Branch Compliance Officer - Bank cheat sheet

Banking Regulation Act, 1949: Section 5(b) defines banking as accepting deposits of money repayable on demand or otherwise, for the purpose of lending or investment.

RBI Act, 1934, Section 42: scheduled banks must maintain CRR on NDTL; Section 24 of the Banking Regulation Act requires SLR in cash, gold, or approved unencumbered securities.

Branch licensing under Section 22 of the Banking Regulation Act: opening, closing, or shifting a branch requires RBI approval unless covered by the general permission policy.

Priority Sector Lending: targets apply at bank level (40% of ANBC or credit equivalent of off-balance-sheet exposure, whichever is higher); a branch holding a shortfall contributes to the shortfall, while PSLC can be purchased only at bank level.

Customer Due Diligence norms are issued under the Prevention of Money Laundering Act, 2002 and the RBI Master Direction on KYC; both bind every branch.

The RBI has issued the Master Direction on Fraud Risk Management in the context of commercial banks; reporting obligations flow through the bank's Fraud Monitoring vertical to the RBI.

The compliance function must be independent of business lines; the branch reports compliance exceptions to the Compliance Department through the designated Branch Compliance Officer.

Statutory returns (e.g., CRR, SLR, ALM) are filed by the treasury/ALM desk; branch-level returns cover areas such as unclaimed deposits, and the branch must reconcile them with the general ledger before submission.

KYC applies at the commencement of an account-based relationship and also to occasional transactions above the threshold set by the bank's board-approved policy, which must not exceed the RBI-prescribed limit.

Officially Valid Documents (OVDs) include Aadhaar, passport, driving licence, voter identity card, NREGA job card, and the letter issued by the National Population Register containing name and address.

Aadhaar-based e-KYC requires the customer's consent and authentication through UIDAI; the customer's Aadhaar number must be masked in records where full display is not required.

Beneficial ownership: for legal persons, identify the natural person holding 10% or more of shares or capital or profits, or exercising control through other means; if no such person exists, the senior managing official is the beneficial owner.

Simplified Due Diligence may be applied to low-risk customers as per board policy; Enhanced Due Diligence is mandatory for high-risk customers, PEPs, and non-face-to-face accounts.

Periodic KYC updation is risk-based: high risk at least every 2 years, medium risk every 8 years, low risk every 10 years.

Politically Exposed Persons: approval of the senior management is required before establishing the relationship, and the source of funds and wealth must be established.

Records of transactions and identity must be maintained for at least 5 years after the business relationship ends or the transaction is carried out; the branch must produce them on demand to authorities.

The three stages of money laundering are placement, layering, and integration; branch staff controls target placement, the stage most visible at the counter.

Structuring: multiple cash deposits below the reporting threshold made to avoid reporting constitute smurfing and are a red flag even when each transaction is individually legal.

Cash Transaction Report (CTR) is filed for cash transactions above the threshold prescribed by FIU-IND; Suspicious Transaction Report (STR) is filed irrespective of the amount, and there is no monetary floor for an STR.

Suspicious Transaction Reports must be filed with FIU-IND within 7 days of arriving at a suspicion; no tipping-off of the customer is permitted.

CTR and STR are filed by the bank's Principal Officer; the branch Designated Director/Officer is responsible for identifying and escalating suspicious activity.

CFT: the UN Security Council resolutions under the UNSC 1267 and successor regimes require screening against the sanctions list; any match requires immediate freezing and reporting.

Screening must be applied at onboarding and on an ongoing basis, including against the lists circulated by RBI, UN, and the bank's own negative list; a hit must be resolved before the transaction is processed.

Wire transfer rules require originator and beneficiary information to accompany the transfer; the branch must reject or hold transfers lacking required information.

Preventive vigilance focuses on systems and procedures that remove opportunities for corruption; punitive vigilance deals with established misconduct after the fact.

The vigilance function is headed by the Chief Vigilance Officer in public sector banks; the CVO reports to the Central Vigilance Commission, not to the bank's management alone.

Fraud classification: an account is classified as fraud by the bank's Fraud Monitoring Committee after examination; reporting to RBI follows the Fraud Monitoring Return mechanism.

Red flags at the branch include dormant accounts suddenly activated by large credits, frequent cash deposits below threshold, high-value loans disbursed without site visits, and borrowers with common addresses or phone numbers.

Segregation of duties: the maker-checker principle must apply to account opening, loan disbursement, and limit enhancement; no single officer should originate and authorise the same transaction.

Rotation and mandatory leave: staff in sensitive posts such as cash, clearing, and credit must be rotated periodically and must take mandatory leave, during which their work is reviewed.

Whistle-blower complaints are handled confidentially by the bank's whistle-blower mechanism; the branch must not attempt to identify the complainant.

Fraud risk management covers the full lifecycle: prevention, detection, investigation, reporting, and recovery, including action against staff and borrowers.

Risk-based internal audit allocates audit resources according to the risk rating of each branch/process; high-risk branches are audited more frequently than low-risk ones.

The internal control system has five components: control environment, risk assessment, control activities, information and communication, and monitoring.

The three lines model: business units own risk (first line), risk and compliance functions monitor (second line), internal audit provides independent assurance (third line).

The audit report should contain findings, root cause, risk rating, management response, and target date for rectification; repeat findings indicate control failure.

Compliance reporting to the board flows through the Compliance Committee; branch-level compliance certificates must be supported by evidence, not merely signed.

The Compliance Department must be independent of business functions and have access to the board; the Chief Compliance Officer position is mandated by the RBI for banks.

Key Risk Indicators and Key Control Indicators are monitored at defined intervals; a breach of a KRI threshold triggers escalation, not merely documentation.

Internal audit must follow up on the status of rectification of past audit findings, and unresolved high-risk findings must be reported to the Audit Committee of the Board.

Cash handling: the branch must observe the joint custodian system for cash, dual control of the strong room, and verification of cash balances at prescribed intervals.

KYC and account opening files must contain the account opening form, KYC documents, and the signature card; missing documents constitute a documentation finding in inspection.

Loan documentation: the sanction letter, agreement, security documents, valuation report, and disbursement note must be on record before disbursement.

Clearing operations: the branch must reconcile the clearing differences account daily; unreconciled entries are a common inspection finding.

Fixed asset registers, stationery registers, and safe custody registers must be updated and reconciled with physical holdings; the physical verification report is an inspection item.

The branch must comply with the prescribed timelines for responding to inspection reports and for rectifying findings; non-compliance escalates to the region.

Transactions above the delegated authority limits must not be approved at the branch; the sanctioning authority matrix must be displayed and followed.

Concurrent audit covers high-risk transactions on a continuous basis; its findings are reported to management and to the Audit Committee.

The RBI Integrated Ombudsman Scheme, 2021 covers complaints against regulated entities; the complaint must first be made to the bank and the bank must resolve it within 30 days.

The bank must appoint a Nodal Officer and Principal Nodal Officer for the Ombudsman scheme and display the details, including the Ombudsman's contact, at the branch.

The Internal Ombudsman mechanism for banks requires an Internal Ombudsman to examine complaints rejected by the bank, with the power to escalate to the RBI Ombudsman.

Complaints must be acknowledged and disposed of within the timeline set by the bank's board-approved grievance redressal policy; the complaint register and complaints portal must be reconciled.

The Fair Practices Code requires transparency in pricing, disclosure of charges, and a reasoned decision on loan applications; the code is displayed at the branch.

The customer has the right to be informed of the reasons for rejection of a loan application in writing; the bank must not discriminate on grounds not permitted by law.

Unauthorised electronic transactions: the customer's liability is limited as per RBI's circular on customer protection; zero liability applies where the fraud is due to bank negligence, and the bank must credit the amount within the prescribed timeline.

Charges for services must be disclosed in the schedule of charges; the bank cannot levy charges not disclosed, and the schedule must be available at the branch and on the website.

The RBI Cyber Security Framework for banks requires a board-approved cyber security policy, a Cyber Crisis Management Plan, and a Security Operations Centre.

Data localisation: payment system data must be stored only in India; if processed abroad, it must be brought back to India within the prescribed period.

The Digital Personal Data Protection Act, 2023 requires consent-based processing, purpose limitation, data minimisation, and breach notification to the Data Protection Board.

The branch must never share customer credentials, OTPs, or card details; staff access to customer data must follow the least-privilege principle and be logged.

Digital banking channels require two-factor authentication; card-not-present transactions must have additional authentication, and the customer must be given the option to switch off or limit digital channels.

Cyber incidents must be reported to RBI within the prescribed timeline (as per the Cyber Security Framework) and to CERT-In within 6 hours of noticing the incident.

Phishing and vishing prevention: the bank must run customer awareness programmes and must not seek sensitive information via email, SMS, or phone.

Business continuity and disaster recovery: the branch must have a tested BCP, and the RTO/RPO for critical systems must be documented and met.

Banking Regulation Act, 1949: Section 5(b) defines banking as accepting deposits of money repayable on demand or otherwise, for the purpose of lending or investment.

RBI Act, 1934, Section 42: scheduled banks must maintain CRR on NDTL; Section 24 of the Banking Regulation Act requires SLR in cash, gold, or approved unencumbered securities.

Branch licensing under Section 22 of the Banking Regulation Act: opening, closing, or shifting a branch requires RBI approval unless covered by the general permission policy.

Priority Sector Lending: targets apply at bank level (40% of ANBC or credit equivalent of off-balance-sheet exposure, whichever is higher); a branch holding a shortfall contributes to the shortfall, while PSLC can be purchased only at bank level.

Customer Due Diligence norms are issued under the Prevention of Money Laundering Act, 2002 and the RBI Master Direction on KYC; both bind every branch.

The RBI has issued the Master Direction on Fraud Risk Management in the context of commercial banks; reporting obligations flow through the bank's Fraud Monitoring vertical to the RBI.

The compliance function must be independent of business lines; the branch reports compliance exceptions to the Compliance Department through the designated Branch Compliance Officer.

Statutory returns (e.g., CRR, SLR, ALM) are filed by the treasury/ALM desk; branch-level returns cover areas such as unclaimed deposits, and the branch must reconcile them with the general ledger before submission.

KYC applies at the commencement of an account-based relationship and also to occasional transactions above the threshold set by the bank's board-approved policy, which must not exceed the RBI-prescribed limit.

Officially Valid Documents (OVDs) include Aadhaar, passport, driving licence, voter identity card, NREGA job card, and the letter issued by the National Population Register containing name and address.

Aadhaar-based e-KYC requires the customer's consent and authentication through UIDAI; the customer's Aadhaar number must be masked in records where full display is not required.

Beneficial ownership: for legal persons, identify the natural person holding 10% or more of shares or capital or profits, or exercising control through other means; if no such person exists, the senior managing official is the beneficial owner.

Simplified Due Diligence may be applied to low-risk customers as per board policy; Enhanced Due Diligence is mandatory for high-risk customers, PEPs, and non-face-to-face accounts.

Periodic KYC updation is risk-based: high risk at least every 2 years, medium risk every 8 years, low risk every 10 years.

Politically Exposed Persons: approval of the senior management is required before establishing the relationship, and the source of funds and wealth must be established.

Records of transactions and identity must be maintained for at least 5 years after the business relationship ends or the transaction is carried out; the branch must produce them on demand to authorities.

The three stages of money laundering are placement, layering, and integration; branch staff controls target placement, the stage most visible at the counter.

Structuring: multiple cash deposits below the reporting threshold made to avoid reporting constitute smurfing and are a red flag even when each transaction is individually legal.

Cash Transaction Report (CTR) is filed for cash transactions above the threshold prescribed by FIU-IND; Suspicious Transaction Report (STR) is filed irrespective of the amount, and there is no monetary floor for an STR.

Suspicious Transaction Reports must be filed with FIU-IND within 7 days of arriving at a suspicion; no tipping-off of the customer is permitted.

CTR and STR are filed by the bank's Principal Officer; the branch Designated Director/Officer is responsible for identifying and escalating suspicious activity.

CFT: the UN Security Council resolutions under the UNSC 1267 and successor regimes require screening against the sanctions list; any match requires immediate freezing and reporting.

Screening must be applied at onboarding and on an ongoing basis, including against the lists circulated by RBI, UN, and the bank's own negative list; a hit must be resolved before the transaction is processed.

Wire transfer rules require originator and beneficiary information to accompany the transfer; the branch must reject or hold transfers lacking required information.

Preventive vigilance focuses on systems and procedures that remove opportunities for corruption; punitive vigilance deals with established misconduct after the fact.

The vigilance function is headed by the Chief Vigilance Officer in public sector banks; the CVO reports to the Central Vigilance Commission, not to the bank's management alone.

Fraud classification: an account is classified as fraud by the bank's Fraud Monitoring Committee after examination; reporting to RBI follows the Fraud Monitoring Return mechanism.

Red flags at the branch include dormant accounts suddenly activated by large credits, frequent cash deposits below threshold, high-value loans disbursed without site visits, and borrowers with common addresses or phone numbers.

Segregation of duties: the maker-checker principle must apply to account opening, loan disbursement, and limit enhancement; no single officer should originate and authorise the same transaction.

Rotation and mandatory leave: staff in sensitive posts such as cash, clearing, and credit must be rotated periodically and must take mandatory leave, during which their work is reviewed.

Whistle-blower complaints are handled confidentially by the bank's whistle-blower mechanism; the branch must not attempt to identify the complainant.

Fraud risk management covers the full lifecycle: prevention, detection, investigation, reporting, and recovery, including action against staff and borrowers.

Risk-based internal audit allocates audit resources according to the risk rating of each branch/process; high-risk branches are audited more frequently than low-risk ones.

The internal control system has five components: control environment, risk assessment, control activities, information and communication, and monitoring.

The three lines model: business units own risk (first line), risk and compliance functions monitor (second line), internal audit provides independent assurance (third line).

The audit report should contain findings, root cause, risk rating, management response, and target date for rectification; repeat findings indicate control failure.

Compliance reporting to the board flows through the Compliance Committee; branch-level compliance certificates must be supported by evidence, not merely signed.

The Compliance Department must be independent of business functions and have access to the board; the Chief Compliance Officer position is mandated by the RBI for banks.

Key Risk Indicators and Key Control Indicators are monitored at defined intervals; a breach of a KRI threshold triggers escalation, not merely documentation.

Internal audit must follow up on the status of rectification of past audit findings, and unresolved high-risk findings must be reported to the Audit Committee of the Board.

Cash handling: the branch must observe the joint custodian system for cash, dual control of the strong room, and verification of cash balances at prescribed intervals.

KYC and account opening files must contain the account opening form, KYC documents, and the signature card; missing documents constitute a documentation finding in inspection.

Loan documentation: the sanction letter, agreement, security documents, valuation report, and disbursement note must be on record before disbursement.

Clearing operations: the branch must reconcile the clearing differences account daily; unreconciled entries are a common inspection finding.

Fixed asset registers, stationery registers, and safe custody registers must be updated and reconciled with physical holdings; the physical verification report is an inspection item.

The branch must comply with the prescribed timelines for responding to inspection reports and for rectifying findings; non-compliance escalates to the region.

Transactions above the delegated authority limits must not be approved at the branch; the sanctioning authority matrix must be displayed and followed.

Concurrent audit covers high-risk transactions on a continuous basis; its findings are reported to management and to the Audit Committee.

The RBI Integrated Ombudsman Scheme, 2021 covers complaints against regulated entities; the complaint must first be made to the bank and the bank must resolve it within 30 days.

The bank must appoint a Nodal Officer and Principal Nodal Officer for the Ombudsman scheme and display the details, including the Ombudsman's contact, at the branch.

The Internal Ombudsman mechanism for banks requires an Internal Ombudsman to examine complaints rejected by the bank, with the power to escalate to the RBI Ombudsman.

Complaints must be acknowledged and disposed of within the timeline set by the bank's board-approved grievance redressal policy; the complaint register and complaints portal must be reconciled.

The Fair Practices Code requires transparency in pricing, disclosure of charges, and a reasoned decision on loan applications; the code is displayed at the branch.

The customer has the right to be informed of the reasons for rejection of a loan application in writing; the bank must not discriminate on grounds not permitted by law.

Unauthorised electronic transactions: the customer's liability is limited as per RBI's circular on customer protection; zero liability applies where the fraud is due to bank negligence, and the bank must credit the amount within the prescribed timeline.

Charges for services must be disclosed in the schedule of charges; the bank cannot levy charges not disclosed, and the schedule must be available at the branch and on the website.

The RBI Cyber Security Framework for banks requires a board-approved cyber security policy, a Cyber Crisis Management Plan, and a Security Operations Centre.

Data localisation: payment system data must be stored only in India; if processed abroad, it must be brought back to India within the prescribed period.

The Digital Personal Data Protection Act, 2023 requires consent-based processing, purpose limitation, data minimisation, and breach notification to the Data Protection Board.

The branch must never share customer credentials, OTPs, or card details; staff access to customer data must follow the least-privilege principle and be logged.

Digital banking channels require two-factor authentication; card-not-present transactions must have additional authentication, and the customer must be given the option to switch off or limit digital channels.

Cyber incidents must be reported to RBI within the prescribed timeline (as per the Cyber Security Framework) and to CERT-In within 6 hours of noticing the incident.

Phishing and vishing prevention: the bank must run customer awareness programmes and must not seek sensitive information via email, SMS, or phone.

Business continuity and disaster recovery: the branch must have a tested BCP, and the RTO/RPO for critical systems must be documented and met.