Who Regulates Banks, and What They Check

The parts are the same everywhere; who plays them differs. In some countries one body plays several — in New Zealand the central bank is also the prudential supervisor and runs the deposit compensation scheme — and in others each part has its own agency. A reader who knows the parts can find their way round any country's system in an afternoon.

The Basel Committee on Banking Supervision writes the international standards for bank capital, liquidity and supervision; its mandate is to strengthen the regulation, supervision and practices of banks worldwide. Its own charter is plain about its limits: it has no formal supranational authority, and its decisions have no legal force. Its members commit to implement the standards at home, and a standard binds a bank only when a national regulator writes it into its own rules.

The prudential supervisor is the one with the powers. It licenses a bank before it may take deposits from the public. It sets and checks the capital the bank must hold against its risk-weighted assets, the liquid assets it must keep against its funding leaving, and the governance around both: who sits on the board, what the board approves, what the risk function may stop. It inspects, asks for data, and stress-tests the bank against a severe recession to see whether its capital would survive one — the Federal Reserve, for instance, runs such a test every year for the largest US banking groups. And it can ask for more than the minimum: the Basel standards themselves expect supervisors to want banks operating above it, and to be able to require it.

Take the bank constructed for the other pages in this order: US$6.0bn of risk-weighted assets, and US$780m of common equity Tier 1 capital — its US$1.0bn of shareholders' equity, less US$220m of intangibles and the dividend it has declared, which do not count.

The 4.5% is a floor the bank must stay above at all times. The 2.5% above it is a buffer, built in good years to be drawn on in bad ones, and it works differently. A bank whose CET1 ratio falls inside the buffer may go on lending and operating as normal, but it is limited in what it may pay out — dividends, share buybacks, discretionary bonuses to staff — and the limits tighten the closer it comes to 4.5%. For the constructed bank that line is US$360m of losses away, beyond whatever a year's earnings absorb first; When a Loan Goes Bad follows one loss to it.

These are the Basel numbers, and they are minimums. The same standards let a country add a countercyclical buffer of up to 2.5% when credit is growing too fast, and add surcharges for its most systemically important banks. National regulators set their own requirements, often higher than Basel's, and each publishes its own; this page prints none of them. The constructed bank's 13.0% is a constructed number, not a target.

The prudential supervisor asks whether the bank will survive. The conduct regulator asks how it treats the people it deals with: whether products are sold fairly, fees disclosed, complaints handled, customers in difficulty dealt with as the rules require. A well-capitalised bank can still overcharge its customers, so the two questions are kept apart, and many countries give them to two different bodies.

The central bank sets the policy rate, which How an Interest Rate Change Reaches You follows to a loan and a savings account. It is also the lender of last resort: in a squeeze it lends to banks that are sound but short of cash, against collateral, so that a bank with good assets is not forced to sell them in a hurry to meet its withdrawals.

Last comes the safety net. A deposit insurer pays out insured deposits up to a limit if a bank fails, and a resolution authority — sometimes the same body — takes control of a failing bank so that it fails in an orderly way. The limits differ by country; Is My Money Safe in a Bank? sets them out.

New Zealand. The Reserve Bank of New Zealand is the central bank, sets the official cash rate, and is the prudential regulator and supervisor of banks. The Deposit Takers Act 2023 replaces the Banking (Prudential Supervision) Act 1989 and the Non-bank Deposit Takers Act 2013 with a single regime for banks and other deposit takers; it comes into full effect on 1 December 2028, and parts of the old Acts stay in force until then. Under the new Act the Reserve Bank already runs the Depositor Compensation Scheme, in effect since 1 July 2025. Conduct is the Financial Markets Authority's: since 31 March 2025, registered banks, licensed insurers and licensed non-bank deposit takers that serve consumers have needed its licence, and must comply with a fair conduct principle.

Australia. The Australian Prudential Regulation Authority is the prudential regulator of banks and other deposit-takers, insurers and superannuation funds, and administers the Financial Claims Scheme. The Australian Securities and Investments Commission is the corporate, markets, financial services and consumer credit regulator. The Reserve Bank of Australia sets the cash rate and can lend to sound institutions short of liquidity.

The United Kingdom. The Prudential Regulation Authority, part of the Bank of England, regulates and supervises banks, building societies, credit unions, insurers and major investment firms. The Financial Conduct Authority regulates the conduct of financial services firms. The Bank of England sets Bank Rate and sees that a failing bank fails in an orderly way, and the Financial Services Compensation Scheme protects deposits.

The United States. The Federal Reserve supervises bank holding companies and state member banks, sets monetary policy, and lends to banks through its discount window against collateral. The Office of the Comptroller of the Currency charters, regulates and supervises national banks and federal savings associations. The Federal Deposit Insurance Corporation insures deposits, examines and supervises banks, and resolves those that fail.

The external auditor gives an opinion on the bank's annual accounts, and among the largest judgments in them are the provisions against its loans. The board's audit committee oversees that auditor and approves its appointment, or recommends it to the shareholders. Credit rating agencies grade the bank's bonds, and a downgrade raises what it pays for wholesale funding. Shareholders and bondholders read its results and its regulatory disclosures — the Basel framework's Pillar 3, which exists to promote market discipline — and price its shares and bonds on what they find; How to Read a Bank's Results reads them line by line.

The board answers for the risks the bank takes, and works through committees: the Basel Committee's corporate governance principles expect an audit committee and a risk committee at systemically important banks, and strongly recommend them elsewhere. Beneath the board, the same principles describe three lines. The business — the relationship managers and the desks — owns the risks it takes. An independent risk management function and a compliance function form the second line, watching and challenging the first. Internal audit, independent of both, is the third, and reports on whether the first two work.

On a lending file, the second line is the credit officer who can say no to the relationship manager — Issue 10, The Dissent, is a credit committee where someone has to. Every layer on this page checks something different, and none of them checks whether a particular loan is a good one. That judgment stays inside the bank.