NBFC Enterprise Risk: Appetite, ALM and Cyber Concentration
Shakti Finance is a mid-sized NBFC with ₹2,800 crore assets under management and 140 branches in Tier-2 and Tier-3 towns. Its loan book is 65% commercial-vehicle loans, 25% microfinance and 10% gold loans. The asset-liability committee reports that 40% of borrowings are short-term market borrowings repricing within 90 days, while 70% of loans are floating-rate linked to repo. Gross NPA rose from 3.1% to 5.4% in two quarters. A cyber incident at a third-party KYC vendor exposed 180,000 customer records. A drought in two states threatens microfinance collections. The board's risk appetite statement caps credit cost at 2.5% of average assets and requires a liquidity coverage ratio of at least 110%, but sets no cyber or concentration limits. The CFO proposes not to renew the interest-rate swap on ₹400 crore of borrowings to cut hedging costs, and to expand branches in the drought-affected states because competitors are withdrawing.
1. Construct a simple risk register for Shakti Finance using a 5×5 likelihood-impact matrix. Score and rank the four risks described, and explain how each connects to the board's risk appetite statement.
Read the worked answer
Scoring approach. Use likelihood and impact on a 1–5 scale; score = likelihood × impact. Scores of 15–25 are extreme, 8–14 high, 4–7 moderate.
| Risk | Likelihood | Impact | Score | Rationale |
|---|---|---|---|---|
| Credit - microfinance drought and rising NPA | 5 | 5 | 25 | Drought is already occurring; GNPA has risen to 5.4%; microfinance is 25% of the book. |
| Liquidity/ALM | 4 | 5 | 20 | 40% of borrowings reprice within 90 days against floating loans; refinancing risk is high. |
| Cyber - vendor breach | 4 | 4 | 16 | 180,000 records exposed; regulatory and reputational impact likely. |
| Interest rate | 3 | 3 | 9 | Swap cancellation would increase repricing mismatch, but the immediate effect is moderate. |
Ranking. Credit first, liquidity second, cyber third, interest rate fourth.
Appetite linkage. The credit cost cap of 2.5% is already breached by the NPA trend, so credit risk is outside appetite and requires board action. The liquidity coverage ratio of 110% is at risk from the short-term funding mix. Cyber and concentration have no limits at all, which is itself a governance gap: the board cannot say whether the vendor breach is within appetite. The register should show gross and residual risk after controls, and be refreshed quarterly.
2. Evaluate the CFO's two proposals - cancelling the interest-rate swap on ₹400 crore and expanding in drought-affected states - against the risk appetite and prudential constraints. Recommend alternatives.
Read the worked answer
Cancelling the swap. The proposal saves hedging cost but increases interest-rate risk. With 70% of loans floating and 40% of borrowings repricing within 90 days, Shakti already has a repricing mismatch. Removing the swap on ₹400 crore makes the mismatch larger and exposes net interest margin to a rate rise. There is no board-approved interest-rate limit, so the CFO's proposal would exploit a governance gap. It should be rejected unless the board sets a limit and the residual exposure is measured.
Alternatives. Retain or restructure the swap; extend the maturity of borrowings; use a cap rather than a full swap; grow fixed-rate gold loans; and set an interest-rate risk limit based on earnings-at-risk and economic value of equity.
Expanding in drought-affected states. This increases concentration in the weakest segment at the worst time. Competitors withdrawing is a signal of risk, not an opportunity. The credit cost cap is already under pressure and the microfinance book is 25% of assets. Expansion would worsen both the credit and concentration profiles.
Alternatives. Tighten underwriting and collection in the drought districts; use weather-index insurance or guarantee cover; diversify into secured gold and commercial-vehicle segments; and impose state and sector concentration limits. Any expansion should be conditional on a stress test showing credit cost within 2.5% and adequate provisioning.
3. Recommend key risk indicators and governance actions the board should adopt to close the gaps in its risk appetite statement.
Read the worked answer
KRIs to report monthly. Credit: GNPA, credit cost, microfinance collection efficiency, state concentration, restructured book. Liquidity: liquidity coverage ratio, 90-day maturity gap, share of short-term market borrowings, cost of funds. Interest rate: swap coverage ratio, earnings-at-risk, repricing gap. Cyber: number of vendor incidents, records exposed, patch compliance, downtime, regulatory queries. Concentration: top-10 borrowers, sector and state limits.
Governance actions. First, rewrite the risk appetite statement with quantitative limits for cyber, concentration, interest-rate risk and vendor risk, plus escalation triggers and board reporting. Second, establish a board risk committee with a charter and direct access to the CRO. Third, strengthen the three lines of defence: business ownership, independent risk and internal audit. Fourth, introduce a vendor-risk programme with due diligence, contractual security clauses, incident notification and exit plans. Fifth, run stress tests for drought, rate shocks and cyber outage, and link results to capital and provisioning. Sixth, require board approval for any new product or geography that breaches a limit.
Accountability. The CFO's proposals should be tabled at the risk committee, not decided operationally. The board should minute its appetite decisions and monitor them quarterly.