Enterprise risk management for banks is the practice of identifying, measuring, and controlling every material threat to a bank’s financial health through a single coordinated framework, rather than letting each department manage its own risks in isolation. Banks operate under this integrated approach because they hold public deposits, run with significant leverage, and are interconnected enough that one institution’s failure can destabilize the broader financial system. That combination of public trust and systemic importance is why regulators impose detailed requirements on how banks govern, measure, and report risk. The framework reaches from the boardroom down to the models a trading desk uses to price a loan portfolio.
Who Runs Risk Management Inside a Bank
A bank’s risk framework is only as strong as the governance structure behind it. Responsibility is layered deliberately, and each layer is designed to check the one before it.
The Board and Its Risk Committee
At the top sits the board of directors, which sets the bank’s risk appetite — the overall level and types of risk the institution is willing to take on in pursuit of its strategy. Federal regulations require covered bank holding companies to maintain a dedicated risk committee of the board whose sole function is overseeing the global risk management framework. That committee operates under a written charter, meets at least quarterly, and reports directly to the full board.1eCFR. 12 CFR 252.22
Independence requirements are specific. The risk committee must be chaired by a director who is not an officer or employee of the bank and has not been one in the prior three years. At least one member must have direct experience managing risk exposures at large, complex financial firms.1eCFR. 12 CFR 252.22 The OCC’s heightened standards for large national banks reinforce this by requiring at least two independent directors on the board and active board oversight of the risk governance framework and risk appetite statement.2Federal Register. OCC Guidelines Establishing Heightened Standards for Certain Large Insured National Banks
The Chief Risk Officer
The chief risk officer is the most senior executive dedicated to the risk function. Under Regulation YY, the CRO reports directly to both the risk committee and the CEO, a dual line that preserves independence from the business side while keeping day-to-day access to senior management.1eCFR. 12 CFR 252.22 The CRO’s team designs the framework, writes risk policies, and monitors whether business units are operating within approved limits. Material issues or noncompliance get escalated to the CEO, the board, or the risk committee depending on severity.
The Three Lines Model
Most banks organize oversight using what the Institute of Internal Auditors calls the Three Lines Model. The first line is the business units themselves. The people originating loans, running trading desks, and handling operations own the risks in their activities and are responsible for managing them daily. The second line is the independent risk management and compliance function led by the CRO. This group develops policies, sets limits, and monitors whether the first line stays within bounds. The third line is internal audit, which provides independent assurance to the board that the first two lines are actually working as designed.3The Institute of Internal Auditors. The IIA’s Three Lines Model
The structure works because it creates deliberate tension. The first line wants to generate revenue. The second line’s job is to say “not that way” when limits are in danger. The third line checks whether the second line is actually doing that job or just rubber-stamping business decisions. When this structure breaks down, examiners notice quickly.
The Risks the Framework Has to Cover
Banks face a broad set of risks that interact with each other in ways that make isolated management impractical. The ERM framework groups them into categories so they can be measured, monitored, and reported in a structured way. Terminology varies slightly across institutions, but the core categories are consistent.
Credit Risk
Credit risk is the most fundamental threat for any bank: the possibility that a borrower fails to repay a loan or meet another obligation. A single large default or a wave of smaller ones can erode capital quickly. Banks manage credit risk through underwriting standards that evaluate borrower creditworthiness before extending credit, concentration limits that prevent overexposure to any single borrower or industry, and ongoing portfolio monitoring that flags deteriorating loans before losses crystallize.
Market Risk
Market risk arises when changes in interest rates, foreign exchange rates, equity prices, or commodity prices move the value of a bank’s assets and liabilities. Interest rate risk is the most pervasive form for traditional banks because mismatches between the duration of loans and deposits create significant exposure when rates shift. Currency risk affects institutions with international operations, and equity price risk matters for banks with investment portfolios or trading desks.
Liquidity Risk
A bank can be solvent on paper and still fail if it cannot meet short-term cash obligations. Liquidity risk takes two forms: funding liquidity risk, where the bank cannot raise cash at a reasonable cost, and market liquidity risk, where assets cannot be sold quickly without a steep discount. The Basel Committee requires banks to maintain a liquidity coverage ratio of at least 100% in normal times, ensuring they hold enough high-quality liquid assets to survive a 30-day stress scenario.4Bank for International Settlements. Basel III: The Liquidity Coverage Ratio and Liquidity Risk Monitoring Tools
Operational Risk
Operational risk captures losses from failed internal processes, human error, system breakdowns, and external events. This is the broadest category and includes everything from a data entry mistake that misprices a trade to a cyberattack that takes down core banking systems. Under the final Basel III reforms, the Basel Committee replaced the older advanced measurement approaches with a single standardized approach that calculates operational risk capital based on a bank’s income and its historical loss experience.5Bank for International Settlements. OPE25 – Standardised Approach
Model Risk
Banks rely heavily on quantitative models for credit scoring, asset pricing, capital calculations, and stress testing. Model risk is the potential for bad outcomes when decisions rest on incorrect or misused model outputs. The Federal Reserve’s supervisory guidance on model risk management establishes that every material model should go through validation with three core elements: evaluation of the model’s conceptual soundness, ongoing monitoring including benchmarking against alternatives, and outcomes analysis such as back-testing predictions against actual results.6Federal Reserve. Guidance on Model Risk Management (SR 11-7) Banks that underinvest in validation tend to accumulate supervisory findings quickly, because examiners treat model governance as a leading indicator of broader risk management quality.
Compliance and Legal Risk
Compliance risk comes from violating laws, regulations, or internal policies. Consequences range from enforcement actions and fines to mandatory operational restrictions. One of the most heavily examined areas is anti-money laundering. The Bank Secrecy Act requires every bank to maintain a BSA/AML compliance program, file suspicious activity reports when it detects potential criminal activity or money laundering, and run customer due diligence to understand who it is doing business with.7Federal Deposit Insurance Corporation. Bank Secrecy Act / Anti-Money Laundering (BSA/AML) AML failures are among the most common triggers for consent orders and civil money penalties.
Strategic Risk
Strategic risk results from poor business decisions, failure to adapt to industry changes, or entering markets where the bank lacks expertise. It operates on a longer time horizon than most other categories and is harder to quantify. A bank that overexpands into commercial real estate without adequate underwriting infrastructure, or that ignores the competitive threat from fintech challengers, is taking on strategic risk. The board’s oversight role is most directly engaged here, because strategic risk is where business strategy and risk appetite intersect.
The Rules That Shape the Framework
Banks do not design their risk programs from scratch. International standards and domestic regulations impose detailed structural requirements on capital adequacy, liquidity, stress testing, and resolution planning. These frameworks define the floor below which no bank’s risk management can fall.
Basel
The Basel Committee on Banking Supervision is the primary global standard-setter for bank regulation.8Bank for International Settlements. Basel Committee on Banking Supervision – Overview Its framework operates through three pillars: minimum capital requirements for credit, market, and operational risk; a supervisory review process that requires banks to assess their own capital adequacy across all material risks; and public disclosure requirements meant to promote market discipline.9Bank for International Settlements. The Basel Framework The self-assessment piece, known as the Internal Capital Adequacy Assessment Process, forces institutions to connect their ERM findings directly to capital planning.
The final set of Basel III reforms, often called the Basel III endgame in the United States, has had a prolonged implementation timeline. As of early 2026, the Federal Reserve is still working on a re-proposal of the U.S. rules, with a potential implementation date no earlier than 2028. Among the most significant changes is the shift from Value-at-Risk to expected shortfall for market risk capital calculations, which better captures losses in the tail of the distribution.
Stress Testing and the Stress Capital Buffer
The Federal Reserve conducts annual stress tests for large firms to assess whether they can maintain adequate capital under severely adverse economic conditions.10Federal Reserve. Comprehensive Capital Analysis and Review and Dodd-Frank Act Stress Tests: Questions and Answers The results feed directly into each firm’s stress capital buffer requirement, which equals the greater of 2.5% or the difference between the firm’s starting capital ratio and its lowest projected ratio under the stress scenario, plus planned dividends during the stress period.11eCFR. 12 CFR 225.8 – Capital Planning and Stress Capital Buffer A bank that performs poorly under stress gets a higher buffer, which directly restricts its ability to pay dividends or repurchase shares.
In late 2025, the Federal Reserve proposed changes to improve transparency and public accountability of the stress test models and scenarios, with a comment period extending into early 2026.12Federal Reserve. Dodd-Frank Act Stress Tests 2026 The tests remain annual, but methodology and disclosure requirements continue to be refined.
Resolution Planning
Large banks must submit resolution plans, commonly called living wills, that describe how the institution could be wound down in an orderly fashion without taxpayer bailouts or broader financial disruption. The largest, most complex firms file every two years. Other large domestic and foreign banking organizations file every three years, and a third group submits abbreviated plans on a three-year cycle.13Federal Reserve. Living Wills (or Resolution Plans) The plans must identify critical operations, material entities, major funding sources, key management information systems, and the overall resolution strategy. The exercise forces banks to understand their own complexity in a way routine operations never require.
Tailoring by Size
Not every bank faces the same regulatory burden. Federal regulators sort bank holding companies into four categories based on size, complexity, and risk indicators like cross-jurisdictional activity and short-term wholesale funding:
- Category I applies to U.S. global systemically important banks, subject to the most stringent requirements with no relief.
- Category II covers firms with $700 billion or more in total assets, or $75 billion or more in cross-jurisdictional activity. Capital and liquidity requirements remain at full strength, including the full 100% liquidity coverage ratio.
- Category III covers firms with $250 billion or more in total assets, or $75 billion or more in certain risk indicators. These firms receive some tailoring, including reduced liquidity requirements if they do not rely heavily on short-term wholesale funding.
- Category IV covers firms with $100 billion or more in total assets that do not meet higher-category criteria. These firms see the most significant reduction in compliance burden.
Below $250 billion, banks are exempt from mandatory company-run stress testing after the threshold was raised from $10 billion under the Economic Growth, Regulatory Relief, and Consumer Protection Act.15Office of the Comptroller of the Currency. Amendments to the Stress Testing Rule for National Banks and Federal Savings Associations: Final Rule Community banks face far fewer prescriptive ERM requirements, though regulators still expect sound risk management practices proportional to the institution’s size and complexity.
Newer Risks Now Inside the Framework
The risk landscape does not stand still. Several categories that barely appeared in ERM frameworks a decade ago now command significant regulatory attention and board-level resources.
Climate-Related Financial Risk
Climate risk enters bank portfolios through two channels. Physical risks are the direct financial harm from events like hurricanes, wildfires, and floods, as well as chronic shifts such as sea level rise. Transition risks are the financial stresses that arise from policy changes, shifting consumer preferences, and new technologies associated with moving toward a lower-carbon economy. The OCC’s climate risk management principles, which apply to financial institutions with more than $100 billion in total assets, require these banks to identify, measure, monitor, and control both types of climate risk as part of maintaining safety and soundness.16Office of the Comptroller of the Currency. Risk Management: Principles for Climate-Related Financial Risk Management for Large Financial Institutions
The Federal Reserve conducted a pilot climate scenario analysis exercise with six of the largest banks, testing physical risk impacts on real estate portfolios under varying hazard severities and transition risk impacts on corporate loan portfolios over a ten-year horizon using scenarios from the Network for Greening the Financial System.17Federal Reserve. Overview of the Pilot Climate Scenario Analysis Exercise These exercises are not yet formal requirements, but they signal the direction regulators are heading.
Third-Party Risk
Banks increasingly rely on outside vendors for core functions like cloud computing, payment processing, and cybersecurity monitoring. The 2023 interagency guidance from the OCC, Federal Reserve, and FDIC requires banks to manage third-party relationships through a full life cycle: planning before entering the relationship, conducting due diligence on the vendor, negotiating contracts that address risk management needs, monitoring performance throughout the relationship, and managing termination when the arrangement ends.18Federal Register. Interagency Guidance on Third-Party Relationships: Risk Management The board holds ultimate oversight responsibility, and the guidance explicitly states that outsourcing an activity does not outsource the risk. A vendor failure that disrupts customer-facing services is the bank’s problem in the eyes of regulators.
Operational Resilience
Operational resilience goes beyond traditional business continuity planning. It asks not just whether the bank can recover from a disruption but whether critical operations can keep functioning through one. Interagency sound practices require large firms to identify critical operations and core business lines, map the interconnections and dependencies among them including third-party dependencies, and design severe but plausible scenarios to test their tolerance for disruption.19Office of the Comptroller of the Currency. Sound Practices to Strengthen Operational Resilience Banks are expected to use scenario testing and back-testing against past disruptions to continuously refine those capabilities.
How Risk Actually Gets Measured
Measurement is where the framework moves from policy documents into daily operations. The challenge is translating qualitative risk categories into numbers the board and regulators can act on.
Value-at-Risk and Expected Shortfall
Value-at-Risk has been the standard market risk metric for decades. A 99% daily VaR of $50 million means there is a 1% probability that the portfolio will lose more than $50 million in a single day. The number is easy to communicate but has a well-known blind spot: it tells you nothing about how bad losses get once you cross the threshold. A portfolio with a $50 million VaR could have a worst-case loss of $55 million or $500 million, and VaR would report the same number for both.
That limitation is why the Basel Committee’s revised market risk framework replaces VaR with expected shortfall for capital calculations. Expected shortfall measures the average loss in the worst scenarios beyond the confidence threshold, giving a more complete picture of tail risk. U.S. implementation of this change is tied to the Basel III endgame timeline, which remains in flux.
Stress Testing and Scenario Analysis
Stress tests apply severe but plausible economic shocks across all risk categories simultaneously, measuring whether the bank’s capital holds up. Regulatory stress tests use standardized scenarios defined by the Federal Reserve, while banks also run internal stress tests using their own scenarios tailored to their specific exposures. Scenario analysis is a more flexible cousin. It examines the impact of specific events like a major counterparty default, a cyberattack on critical infrastructure, or a sudden shift in interest rates, without requiring the full macroeconomic modeling of a formal stress test. Both tools are forward-looking and focus on whether the bank can survive conditions it has not yet experienced.
Risk Appetite Statements and Key Risk Indicators
The board’s risk tolerance is formalized in a risk appetite statement, a document that translates strategic goals into measurable limits. A well-constructed statement sets quantitative boundaries like maximum credit concentration in any single industry, minimum liquidity coverage ratios, and maximum tolerance for operational losses. Management uses those boundaries to set operating limits for individual business units.
Key risk indicators are the metrics that track whether the bank is approaching those limits. A KRI for operational risk might track the number of failed transactions per day or the volume of unresolved cybersecurity alerts. Their value is that they provide early warning before a formal limit breach occurs, giving management time to adjust rather than react. When a KRI trends toward a threshold, the second line of defense escalates the issue before it becomes a crisis.
Risk Data Aggregation
None of these measurement tools work if the underlying data is unreliable. The Basel Committee’s Principles for Effective Risk Data Aggregation require systemically important banks to maintain data architecture that supports accurate, complete, and timely risk reporting in both normal and stressed conditions. Banks must be able to aggregate risk data across business lines, legal entities, asset types, and geographies on a largely automated basis to minimize errors.20Bank for International Settlements. Principles for Effective Risk Data Aggregation and Risk Reporting Aggregation capabilities must also be adaptable enough to handle ad hoc reporting requests during a crisis, which is where many banks still fall short. Compliance with these standards has been a persistent challenge even for the largest global banks, and regulators have repeatedly flagged slow progress.
What Happens When Risk Management Falls Short
Banks that fall short of regulatory expectations face a graduated escalation process. Examiners do not jump straight to public enforcement. The process starts with supervisory findings and builds from there, giving institutions a window to correct problems before consequences become severe.
Supervisory Findings
When Federal Reserve examiners identify weaknesses, they issue Matters Requiring Attention or, for more significant issues, Matters Requiring Immediate Attention. An MRA requires the bank to address weaknesses that could lead to deterioration in safety and soundness. An MRIA demands immediate corrective action on a priority basis for issues that are more urgent or have gone unresolved.21Federal Reserve. How Federal Reserve Supervisors Do Their Jobs Management is responsible for fixing the problems, and examiners evaluate whether the fixes are adequate. If a bank fails to resolve its MRAs and MRIAs, examiners build a case for formal enforcement.
Formal Enforcement
The OCC and other banking regulators use several types of formal enforcement actions to compel compliance. Consent orders require the bank to take specific corrective steps under a legally binding agreement. Formal agreements serve a similar function. For individual officers and directors, an order of prohibition can permanently bar a person from participating in the affairs of any bank.22Office of the Comptroller of the Currency. OCC Announces Enforcement Actions for March 2026 Enforcement actions are public, and the reputational damage often exceeds the direct financial penalty. A consent order signals to the market, to counterparties, and to customers that the institution has serious governance or risk management deficiencies. Termination of an enforcement action requires the bank to demonstrate full compliance with every article, a process that routinely takes years.
The practical lesson is that risk management failures compound. A missed model validation leads to an MRA. An unresolved MRA becomes an MRIA. Persistent MRIAs attract a consent order. A consent order constrains the bank’s ability to grow, acquire, or distribute capital until the underlying problems are fixed. Banks that treat enterprise risk management as a compliance exercise rather than a core business function tend to learn this progression the hard way.