Safety Norms: Retail and Commercial Banking Operations

1Purpose, Scope, and Safety Principles

These norms protect customers, employees, the institution, and the wider financial system from harm arising from routine banking work. In this document, safety means preventing financial loss, unauthorized transactions, fraud, data breaches, unfair treatment of customers, unsafe working conditions, and regulatory violations. The scope covers deposit and account servicing, payment release, loan documentation and disbursement, cash and vault handling, general ledger reconciliation, customer onboarding, and back-office exception handling.

The core principles are simple. No single person should control a high-value transaction from start to finish. Every control has a named owner. Access is granted by business need and removed promptly when no longer needed. Suspicious activity is escalated, not resolved informally. No employee may bypass a control to meet a service target.

• Mandatory: every control must have a documented owner and procedure.
• Mandatory: staff must not bypass a control to meet a deadline or sales target.
• Recommended: review these principles with each new team member during onboarding.

2Roles, Competence, and Accountability

The board and senior management approve the risk appetite and the control framework. Line managers are accountable for daily control performance in their unit. Operations staff perform tasks only within their authorized limits. Compliance, risk management, internal audit, information security, and legal functions provide independent oversight and should not be asked to approve their own work.

Competence and authorization must be confirmed before work begins. Staff must complete role-specific training before receiving system access or transaction authority. Approval limits, signing authorities, and override rights must be recorded in writing and reviewed periodically. Temporary cover requires a documented authorization. Sharing credentials, or allowing another person to work under a colleague's login, is prohibited.

• Mandatory: no employee may approve a transaction, account, or exception in which they have a personal or family interest. Such conflicts must be declared and the item reassigned.
• Mandatory: every user must have a unique login. Shared accounts are not permitted for transaction processing.
• Mandatory: managers must remove access within the period set by policy when a person changes role or leaves.
• Recommended: maintain a current authority matrix that lists who may approve each transaction type and at what value.

3Course-Specific Hazards and Risk Assessment

Fraud is the most significant hazard. Common examples include account takeover through stolen credentials, business email compromise where a fake instruction changes a commercial client's payment details, check and card fraud, and synthetic identity applications. Operational errors are also common and costly. Examples include duplicate postings, payments sent to the wrong beneficiary, misapplied remittances, and reconciliations left unresolved. Insider misconduct includes unauthorized changes to customer records, skimming of funds, and collusion between staff and external parties.

Other hazards include cash shortages or counterfeit notes at tellers and vaults, robbery at branches, exposure of customer data on screens or in printed statements, sanctions or anti-money laundering failures, and customer harm such as vulnerable customers targeted by scams or unsuitable products sold without proper assessment. Staff also face physical hazards such as poorly configured workstations, repetitive strain, and stress from high-volume queues.

• High risk: any payment release, beneficiary or contact detail change, vault access, sanctions alert, or large cash movement.
• Medium risk: account opening exceptions, manual rate or fee adjustments, and reconciliation differences older than the defined aging threshold.
• Low risk: routine balance enquiries and standard statement requests, still subject to identity checks.
• Mandatory: each process owner must complete a documented risk assessment before the process goes live and after any significant system, staffing, or regulatory change.
• Recommended: rate likelihood and impact on a three-level scale, and record the controls that reduce each risk.

4Preventive Controls and Safe Work Practices

Segregation of duties, often called SoD, means that the person who creates or changes a record must not be the person who approves or releases it. This maker-checker separation applies to payments, account opening, interest rate changes, loan disbursements, and customer contact changes. For example, a teller who posts a cash deposit must not reconcile the same cash drawer, and a relationship manager must not approve a credit exception on a client they originated. Where staffing is too small for full separation, the institution must apply compensating controls, such as independent post-transaction review, and record the decision.

Dual control applies to high-value or irreversible actions. Commercial beneficiary changes, dormant account reactivation, and vault access require a second authorized person. Before changing payment or contact details, staff must verify the request through a call-back to a number already held on file, not to a number supplied in the request itself. Identity must be verified before discussing or changing any account. For commercial clients, signatories must be checked against the current board resolution or authority documents on file.

Payment controls must confirm beneficiary name, account, amount, purpose, and currency before release. New or changed payees should be held for out-of-band confirmation. Sanctions and fraud screening must clear before funds leave the institution. An alert may only be cleared with a documented reason and an approver who is independent of the originator.

Reconciliations must be completed on the defined schedule, covering ledgers, nostro accounts, suspense accounts, and cash positions. Unexplained differences must be aged, assigned, and escalated when they exceed policy thresholds. Differences must not be cleared to suspense or netted without approval. Exceptions and overrides must have a stated reason, a named approver, and an expiry date. Permanent overrides are not permitted.

• Mandatory: maker and checker must be different people for all payment releases and master data changes.
• Mandatory: verify changes to payment or contact details by call-back to details held on file before processing.
• Mandatory: sanctions and fraud alerts must be resolved and documented before release. Staff must not release a held item to avoid a complaint.
• Mandatory: do not discuss suspicious activity concerns with the customer where this is prohibited by law or internal policy.
• Mandatory: unexplained reconciliation differences above policy thresholds must be escalated to the designated owner.
• Recommended: use customer-facing scripts for scam warnings, especially for older customers and first-time payment recipients.
• Recommended: run a clean desk check at the end of each shift and lock workstations when leaving them.

5Systems, Environment, Information, and Protective Safeguards

Access management is the main technical safeguard. Role-based access should limit each user to the functions required for their job. Privileged access, such as system administration or master data override, should be granted only to named individuals and reviewed periodically. Multi-factor authentication should be required for remote access and for any privileged or high-value function, as configured by information security. Passwords must not be written on sticky notes or stored in unprotected files.

Information must be classified and handled according to its sensitivity. Customer account data, identity documents, and credit files are confidential. They may be shared only on a need-to-know basis. Test environments should use masked or synthetic data. Customer information must not be sent through personal email, consumer messaging applications, or unapproved cloud storage. Printed material containing personal or financial data must be shredded or placed in locked secure disposal bins.

The physical environment requires specific safeguards. Teller and cash areas should use approved cash limits, dual custody for vault access, and surveillance and alarms as required by local policy. Workstations in customer-facing areas should use privacy screens or be positioned to prevent viewing by customers. Ergonomic workstation setup, adequate breaks, and cleaning of shared cash counters and keyboards reduce physical strain and contamination risks. Protective equipment in this context means controls such as badges, tamper-evident cash bags, and secure storage rather than personal protective garments.

• Mandatory: no customer data may be stored on personal devices or sent through personal accounts.
• Mandatory: remove or revoke access for staff on leave, transferred, or separated, as soon as the change is approved.
• Recommended: use tamper-evident bags and sealed transfer procedures for cash movements between branches and vaults.
• Recommended: follow local ergonomics guidance for workstation height, screen position, and break intervals.
• Jurisdiction-dependent: cash handling limits, surveillance rules, and data protection requirements must be confirmed with the relevant authorities and compliance.

6Incident Reporting, Escalation, and Emergency Response

Any suspected fraud, loss, data exposure, sanctions or suspicious activity indicator, cash discrepancy, payment system outage, robbery, threat, or near miss must be reported immediately to the designated supervisor and the relevant specialist function. Do not attempt a private investigation, confront a customer, or alter records to hide an error. Preserve evidence such as emails, call logs, screenshots, and transaction references, and stop further processing of the affected item until instructed.

Suspicious activity should be escalated to the designated anti-money laundering or compliance officer using the internal reporting channel. Reporting timelines and filing obligations are jurisdiction-dependent and must be verified with compliance. Data breaches must be reported to information security and the privacy officer without delay so that legal notification duties can be assessed. In a robbery or violent situation, the priority is personal safety. Staff should follow the branch robbery procedure, comply with instructions, avoid resistance, activate the alarm only if safe, and call emergency services as soon as it is possible to do so. Staff should not rely on this document as a substitute for formal emergency training and the local emergency plan.

• Mandatory: report suspected fraud or suspicious activity to the designated officer within the internal timeline set by policy.
• Mandatory: do not tip off customers where suspicious activity reporting restrictions apply.
• Mandatory: log every near miss, even when no loss occurred, so trends can be reviewed.
• Recommended: hold a short incident debrief within an agreed period and record corrective actions with owners.
• Recommended: include contact details for security, compliance, privacy, and emergency services in each branch and operations area.

7Records, Training, Inspection, and Review

Records must be complete, accurate, and contemporaneous. Approval evidence, access reviews, exception logs, reconciliations, training completion, incident reports, and corrective action plans must be retained. Corrections must be made through attributed, explained entries. Original records must not be erased or overwritten. Retention periods are set by law and internal policy and must be verified locally.

Training must be delivered before access is granted and refreshed periodically. Scenario-based sessions on payment fraud, business email compromise, cash discrepancies, and robbery response are recommended, because they test decisions rather than memory. Supervisors should carry out daily spot checks of exceptions, overrides, and reconciliations. Internal audit or independent quality reviewers should test controls on a periodic basis. Metrics such as exception volume, aged reconciling items, fraud losses, access review completion, and incident closure times should be reported to management. These norms must be updated when regulations, systems, or incident patterns change.

• Mandatory: maintain training and authorization records for every person with transaction or data access.
• Mandatory: complete access reviews and remove unnecessary entitlements on the schedule set by policy.
• Recommended: hold post-incident reviews and update procedures based on root cause rather than individual blame.
• Recommended: test branch and operations response plans through drills that include fraud and emergency scenarios.

Implementation checklist

• Confirm that every payment release and master data change has a separate maker and checker.
• Verify customer identity and commercial signatory authority before any account change.
• Confirm payment or contact changes by call-back to details already held on file.
• Resolve and document sanctions and fraud alerts before releasing held items.
• Complete daily reconciliations and escalate aged or unexplained differences to the owner.
• Lock workstations, protect customer data from view, and complete a clean desk check.
• Report suspected fraud, suspicious activity, data exposure, or near misses to the designated officer immediately.
• Do not tip off customers where suspicious activity restrictions apply.
• Confirm your training and access authorization are current before performing transaction work.
• Record every exception with a reason, named approver, and expiry.