Bhotekoshi flood prompts NRB to recognize climate risk

KATHMANDU: Nepal Rastra Bank (NRB) has expanded its risk-management rules for banks and financial institutions (BFIs) by introducing dedicated provisions for technology and climate risks.

The move comes shortly after the devastating Bhotekoshi floods of August 26, which exposed the growing risks that extreme weather events can pose to financial institutions and their operations.

The updated Risk Management Guidelines replace the 2018 framework and broaden the range of risks that BFIs must assess and manage. The previous guidelines recognized five traditional risk categories: credit risk, liquidity risk, operational risk, market risk, and interest rate risk.

The new framework aims to promote a stronger risk-management culture, setting minimum supervisory standards and helping financial institutions prepare for emerging threats, according to the central bank.

Under the climate-risk provisions, boards of directors must assess how climate-related risks could affect their credit, market and operational portfolios. BFIs are also required to establish a Climate Risk Committee that meets at least once every quarter to oversee climate-related risks and ensure that their exposure remains within the institution’s risk appetite.

The guidelines require BFIs to clearly assign responsibilities for managing climate risks under the three lines of defense model. They must also continue to follow the Environmental and Social Risk Management (ESRM) Guidelines, 2022 when assessing loans.

The new rules also encourage BFIs to make their physical infrastructure more resilient to climate-related events, including floods, and promote investments in energy-efficient assets to reduce long-term operational losses.

According to the NRB, financial institutions should strengthen the resilience of their assets and incorporate climate-related insights into their risk-management practices to mitigate potential losses, ensure business continuity and meet evolving regulatory and sustainability expectations.
They should also periodically conduct awareness programs on climate-exposure risks within their institutions and among relevant stakeholders.

In addition, financial institutions should foster a strong risk-awareness culture and continuously build their capabilities and expertise in managing climate-related and environmental risks in line with international standards.

NRB has also introduced stricter requirements for managing technology risks. The provisions cover risks arising from cyberattacks, system failures, data breaches and digital fraud.

Under the new framework, boards of directors are responsible for overseeing technology-risk management and ensuring that banks have adequate resources and budgets for cybersecurity. BFIs are also expected to follow recognized international security standards, including ISO/IEC 27001, as well as relevant Basel guidelines.

Banks must align their technology strategies with their broader operational-resilience plans and maintain policies covering access controls, data protection, incident response and risks associated with third-party service providers.

According to the NRB, the expanded framework is intended to ensure that BFIs are better prepared not only for traditional financial risks but also for disruptions arising from climate change and rapid technological change.