BNPL Expansion and Three Lines Accountability
A Malaysian digital bank launched a buy-now-pay-later (BNPL) wallet six months ago. The first-line product team owns the credit approval rules, sets affordability thresholds and reports arrears to the CEO weekly. The second-line credit risk function validates the scorecard, but its head reports to the same Head of Credit as the first-line lending team. Internal audit is outsourced and last reviewed the product at launch, 20 months ago. The CRO now receives a request to approve expansion from 80,000 to 500,000 users within six weeks. A sample test found 14% of approvals bypassed the affordability rule after a system change; 30-day arrears are 4.8% against a 2.5% plan; complaints about unexpected fees have doubled. The product team argues that slowing down will lose market share. The Board Risk Committee asks the CRO for a recommendation and wants a revised risk appetite statement.
1. Identify the governance and three-lines weaknesses in this product approval request.
Read the worked answer
The core weakness is not the BNPL loss rate by itself but the allocation of risk ownership. The first line both sets affordability rules and reports its own arrears, so it has an incentive to weaken controls. The second line is not independent because its head reports to the same Head of Credit as the lending team; validation therefore lacks challenge. Internal audit's 20-month gap means no independent assurance over a material product change. The CRO is being asked to approve scale without a board-approved risk appetite for BNPL, without evidence that the 14% bypass is closed, and without independent validation of the changed system rule. That is a governance failure under the three-lines model: the first line owns and manages risk, the second line oversees and challenges, and the third line provides independent assurance. The Board Risk Committee should require a product risk assessment, a clearly independent second-line reporting line, validation of the affordability rule, and a defined escalation route for limit breaches. Until then, the bank cannot demonstrate that the product is within appetite.
2. Should the CRO approve the expansion to 500,000 users? Set out the decision and conditions.
Read the worked answer
Conditional approval is defensible only if it is time-bound and limited. I would not approve the 500,000-user expansion now. The CRO should issue a conditional no-expansion-beyond-current-limits decision, with a 30-day remediation plan: restore the affordability rule and test approvals; require independent second-line validation of the scorecard and rule engine with a report to the Board Risk Committee; impose a temporary user cap and lower initial credit limits; require daily arrears and complaints reporting; and agree a revised risk appetite with thresholds for 30-day arrears, bypass rate and complaint ratio. If the bypass is not closed and validated, the CRO should reject the expansion. The reasoning is that growth is not risk-adjusted if controls are broken; 4.8% arrears against a 2.5% plan and doubled complaints are early-warning indicators. A staged rollout, for example from 80,000 to 150,000 users, can test controls. The CRO must have a documented right to veto or pause. The CEO's six-week timetable cannot override consumer protection and risk appetite.
3. What should the Board Risk Committee see monthly to monitor this product?
Read the worked answer
Monthly Board reporting should include approval volumes and limits by channel; the percentage of approvals bypassing affordability rules, with a target of zero; 30-day and 90-day arrears by vintage; complaint categories and upheld rate; loss rates against plan; model validation status; audit findings and closure; third-party and system change logs; and any risk-limit breaches. It should also show a forward-looking sensitivity, for example arrears if unemployment rises by 1 percentage point. Reporting should distinguish first-line metrics from second-line opinion so the Board sees challenge, not just management's view. A dashboard with red-amber-green thresholds tied to the risk appetite statement would make escalation automatic rather than discretionary.