With an objective to augment risk management practices and to ensure highest standards of risk management, the Reserve Bank of India (RBI) vide its notification dated 16th May, 2019 has mandated Non-Banking Financial Companies (NBFCs) having asset size of more than INR 5,000 crore to appoint a Chief Risk Officer (CRO).

Further, RBI has given the following instructions to be adhered by NBFCs-

1. CRO to be appointed as a senior official in the hierarchy and shall possess adequate professional qualification/ experience in the area of risk management.
2. Appointment shall be made for a fixed tenure with the approval of the Board and can be transferred/ removed from the position before completion of the tenure only with the approval of the Board and such premature transfer/ removal shall be reported to RBI and stock exchange, in case of listed NBFCs.
3. Board shall frame policy(ies) to safeguard the independence of the CRO and no other responsibility other than risk management shall be delegated to CRO.
4. Risk Management Committee/ Board of the Company shall meet CRO on quarterly basis, in the absence of CEO and MD.
5. CRO shall be involved in the process of identification, measurement and mitigation of risks and his role in deciding credit proposals shall be limited to being an advisor.
6. Voting power shall be granted to CRO if he is part of decision making team in the credit sanction process.
7. CRO shall not have any reporting relationship with the business verticals of the NBFC and shall not be given any business targets.

Please take note that no timeline is prescribed with regard to the appointment of CRO.