Answers Series: 7th Banking Professional Examination, 2026

 

Answers to 7th Banking Professional Examination, 2026

Subject: Risk Management in Financial Institutions (RMFI)

---

Part A—Broad Questions

Question 1(a): "Risk and return are the two sides of the same coin"—Explain. [8 marks]

Risk and return are fundamentally interconnected in banking and finance. This relationship can be explained as follows:

Definition of Risk and Return:

• Risk represents uncertainties resulting in adverse outcomes relative to planned objectives or expectations
• Return represents the reward or profit earned from taking on risk

The Coin Analogy: Like two sides of a coin that cannot exist separately, risk and return are inseparable:

1. Higher Risk, Higher Return: Banks that take greater risks can potentially earn higher returns. For example, lending to riskier borrowers at higher interest rates offers attractive revenues but carries higher potential losses.
2. Lower Risk, Lower Return: Prudent banks that limit risks by restricting business volume and screening out risky borrowers may have lower market shares and revenues but also save potential losses.
3. Zero Risk Scenario: Investments with zero risk (like cash holdings) provide the lowest returns compared to other market opportunities.

Risk-Return Trade-off: Easy to lend and obtain attractive revenues from risky borrowers, but the price is higher risk and potential losses. Prudent lending limits risks but might suffer from lower performance initially. Over time, careless risk-takers often find that higher losses materialize, potentially ending with lower performance than prudent lenders.

---

Question 1(b): What is the risk appetite of a bank? What are the objectives of risk appetite? How is the risk management strategy of bank related to its risk appetite? [12 marks]

Definition of Risk Appetite: Risk appetite is the level and type of risk a bank is able and willing to assume in its exposures and business activities, given its business objectives and obligations to stakeholders (depositors, creditors, shareholders, borrowers, regulators). It is expressed through both quantitative and qualitative means, considering extreme conditions, events, and outcomes in terms of potential impact on profitability, capital, and liquidity.

Objectives of Risk Appetite:

1. Upholding Ethical Standards: Maintaining the highest standards of conduct in all operations
2. Preserving Financial Resilience: Ensuring long-term financial stability of the bank
3. Avoiding Losses: Preventing losses when investing public money
4. Ensuring Compliance: Meeting legal and regulatory obligations
5. Maintaining Control Environment: Safeguarding operational continuity through robust internal controls

Components of Risk Appetite Framework: The Risk Appetite Statement (RAS) should include:

• Overall loan growth targets (percentage and absolute amounts)
• Industry-wise sectoral concentration limits
• Product-wise funded/non-funded loan concentration
• Geographic and currency-wise limits
• Business segment-wise concentrations
• Client concentration based on credit ratings
• NPL classification boundaries
• Environmental and social risk ratings

Relationship with Risk Management Strategy:

1. Top-Down Alignment: The board sets risk appetite, which cascades down through strategic planning, business line objectives, operational limits, and transaction-level decisions.
2. Capital Planning Integration: Risk appetite determines required capital levels, capital conservation buffers, and business growth constraints.
3. Performance Measurement: Risk appetite provides benchmarks for risk-adjusted returns, portfolio quality metrics, and limit adherence monitoring.
4. Decision Framework: All major decisions (lending, investments, product launches) must align with stated risk appetite.

---

Question 2(a): How do you define the responsibilities of senior management in banks? Discuss the responsibilities of senior management with regard to credit risk management. [10 marks]

General Responsibilities of Senior Management: Senior management's responsibility is to transform strategic directions set by the board into operational policies, procedures, and processes for effective risk management. They must:

1. Strategy Implementation: Convert board-approved strategies into actionable plans
2. Policy Embedding: Ensure policies are embedded in the bank's culture
3. Risk Awareness: Maintain full awareness of activities that expose the bank to various risks
4. Reporting: Provide regular reports to the board on the bank's risk profile
5. MIS Development: Oversee development of Management Information Systems for risk identification, measurement, monitoring, and control

Specific Responsibilities for Credit Risk Management:

1. Policy Development and Implementation: Develop credit policies and administration procedures for board approval; implement credit risk management policies; ensure procedures manage and control credit risk and portfolio quality.
2. Reporting and Monitoring: Establish and implement appropriate reporting systems; monitor and control the nature and composition of credit portfolio; monitor portfolio quality ensuring thorough and conservative valuation; ensure adequate provisioning for probable losses.
3. Internal Controls: Establish internal controls with clear lines of accountability and authority; set limits (e.g., officer limits, large exposure limits, NPL limits); ensure segregation of duties.
4. Communication: Build communication lines for timely dissemination of credit risk management policies, procedures, and other risk management information to all credit staff.
5. Portfolio Management: Ensure credit portfolio diversification; monitor concentration risks (sector, geographic, single borrower); oversee loan recovery processes; monitor NPL trends and recovery rates.
6. Compliance: Ensure adherence to regulatory requirements; maintain credit rating processes; oversee environmental and social risk assessments.

---

Question 2(b): Discuss the issues to be considered by banks and finance companies while addressing AML and CFT risk management. [10 marks]

Key Issues in AML/CFT Risk Management:

1. Policy Framework: Develop and maintain comprehensive AML/CFT policies approved by the board; regular policy reviews and updates based on emerging risks; dissemination to all concerned personnel.
2. Governance Structure: Formation of Central Compliance (CC) Committee led by CAMLCO; appointment of qualified CAMLCO and Deputy CAMLCO with appropriate authority; setting up AML & CFT Compliance Division (ACCD) with sufficient manpower; branch-level BAMLCO appointments.
3. Customer Due Diligence (CDD): Implementation of e-KYC processes; risk-based approach to customer classification (Simplified Due Diligence for low-risk, Standard CDD for normal, Enhanced Due Diligence for high-risk); identification of Beneficial Ownership; special attention to Politically Exposed Persons, Influential Persons, and non-face-to-face customers.
4. Transaction Monitoring: Cash Transaction Reporting (CTR) for transactions ≥ BDT 1 million; Suspicious Transaction Reporting (STR) mechanisms; Trade-Based Money Laundering (TBML) monitoring; wire transfer monitoring; structuring detection.
5. Sanctions Screening: Implementation of UNSCR sanctioned lists; Bangladesh Government sanctioned lists; automated screening systems; "false positive" management.
6. Record Retention: Maintain records for minimum 5 years from account closure; documentation of CDD information; transaction records; training and meeting records; audit and inspection reports.
7. Training and Awareness: Regular training programs for staff; customer education initiatives; awareness about emerging ML/TF risks.
8. Technology and Systems: Automated monitoring systems; sanctions screening tools; e-KYC platforms; reporting systems to BFIU.
9. Reporting Requirements: Monthly CTR submission to BFIU; immediate STR reporting; self-assessment reports; independent testing reports.
10. Specific Risk Areas: Prevention of Terrorist Financing (TF); Proliferation of Weapons of Mass Destruction (WMD); Foreign Account Tax Compliance Act (FATCA) compliance; correspondent banking relationships.

---

Part B—Mathematical Problem

Question 5: Duration Gap Analysis for XYZ Bank PLC

Given Information:

• Assets: BDT 850 crore
• Liabilities: BDT 730 crore
• Equity: BDT 120 crore
• Duration of assets (DA): 4.5 years
• Duration of liabilities (DL): 3 years
• Expected interest rate change: from 11% to 13% (Δi = 2%)

(a) Changes in market values of assets, liabilities and net worth (6 marks):

Step 1: Calculate change in asset value
ΔA = -DA × [Δi/(1+i)] × A
ΔA = -4.5 × [0.02/1.11] × 850
ΔA = -4.5 × 0.018018 × 850
ΔA = -68.92 crore
New Asset Value = 850 - 68.92 = 781.08 crore

Step 2: Calculate change in liability value
ΔL = -DL × [Δi/(1+i)] × L
ΔL = -3 × [0.02/1.11] × 730
ΔL = -3 × 0.018018 × 730
ΔL = -39.46 crore
New Liability Value = 730 - 39.46 = 690.54 crore

Step 3: Calculate change in net worth
ΔE = ΔA - ΔL
ΔE = -68.92 - (-39.46)
ΔE = -29.46 crore
New Equity/Net Worth = 120 - 29.46 = 90.54 crore

(b) New Balance Sheet of XYZ Bank PLC (2 marks):

Assets	BDT (crore)	Liabilities & Equity	BDT (crore)
Total Assets	781.08	Total Liabilities	690.54
		Equity	90.54
Total	781.08	Total	781.08

(c) Comment on findings (2 marks):

1. Negative Duration Gap Impact: The bank has a positive duration gap (DA > DL), meaning assets are more interest rate sensitive than liabilities. When interest rates rise, asset values fall more than liability values, reducing net worth.
2. Capital Erosion: The bank's equity decreased by 24.55% (29.46/120), indicating significant vulnerability to interest rate increases.
3. Risk Management Implication: The bank should consider hedging interest rate risk through derivatives, adjusting asset-liability maturity profile, and maintaining higher capital buffers to absorb such shocks.

---

Question 6: Capital Adequacy Calculation for ABC Bank PLC

Given Information:

• Common Equity Tier 1 (CET1): BDT 1,250 crore
• Additional Tier 1 (AT1): BDT 350 crore
• General Provision: BDT 360 crore
• Subordinated Debt: BDT 500 crore
• Credit RWA: BDT 26,000 crore
• Market RWA: BDT 2,500 crore
• Operational RWA: BDT 7,000 crore
• Capital requirement: 12.5% of total RWA (MCR of 10%)
• General provision limit: 1.25% of credit RWA
• Tier 2 limit: 100% of Tier 1

(a) Calculate total RWA (2+3=5 marks):
Total RWA = Credit RWA + Market RWA + Operational RWA
Total RWA = 26,000 + 2,500 + 7,000
Total RWA = BDT 35,500 crore

(b) Calculate eligible Tier 1 capital and eligible Tier 2 capital (2+3=5 marks):

Tier 1 Capital:
CET1 = BDT 1,250 crore
AT1 = BDT 350 crore (must be ≤ 33.33% of CET1 or 1.5% of RWA)
- Check: 33.33% of 1,250 = 416.625 crore ✓
- Check: 1.5% of 35,500 = 532.5 crore ✓
Eligible Tier 1 = 1,250 + 350 = BDT 1,600 crore

Tier 2 Capital:
- General Provision (limited to 1.25% of Credit RWA): Actual = 360 crore; Max allowed = 1.25% × 26,000 = 325 crore; Eligible provision = 325 crore
- Subordinated Debt = 500 crore
- Total Tier 2 before limit = 325 + 500 = 825 crore
- Tier 2 limit (100% of Tier 1) = 1,600 crore
Eligible Tier 2 = BDT 825 crore

(c) Calculate total eligible capital (1 mark):
Total Eligible Capital = Tier 1 + Tier 2 = 1,600 + 825 = BDT 2,425 crore

(d) Calculate Capital Adequacy Ratio and comment (1+2=3 marks):
CRAR = (Total Eligible Capital / Total RWA) × 100
CRAR = (2,425 / 35,500) × 100
CRAR = 6.83%

Comment:

1. Below Regulatory Minimum: The bank's CRAR of 6.83% is significantly below the minimum requirement of 10%, indicating severe capital deficiency.
2. Capital Shortfall: Required capital = 10% × 35,500 = 3,550 crore; Actual capital = 2,425 crore; Shortfall = 1,125 crore (31.69% deficiency).
3. Immediate Actions Required: Capital raising through rights issue or new equity; reduction of RWA through de-risking; dividend restriction; business growth constraints; potential regulatory intervention.
4. Component Analysis: Tier 1 ratio = 4.51% (below 6% requirement); CET1 ratio = 3.52% (below 4.5% requirement); all capital components are deficient.

---

Part C—Problem Solving

Case 1: Liquidity Risk Management

Case Scenario: During market volatility, a bank faced liquidity pressure due to heavy reliance on short-term wholesale deposits and sudden withdrawals by large depositors. Despite complying with regulatory liquidity ratios, stress testing showed gaps would widen significantly. The bank's risk appetite statement had not been reviewed for several years.

(a) Key liquidity and strategic risks highlighted (5×4=20 marks):

Liquidity Risks Identified:

1. Funding Concentration Risk: Heavy reliance on short-term wholesale deposits; lack of diversification in funding sources; vulnerable to sudden withdrawals by large depositors.
2. Maturity Mismatch Risk: Asset-liability duration gap; short-term funding of long-term assets; gaps widening under stress scenarios.
3. Contingent Liquidity Risk: Inadequate liquid asset buffers; limited access to emergency funding; potential crystallization of off-balance sheet commitments.
4. Market Liquidity Risk: Difficulty in liquidating assets quickly without significant loss; stressed market conditions reducing asset values; limited secondary market access.

Strategic Risks:

1. Risk Appetite Outdated: Risk appetite statement not reviewed for several years; misalignment with current market conditions; failure to adapt to changing risk landscape.
2. Governance Failure: Inadequate board oversight; weak ALCO functioning; insufficient stress testing integration.

(b) Why compliance with regulatory ratios alone may not be sufficient:

1. Static Nature of Ratios: Provide snapshot views, not forward-looking assessments
2. Minimum Standards: Represent minimum requirements, not optimal levels for specific banks
3. Standardized Assumptions: May not capture bank-specific vulnerabilities
4. Idiosyncratic Risks: Cannot address unique funding structures or business models
5. Market Confidence: Compliance doesn't guarantee market/depositor confidence during stress

(c) Effective risk appetite framework and stress testing for liquidity decisions:

Risk Appetite Framework:
- Clear quantitative limits for wholesale funding concentration, loan-to-deposit ratios, liquidity coverage ratios (above regulatory minimum), net stable funding ratios, and maximum cumulative outflow limits.
- Qualitative statements on acceptable funding sources, diversification requirements, and stress tolerance levels.

Stress Testing Integration:
- Regular scenario analysis (mild, moderate, severe); bank-specific and system-wide scenarios; forward-looking assessment of funding needs, available liquidity buffers, and contingency funding sources.
- Results feeding into ALCO decisions, capital planning, and risk appetite reviews.

(d) ERM approach recommendations for improving risk resilience:

1. Holistic Risk Assessment: Integrate liquidity risk with other risks; assess interconnectedness during stress; portfolio view of aggregate risks.
2. Enhanced Governance: Strengthen board oversight; regular ALCO meetings; clear escalation procedures for limit breaches.
3. Stress Testing Framework: Comprehensive scenarios including idiosyncratic stress, market-wide stress, and combined scenarios; reverse stress testing to identify breaking points.
4. Contingency Funding Plan: Diversified funding sources; pre-arranged credit lines; asset liquidation strategies; central bank access procedures.
5. Risk Culture: Embed risk awareness; training programs on liquidity risk; incentive structures aligned with risk management.
6. Dynamic Monitoring: Real-time liquidity dashboards; early warning indicators; automated limit monitoring systems.

---

Case 2: Digital Dilemma of Unique Bank PLC

Case Scenario: Unique Bank (UB) PLC, successful but lagging in tech investment, faces increasing competition from rivals. UB launched a new mobile banking app and outsourced core IT infrastructure to Cosmo Technologies Ltd. (CTL). Events include: (i) Software malfunction causing 48-hour transaction failures; (ii) Cyber attack/ransomware exposing customer data; (iii) Employee fraud through fake vendor payments. UB's existing risk management framework mainly focused on credit risk, proving inadequate for digital and third-party risks.

(a) Underlying process/control failures and hasty app launch contribution (5×4=20 marks):

Software Malfunction Analysis:
Underlying Failures: Inadequate testing (UAT, stress testing); rushed deployment; poor change management; weak vendor management (SLA, oversight).
Hasty App Launch Contribution: Competitive pressure led to rushed timeline; skipped critical testing phases; inadequate staff training; poor customer communication.

Cyber Attack Analysis:
Underlying Failures: Weak security controls at CTL; lack of multi-layered security; inadequate intrusion detection; poor due diligence on CTL; weak contractual security requirements; no cyber incident response plan; delayed detection.

Employee Fraud Analysis:
Underlying Failures: Inadequate segregation of duties; weak maker-checker processes; insufficient approval authorities; lack of vendor verification; weak payment authorization limits; insufficient transaction monitoring.

(b) How UB's Business Continuity Plan could better address CTL's ransomware attack:

• Data Backup and Recovery: Offline/air-gapped backups; regular backup testing; geographic redundancy.
• Incident Response Procedures: Cyber incident response team; clear escalation protocols; communication templates.
• Alternative Service Delivery: Manual processing procedures; alternative banking channels; redundant systems.
• Recovery Time Objectives (RTO): Critical services restored within 4 hours; full services within 24 hours; tested procedures.
• Vendor Continuity Requirements: Mandatory BCP/DRP for critical vendors; regular testing; alternative vendor arrangements.

(c) Responsibilities of senior management and Board in ensuring effective operational risk management and third-party oversight:

Senior Management Responsibilities: Develop operational risk framework; establish risk identification processes; implement three lines of defense; IT steering committee; technology risk policies; vendor due diligence and monitoring; internal controls enforcement; cybersecurity and fraud prevention training.

Board of Directors Responsibilities: Approve risk appetite; ensure adequate resources; review major technology investments; approve operational risk, third-party risk, and BCP policies; monitor operational risk incidents and KRIs; oversee internal and external audit of technology/operations.

(d) Strategic shifts for digital transformation and risk management investments:

Digital Transformation Strategy: Phased approach with pilot programs; agile development; customer feedback integration; build core capabilities in-house; hybrid cloud strategy; legacy system upgrades; API-based architecture.

Risk Management Investments: Cybersecurity infrastructure (next-gen firewalls, SIEM, IDS/IPS, endpoint protection, pen testing); third-party risk platform; operational risk systems (loss data, RCSA tools, KRI monitoring, incident management); hire specialized risk professionals (CISO, operational risk experts); establish SOC, third-party risk, and BCM teams.

Balancing Competitiveness and Resilience: Risk-adjusted innovation; agile risk management; continuous improvement; position security as competitive advantage; proactive regulatory engagement.

---

Part D—Understanding Terminology

Question 9: Compare and Contrast (Select any 5)

(i) Internal Audit vs External Audit:

Aspect	Internal Audit	External Audit
Purpose	Review internal controls, risk management, governance	Express opinion on financial statements
Independence	Internal but functionally independent	External third party
Scope	Broad (operations, compliance, efficiency)	Financial statement accuracy
Frequency	Continuous/ongoing	Periodic, typically annual
Reporting	Audit Committee/Board/management	Shareholders, regulators, public

(iii) Market Risk vs Operational Risk:

Aspect	Market Risk	Operational Risk
Definition	Losses from adverse market price movements	Loss from inadequate/failed processes, people, systems, or external events
Nature	Financial, quantifiable	Varied (process, human, technology, external)
Measurement	VaR, sensitivity, duration gap	Loss data, scenarios, KRIs
Example	Loss due to interest rate increase	Fraud, system failure, processing error

(iv) Liquidity Coverage Ratio (LCR) vs Net Stable Funding Ratio (NSFR):

Aspect	LCR	NSFR
Time Horizon	Short-term (30 days)	Long-term (1 year)
Purpose	Sufficient liquid assets for acute stress	Promote stable funding structure
Formula	HQLA / Net Cash Outflows ≥ 100%	ASF / RSF ≥ 100%
Focus	Liquidity buffers	Funding stability

(v) Forex Options vs Forex Swaps:

Aspect	Forex Options	Forex Swaps
Definition	Right (not obligation) to exchange currencies	Simultaneous spot and forward transaction
Obligation	Optional	Mandatory
Premium	Option premium paid upfront	No premium, priced through swap points
Flexibility	High	Low

(viii) Preventive Internal Control vs Corrective Internal Control:

Aspect	Preventive Control	Corrective Control
Timing	Before error/fraud occurs	After error/fraud is detected
Purpose	Prevent problems	Fix problems that occurred
Nature	Proactive	Reactive
Examples	Segregation of duties, authorization, access controls	Exception reports, reconciliations, variance analysis
Cost	Generally lower	Generally higher

---

Part E—Short Questions

Question 10: Answer any FIVE

(i) Steps for developing a risk appetite statement:

1. Strategic Alignment with overall bank objectives
2. Environmental Analysis (annual reports, regulatory requirements, peer comparisons)
3. Risk Profile Assessment (current and target)
4. Stakeholder Consultation (business lines, risk management, finance, board)
5. Quantitative Metrics Setting (growth, concentration, NPL, capital, liquidity)
6. Qualitative Statements (acceptable/unacceptable risks and behaviors)
7. Documentation of comprehensive RAS
8. Board Approval
9. Communication and training throughout organization
10. Integration into policies, procedures, limits, and decisions

(ii) Consequences of inconsistent and unreliable risk assessment process:

1. Poor Decision-Making due to inaccurate information
2. Inconsistent Risk Treatment across departments
3. Increased Risk Exposure from unidentified risks
4. Invalid Controls that become outdated and ineffective
5. Regulatory Non-Compliance leading to penalties
6. Capital Misallocation from incorrect risk assessment
7. Reputation Damage harming stakeholder confidence
8. Competitive Disadvantage in pricing and opportunities

(iii) Risk Register components:

• Date (identification, target, completion)
• Risk Number (unique identifier)
• Risk Description (causes and impact)
• Risk Category (credit, market, operational, etc.)
• Existing Controls
• Consequence/Impact (severity rating 1-5)
• Likelihood/Probability (rating 1-5)
• Overall Risk Score (Likelihood × Consequence, 1-25)
• Risk Ranking (priority list)
• Risk Owner
• Trigger/Indicator (early warning signs)
• Management Action
• Action Owner
• Target Date
• Status (open, in progress, closed)

(iv) Differentiate between CTR and STR:

Aspect	CTR (Cash Transaction Report)	STR (Suspicious Transaction Report)
Basis	Threshold-based (objective)	Suspicion-based (subjective)
Threshold	≥ BDT 10 lakh (1 million) in single day	No specific threshold
Frequency	Monthly reporting	Immediate reporting
Reporting to	Bangladesh Financial Intelligence Unit (BFIU)	BFIU

(v) Prime objectives of Supervisory Review Process (SRP):

1. Ensure Minimum CRAR Compliance
2. Enable Early Intervention to prevent capital erosion
3. Assess Beyond Pillar-I Risks (residual, concentration, IRRBB, liquidity, strategic, reputation)
4. Promote Better Risk Management techniques
5. Evaluate ICAAP adequacy
6. Establish Supervisory Dialogue (SRP-SREP)
7. Ensure forward-looking Capital Planning
8. Enable Risk-Based Supervision

(viii) Areas of disclosure required by Pillar 3 of Basel III:

• Scope of Application
• Capital Structure (CET1, AT1, Tier 2 components and reconciliation)
• Capital Adequacy (ratios, RWAs by risk type)
• Credit Risk (exposure by portfolio, geography, industry; impaired exposures; credit risk mitigation)
• Equities Disclosure for Banking Book
• Interest Rate Risk in Banking Book (IRRBB) sensitivity
• Market Risk (capital requirements, VaR)
• Operational Risk (approach used, capital requirements)
• Leverage Ratio
• Liquidity Ratios (LCR, NSFR)
• Remuneration (policy, pay-for-performance link, aggregate data)

---

[End of Answers]