Risk Benchmarking
Welcome to Risk Benchmarking, a new research service scrutinising op risk practices at a range of financial institutions. Each quarter, we’ll share some of the findings from one of four cohorts – G-Sibs, other banks, asset managers and insurers, and FMIs.
Participants get to see all the data – message us for details: benchmarking@risk.net
XVA desks prioritise core tech upgrades over AI
Vendor upgrades, cloud-native rebuilds and sensitivities tooling dominate 2026 budget road maps
XVA desks target capital in optimisation runs
US regulatory uncertainty leaves banks cautious on investing in new optimisation tools, Risk Benchmarking study finds
Almost two-thirds of banks now run XVAs on cloud
Risk Benchmarking study finds a majority of big dealers tapping cloud capacity, some exclusively, with others migrating
Risk Benchmarking data
Most banks stick to tried-and-trusted XVA models
Black Scholes- and Heath-Jarrow-Morton-based approaches dominate, with some exploring Copulas for wrong-way risk, post-Archegos
XVA Benchmarking: explore the data
Take a deep dive into the findings of our 30-bank study, with interactive charts covering XVA optimisation, regulation and tech stacks
Explore the data
Two-speed FRTB
European banks are four times more likely to incorporate the Fundamental Review of the Trading Book into their XVA capital calculations versus their North American peers – reflecting the US’s continued delays in implementing Basel principles. The EU is set to go live in 2027 – but some of its banks are already factoring the potentially hefty portfolio impacts into calculations.
Take a deep dive into the findings of our 30-bank XVAs study, with interactive charts on optimisation, regulation and tech:
Enterprise risk
Fewer than half of banks rate their GRC vendor as ‘good’
Enterprise Risk Benchmarking study shows banks juggling multiple systems, adding costs and complexity
Most banks add ERM heads – but CROs keep control
Hiring tilts towards AI, cyber and model risk as enterprise risk’s remit grows faster than its reach
71% of banks automate escalation of appetite breaches
Automated processes are less common at banks where ERM sets overall risk appetite, research shows
North American banks outpace Europeans in ERM
New research shows US, Canadian banks have more developed enterprise risk management functions
Operational risk
Banks curb frequency of GRC vendor reviews
Data shows drop in plans to pitch or switch vendors, amid tighter third-party rules – but TPRM bucks the trend
In more than 90% of banks, second line tackles cyber risk
But some regulators would still like to see more 2 LoD risk staffing for infosec and IT disruption
Almost all banks mandate cyber security training
And unlike other risks, information security coaching moves the internal confidence dial
Regional banks favour scenario analysis over op risk modelling
Domestic and smaller regional players favour scenarios to gauge tail exposure; G-Sibs stick to modelling, for now
Top 10 Op risks
Top 10 op risks: AI arms race leaves risk teams playing catch-up
As firms invest for fear of being left behind, op risk managers urge caution on data, controls and access
Top 10 op risks: Why cyber risk looms larger than its losses
Fast-moving threat landscape and increased supplier concentration keep infosec top of the table
Top 10 op risks: For change management, the cloud is its own weather front
As lenders move legacy banking to the cloud, the risks of getting it wrong are exponentially greater
Top 10 operational risks for 2025
The biggest op risks as chosen by senior practitioners – and what they’re doing about them
XVAs
XVA desks prioritise core tech upgrades over AI
Vendor upgrades, cloud-native rebuilds and sensitivities tooling dominate 2026 budget road maps
XVA desks target capital in optimisation runs
US regulatory uncertainty leaves banks cautious on investing in new optimisation tools, Risk Benchmarking study finds
Almost two-thirds of banks now run XVAs on cloud
Risk Benchmarking study finds a majority of big dealers tapping cloud capacity, some exclusively, with others migrating
Most banks stick to tried-and-trusted XVA models
Black Scholes- and Heath-Jarrow-Morton-based approaches dominate, with some exploring Copulas for wrong-way risk, post-Archegos
