Banking internal controls: how to prove compliance to RBI

Banking internal controls in India rest on three lines of defence: the business that owns the risk, the risk management and compliance functions that oversee it, and internal audit that gives independent assurance. RBI sets specific requirements for the second and third lines, and expects a bank to show evidence for each obligation, not only a policy.

This guide covers what the directions ask for as of November 2026 and what good audit evidence looks like.

The three lines of defence in a bank

Concurrent audit sits close to the first line as an ongoing check on transactions. Statutory auditors and RBI's own supervision sit outside the three lines.

The compliance function and the Chief Compliance Officer

The reference point for many years was RBI's circular of 11 September 2020, "Compliance functions in banks and Role of Chief Compliance Officer (CCO)". It followed earlier compliance guidance of 2007 and 2015 and set uniform rules for appointing a CCO.

That circular has now been absorbed. On 31 July 2026 RBI's Department of Supervision issued the Reserve Bank of India (Commercial Banks – Compliance Function) Directions, 2026, which repealed the earlier compliance instructions for commercial banks. The main requirements carry forward:

• Policy. A board-approved compliance policy, reviewed by the board at least once a year.
• Tenure and rank. The CCO has a fixed tenure of at least three years, should ideally be a General Manager or equivalent, and sits no more than two levels below the MD and CEO. Early transfer or removal needs prior board approval.
• Independence. No business targets and no role that creates a conflict of interest.
• Reporting line. The CCO reports to the MD and CEO, the board or the Audit Committee. If the CCO reports to the MD and CEO, the Audit Committee meets the CCO one-on-one every quarter.
• Annual compliance risk assessment. Major compliance risks are identified and assessed at least once a year, with an activity plan placed before the Audit Committee.
• Compliance testing. The function must carry out sufficient and representative testing and report the results upwards.
• RBI intimation. RBI is informed before a CCO is appointed, transferred early or removed.

Separate directions cover other categories of banks and NBFCs. Read the one for your entity.

Risk based internal audit and concurrent audit

RBI introduced risk based internal audit (RBIA) for banks through a guidance note in December 2002 and strengthened it in January 2021. The instructions are now in the Reserve Bank of India (Commercial Banks – Internal Audit Function) Directions, 2026, issued on 31 July 2026. Check the "updated as on" date, since the page shows a later update.

The principles are consistent across RBI's internal audit instructions:

• The audit plan comes from an independent risk assessment of activities and locations, not from a fixed rotation.
• The board or Audit Committee approves the plan and reviews the function's performance.
• The Head of Internal Audit is senior, independent of business lines and has access to all records.
• Internal audit also covers the risk management and compliance functions.
• Findings are tracked to closure within set timelines.

Concurrent audit examines transactions as they happen or soon after. Since September 2019 RBI has left the scope and coverage of concurrent audit to each bank, under the oversight of the Audit Committee and based on risk. In practice it covers high-risk branches, treasury and other sensitive areas.

A change to watch: control functions from 2027

On 10 June 2026 RBI published draft amendment directions that bring risk management, compliance and internal audit together as "control functions" with common rules. For commercial banks the draft is the Governance Second Amendment Directions, 2026, with a proposed effective date of 1 January 2027. Comments closed on 9 July 2026.

The draft proposes, among other things:

• A CRO, CCO and Head of Internal Audit, each with a board-approved policy and a fixed tenure of at least three years.
• Functional reporting to the board and administrative reporting to the MD and CEO, with a quarterly meeting with the board or its committee without senior management present.
• No outsourcing of the control functions.
• A quality assurance programme and periodic external review.

Confirm on rbi.org.in whether the amendments have been issued in final form and what changed from the draft.

RBI's supervisory approach and enforcement

RBI supervises banks on a risk-based model. Supervisors assess the bank's risks and the quality of its controls, and the compliance, risk and audit functions are themselves assessed. Weak second and third lines therefore affect the supervisory view of the whole bank, not only of one product.

Where RBI finds a breach of its directions, it can impose a monetary penalty under the Banking Regulation Act, 1949. Its orders typically say the action is based on deficiencies in regulatory compliance. According to the RBI Annual Report 2024-25, RBI imposed 353 penalties totalling ₹54.78 crore on regulated entities in that year. Check the latest Annual Report for the 2025-26 figures.

Penalty amounts are often modest. The larger costs are business restrictions, remediation under supervisory watch and the board's time.

What good audit evidence looks like

Regulatory compliance in banking is judged on evidence. For any obligation, a reviewer should be able to trace from the regulator's text to the action taken. A complete record has six parts:

1. Source version. Which document, with its number and date, and which version if it has been amended.
2. Clause. The exact paragraph the obligation comes from, not a summary of the circular.
3. Decision. Whether it applies to the bank, how it was interpreted and what was decided.
4. Approval. Who approved the interpretation and the closure, and under what authority.
5. Timestamp. When the circular was received, assessed, assigned and closed.
6. Integrity. A hash or similar control showing the stored document and record have not been altered.

Evidence of the control operating, such as test results, samples and exception reports, sits alongside this.

Common gaps in operational risk and compliance tracking

• Missed circulars. A notification from NPCI, FIU-IND or CERT-In that nobody was watching.
• Old references. Trackers that still cite circulars repealed in the November 2025 and July 2026 consolidations.
• Circular-level tracking. One row per circular, when a single direction can hold dozens of separate obligations.
• Scattered trackers. Spreadsheets by department with no common owner, status or due date.
• Drafts not followed. A draft is noted when published and the final text is missed.
• Closure without proof. "Complied" marked with no link to the policy change, system change or test.
• No amendment trail. Nobody can show which version of a direction a decision was based on.

How RegIntel Nexus helps

RegIntel Nexus is built for this evidence trail. It monitors publications from RBI, SEBI, FIU-IND, NPCI, IRDAI, CERT-In and MeitY, classifies circulars and tracks amendments and repeals. Its research assistant answers with the document, clause and page cited. Requirements become clause-level obligations with owners, due dates, status and escalation, and each is mapped from regulation and clause through to the business capability, process, application and remediation. Source references, document versions, approvals and SHA-256 integrity records are retained. It does not test controls or run audits for you. It gives the compliance and audit teams one record to work from.

This article is general information for compliance and risk professionals. It is not legal advice. Regulations are amended often; check the current text published by the regulator before acting.