishes breach-response procedures. Sharing data with a fintech, credit bureau, agent or analytics provider must have a clear legal and contractual foundation.

Cybersecurity controls include identity and access management, multi-factor authentication where suitable, patching, network segmentation, secure software development, phishing awareness, backup testing, fraud monitoring and incident response. Biometric or alternative authentication can improve inclusion but creates risks of exclusion, spoofing, surveillance and irrevocable compromise. A password can be changed; a biometric characteristic generally cannot.

6.1 Artificial intelligence and automated decisions

AI can support credit scoring, fraud detection, service personalisation and document processing. It can also reproduce historical discrimination, create opaque decisions, leak confidential data or generate inaccurate explanations. Banks should establish model inventory, documented purpose, data lineage, validation, performance monitoring, bias testing, human review and appeal mechanisms.

A useful governance principle is that accountability cannot be outsourced to an algorithm or vendor. If a customer is denied credit, the bank must be able to identify the material factors, review errors and provide a lawful explanation. Human oversight should be meaningful rather than a ceremonial approval step.

7. Outsourcing and third-party risk

Outsourcing transfers activities, not accountability. Banks remain responsible for regulatory compliance, customer protection, resilience and confidentiality even when services are provided by business correspondents, technology firms, collection agencies, cloud providers or call centres.

Before appointment, due diligence should assess ownership, financial strength, competence, information security, business continuity, subcontractors, conflicts and regulatory history. Contracts should define service levels, audit and access rights, data use, incident notification, location and recovery requirements, customer-contact standards, termination assistance and exit arrangements.

Ongoing oversight should combine service metrics, control testing, complaints, incident data, site visits and independent assurance. Concentration risk matters: several banks may depend on the same cloud, telecom or payment provider. An exit plan should be tested before a crisis. A vendor’s certification is useful evidence but does not replace the bank’s own risk assessment.

8. Priority-sector and rural banking responsibilities

Priority-sector lending is a policy mechanism intended to direct adequate institutional credit to economically important or underserved segments. Categories and targets are prescribed and periodically revised by the RBI. Depending on the applicable framework, relevant segments may include agriculture, micro and small enterprises, education, housing, weaker sections and renewable energy. Banks must use current definitions, qualifying conditions and reporting rules rather than relying on historical practice.

Rural banking also involves branch networks, business correspondents, self-help groups, joint-liability groups, microfinance institutions, farmer organisations and digital channels. Developmental objectives do not justify weak credit discipline. Good rural banking combines:

• cash-flow-based underwriting;
• seasonal repayment design where appropriate;
• crop, livestock and weather-risk awareness;
• financial literacy and transparent pricing;
• credit-plus services such as savings, insurance and payments;
• responsible use of guarantees and collateral;
• monitoring for multiple borrowing and over-indebtedness.

Priority-sector compliance should be substantive. Window-dressing, artificial classification, forced products or lending that predictably causes distress undermine both ethics and policy. Management should evaluate additionality: did the bank genuinely improve access, terms or service quality for the intended customer?

9. An integrated compliance-control framework

An effective framework links regulation to daily decisions:

1. Identify obligations: map laws, directions, licences, contractual duties and voluntary commitments.
2. Assess risks: evaluate inherent risk by product, customer, geography, channel and process.
3. Set controls: prevent, detect and correct failures; assign accountable owners.
4. Test and monitor: use sampling, exception reports, complaints, mystery shopping and analytics.
5. Escalate: define materiality thresholds and reporting routes.
6. Remediate: identify root causes, owners, deadlines and verification of closure.
7. Learn: update training, products, models and controls after incidents.

A compliance risk register should record the obligation, risk event, consequence, likelihood, control, control owner, evidence, residual risk and review date. Residual risk is the exposure remaining after controls; it is not automatically acceptable merely because a control exists.

10. Illustrative case: Suryodaya Rural Bank

Background

Suryodaya Rural Bank, a fictional regional rural bank, expanded rapidly through business correspondents and a mobile lending application. It reported strong growth in small agricultural loans and achieved its priority-sector target. The board later observed rising complaints, duplicate customer accounts, unusual repayments through agents and a sharp increase in delinquency after a regional drought.

Problem

The bank’s growth incentives rewarded disbursement and account opening. Agents collected informal fees, sometimes retained customer phones during authentication and encouraged borrowers to take multiple loans. The mobile model used historical repayment data that underrepresented women and first-time borrowers. KYC exceptions were approved locally without consistent documentation. A technology vendor hosted customer data, but the contract provided weak audit and breach-notification rights.

Analysis

The bank had treated inclusion as volume rather than sustainable access. First-line sales ownership was unclear; compliance reviewed samples after disbursement rather than at product design. The board received aggregate portfolio data but no agent-level complaint or multiple-borrowing dashboard. The credit model’s apparent efficiency concealed data bias and exclusion. Drought created correlated portfolio risk that had not been stress-tested.

Approach and solution

The bank paused expansion in the highest-risk districts and appointed an independent review team. It:

• redesigned incentives around repayment quality, complaint outcomes and verified customer consent;
• prohibited agent fees outside approved schedules and introduced receipt-based monitoring;
• conducted enhanced KYC remediation and duplicate-account detection;
• applied affordability and multiple-borrowing checks;
• created a hardship and restructuring pathway for drought-affected borrowers;
• validated the credit model for disparate outcomes and added human review;
• strengthened vendor clauses for audit, security, incident reporting and exit;
• provided the board with district, agent, product and vulnerability dashboards;
• expanded local-language financial education and grievance access.

Outcome

Within two reporting cycles, complaint closure improved, unauthorised-fee incidents declined and new lending slowed while portfolio quality was reassessed. The bank did not eliminate risk, but it restored control over growth and created evidence that inclusion was being pursued responsibly.

Learning points

The case demonstrates that regulatory compliance is interconnected. KYC weakness can enable fraud; incentive design can produce consumer harm; poor data governance can amplify discrimination; and rural concentration can convert an environmental shock into a solvency problem. Board oversight must examine outcomes, not merely declarations of compliance.

Challenges and limitations

Regulation can create documentation costs and unintentionally exclude people without standard records. One-size-fits-all rules may be unsuitable for seasonal income or remote communities. Automated monitoring produces false positives, while human discretion can introduce bias. Outsourcing improves efficiency but creates dependency and accountability gaps. Excessive compliance can become procedural, whereas insufficient compliance damages trust and stability.

The appropriate response is proportionality with evidence: simplified processes where legally permitted, compensating controls, continuous monitoring, customer testing, independent challenge and transparent escalation. Ethical judgement remains necessary because not every harmful practice is clearly prohibited and not every lawful practice is fair.

Contemporary strategic implications

Retail and rural banks should treat conduct, resilience and inclusion as strategic capabilities. Competitive advantage increasingly depends on trustworthy digital identity, reliable service in low-connectivity environments, explainable analytics, responsible partnerships and rapid remediation. Climate and disaster risk require scenario analysis for agricultural and rural portfolios. Open finance and embedded banking increase the importance of consent, API security and third-party oversight.

The strategic question is not whether regulation constrains growth. It is whether growth is durable when customers, supervisors, employees and communities trust the institution. Sustainable banking aligns commercial returns with prudent risk-taking and demonstrable customer value.

Chapter Summary

Banking regulation protects stability, customers and public confidence through prudential, conduct, AML/CFT, data and outsourcing requirements. Governance assigns responsibility: the business owns risks, compliance and risk functions challenge and monitor, and internal audit provides independent assurance. Ethical banking extends beyond legal compliance to fair treatment, responsible lending, respectful recovery, privacy and inclusion.

Prudential analysis requires attention to capital, asset quality, liquidity, operational resilience and concentration. KYC is a continuing, risk-based process that identifies customers and beneficial owners, understands expected activity and monitors change. Consumer protection requires transparent products, fair criteria, accessible redress and controls over agents and algorithms. Priority-sector and rural banking obligations should create genuine additionality rather than artificial target achievement. Strong boards connect strategy, incentives, data, third parties and customer outcomes through measurable oversight.

Key Terms

Prudential regulation: Rules designed to preserve the safety, solvency and liquidity of financial institutions.

Capital adequacy ratio: Eligible regulatory capital expressed relative to risk-weighted assets.

Risk-weighted assets: Assets or exposures adjusted for prescribed levels of risk.

Credit risk: The possibility that a borrower or counterparty will fail to perform.

Expected loss: A risk estimate based on probability of default, loss given default and exposure at default.

Operational risk: Loss arising from failed processes, people, systems or external events.

Conduct risk: The risk that an institution harms customers or market integrity through its behaviour.

KYC: Know Your Customer processes for identification, verification and ongoing understanding.

Customer due diligence: Assessment of customer identity, ownership, purpose and risk.

Beneficial owner: The natural person who ultimately owns or controls a customer or arrangement.

AML/CFT: Anti-money-laundering and countering-the-financing-of-terrorism controls.

Suspicious transaction: Activity that reasonably warrants investigation or reporting under applicable rules.

Financial inclusion: Affordable and useful access to appropriate financial services.

Priority-sector lending: Regulated lending to specified economically important or underserved sectors.

Business correspondent: An authorised intermediary providing specified banking services on behalf of a bank.

Fair lending: Consistent, legitimate and non-discriminatory credit treatment.

Data governance: Frameworks assigning responsibility for data quality, access, use, security and retention.

Outsourcing risk: Risk arising when a third party performs activities for a bank.

Three-lines model: Governance arrangement separating operational ownership, oversight and independent assurance.

Residual risk: Risk remaining after controls are applied.

Review Questions

Short Answer Questions

1. Why is banking subject to prudential regulation?
2. Distinguish KYC from ongoing customer due diligence.
3. What are the three lines in the three-lines model?
4. State two principles of fair lending.
5. Why does outsourcing not remove a bank’s accountability?

Long Answer Questions

1. Explain how capital, credit-risk management, liquidity and operational resilience support rural-bank stability.
2. Discuss the relationship between consumer protection and ethical banking across the product life cycle.
3. Explain a risk-based AML/CFT framework for a retail bank.
4. Analyse the board’s responsibilities for conduct, data, outsourcing and priority-sector lending.
5. Evaluate the benefits and limitations of AI in retail-credit decision-making.

Analytical / Application Questions

1. A rural bank has achieved its priority-sector target, but complaints about forced insurance and multiple borrowing are increasing. Diagnose the governance failures and propose a corrective plan.
2. A credit model rejects applicants from a low-data district at twice the rate of other applicants. Design an investigation covering data quality, fairness, validation, human review and customer redress.
3. A business correspondent reports suspicious cash activity but asks the branch manager not to record it because the customers are influential locally. Explain the correct governance, AML/CFT and escalation response.

Multiple Choice Questions with Answers

Question 1

What is the principal purpose of risk-weighted assets in capital regulation?

A. To measure customer satisfaction

B. To adjust exposures according to their risk when assessing capital adequacy

C. To calculate branch profitability

D. To determine the number of bank employees

Correct Answer: B. To adjust exposures according to their risk when assessing capital adequacy

Question 2

Which activity belongs primarily to the second line of the three-lines model?

A. Selling loans to customers

B. Processing cash withdrawals

C. Independent statutory auditing

D. Risk and compliance oversight and challenge

Correct Answer: D. Risk and compliance oversight and challenge

Question 3

Which statement best describes risk-based KYC?

A. Every customer must receive identical monitoring regardless of risk

B. KYC is required only when an account is opened

C. The intensity of identification, monitoring and review is proportionate to assessed risk

D. KYC applies only to corporate customers

Correct Answer: C. The intensity of identification, monitoring and review is proportionate to assessed risk

Question 4

Which is an example of a fair-lending concern?

A. Using verified repayment capacity

B. Applying the same documented credit rule consistently

C. Using a model that indirectly discriminates against a protected group

D. Reviewing existing indebtedness

Correct Answer: C. Using a model that indirectly discriminates against a protected group

Question 5

A bank has PD = 2%, LGD = 40% and EAD = ₹500,000. Using Expected Loss = PD × LGD × EAD, what is the expected loss?

A. ₹400

B. ₹4,000

C. ₹40,000

D. ₹400,000

Correct Answer: B. ₹4,000

Question 6

Which statement about outsourcing is correct?

A. The vendor becomes solely responsible for regulatory compliance

B. The bank remains accountable for compliance and customer protection

C. Outsourcing eliminates operational risk

D. A contract is unnecessary if the vendor is reputable

Correct Answer: B. The bank remains accountable for compliance and customer protection

Question 7

Why is transaction size alone inadequate for AML/CFT monitoring?

A. Terrorist financing and laundering may involve small or fragmented transactions

B. Large transactions are never suspicious

C. Only cash transactions are relevant

D. KYC eliminates the need for monitoring

Correct Answer: A. Terrorist financing and laundering may involve small or fragmented transactions

Question 8

Which board indicator may reveal poor customer outcomes despite strong business growth?

A. Higher office-rent expense

B. Increased complaints and unresolved remediation actions

C. More internal meetings

D. Lower stationery consumption

Correct Answer: B. Increased complaints and unresolved remediation actions

Question 9

What is a key ethical risk of biometric authentication?

A. Biometric data is always easy to replace

B. Biometric systems cannot improve access

C. A compromised biometric characteristic is generally difficult to change

D. Biometrics remove all fraud risk

Correct Answer: C. A compromised biometric characteristic is generally difficult to change

Question 10

What does substantive priority-sector compliance require?

A. Artificial classification of ordinary loans

B. Genuine lending and service improvement for intended underserved sectors

C. Ignoring repayment capacity to meet targets

D. Replacing all credit assessment with collateral

Correct Answer: B. Genuine lending and service improvement for intended underserved sectors