SUNANDO ROY – On Banking, Finance and Society

International expansion through overseas banking subsidiaries has become a defining feature of large banking groups worldwide. Yet this expansion creates substantial risk-management and supervisory challenges that are difficult to resolve. Overseas subsidiaries occupy a unique position at the intersection of group-wide strategies and host-country prudential regimes, requiring banks and regulators alike to balance consolidated oversight with robust local safeguards.

Overseas banking subsidiaries are locally incorporated entities controlled by a foreign parent that conduct banking or closely related financial activities in the host jurisdiction. They are fully subject to host-country law and supervision, while their risks are expected to be captured within the parent’s consolidated risk and capital framework.

This dual character gives rise to a set of structural risk concerns, including:

• Credit and country risk arising from local portfolios, sovereign exposures, and cross-border lending.
• Liquidity and funding risk, including reliance on intra-group funding and foreign-currency markets.
• Operational, legal, and compliance risk, particularly in areas such as AML/CFT, sanctions, data protection, and conduct-of-business obligations.
• Governance risk, where weak alignment between group and subsidiary risk-appetite frameworks can amplify vulnerabilities across both home and host financial systems.

Regulatory Foundation

Consolidated Supervision

The Basel Framework applies minimum capital, leverage, liquidity, and large-exposure standards on a consolidated basis to internationally active banks, with the objective of capturing all material risks across banking, securities, and other financial subsidiaries. Consolidated application — from the holding company level down to significant banking entities — is designed to prevent double-gearing, ensure capital integrity, and bring overseas subsidiaries firmly within the regulatory perimeter.

The Basel Core Principles reinforce these requirements by obliging supervisors to conduct consolidated supervision, assess group-wide governance and risk management, and ensure that complex group structures do not impede transparent oversight of overseas entities. Where risks are not fully captured through regulatory consolidation — such as step-in risk — supervisors are encouraged to apply additional capital or risk-management expectations.

Home-Country Responsibilities

Home supervisors bear ultimate responsibility for the safety and soundness of the consolidated banking group and must therefore maintain a thorough understanding of the risk profiles of all overseas subsidiaries. This includes assessing intra-group exposures, funding channels, and potential stress-transmission between entities; evaluating governance and internal-control arrangements at subsidiaries; and leveraging supervisory colleges and information-sharing arrangements to coordinate effectively with host authorities.

The Basel “Concordat” on the supervision of foreign establishments established early foundational principles for the allocation of supervisory responsibilities, emphasising consolidated home-authority oversight alongside compliance with local rules under host supervision. These principles are now embedded in the Basel Core Principles and in more recent guidance on supervisory cooperation, recovery, and resolution planning.

Host-Country Responsibilities

Host supervisors are responsible for protecting their own financial stability and depositors. This leads them to impose local prudential requirements on foreign-owned subsidiaries, which may include local capital and liquidity buffers, limits on intra-group exposures or dividend repatriation, and, in some cases, ring-fencing measures to ensure continuity of critical local financial functions.

In emerging markets, where foreign banks may dominate system assets, host authorities face particular challenges: ensuring effective home–host cooperation, navigating complex conglomerate structures, and sequencing the adoption of international standards in line with available supervisory capacity. These conditions place a premium on clear cross-border cooperation frameworks and robust subsidiary-level risk-management practices.

Risk-Management Practices for Overseas Subsidiaries

Governance and Risk-Appetite Alignment

• Effective group-wide risk management begins with a clearly articulated risk-appetite framework (RAF) that translates into coherent expectations for individual business lines and legal entities, including overseas subsidiaries. The RAF should establish boundaries for all material risk types, incorporate both quantitative limits and qualitative guidance, and clearly define the roles of the board and senior management.
• Subsidiary boards must receive sufficient and timely information, possess adequate technical expertise, and retain the authority to challenge group decisions that may compromise local safety and soundness. Emerging supervisory guidance on governance and risk culture stresses the need for a consistent risk culture across the group, transparent escalation channels, and integrated risk dashboards accessible to boards at all levels
• Country, Credit, and Concentration Risk
• Country-risk frameworks must cover all jurisdictions in which the group operates, encompassing sovereign, macroeconomic, political, and transfer-risk factors that can affect overseas subsidiaries. Banks are expected to establish limits on country and cross-border exposures at both group and entity level, monitor these limits closely, and update them promptly when conditions deteriorate — particularly in more volatile emerging markets.
• The Basel Core Principles and national supervisory guidance emphasise the robust identification and aggregation of large exposures and sectoral or geographic concentrations, as well as contagion channels arising from intra-group exposures. This is especially important where subsidiaries across multiple countries lend to common corporate groups or sectors, or where economic shocks may affect several markets simultaneously.
•  Liquidity, Funding, and Intra-Group Exposures
• Liquidity-risk management for overseas subsidiaries must satisfy both the applicable Basel standards and host-country rules on liquidity coverage, stable funding, and local-currency liquidity. Supervisors and banks pay particular attention to subsidiaries’ reliance on short-term wholesale or intra-group funding, foreign-currency mismatches, and contagion channels that could be triggered by parent-level stress.
• Sound practice requires the maintenance of realistic contingency-funding plans at both group and subsidiary levels, incorporating combined home–host stress scenarios and potential ring-fencing actions by host authorities. Intra-group exposures should be clearly documented, subject to appropriate limits and arm’s-length pricing, and monitored continuously to prevent excessive accumulation of concealed leverage or guarantees.
• Operational, Legal, and Compliance Risk (including AML/CFT)
• Group-wide standards for AML/CFT, sanctions screening, data protection, outsourcing, and conduct-of-business should apply consistently across all subsidiaries, with local additions where host-country requirements are more stringent. Under evolving European AML rules, for example, institutions are required to implement group-wide AML/CFT policies for branches and subsidiaries in third countries and to adopt supplementary measures where local law prevents the full application of group standards.
• Supervisors are also placing growing emphasis on third-party and intra-group service-provider risk, including foreign-based outsourcing arrangements covering IT, cloud services, and shared service centres. Regulatory guidance expects banks to maintain robust due diligence, enforceable contractual safeguards, credible contingency plans, and clear cross-jurisdictional allocation of responsibilities.
•  Information Systems, Reporting, and Supervisory Cooperation
• Data aggregation and risk-reporting capabilities must enable banks to generate timely, accurate, and consolidated risk information for all overseas subsidiaries, while simultaneously meeting host-country reporting requirements at the legal-entity level. Weaknesses in data architecture can prevent supervisors from forming a comprehensive and coherent view of the risk profile of overseas subsidiaries and their interactions with the broader group.
• Supervisory cooperation — through colleges, Memoranda of Understanding (MoUs), and crisis-management groups — is indispensable for aligning expectations, sharing information, and coordinating responses in periods of stress. In emerging markets, effective cross-border cooperation has been identified as both a particular challenge and a critical ingredient of financial stability, especially where foreign banks hold a large share of system assets.

Cross-Jurisdictional Perspective

The table below summarises approaches to the risk management of overseas banking subsidiaries across selected frameworks and jurisdictions.

Jurisdiction / Framework	Consolidation & Group-Wide View	Local Prudential Requirements	Governance & Risk-Appetite	AML/CFT & Compliance Focus
Basel Framework (BCBS)	Applies capital, leverage, liquidity, and large-exposure rules on a consolidated basis, capturing banking and related financial subsidiaries. bis.org	Allows host authorities to impose additional local capital or liquidity measures; encourages expanded consolidation or capital deductions for material unconsolidated entities and step-in risks. bis.org	Core Principles require strong group-wide governance, risk management, and clear allocation of responsibilities across entities. bde.es	Emphasises identification, measurement, monitoring, and mitigation of country and transfer risk, including those arising from overseas operations. bde.es
United States (Federal Reserve / OCC / FFIEC)	Consolidated supervision of large foreign banking organisations’ US operations and enhanced standards for intermediate holding companies. federalreserve.gov	Host rules govern foreign subsidiaries; US supervisors assess their impact on the consolidated group. Local ring-fencing and stress-testing requirements apply to significant US operations. federalreserve.gov	Guidance stresses board-level oversight of combined operations and sound risk-management practices, including for cross-border activities. federalreserve.gov	Strong focus on AML/CFT and correspondent-banking due diligence, including periodic risk re-evaluation and management of foreign-based service providers. occ.gov
European Union / ECB–SSM	Consolidated prudential supervision of significant institutions, including cross-border groups and their subsidiaries within and outside the EU. bankofengland.co.uk	Local capital and liquidity requirements, resolution planning, and possible structural measures (e.g., subsidiarisation) may shape treatment of non-EU subsidiaries. suerf.org	Draft guidance on governance and risk culture expects coherent group-wide risk-appetite and risk-culture frameworks with effective oversight by management bodies. bankingsupervision.europa.eu	AMLR requires group-wide AML/CFT policies for branches and subsidiaries in third countries, plus additional measures where local laws impede full application. morlings.se
United Kingdom (PRA)	Focuses on group-wide risks and ensures overseas subsidiaries and branches do not compromise the resilience of UK entities or the consolidated group. bankofengland.co.uk	Imposes UK-specific capital, liquidity, and conduct standards on locally incorporated subsidiaries; differentiates branches from subsidiaries in resolution planning. bankofengland.co.uk	Expects proportionate but robust governance and risk-management structures for international operations, with clear responsibilities and information flows. bankofengland.co.uk	Requires compliance with UK AML/CFT and conduct rules, alongside effective group-wide oversight of financial crime risks. bankofengland.co.uk
Emerging-Market & GCC-Style Hosts (IMF/FSB perspective)	Encouraged to develop consolidated supervision of domestic groups and engage effectively with home supervisors of foreign-owned banks. imf.org	Often rely on strong local capital, liquidity, and foreign-currency regulations; may use ring-fencing to limit outward contagion. suerf.org	International assessments call for clearer risk-appetite frameworks, stronger board oversight, and improved tools for supervising conglomerate structures. imf.org	Expected to align with global AML/CFT standards despite constrained supervisory capacity; foreign subsidiaries must comply with local AML/CFT rules alongside group standards. imf.org

References

Basel Committee on Banking Supervision. (2019). Basel framework: Scope of application — Executive summary. Bank for International Settlements. https://www.bis.org/fsi/fsisummaries/scope_app.htm

Basel Committee on Banking Supervision. (2019). The Basel framework (consolidated version). Bank for International Settlements. https://www.bis.org/baselframework/

Basel Committee on Banking Supervision. (2019). Core principles for effective banking supervision. Bank for International Settlements. https://www.bis.org/bcbs/publ/d460.htm

Basel Committee on Banking Supervision. (1983). Principles for the supervision of banks’ foreign establishments (Concordat). Bank for International Settlements. https://www.bis.org/publ/bcbsc312.htm

European Central Bank. (2021). The PRA’s approach to branch and subsidiary supervision. Prudential Regulation Authority. https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/supervisory-statement/2021/ss521-july-2021.pdf

European Central Bank. (2024). Draft guide on governance and risk culture. European Central Bank. https://www.bankingsupervision.europa.eu/framework/publiccons/html/ssm.pubcon202407_draftguide.en.html

European Commission. (2024). Anti-Money Laundering Regulation (AMLR): Group-wide policies and procedures (Arts. 16–17). https://morlings.se/en/blog/amlr-art-16-17-group-wide-risk-management-operations-third-countries/

Financial Stability Board. (2013). Principles for an effective risk appetite framework. Financial Stability Board. https://www.fsb.org/2013/11/r_131118/

Financial Stability Board. (2011). Financial stability issues in emerging market and developing economies. Report to the G-20 Finance Ministers and Central Bank Governors. https://www.fsb.org/wp-content/uploads/r_111019.pdf

Office of the Comptroller of the Currency. (2012). Country risk management: Comptroller’s handbook. https://www.occ.gov/publications-and-resources/publications/comptrollers-handbook/files/country-risk-management/index-country-risk-management.html

Office of the Comptroller of the Currency. (2016). Risk management guidance on foreign correspondent banking (OCC Bulletin 2016-32). https://www.occ.gov/news-issuances/bulletins/2016/bulletin-2016-32.html

U.S. Federal Financial Institutions Examination Council. (2003). Foreign branches and offices of U.S. banks — Overview (BSA/AML Examination Manual). https://bsaaml.ffiec.gov/manual/ProgramStructures/02

U.S. Federal Reserve Board. (2014, March 27). Regulating large foreign banking organizations (Speech by Governor Daniel K. Tarullo). https://www.federalreserve.gov/newsevents/speech/tarullo20140327a.htm

U.S. Federal Reserve Board. (2024). Interagency statement on sound risk management. https://www.federalreserve.gov/frrs/guidance/interagency-statement-on-sound-risk-management.htm

U.S. Federal Reserve Board. (2026). Supervisory policy and guidance topics — Foreign banking organizations. https://www.federalreserve.gov/supervisionreg/topics/fbo_supervision.htm

Annex 1: Supervisory Audit Checklist for Overseas Banking Subsidiaries

This annex provides a practical checklist for bank supervisors conducting off-site reviews or on-site examinations of banking groups with overseas subsidiaries.

Governance and Group Structure

• Has the parent board approved a group-wide risk-appetite framework that explicitly covers overseas subsidiaries?
• Are roles and responsibilities for subsidiary oversight clearly defined across the parent board, group committees, regional management, and local boards?
• Does each subsidiary board have sufficient independence, expertise, and information access to challenge group decisions that affect local safety and soundness?
• Is there an up-to-date legal-entity structure chart, including ownership, guarantees, and key intra-group dependencies?

Risk-Appetite, Policies, and Limits

• Are subsidiary-level risk-appetite statements consistent with the group RAF in terms of risk types, metrics, and tolerances?
• Are material risk limits (credit, market, liquidity, country, operational) cascaded to subsidiaries and reflected in local policies and procedures?
• Are deviations driven by host-country rules documented, approved at group level, and communicated to home and host supervisors where material?

Country, Credit, and Concentration Risk

• Does the group maintain a documented country-risk framework covering all jurisdictions where subsidiaries operate, including sovereign and transfer-risk analysis?
• Are country and cross-border limits set, monitored, and periodically reviewed at both group and subsidiary level?
• Are large exposures and sectoral or geographic concentrations aggregated across entities and reported to senior management and the board?

 Liquidity, Funding, and Intra-Group Exposures

• Are subsidiary liquidity-risk practices aligned with Basel-consistent standards and host regulations, including local-currency liquidity buffers?
• Is the subsidiary’s reliance on intra-group or foreign-currency funding identified, stress-tested, and subject to internal limits?
• Are intra-group exposures (loans, guarantees, derivatives, services) clearly identified, contractually documented, and monitored against well-defined limits?
• Do group and subsidiaries maintain realistic contingency-funding plans that incorporate home–host stress scenarios and potential ring-fencing actions?

Operational, Legal, and Compliance Risk (including AML/CFT)

• Are group-wide minimum standards for AML/CFT, sanctions, data protection, outsourcing, and conduct applied consistently across all subsidiaries?
• Where host rules are less stringent than group AML/CFT standards, are compensating measures applied and documented as required by group policies and applicable law?
• Are risks from foreign-based third-party or intra-group service providers assessed and mitigated, including data-localisation and legal-enforceability issues?
• Are outsourcing and shared-service arrangements governed by robust contracts, service-level agreements, and documented exit strategies? FSB guidance

Information Systems, Reporting, and Data Aggregation

• Can risk data be aggregated quickly and accurately across the group, including all overseas subsidiaries, for all key risk types?
• Are regular risk and financial reports between subsidiaries and the parent clearly specified in terms of content, frequency, and escalation thresholds?
• Can supervisors obtain both consolidated and entity-level risk information in a timely manner for their supervisory assessments?

 Supervisory Cooperation and Resolution Planning

• Are MoUs or equivalent cooperation arrangements in place between relevant home and host authorities, addressing information sharing and coordinated response actions?
• Does the bank participate in supervisory colleges where the risk profiles of overseas subsidiaries are regularly discussed?
• Have home and host resolution authorities considered the role of subsidiaries in group recovery and resolution plans, including separability and continuity of critical functions?

Emerging-Market and Host-Specific Considerations

• Do group and subsidiary stress tests explicitly reflect host-country vulnerabilities such as FX volatility, sovereign risk, and liquidity shocks?
• Are host-country ring-fencing measures (capital surcharges, liquidity traps, dividend restrictions) properly reflected in group capital planning and liquidity management?
• Has the home supervisor evaluated any material gaps between host practice and the Basel Core Principles and, where necessary, imposed compensatory measures at group level?