RBI Notification Regarding Automation for NPA, Income Identification
As per recent RBI notification, banks have been told to automate NPA classification wholly and provide computation methods. In the present circumstances, every account of the borrower will be covered, and lenders get time till 30th June 2021 to finish the procedure.
What prompted RBI to mandate automation?
RBI saw that despite its 4th August 2011 instructions to utilize IT systems for identifying Non-Performing Assets (NPA) and generation of relevant data/returns for statutory reporting and for bank’s own MIS needs, the methods for finding NPA, income recognition, provisioning and generation of the concerned returns in several banks were not wholly automated.
It came to the notice that they were still following manual ways of finding NPA and were bypassing the system-oriented asset categorization via manual intervention in a regular manner, clearly violating RBI’s instructions.
RBI said further that its notification to make sure the entirety and morality of automated asset classification, provisioning classification, and income identification methods, banks were asked to upgrade their system so as to follow the prescribed guidelines latest by 30th June 2021.
The borrower accounts to be covered according to the RBI notification
The RBI said that each and every borrower accounts, even the temporary overdrafts, irrespective of magnitude, sector, or ceiling, will come under the automated IT-oriented system for asset categorization, up-gradation, and provisioning methods.
More asset classification norms would be integrated in the system in line with the regulatory mandates. RBI found out that a system-oriented process was amiss in terms of income recognition/de-recognition, impaired assets (NPAs and NPIs), the amount required to be reversed from the income account and managing downgrade and upgrade of accounts via Straight Through Process.
What RBI notification says about frequency?
As per the RBI notification the system-oriented asset categorization will be a continuous endeavor for downgrading and upgrading accounts. It also specifies that the banks must make sure that the asset classification status gets refreshed in line with the day-end process.
It even said that banks should be in a position to bring out a classification status report at any time along with the real date of assets classification as Non-Performing Assets/Non-Performing Investments.
Exceptions offered by the RBI
Under unusual situations when a manual intervention is required to bypass the system classification, two-level authorization is needed. Such power deputation regarding authorization of exceptions should be in line with the board-approved policy of the bank and has to be performed, ideally from a centralized location and should be aptly documented. If the CEO approves, his action will be intimated to the board for the sake of informing.
For this type of intervention there will be audit trails and the same will be subjected to the audit by concurrent and statutory auditors.
The accurate reports of such manual interference should be given to the Audit Committee/Audit head regularly.
Also, the RBI wants banks to keep logs regarding every exception of manual interventions/ overrides, including the date and time stamp, purpose/reason, user Ids name, and designation pertaining to those behind such a manual intervention and relevant account particulars. These logs have to be recorded for a minimum period of three years and should not be tampered with during its mandatory existence. These logs need to be system generated.
What else does RBI notification say?
According to the RBI notification if a different application outside the CBS system is utilized as the system for the identification and or classification of NPA/NPI, the system must obtain the requisite data from CBS and or other concerned applications of the bank and the borrower/investment accounts needs to be refreshed back to the CBS automatically, wherever needed via Straight Through Process.
Also, a periodic system audit minimum once a year has to be done by internal/ external auditors duly certified on system criteria as also regarding compliance, income recognition, asset classification, and provisioning guidelines.
Baseline needs for the NPA classification solution
Data Input
As per the RBI notification data input in the system must be wholly captured and documented without any pruning. For example, Timestamp along with date and time, narration field, or any other text data extracted. The banks have to make sure that there are statutory validation/verification checks in the solution for the sake of user inputs, wherever applicable, and such validations, among other things, must examine data type validations, minimum/ maximum value, exceptions, etc. The RBI mandates that such manual validations performed with master data (or yardstick used in asset classification put into the system in line with the internal policy of the bank) are good enough to eliminate issues regarding the erroneous entries found in margin setting, embargo period, security valuation, repayment process, products mapped or linked to different categories of account holders (as per applicability), etc. The data input will be activated only post authentication and authorization.
User Access Management
The user ids in the solution must possess a unique identification. The generic ids can be used only in unusual situations, and such ids should be linked to the employee id of the user so that responsibility regarding any activity can be fixed on the individual having the id.
Offers two factors or superior types of authentication for the users of the application. Limit the access to the requisite solution to have least privilege basis for all the users.
Offer maker checker authorization/control for transactions (an illustrative list of transactions includes updating/changing the internal accounts, customer accounts, yardsticks- both financial and non-financial that would impact the status of the credit portfolio/ loan/ asset.) entered in the solution. For example, activities such as make/ update/ change user ids, roles, facilities such as access to several modules, updates to master data, etc. should have a minimum of two individuals to finish the activity.
Straight Through Processing
For offering straight-through processing and assistance for straight-through processing integration with every critical systems/add on sub-systems/modules etc. in an unhindered and safe manner for NPA/NPI classification according to current guidelines on Income Recognition and Asset Classification (IRAC).
Back end data access checks
For any modification to data, criteria from the backend has to be avoided. The solution should offer amendments to data only via the front end. Audit trails/logs of access, tweaks to any data, parameters need to be extracted with certain user particulars in the system.
Audit Logs
Audit trails/logs to get the particulars about the requisite fields (that are critical to finish the transaction and to spot the transaction for the sake of audit/forensic in the future) pertaining to every transactions (financial and non-financial) need to be provided, and logs have to be kept for modifying the master data.
As per the RBI notification, it has also been stated that system created activity logs of the users and administrative privileges should also be maintained. Safe storage and maintenance of logs encrypted format with access control in an archival solution.
NPAs Generated by Systems
It is also stated that all criteria required for NPA/NPI identification need to be shown in the CBS or associated sub/systems/modules for the purpose of NPA/NPI identification/classification of asset codes as per the Income Recognition and Asset Classification norms and extant guidelines. It is also specified that provision for MIS report with all yardsticks for NPA/NPI identification would be needed, and such yardsticks could either be figured out in the database or application itself in line with the architecture of the solution/Sub-system.
Test Environment
The current test regime in the bank together with the prototype data and the functional logic akin to the product environment of the solution is needed to be made accessible to the supervisors during their onsite inspections according to the demands.
Conclusion
The RBI ruling pertaining to automation for NPA can fortify the reporting system of NPAs in an easy way to obtain information devoid of any manual interference. Banks have no option but to follow the guidelines of the RBI, and any violation regarding the same shall result in supervisory or enforcement action against the bank in question.
