1. What the Law Requires

US:

• 12 CFR 30 - OCC Heightened Standards: Banks >$50bn must have enterprise-wide risk governance framework, independent risk management, and board risk committee.
• Regulation YY - 12 CFR 252.155: FBOs with combined US assets >$100bn must have US risk management framework commensurate with structure, risk profile, complexity and consistent with enterprise-wide policies.
• Basel II Pillar 2 + Basel III: ICAAP, ILAAP - bank must demonstrate enterprise risk aggregation.

India:

• RBI Risk Based Supervision - RBS: Board-level Risk Management Committee for enterprise-wide risk oversight, mandatory for all SCBs. Covers credit, market, operational, liquidity, legal, reputational, ESG risks.
• RBI Cyber Security Framework 2016 + Integrated Risk Management Framework for NBFCs: Enterprise-wide risk monitoring including IT, cyber, third-party.

Bahrain / GCC Model - CBB Rulebook: Conventional bank licensees must establish sound risk management framework with: (a) enterprise-wide risk governance framework approved by board including risk culture, appetite, limits (b) ongoing monitoring and assessment (e) comprehensive identification, measurement, mitigation, controlling, monitoring and reporting.

Failure = Formal Agreement / Consent Order.

2. Components of an Effective EWRM Framework

a) Risk Governance - Three Lines:

1. Business Line owns risk
2. Independent Risk Management - CRO reports directly to Board Risk Committee, not CEO
3. Internal Audit - enterprise-wide audit

b) Risk Appetite Statement - RAS:
Quantitative limits - e.g., Credit concentration <15% to single sector, Liquidity LCR >110%, AML alert backlog <500.

c) Enterprise Risk Aggregation:
Single data lake - ability to aggregate exposures in real-time. BCBS 239 principles. Most banks fail here - Citibank $400m OCC order in 2020 was exactly this - deficiencies in data governance, risk management, internal controls that constitute unsafe or unsound practices.

d) Continuous Monitoring & Early Warning:
KRI - Key Risk Indicators, KRIs for each risk type feeding enterprise dashboard. E.g., BSA/AML alert aging, credit migration, VaR breaches, vendor SLA breaches.

e) Escalation:
Clear path from KRI breach -> Risk Committee -> Board.

3. Enforcement Case Law - Where EWRM Failed

A. OCC / FED Enterprise-Wide Failures

1. Citibank, N.A. Consent Order AA-EC-2020-65, 7 Oct 2020 - $400 Million

OCC found: For several years, deficiencies in enterprise-wide risk management, data governance, internal controls constituted unsafe or unsound practices. Bank could not aggregate risk across entities, could not identify enterprise exposure. Required overhaul of enterprise risk framework, hiring of CRO, and $400m penalty.

This is textbook: No enterprise-wide monitoring = violation of 12 USC 1818(b).

2. Wells Fargo - Sales Practices + Enterprise Risk - 2016-2024 Saga - $3bn+

• OCC Sept 2016 Consent Order: Unauthorized accounts - failure of enterprise risk monitoring to detect sales misconduct.
• OCC April 2018 Cease and Desist + $500m penalty: Broader enterprise-wide compliance failures - risk management, audit.
• 2024: 11 former executives personal liability - $43m fines, prohibition orders. OCC stated: "failed to fulfill oversight, governance, risk management, and escalation responsibilities" - personal enterprise risk duty.

Legal principle: Francis v. United Jersey Bank, 87 N.J. 15 (1981) and Stone v. Ritter, 911 A.2d 362 (Del. 2006) - Caremark duty: Directors have duty to ensure enterprise-wide monitoring system exists. Failure to implement any system = breach of fiduciary duty. Wells Fargo board sued derivatively on this.

3. OCC Formal Agreements 2025 - Pattern:

First National Bank of Pasco, 16 Oct 2025: Formal Agreement cites unsafe or unsound practices tied to board oversight and corporate governance, strategic and capital planning, BSA/AML risk management and suspicious activity reporting, plus violations 12 CFR 21.11 SARs and 31 CFR 1010.610 correspondent due diligence. Root cause = no enterprise risk aggregation.

Patriot Bank, N.A., Stamford, CT, Feb 2025 - AA-NE-2025-05: Unsafe practices including strategic planning, capital planning, BSA/AML risk management, payment activities oversight, credit administration, concentration risk management. Again, failure to monitor risks enterprise-wide.

United Fidelity Bank, FSB, Evansville, Ind.: Consent Order for unsafe practices including corporate governance and enterprise risk management, credit underwriting, liquidity risk management.

American Express National Bank, 8 Oct 2026 - $350 Million OCC + Fed parallel order: BSA/AML program failures tied to $13bn suspected trade-based money laundering 2014-2025. Federal Reserve simultaneously issued consent cease-and-desist against holding company covering enterprise-wide financial crimes risk management. Shows new trend - Fed goes after holding company for enterprise failure, not just bank.

B. India - RBI + Supreme Court

1. YES Bank - Supreme Court Observation 2024 - Yes Bank v. Axis Trusteeship, Justices Dipankar Datta & Augustine George Masih

Supreme Court rapped RBI: "RBI was mere bystander, allowing CET1 ratio to drop to astonishing low of 0.6% while business carried out clandestinely." Court observed active selling of AT-1 bonds violating RBI guidelines. RBI's RBS enterprise monitoring failed - did not aggregate credit concentration risk to single groups, evergreening, liquidity risk.

Result: RBI now requires Enterprise Risk Dashboard reporting quarterly to RBS.

2. Official Liquidator, Supreme Bank Ltd. v. P.A. Tendolkar, SC 19 Jan 1973

Seminal misfeasance case. Directors personally liable for failure to monitor enterprise risks - misappropriation, fraudulent activities. Established director duty to have enterprise-wide monitoring, not just branch level.

3. Lending Bank MSME NPA Case, Supreme Court Verdict 2023-24

SC held Notification 29 May 2015 Framework for Revival of MSMEs does not prohibit bank from classifying MSME account as NPA without identification of incipient stress. But court stressed bank must have enterprise-wide Early Warning System for incipient stress detection - part of RBS. Failure to have EWS = procedural defect.

C. Options Clearing Corporation - SEC + CFTC $20 Million, 2024

Chicago-based OCC failed to establish and enforce policies involving financial risk management, operational requirements, information-systems security as required by SEC/CFTC rules. Settlement $20m. Shows even non-bank SIFMU must have enterprise risk.

4. How to Build Defensible EWRM - Regulatory Expectation in 2026

Structure regulators expect to see during exam:

1. Board Risk Committee minutes quarterly, independent chair, enterprise risk reports
2. CRO with direct board access, dual reporting to CEO and Risk Committee
3. Enterprise Risk Inventory - all risks mapped to owners
4. Risk Appetite with quantitative thresholds, linked to compensation
5. BCBS 239 compliant data aggregation - ability to produce enterprise exposure in 24 hours
6. Integrated GRC platform - RSA Archer, ServiceNow - linking audit findings, KRIs, incidents
7. Escalation - Material risk to board within 48 hours

Common Defects leading to Formal Agreement:

• Risk reports siloed - Credit risk not speaking to AML risk - e.g., loan to high-risk MSB without EDD
• Data lineage broken - Citibank case
• Vendor risk not integrated - OCC 2014 joint order with FDIC against tech service providers - operating without internal auditor, without comprehensive due diligence program to evaluate vendor risk
• BSA Officer not part of enterprise risk committee