The Reserve Bank of India (RBI) has issued the Reserve Bank of India (Commercial Banks – Compliance Function) Directions, 2026, in exercise of the powers conferred under Section 35A of the Banking Regulation Act, 1949. These Directions came into effect immediately upon issuance and establish a comprehensive regulatory framework for the governance, structure, independence and functioning of the Compliance Function in Commercial Banks. The Directions are based on the principles of the Basel Committee on Banking Supervision and seek to strengthen compliance culture, enhance regulatory oversight, and ensure effective management of compliance risk across banking operations.
The Directions place the overall responsibility for the Compliance Function on the Board of Directors, requiring the Board to approve and annually review a comprehensive Compliance Policy, oversee the effectiveness of the Compliance Function, review compliance reports on a quarterly basis, and ensure that the Compliance Function remains independent from the Internal Audit Function. Senior Management has been entrusted with implementing the Compliance Policy, identifying and managing compliance risks, ensuring prompt remediation of compliance failures, and reporting material compliance breaches to the Board or Audit Committee.
Further, every Commercial Bank is required to establish an independent Compliance Department headed by a Chief Compliance Officer (CCO), supported by adequately qualified staff and appropriate reporting structures. The Compliance Function is required to identify, assess, monitor and report compliance risks across all business lines, review new products and processes before implementation, monitor compliance with regulatory instructions, conduct compliance testing, maintain compliance manuals, coordinate with other control functions, and promote a strong compliance culture throughout the organisation. Banks are also required to implement enterprise-wide technology solutions for monitoring compliance obligations, tracking regulatory submissions, and providing management dashboards for
effective oversight.
The Directions also prescribe detailed eligibility criteria, appointment process, tenure, authority and reporting requirements for the Chief Compliance Officer. The CCO must possess the prescribed qualifications and experience, function independently without business responsibilities or targets, report directly to the Managing Director & CEO and/or the Board or Audit Committee, and act as the principal liaison with the RBI on compliance matters. The CCO is further responsible for conducting annual compliance risk assessments, reporting significant compliance failures, ensuring timely implementation of supervisory observations, participating in new product approvals, and strengthening the overall compliance framework within the bank.
