Banking

Introduction
Nepal’s financial sector reform began in 2048 BS (1992 AD) with the Financial Sector Reform Program (FSRP) supported by the World Bank and IMF. It continued in phases: FSRP-I (2048 BS), FSRP-II (2056 BS), Financial Sector Development Strategy (2063 BS), and Financial Sector Development/Reform Strategy (2077 BS). The main objectives were liberalisation, institutional strengthening, financial deepening, inclusion, and stability. Although good results were achieved, fundamental banking risks remain, and recently non-performing assets (NPAs) are rising while profitability is declining.

---

A. Achievements of Previous Financial Sector Reform Programs (5 marks)

1. Liberalisation and deregulation
   Interest rates were deregulated, directed credit was reduced, and private and foreign joint-venture banks were allowed to enter. This increased competition, efficiency, and financial innovation.

2. Institutional strengthening
   Nepal Rastra Bank (NRB) gained greater autonomy. Nepal Bank Ltd. and Rastriya Banijya Bank were restructured. Merger and acquisition policies were introduced, and problem financial institutions were liquidated or merged.

3. Financial deepening
   The number of banks, branches, deposits, and credit increased significantly. Broad money to GDP and private sector credit to GDP improved, indicating a deeper financial system.

4. Financial inclusion
   Branch expansion, branchless banking, mobile banking, digital wallets, QR payments, and remittance services expanded access to finance, especially in rural and remote areas.

5. Supervisory framework
   Basel II and III norms, risk-based supervision, CAMELS rating, off-site and on-site supervision, AML/CFT measures, credit information, and deposit insurance were introduced.

6. Payment systems
   RTGS, NCHL, connectIPS, and digital payment systems modernised transactions and reduced cash dependence.

7. Capital market and insurance
   SEBON, NEPSE, demat, online trading, Beema Pradhikaran, and microinsurance developed the non-bank financial sector.

8. Legal reform
   NRB Act 2058, BAFIA 2073, Insolvency Act, Secured Transactions Act, and AML/CFT Act provided a stronger legal foundation.

---

B. Framework for Current Situation and Future Risk Mitigation (5 marks)

Current situation: Rising NPAs and falling profitability are caused by COVID-19, economic slowdown, import restrictions, high interest rates, real estate slowdown, weak governance, credit concentration, aggressive lending, and regulatory forbearance.
Future risks: Cyber risk, climate risk, fintech disruption, global financial volatility, remittance dependency, concentration risk, liquidity risk, interest rate risk, operational risk, and money laundering.

Proposed Reform Framework

1. Strengthen regulatory and supervisory architecture
   Fully implement Basel III, risk-based and consolidated supervision, stress testing, early warning systems, and macroprudential tools such as loan-to-value (LTV), debt-to-income (DTI), and sectoral exposure limits. Use SupTech and RegTech for real-time monitoring.

2. Resolve NPAs and improve asset quality
   Enforce strict loan classification and provisioning. Introduce prompt corrective action (PCA), an asset management company (AMC), reform the Debt Recovery Tribunal, strengthen insolvency law, allow one-time settlement, and permit restructuring only for viable borrowers.

3. Improve corporate governance and risk culture
   Apply fit-and-proper criteria, ensure independent directors, form board risk committees, adopt a risk appetite framework, reform compensation, protect whistleblowers, and enhance disclosure.

4. Build capital and liquidity buffers
   Maintain capital conservation buffer, leverage ratio, liquidity coverage ratio (LCR), and net stable funding ratio (NSFR). Prepare contingency funding plans, strengthen deposit insurance, and require recovery and resolution plans.

5. Diversify credit and support productive sectors
   Reduce concentration in real estate, shares, and import-based trade. Promote priority lending to agriculture, SMEs, tourism, renewable energy, and exports through credit guarantees and value-chain financing.

6. Promote financial inclusion and digital finance
   Expand digital financial services, mobile banking, QR payments, and branchless banking. Improve financial literacy, consumer protection, and grievance redressal. Encourage interoperability, open banking, fintech sandbox, and digital ID.

7. Strengthen payment systems and cyber resilience
   Develop robust payment infrastructure, RTGS, retail and cross-border payments. Enforce cybersecurity frameworks, incident reporting, business continuity planning (BCP), disaster recovery (DR), and AML/CFT transaction monitoring.

8. Reform non-bank financial sector and capital market
   Reform cooperatives, microfinance, insurance, and capital markets. Strengthen SEBON, Beema Pradhikaran, and Cooperatives Authority. Develop bond markets and long-term infrastructure financing.

9. Enhance coordination and financial stability architecture
   Activate the Financial Stability Oversight Committee with MoF, NRB, SEBON, Beema Pradhikaran, and Cooperatives Authority. Prepare crisis management and contingency plans, and promote cross-border supervisory cooperation.

10. Legal, institutional and human resource reform
    Amend NRB Act, BAFIA, insolvency, secured transactions, and AML/CFT laws. Build supervisory capacity, specialise supervision, strengthen training, ensure succession planning, and promote performance-based and ethical banking.

---

Conclusion
Previous financial sector reforms have improved liberalisation, inclusion, supervision, and payment systems. However, rising NPAs and declining profitability demand a renewed reform framework focused on asset quality, governance, capital and liquidity, digital resilience, credit diversification, and coordinated financial stability. Such reforms will help mitigate current and future risks and support a stable, competitive, and inclusive financial sector.

बैंकिङ प्रणालीमा सूचना प्रविधिको प्रयोगसँग जोडिएका जोखिमहरू र नियन्त्रणका उपायहरू

सूचना प्रविधिको प्रयोगले बैंकिङ सेवालाई छिटो, सुलभ र प्रभावकारी बनाए पनि यससँग सम्बन्धित जोखिमहरू पनि बढाएको छ । मुख्य जोखिमहरू देहायबमोजिम छन् :

जोखिमहरू : १. साइबर आक्रमण तथा ह्याकिङ : अनधिकृत व्यक्तिले बैंकको सूचना प्रणालीमा पहुँच पुर्‍याई रकम हिनामिना वा डाटा चोरी गर्न सक्छन् । २. डाटा चोरी तथा गोपनीयता भंग : ग्राहकको व्यक्तिगत तथा वित्तीय विवरण अनधिकृत रूपमा चोरी वा फाँसो हुन सक्छ । ३. फिसिङ, भाइरस तथा म्यालवेयर : ठगीपूर्ण इमेल, लिङ्क वा सफ्टवेयरमार्फत प्रणालीमा क्षति पुर्‍याइन्छ । ४. प्रणाली विफलता (System Failure) : हार्डवेयर, सफ्टवेयर वा सञ्जालमा आउने खराबीले सेवा अवरुद्ध हुन सक्छ । ५. आन्तरिक जोखिम : बैंकका कर्मचारीबाटै गोपनीय सूचना वा पहुँचको दुरुपयोग हुन सक्छ । ६. सञ्चालन तथा प्रतिष्ठा जोखिम : प्रणालीगत त्रुटि वा साइबर घटनाले बैंकको विश्वसनीयता र प्रतिष्ठामा आँच पुग्छ ।

नियन्त्रणका उपायहरू : १. सुरक्षित सफ्टवेयर तथा फायरवाल : एन्टिभाइरस, फायरवाल र इन्क्रिप्सनको प्रयोग गरी प्रणालीलाई सुरक्षित राख्ने । २. बहुस्तरीय प्रमाणीकरण (Multi-factor Authentication) : पासवर्डसँगै ओटीपी वा बायोमेट्रिक प्रयोग गरी पहुँच नियन्त्रण गर्ने । ३. डाटा ब्याकअप तथा डिजास्टर रिकभरी : नियमित ब्याकअप र आपतकालीन पुनःस्थापना योजना कार्यान्वयन गर्ने । ४. कर्मचारी सचेतना तथा तालिम : साइबर सुरक्षा सम्बन्धी नियमित तालिम र जिम्मेवारी पृथकीकरण (Segregation of Duties) कायम गर्ने । ५. सूचना सुरक्षा नीति तथा नियमन : बैंक तथा वित्तीय संस्था ऐन, नेपाल राष्ट्र बैंकका निर्देशन र आन्तरिक सूचना सुरक्षा नीति कडाइका साथ लागू गर्ने । ६. नियमित लेखापरीक्षण तथा अनुगमन : सूचना प्रणालीको नियमित सुरक्षा परीक्षण (Security Audit) र जोखिम मूल्याङ्कन गर्दै सुधार गर्ने ।

यसरी प्रविधिगत सुरक्षा, संस्थागत नीति र मानवीय सचेतनालाई एकसाथ व्यवस्थापन गरेमा बैंकिङ प्रणालीमा सूचना प्रविधिजन्य जोखिमलाई प्रभावकारी रूपमा नियन्त्रण गर्न सकिन्छ ।

Nepal Rastra Bank — Assistant Director / Officer 3rd Level Subject: Information Technology in Banking — Risks and Mitigating Measures Marks: 10

---

1. Introduction

Information technology (IT) has become the backbone of modern banking — core banking systems, mobile and internet banking, ATMs, card networks, digital wallets, and interbank payment switches. In Nepal, BFIs operate under the Payment Systems Act, 2075, the Electronic Transactions Act, 2063, and NRB's IT Guidelines, 2077 (with subsequent circulars on cybersecurity, cloud computing, digital lending and outsourcing). While IT brings speed, cost efficiency and financial inclusion, it simultaneously creates new categories of risk that must be identified, measured, monitored and controlled.

---

2. Risks Associated with Widespread Use of IT in Banking

(a) Operational Risk

• System downtime, hardware/software failure, network outage, power failure.
• Errors in data entry, batch processing, reconciliation and migration.
• Dependence on vendors for core banking, ATM switch and card management.

(b) Cyber and Information Security Risk

• Hacking, phishing, vishing, SIM swapping, ransomware, DDoS attacks.
• Data leakage and identity theft of customer KYC information.
• Insider fraud by employees with privileged access.
• Weak password policy, unpatched software, unsecured APIs.

(c) Technology and Obsolescence Risk

• Outdated core banking version, unsupported operating systems.
• Inability to integrate with new payment systems (RTGS, connectIPS, QR, cross-border remittance).

(d) Third-Party / Outsourcing Risk

• Concentration risk on a single vendor or data centre.
• Vendor bankruptcy, service-level breach, data sovereignty issues when hosted abroad.

(e) Compliance and Legal Risk

• Breach of AML/CFT, data privacy and reporting requirements.
• Non-compliance with NRB IT directives leading to supervisory action.

(f) Strategic and Reputational Risk

• Failure of digital channels damages customer trust and brand image.
• Poor digital strategy leading to loss of market share to fintechs.

(g) Financial Risk

• Direct loss from fraud, ransom payment, litigation and remediation cost.
• Liquidity and settlement risk if payment systems fail.

(h) Human Resource Risk

• Shortage of skilled IT and cybersecurity manpower; high staff turnover.
• Lack of awareness among general staff and customers.

---

3. Measures for Minimizing IT Risks

(a) Governance and Strategy

• Board-approved IT and cybersecurity policy, reviewed annually.
• IT Steering Committee headed at senior management level.
• Separate IT and Information Security functions; appointment of a Chief Information Security Officer (CISO).
• Risk-based IT audit (internal and external) at least annually.

(b) Physical and Environmental Security

• Access-controlled data centre with biometric entry, CCTV, fire suppression, UPS and backup generator.
• Alternate site / Disaster Recovery (DR) site at a geographically separate location.
• Environmental controls for temperature, humidity and water leakage.

(c) Logical Access Control

• Role-based access, least-privilege principle, maker–checker concept.
• Multi-factor authentication for privileged and remote access.
• Periodic review of user IDs; immediate revocation on staff exit or transfer.
• Strong password policy and session time-out.

(d) Network and Data Security

• Firewalls, IDS/IPS, antivirus, endpoint detection and response (EDR).
• Encryption of data at rest and in transit (TLS, AES).
• Network segmentation; separate VLANs for ATMs, servers and user LAN.
• Regular vulnerability assessment and penetration testing (VAPT).
• Secure configuration and timely patch management.

(e) Business Continuity and Disaster Recovery

• Documented BCP and DR plan, tested at least twice a year.
• Defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
• Real-time data replication and regular backup (3-2-1 rule), with restoration testing.

(f) Third-Party Risk Management

• Due diligence before onboarding vendors; NRB approval where required.
• Clear SLAs, right-to-audit clause, exit strategy and data-handling agreement.
• Avoid vendor lock-in; maintain alternative service providers.

(g) Fraud Detection and Monitoring

• Real-time transaction monitoring, exception reports, velocity checks.
• 24×7 Security Operations Centre (SOC) or outsourced monitoring.
• Prompt customer alerting (SMS/e-mail) for every transaction.
• Strong whistle-blowing and segregation-of-duties mechanism.

(h) Human Resource and Awareness

• Background verification at recruitment; confidentiality agreements.
• Continuous training on cybersecurity, phishing and social engineering.
• Customer education campaigns on safe digital banking practices.

(i) Regulatory Compliance

• Adherence to NRB IT Guidelines 2077, cybersecurity circulars, AML/CFT Act 2064 and ETA 2063.
• Mandatory reporting of cyber incidents to NRB within the prescribed time.
• Participation in NRB's Cybersecurity Framework and sectoral CERT.

(j) Emerging Technology Controls

• Governance framework for cloud, AI, blockchain and open banking.
• Data localisation and privacy impact assessment before adoption.
• Regular review of digital product design to prevent mis-selling and over-indebtedness.

---

4. Conclusion

IT has transformed banking from a branch-based to a technology-driven industry, but this transformation has widened the risk surface from operational and cyber threats to strategic, compliance and third-party risks. A layered defence — strong governance, robust access and network controls, resilient BCP/DR, vigilant monitoring, vendor discipline and continuous human resource development — is essential. For NRB as regulator and supervisor, the priority is to keep its IT Guidelines and cybersecurity framework updated, conduct risk-based supervision and enforce timely incident reporting so that innovation in digital banking proceeds without compromising stability and customer trust.

Objectives of Nepal Rastra Bank under the NRB Act, 2058

The Nepal Rastra Bank (NRB) is the central bank of Nepal. It was originally established on 14 Baisakh 2013 B.S. under the Nepal Rastra Bank Act, 2013, and is presently governed by the Nepal Rastra Bank Act, 2058 (2002). Section 4 of this Act spells out the objectives of the Bank. The Act mentions the following five objectives:

1. To maintain price stability (मूल्य स्थिरता): One objective of NRB is to maintain stability in the general price level of goods and services in the country. Through the regulation of money supply, credit expansion and inflation, the Bank seeks to preserve the purchasing power of the Nepalese rupee.

2. To maintain balance of payments stability (भुक्तानी सन्तुलनको स्थिरता): NRB aims to keep the country's balance of payments in a stable position. It manages foreign exchange reserves, regulates foreign exchange transactions and formulates policies so that the inflow and outflow of foreign currency remain balanced.

3. To promote a stable and healthy banking and financial system: The Act envisages the development of a sound, stable and trustworthy banking and financial system in Nepal. NRB regulates, supervises, inspects and monitors banks and financial institutions to protect the interests of depositors and maintain public confidence in the financial sector.

4. To develop a secure, healthy and efficient system of payment: NRB is responsible for establishing and operating a secure, reliable and efficient payment system in the country. It issues currency notes and coins, operates clearing houses, and promotes electronic payment systems to facilitate smooth transactions.

5. To provide necessary support to the economic policies of the Government of Nepal: NRB, as the monetary authority, supports and complements the fiscal and economic policies of the Government of Nepal. It renders necessary advice and assistance to the Government in formulating and implementing economic policies.

Other matters such as formulating and implementing monetary policy, issuing currency notes and coins, acting as banker, advisor and agent of the Government, and acting as lender of last resort are functions of the Bank (Sections 5 and subsequent provisions), not the objectives listed in Section 4. They should not be presented as objectives.

Conclusion: In short, the Nepal Rastra Bank Act, 2058, mentions five objectives of the Bank: to maintain price stability, to maintain balance of payments stability, to promote a stable and healthy banking and financial system, to develop a secure, healthy and efficient payment system, and to provide necessary support to the economic policies of the Government of Nepal. These objectives together aim to ensure monetary stability and contribute to the sustainable development of the national economy.

Under the Bank and Financial Institutions Act (BAFIA), 2073, the Companies Act, 2063, and Nepal Rastra Bank (NRB) directives, a bank or financial institution (BFI) may buy back its own shares only in the following conditions:

1. Surplus free reserves and liquidity — The BFI must have sufficient free reserves (after setting aside all statutory reserves) and adequate liquid assets to pay for the buy-back without affecting its capital adequacy and liquidity position.

2. Approval of the general meeting — The buy-back must be approved by a special resolution of the general meeting of shareholders, and the resolution must specify the maximum number of shares, the price, and the period (generally within one year).

3. Prior approval of NRB — Since BFIs are regulated, the buy-back requires prior written approval of Nepal Rastra Bank. NRB grants approval only after being satisfied that the buy-back will not weaken the BFI's capital fund, depositors' interest, or financial soundness.

4. Compliance with minimum capital requirement — After buy-back, the BFI's paid-up capital and capital fund must still meet the minimum capital prescribed by NRB. The buy-back must not reduce capital below this floor.

5. No default / sound financial position — The BFI must not be in default in repayment of deposits, loans, or interest, and must not have been declared problematic or placed under corrective action by NRB.

6. Purpose of cancellation or reduction of capital — Buy-back is generally allowed for cancelling the shares to reduce paid-up capital, to return excess capital to shareholders, or to adjust capital structure — not for speculative trading in its own shares.

7. Restriction on resale — Shares bought back must be cancelled within the prescribed period; the BFI cannot hold or resell its own shares as treasury stock beyond the limit allowed by law.

8. No buy-back in certain circumstances — Buy-back is not allowed if the BFI is insolvent, if it would reduce capital below the regulatory minimum, or if it is under liquidation or merger proceedings.

Conclusion: A BFI may buy back its own shares only with NRB's prior approval, a special resolution of shareholders, sufficient free reserves and liquidity, and while maintaining the minimum capital fund — primarily to cancel shares and reduce or restructure its capital.

Money Laundering Offences and Punishment under the Money Laundering Prevention Act, 2064

1. Acts Considered Money Laundering (Section 3)

A person commits the offence of money laundering if he/she, knowing or having reason to believe that property is proceeds of crime (property derived from a predicate offence):

• Converts or transfers the property to conceal or disguise its illicit origin, or to help any person involved in the offence evade legal consequences;
• Conceals or disguises the true nature, source, location, disposition, movement or ownership of the property or rights in it;
• Acquires, possesses or uses the property.

Participation in, association with, attempt, aiding, abetting, facilitating or conspiracy to commit any of these acts is also an offence.

2. Predicate Offences

The Act defines predicate offences by reference to specified laws and offences, including corruption and bribery, tax and revenue evasion, smuggling, narcotic drugs, counterfeiting of currency and documents, arms and explosives, kidnapping and extortion, human trafficking, banking and financial offences, foreign exchange offences, fraud and forgery, terrorism and its financing, and offences against wildlife, forests and the environment. The Government of Nepal may add further offences by notification in the Nepal Gazette.

3. Punishment

Related measures: property may be frozen or seized during investigation by the Department of Money Laundering Investigation; reporting entities such as banks that fail to submit suspicious or threshold transaction reports are liable to fines and regulatory action by Nepal Rastra Bank; the Act also provides for mutual legal assistance and international cooperation.

Conclusion: Money laundering under the Act covers converting, concealing, acquiring or using proceeds of crime, and is punished by a fine equal to the property involved, imprisonment scaled to the amount (up to 10 years) and confiscation of the proceeds.

Banking Offence

A banking offence is any act or omission, committed by a person or institution, that violates the banking laws of Nepal or harms the property, security and credibility of a bank or financial institution. In the Nepali context, the Banking Offence and Punishment Act, 2064 (2008) defines banking offences and prescribes punishment for them. The Act treats as offences acts such as:

• Unauthorised banking transactions — carrying on banking business without a licence from Nepal Rastra Bank.
• Embezzlement or misappropriation of funds, deposits or property of a bank by its directors, officials or employees.
• Fraud, forgery and cheating — preparing false documents, false accounts, or obtaining loans on the basis of false collateral or false information.
• Wilful default — taking a loan with dishonest intention to avoid repayment, or misusing the loan amount.
• Obstruction — obstructing NRB inspection, refusing to submit records, or giving false statements to the regulator.
• Leakage of confidential information relating to depositors and customers.
• Illegal takeover or manipulation of the management of a bank.

The Act provides for imprisonment and fines, and in serious cases the offender may be barred from holding any office in a bank or financial institution. The Special Court tries banking offences, and the Act also allows for confiscation of property obtained through the offence and for compensation to the affected bank or depositor.

Problems in Implementation of the Banking Offence and Punishment Act, 2064

Despite being a special law with a special court and special procedures, the Act has faced several practical difficulties in implementation:

1. Lengthy investigation and prosecution — Investigation by Nepal Police and prosecution by the District Government Attorney's Office often take years. By the time a case reaches the Special Court, evidence and witnesses are difficult to secure.

2. Difficulty in proving dishonest intention — The Act requires proof of mens rea (dishonest intention), especially in wilful default cases. Courts often treat failure to repay as a civil debt matter rather than a criminal offence, so offenders escape criminal liability.

3. Weak enforcement of court orders — Even when the Special Court convicts an offender, execution of the sentence — recovery of fines, confiscation of property, and enforcement of the bar from banking office — is weak and delayed.

4. Political and executive influence — Many big defaulters are politically connected. Pressure on investigators, prosecutors and even on the regulator weakens independent enforcement.

5. Inadequate legal and technical capacity — Investigators, prosecutors and even judges often lack expertise in complex banking transactions, forensic accounting and digital evidence. This leads to weak cases and acquittals.

6. Ambiguity and gaps in the law — Some provisions are vague; the distinction between a civil default and a criminal banking offence is not always clear. The Act has also been amended repeatedly, creating inconsistency.

7. Non-cooperation of banks themselves — Banks sometimes delay or withhold records, or settle matters internally, to protect their reputation or due to pressure from influential borrowers.

8. Weak coordination among agencies — NRB, Nepal Police, the Attorney General's Office and the Special Court do not always coordinate effectively, causing delays and contradictory positions.

9. Recovery versus punishment conflict — The primary concern of banks is recovery of loans; they often prefer settlement to criminal prosecution, which undermines the punitive purpose of the Act.

10. Limited public awareness and reporting — Many depositors and small customers do not know their rights or the procedure for lodging complaints, so many offences go unreported.

Conclusion: The Banking Offence and Punishment Act, 2064 is a strong legal instrument on paper, but its effectiveness depends on speedy investigation, independent prosecution, capable courts, strict execution of sentences and freedom from political influence. Without these, the Act cannot fully deter banking offences in Nepal.