TIL BDR GHALLEY | Thimphu
The Royal Monetary Authority of Bhutan (RMA) has imposed regulatory penalties exceeding Nu 228 million on Bank of Bhutan Limited (BoBL) and issued sweeping directives following an investigation into a major operational incident linked to the bank’s core system migration.
The central bank announced the enforcement action after completing its inspection into a client-related case that occurred during a recent technology overhaul at BoBL.
The incident involved erroneous account activity in which transactions were processed even after account balances had turned negative.
The total value of transactions linked to the case was reported to be approximately Nu 1.5 billion.
In its official statement, the RMA said the incident should not be interpreted as an isolated technical malfunction or a simple consequence of system migration.
Instead, the regulator stated that the findings point to fundamental gaps in governance, risk oversight, internal controls, and management practices within the institution.
The central bank emphasized that the responsibility for such failures lies with the Board of Directors and Executive Management of BoBL, who are accountable for ensuring the safety, soundness, and resilience of the financial institution.
It stated that the failure to adequately oversee system migration, risk controls, and operational safeguards constituted a breach of fiduciary duty and regulatory obligations.
The RMA also rejected explanations that attributed the incident primarily to third-party vendors or technical errors, stating that such interpretations fail to address the underlying governance weaknesses identified during the inspection.
As part of the enforcement action, the RMA imposed a monetary penalty of Nu 219,387,005 on BoBL for failing to maintain a functional Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) system.
The bank was also penalized for delays in filing Suspicious Transaction Reports, in violation of Section 7.3 of the AML/CFT Regulations 2025.
An additional penalty of Nu 9,072,468.81 was imposed for failure to report systemic issues, including multiple equated monthly instalment (EMI) debits and unauthorized account reversals that affected customers.
The central bank stated that these compliance failures reflected weaknesses in the bank’s internal monitoring systems and regulatory reporting mechanisms.
The investigation also examined the impact of the incident on customers. According to the RMA, multiple accounts were affected by irregular transactions during and after the system migration process. These included unauthorized deductions, erroneous credits, and temporary restrictions placed on accounts, including those of third-party recipients.
The regulator directed BoBL to conduct a comprehensive review of all affected accounts.It instructed the bank to restore access to customers not implicated in any wrongdoing and to provide compensation for direct losses and, where applicable, consequential damages.
The RMA further instructed the bank to strengthen its customer grievance redressal mechanisms to ensure timely resolution of complaints and improve transparency in customer communication.
The central bank’s findings highlighted significant deficiencies in BoBL’s governance structure and internal control systems.
According to the RMA, there were weaknesses in oversight during the system migration process, including inadequate risk assessment, insufficient testing of the new system, and poor coordination between management, technical teams, and external vendors.
The regulator noted that change management procedures were not effectively implemented, resulting in gaps in transaction validation, reconciliation processes, and monitoring of system performance during critical stages of the migration.
The RMA stated that such deficiencies exposed the institution to operational risks that ultimately affected customer accounts and financial integrity.
As part of the enforcement action, BoBL has been directed to implement immediate corrective measures.
These include strengthening transaction controls, improving monitoring systems, and enhancing reconciliation procedures to ensure accuracy in financial operations.
The bank has also been instructed to undertake an independent assessment to identify specific lapses in oversight, execution, and control. Based on the findings, the Board has been directed to take disciplinary action against individuals found responsible for the failures.
The RMA has further ordered a comprehensive review of the bank’s governance framework, IT systems, human resources, and vendor management practices.
This review will be conducted under the oversight of Druk Holding and Investments Limited (DHI), the majority shareholder of BoBL.
In addition to monetary penalties, the RMA has introduced prudential safeguards to strengthen the bank’s financial position.
BoBL has been directed to maintain 100 percent provisioning for an unrecovered amount of Nu 149,033,895.07 with immediate effect.
The bank has also been prohibited from declaring or distributing dividends for the financial year 2025.
The restriction is intended to ensure that financial resources are retained to support corrective actions and strengthen institutional stability.
The RMA has imposed strict supervisory controls on BoBL’s technology operations. The bank is prohibited from undertaking any changes, upgrades, or platform migrations to its critical IT systems until further notice.
The restriction will remain in place until the regulator is satisfied that appropriate governance structures, risk mitigation frameworks, and control mechanisms are established and functioning effectively.
BoBL is also required to provide advance notification and obtain regulatory approval for any material changes to its core banking or IT systems going forward.
The RMA has formally communicated with DHI in its capacity as the majority shareholder of BoBL.
The central bank has directed DHI to ensure that the bank’s Board fully complies with all regulatory directives issued in connection with the incident.
The regulator stated that strong and accountable governance at the Board level is essential for ensuring institutional stability, safeguarding depositor interests, and maintaining confidence in the banking system.
The RMA stated that it will continue to closely monitor BoBL’s compliance with the directives and the implementation of corrective measures.
It emphasized that full remediation of identified weaknesses is necessary to prevent recurrence of similar incidents.
The central bank said it reiterates its commitment to maintaining the stability and integrity of Bhutan’s financial system and ensuring that regulated institutions adhere to required standards of governance, risk management, and operational control.
