The Bhutanese Leading the way.
The Royal Monetary Authority said it has completed its inspection involving a client of the Bank of Bhutan (BoB)and the findings indicate that the incident is the result of fundamental gaps in governance, risk oversight, internal controls, and change management practices.
RMA said the matter cannot and must not be construed as an isolated incident arising from a technology overhaul or as a system failure. Such characterization materially understates the gravity of the situation and obscures the underlying deficiencies.
It said that under applicable regulatory requirements, the Board of Directors and Executive Management bear ultimate responsibility for the safety, soundness, and resilience of the institution.
RMA said the failure to exercise adequate oversight over system migration and associated risks constitutes a serious breach of fiduciary duty and regulatory obligations.
The RMA emphasized that any attempt to minimise the incident as a mere technical malfunction or to attribute responsibility primarily to third parties is unacceptable and detracts from addressing the underlying governance failures.
RMA directives to BoB
BoB is to do an independent assessment that shall identify specific lapses in responsibility, and determine accountability for failures in oversight, execution, and control. The Board has been directed to take clear and proportionate disciplinary action against all individuals found responsible for the failures.
BoB has been directed to immediately implement corrective measures to address critical control failures identified, including strengthening transaction controls, monitoring systems, and reconciliation processes.
BoB shall undertake a comprehensive review of all customer accounts affected by the incident, including third party recipients whose accounts were put on hold. The Bank has been directed to ensure prompt restoration of access for customers not implicated in wrongdoings, provide compensation for direct and, where applicable, consequential losses; and to strengthen its customer redressal mechanism.
BoB has to conduct a comprehensive and independent assessment, with oversight from the Druk Holding and Investments Limited (DHI), of the BoBL’s governance structures, IT systems, resourcing and vendor management frameworks. This review is expected to result in a time-bound remediation plan with clearly assigned responsibilities that will enhance the resilience and integrity of BoBL going forward.
Penalty
A penalty of Nu. 219.387 mn is imposed for the failure to maintain a functional Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) system and delays in filing Suspicious Transaction Reports in accordance with Section 7.3 of the AML/CFT Regulations 2025.
A penalty of Nu. 9.072 mn is imposed for failure to report systemic issues, such as multiple equated monthly instalment (EMI) debits, and for unauthorized account reversals affecting customers.
BoB shall maintain 100% provisioning for the unrecovered amount of Nu. 149.033 mn with immediate effect and shall not declare or distribute dividends for the year 2025.
Until further notice and effective immediately, BoB is prohibited from embarking on any changes, system upgrades, or platform migrations to critical IT systems, until the RMA is satisfied that the technical governance and risk mitigation protocols are sound, well-defined, and aligned with established best practices. BoB is to provide advance notification of all material system modifications.
RMA communicates with DHI
In addition, the RMA has formally communicated with DHI, in its capacity as the majority shareholder of BoB, to exercise active oversight in ensuring that the BoB Board fully and effectively complies with the above directives.
The RMA has further emphasized the need for DHI to ensure that a rigorous and independent assessment is undertaken of the competency, fitness, and propriety of the BoB Board, in light of the governance and oversight deficiencies identified and the scale of remediation required.
It said strong and accountable governance at the Board level is critical to restoring confidence, safeguarding stakeholders, and ensuring the long-term stability and integrity of BoB.
The RMA said it remains committed to maintaining the stability and integrity of, and public confidence in the financial system and will continue to closely monitor developments in this matter.
