NRB Overhauls Bank Risk Rules, Adds Climate, AI and Cyber Threats

Nepal Rastra Bank has overhauled its risk management framework for banks and financial institutions after eight years, expanding the regulatory focus beyond traditional concerns such as credit, liquidity and market movements to include climate shocks, artificial intelligence, cyber threats, digital fraud and operational resilience.

The change is more significant than simply adding floods, landslides and new technologies to a list of banking risks.

The 2018 Risk Management Guidelines were largely built around risks generated by banking activities themselves. They covered six major areas: credit, liquidity, operational, market, foreign exchange and interest rate risk. Foreign exchange risk was handled within the market risk framework.

The 2026 guidelines identify seven major areas: credit, liquidity, operational, market, interest rate, technology and climate risk. Technology and climate now stand as distinct risk areas, while banks are also told to consider other risks to which they may be exposed.

That marks a change in the central bank's approach. Banks are no longer being asked only how they will manage bad loans, liquidity shortages, interest rate movements or failures inside their own operations. They are increasingly being required to assess risks arising from the wider environment in which banking takes place.

The new framework raises a broader set of questions. What happens to a bank's loan portfolio after a major flood? How much exposure does it have to climate sensitive sectors? How long can mobile banking remain unavailable? What happens if a critical technology provider fails? Can a cyberattack be detected in real time? What new risks emerge when artificial intelligence is introduced into banking operations? And how much disruption is a bank prepared to tolerate?

NRB itself explains the shift in the introduction to the 2026 guidelines. It points to climate change, rapid digitalisation, increasing reliance on data driven technologies and advances in artificial intelligence as sources of emerging risks involving data confidentiality, cybersecurity, operational resilience and the safety and integrity of payment systems and financial markets.

Climate risk is perhaps the clearest example of how far the framework has changed.

Natural disasters were not entirely absent from the 2018 rules. Operational risk was defined broadly enough to include losses arising from external events, IT failures and damage to physical assets. The earlier guidelines also required contingency planning and business continuity arrangements for critical processes.

The 2018 framework went as far as requiring business continuity plans to identify time critical activities and determine their maximum tolerable downtime.

What changes in 2026 is the treatment of disasters as a financial risk in their own right.

Climate risk now receives a separate chapter and is divided into physical risks, arising from extreme weather and longer term changes in climate, and transition risks linked to the move towards a low carbon economy. NRB says both can affect the soundness of individual institutions as well as the stability of the wider financial system.

The new rules therefore move disasters from the margins of operational risk towards the centre of financial risk management.

Banks must now consider climate exposure when setting business and risk strategies. Climate related financial risks are expected to be incorporated into their risk appetite frameworks, with clear responsibility and reporting lines across the institution.

Climate shocks are also expected to be examined through their effect on lending portfolios.

Banks are expected to identify and assess their exposure to sectors and activities that may be affected by climate factors, including agriculture, infrastructure, energy and other environmentally sensitive sectors.

The framework also brings physical assets, geographical vulnerability and portfolio losses into the assessment. Institutions are encouraged to conduct climate vulnerability assessments covering hazards such as floods and landslides, while scenario analysis can examine the impact of natural disasters on vulnerable regions and loan portfolios.

This means a flood is no longer merely an event that might damage a branch or interrupt banking operations. It can also affect the repayment capacity of borrowers, the value of collateral, the concentration of loans in vulnerable sectors or locations and, ultimately, the stability of the institution itself.

Governance requirements have also become more explicit.

Boards are expected to understand climate related exposures and incorporate them into business and risk strategy. Banks should also establish climate risk committees that meet quarterly and advise their boards on climate and environmental risks. The guidelines call for strategies to strengthen physical resilience through measures such as flood defences, reinforced structures and energy efficient buildings.

Technology receives a similarly large upgrade.

Under the 2018 framework, IT risk was largely treated as part of operational risk. The 2026 guidelines create a separate technology risk chapter with its own governance, policies, risk assessment, monitoring, reporting and contingency requirements.

Boards are expected to oversee IT risk management, while responsibility is assigned to functions including chief information, technology and information security officers. Technology risk teams are expected to conduct risk assessments, system audits and penetration testing, while internal audit and compliance functions are expected to oversee adherence to information system and cybersecurity requirements.

The new guidelines also require a comprehensive Digital Fraud Prevention Policy and a cybersecurity framework covering vulnerability assessment, incident response, security testing, cyber threat intelligence and protection of critical information assets.

Artificial intelligence and machine learning enter the formal risk framework for the first time.

Banks are required to ensure the ethical and responsible use of such technologies and identify and mitigate additional risks arising from them. The guidelines also call for technology risks to be assessed through tools that may include penetration testing, ethical hacking, scenario analysis and stress testing.

AI is not treated as a separate top level risk category. Instead, it sits within technology risk management. But its explicit inclusion means banks will have to consider risks created by automated systems, data dependence and emerging technologies as part of formal risk governance rather than leaving them solely to IT departments.

Cybersecurity monitoring is also expected to become more continuous.

Senior management is expected to put in place real time security monitoring systems, regular vulnerability assessments, security audits and automated fraud detection. The guidelines also call for Security Operations Centres to monitor cyber threats in real time, alongside clear escalation procedures and reviews following security incidents.

Operational resilience has also been strengthened, although the concept itself is not entirely new.

The 2018 guidelines already dealt with contingency planning, business continuity and acceptable downtime. The 2026 version goes further by requiring banks to distinguish critical from non-critical operations and establish risk appetite and tolerance for disruption.

For each critical operation, banks should develop a risk tolerance matrix approved by the board, setting out as far as possible the maximum acceptable level of disruption.

That gives service disruption a more measurable place within risk management.

A bank must increasingly determine in advance how long mobile banking, payment services or other critical operations can remain unavailable before the disruption becomes unacceptable.

It must also understand the dependencies behind those services. The new framework requires institutions to consider the people, technology, processes, information, facilities and third parties needed to keep critical operations running. It also calls for resilience assessments of outside service providers and continuous improvement of crisis and recovery plans based on incidents, drills and simulation exercises.

Money laundering and terrorist financing also receive a more explicit place in the new framework.

The 2026 guidelines add a dedicated section requiring banks to integrate such risks into institution wide risk assessment, internal audit, capital adequacy assessment, risk appetite, monitoring and staff training.

Traditional risks remain central, but some of their requirements have also become more detailed.

In credit risk, the 2026 framework explicitly adds limits on non-performing loans and loan to value ratios and requires banks to consider stress testing when reviewing credit limits.

Business borrowers are also expected to be monitored through on site visits, while the repayment capacity of individual borrowers should be updated regularly to identify signs of deterioration early.

Loan provisioning is now explicitly linked to the NFRS 9 Expected Credit Loss Related Guidelines issued in 2024.

Interest rate risk has also been recast more specifically as Interest Rate Risk in the Banking Book. The framework links it with capital adequacy assessment and names tools including Earnings at Risk, Economic Value of Equity, duration analysis and stress testing.

At the centre of the overhaul is a stronger emphasis on risk appetite.

The 2018 guidelines already required banks to define how much risk they were willing to take. The 2026 version links risk appetite more explicitly to risk capacity, strategic objectives and business plans.

The guidelines also add a practical risk appetite and tolerance template. The annex includes examples such as non-performing loans, single obligor exposure, mobile banking downtime and Recovery Time Objectives, and says financial institutions should set risk appetite and tolerance limits for all risks covered by the guidelines.

Taken together, the changes show how NRB's view of banking risk has widened since 2018.

The older framework was primarily concerned with managing risks created within banking activities and ensuring that institutions could withstand failures in those activities. The new framework keeps those concerns but adds a second layer: whether banks can withstand shocks arising from climate change, digital dependence, cyber threats, artificial intelligence and failures in the wider systems on which modern banking relies.

That makes the 2026 overhaul less about adding a few new risk categories and more about redefining what banks are expected to prepare for.

Area	2018 Guidelines	2026 Guidelines
Major risk areas	Credit, liquidity, operational, market, foreign exchange and interest rate risk	Credit, liquidity, operational, market, interest rate, technology and climate risk
Climate and disasters	External events and physical asset damage were mainly treated under operational risk	Climate becomes a standalone risk category covering physical and transition risks, including extreme weather
Climate governance	No dedicated climate governance framework	Boards must integrate climate risk into strategy and risk appetite, while climate risk committees are expected to meet quarterly
Technology risk	IT failures were largely part of operational risk	Technology gets a separate risk management framework covering governance, cybersecurity, digital fraud and resilience
Artificial intelligence	No explicit AI framework	Banks must ensure ethical and responsible use of AI and machine learning and manage additional risks arising from them
Cybersecurity	Covered indirectly through IT and operational risk	Real time monitoring, vulnerability assessment, incident response, penetration testing and SOCs are explicitly included
Digital fraud	Fraud treated as an operational risk	Banks are expected to adopt a dedicated Digital Fraud Prevention Policy
Operational resilience	Business continuity plans and maximum tolerable downtime were already required	Banks must distinguish critical and non critical services and establish board approved disruption tolerance matrices
Third party dependencies	Outsourcing risk recognised	Banks must assess the resilience of third parties and map dependencies supporting critical operations
Money laundering risk	No dedicated section in the main risk framework	Separate ML and TF risk provisions cover risk assessment, internal audit, ICAAP, monitoring and training
Credit risk	Traditional credit limits and monitoring	Adds explicit NPL and loan to value limits, greater borrower monitoring and NFRS 9 expected credit loss linkage
Interest rate risk	General interest rate risk management	Recast as Interest Rate Risk in the Banking Book, with tools such as Earnings at Risk and Economic Value of Equity
Risk appetite	Risk appetite and tolerance already required	More closely linked to risk capacity and strategy, with a practical template covering areas such as NPLs and mobile banking downtime

What Banks Will Now Have to Ask

• How much of the loan portfolio is exposed to floods, landslides and other climate sensitive activities?

• How would a major climate event affect borrowers, collateral and loan quality?

• Which sectors and locations create the greatest climate concentration risk?

• How much disruption can mobile banking, payments and other critical services tolerate?

• Which employees, systems, vendors and infrastructure are essential to keeping critical services running?

• Can cyber threats be detected and escalated in real time?

• Are disaster recovery systems, backup data centres and recovery targets adequate?

• What new risks arise when AI or machine learning is used in banking operations?

• Are third party technology providers resilient enough to withstand disruptions?

• Has the board clearly defined how much climate, technology and operational risk the institution is willing to accept?