Top 10 operational risks for 2024

The biggest op risks for the year ahead, as chosen by senior industry practitioners

Welcome to the 2024 edition of the Top 10 Op Risks. This year’s survey enjoyed a record participation rate: 81 firms took part, a high watermark in the near two decades Risk.net has been running the poll. More than half were banks, but a record number of institutional investors and financial market infrastructures are represented too, with separate rankings produced for each. 

The core methodology used to rank participants’ choices remains unchanged: respondents are asked to list their five most pressing op risk concerns for the year ahead, which are then weighted and aggregated (jump to methodology).

We have once again produced a risk score for every category, designed to show the direction of travel for each: whether a risk manager believes it to be on the rise, for the industry, as well as their firm; whether they expect this trend to continue; and whether their own loss exposure has changed in the past 12 months.

 

In addition, for several risks, insights from our sister service Op Risk Benchmarking are included for the first time. These are derived from follow-up surveys that ran during 2023: each cohort of respondents was asked detailed questions on the top five risks as chosen by their peers, focused on the frameworks used for managing each and approaches to measuring them.

The Op Risk Benchmarking service is running again this year; if you’d like to get involved, please email us.

In addition, Risk.net will once again produce deep dives on three of the key risks highlighted by this year’s survey: cyber and third-party risk; change management and external fraud. Check back here for full coverage in the coming days.

Reporting by Tom Osborn, Luke Clancy, Paulina Pielichata and Natacha Maurin. Data-gathering by Tom Osborn and Michael Paterakis. Editing and production by Alex Krohn, Jon Lloyd and Jennifer Delaney.

Jump to category

1. Information security | 2. IT disruption  | 3. Third-party risk  | 4. Regulatory compliance | 5. Change management | 6. Resilience risk | 7. Geopolitical risk | 8. Execution & process errors  | 9. External fraud | 10. Conduct risk

1. Information security

Two major ransomware attacks bookended 2023: against Ion Group, the world’s largest provider of trading connectivity in February, then the US clearing arm of Industrial and Commercial Bank of China, the world’s largest bank in October.

Both were among a series of 71 successful attacks claimed by the same group of hackers, LockBit, last year alone – swelling a war chest of payouts US authorities say already tops at least $120 million. Each could have been avoided, senior op risk managers contend, through better cyber hygiene.

Like many of LockBit’s most lucrative hacks, both exploited known vulnerabilities in commonly used software – flaws that sizeable institutions should have been aware of through basic inventory management and routine patching, bank cyber experts argue, with one calling the failure to do so by a global systemically important bank (G-Sib) “negligent”.

$300 billion

The industry’s estimated annual cyber security spend

Bank senior management pay particular attention to high-profile cyber incidents at peer firms, says a senior op risk manager at one US G-Sib. Such incidents raise fears of “reputational damage, as well as a real risk of direct losses or ransom demands”, even without any change in the bank’s own external threat drivers. The ICBC attack exploited a software flaw in a common server utility. “It appears that ICBC did not diligently maintain their software to avoid a vulnerability,” says the op risk manager.

ICBC did not respond to a request for comment.

Banks typically respond to news of major cyber attacks at rival firms by reviewing their exposure monitoring and threat measurement, and reassessing frameworks and personnel accordingly, the op risk manager adds.

Even if most hacks still rely on well-established methods and exploit routine failings, artificial intelligence is cited by many respondents as exacerbating the fear factor. The influence of AI has helped push information security to top spot in this year’s poll by a record margin: of the more than 80 major banks and financial services firms that took part – the most since the survey’s inception – 22 cited cyber-led information security risk as their top concern and 16 as their second-top. Artificial intelligence was cited as an aggravating factor for many of this year’s top 10 operational risks.

“There is likely to be some changes to this risk as generative AI becomes more sophisticated,” says the head of op risk at one European insurer. 

Findings from Risk.net’s sister service, Op Risk Benchmarking, suggest firms are already changing their risk management practices, switching vendors and inviting more frequent pitches in a bid to stay ahead of the curve. One recent estimate put the industry’s annual cyber security spend at $300 billion.

 

Even though many breaches are still thought to go unreported, especially those stemming from ransomware attacks, respondents say loss exposure is ticking up: for each risk cited in this year’s survey, participants were asked a series of follow-up questions, one of which was whether aggregate losses have increased in the preceding 12 months. Four participants said losses had increased significantly, and seven somewhat – giving an overall risk score of 0.3 on the Likert scale built from response data, up from flat last year (jump to methodology).

This is borne out by public data: in the first month of this year, more than one in 10 publicly reported losses recorded by ORX News was a cyber-related incident. Recent moves from regulators, such as the US Securities and Exchange Commission’s decision to tighten cyber incident disclosure rules, should help to increase information on attacks. 

Firms found guilty of basic failings can expect regulators to take an interventionist stance too. In January, broker Genesis Global Trading lost its licence and was fined $8 million by the New York Department of Financial Services, in part owing to its failure to conduct a thorough cyber risk assessment, and correct known deficiencies in its systems and network monitoring, disaster recovery planning and vendor management.

However, regulators were criticised last year for their own cyber hygiene – not for the first time – after inspectors found shortcomings in the Federal Deposit Insurance Corporation’s information security management in October.

The geopolitical environment is further exacerbating information security risk, with high-profile incidents impacting public targets, respondents say. In late March, the UK government sanctioned individuals with links to suspected Chinese state-sponsored hacking of UK parliamentarians. 

The fear is not confined to the largest global operators – the head of op risk measurement at one US super-regional cites “increasing risk exposure, [with] technological advances for sophisticated threat actors, including AI and other emerging technologies, geopolitical tensions [and] attacks on supply chain and third parties”. 

The head of one European regional bank adds: “With the geopolitical environment as it is, the risk of the bank’s information being manipulated, stolen, or used in ways in which it was not intended has increased. Added to this is the increase in use of AI, which heightens the exposure further.”

---

2. IT disruption

As in previous years, our survey subdivides cyber risk into three rough camps: information security; cyber-led IT disruption; and theft of funds (which polled at fourteenth place). It’s not a clean split – all overlap among themselves and with other risks in the top 10, which frequently share common external threat actors.

Nor is it a distinction that all firms make. One US financial market infrastructure lumps together infosec and IT disruption, on the basis that attempts by bad actors to ransom businesses can also result in loss of service, argues the firm’s chief risk officer.

Still, many firms choose to cite it individually – partly with a focus on outcomes and differing risk measurement and mitigation practices, rather than threat exposure. Losses resulting from a cyber-induced outage such as a denial of service attack can be far more damaging, many point out – especially for undiversified domestic lenders, whose sole business is serving retail customers. Regional and domestic banks – the largest cohort in this year’s ranking – voted IT disruption a narrow second in their responses.

Reported losses have not increased, but with more focus on ‘making the bank digital’, there is increased exposure

Senior op risk manager at a European bank

As many op risk managers point out, payments to ransomware firms and compensation to customers can be quantified, and insured against; but even where a firm has an increasingly pricey business interruption policy, the opportunity costs from lost business in the immediate term and reputational damage in the longer term can't be mitigated in the same way. 

“The risk of disruption to IT systems, rather than theft of funds or ransom demands is the bigger impact, if customers cannot access bank systems,” one senior op risk manager at a European bank says. “Reported losses have not increased, but with more focus on ‘making the bank digital’, there is increased exposure.” 

Many see the trend continuing. Asked whether they expected IT disruption to become a bigger risk for the industry over the next 12 months, nine respondents said they expect it to increase significantly, and 21 somewhat, giving an overall risk score of 1.1 on the Likert scale built from responses – a higher forward-looking indicator than for any category except geopolitical risk. 

Even where disclosed losses remain low, the number of near misses (which many firms do not quantify) also have knock-on effects for internal risk prioritisation, framework reviews and resource allocation, as well as opportunity costs for areas that risk being neglected.

 

“Despite the absence of significant losses attributed to these risk events so far, the increased potential for disruption has necessitated the allocation of substantial resources,” says the chief risk officer of one European bank. 

Regulators are also paying closer attention: in the most recent Op Risk Benchmarking survey, two-thirds of regional and domestic banks said their regulator had shown an increased focus on IT disruption over the preceding 12 months. A majority said they had then been subject to enhanced reporting, and a plurality to closer monitoring. One bank said it had been asked to hold more capital against this risk type, as well as making additional Pillar 3 disclosures.

Critically aware of their role as potential magnifiers of systemic stress, FMI respondents ranked IT disruption as their top threat this year. 

“Events in the industry – Ion, ICBC – have made this hit close to home,” says the head of op risk at one US financial market infrastructure. “It was always a risk, but it seems to be manifesting a bit more.”

That’s even before many FMIs get pulled into the regulatory dragnet relating to third-party risk management, in the form of the EU’s Digital Operational Resilience Act and the UK’s operational resilience regime, the latter of which enters full force in 12 months’ time. 

---

3. Third-party risk

Coming scarcely 12 months after the hack of Ion Group, January’s ransomware attack on EquiLend, the largest securities lending platform, sparked panic in global equities markets among buy- and sell-side firms, disrupting trade reporting and prompting regulators to temporarily relax compliance obligations. 

It also forced firms to confront a harsh new reality: the compounding effect of multiple risks spanning cyber and critical third parties. Coupled with far-reaching new regulations on both sides of the Atlantic that threaten to dramatically expand that definition, and it’s not hard to see why firms of all stripes voted third-party risk management at a fresh high of third place in this year’s Top 10 op risks. 

“There has been a trend where threat actors commit cyber attacks on third parties that centrally warehouse several institutions’ data,” says a senior risk manager at one of the largest US insurers. “It is often easier than successfully attacking the larger institutions themselves. Additionally, there is increased reliance on third parties, making the threat landscape even larger.”

The tools that are available today are not efficient. They need upgrading across the global industry

Oliver Huggins, MarketAxess

Adrian Munday, group head of non-financial risk management at Deutsche Bank, sees recent industry cyber events highlighting the “nexus” between information security, IT disruption and third-party risks: “This is providing a further spotlight for the industry to look at those risks and reflect on exactly how we manage them more effectively.” 

The connection between risks affects how the industry manages them. Munday says banks are being forced to look with more granularity around assets deployed, understanding the risks that third parties linked to the most critical applications are exposed to, and assessing the effectiveness of their controls.

“This risk profile for all banks requires drilling down into individual applications and defining risk appetite at that level for our most critical resources,” he says. “This ultimately enables a view through the lens of client impact.”

Regulators’ belated moves towards codifying due diligence expectations are clearly a driver for many firms. But many hope monolithic regulations such as the EU’s Digital Operational Resilience Act should at least aid scrutiny of major tech providers, and help firms to triage the layers of due diligence they need to apply to vendors.

Staffan Hansson, senior cyber risk manager at SEB, believes Dora will help in targeting the big cloud service providers, as a register of third parties running critical or important functions for the financial sector will be reported to authorities who can then identify concentration risks as part of the digital supply chain to the financial sector.

Dora will also require financial institutions to seek contractual arrangements with EU legal entities rather than foreign firms. “Our regulators cannot supervise legal entities outside of the EU, so we need to shift and have a renegotiation,” Hansson says.

 

Due diligence practices also need to evolve, many argue. Oliver Huggins, chief risk officer at trading platform MarketAxess, says existing “onerous” methods of due diligence on third parties provide “low comfort” given the amount of effort required. 

“The tools that are available today are not efficient. They need upgrading across the global industry,” he says.

Some of the best-resourced firms have begun scrutinising the attestation processes of critical third-party vendors, verifying that they have deployed patches when they say they have. 

The growing reliance on a handful of cloud providers to provide core services is also occupying the official sector, as a recent ECB report on bank outsourcing practices highlighted.

“Concentration risk is growing with vendors, given heightened vendor requirements that leaves financial institutions with fewer options,” says the head of enterprise and technology risk at one US superregional.

---

4. Regulatory compliance

When it comes to staying on the right side of compliance expectations, what firms most dislike from regulators – perhaps more than fines – is inconsistency. 

As Risk.net reported in October, compliance officers in the US say they have seen a sharp uptick in the use of ‘matters requiring attention’ or MRA notices from supervisors, in the wake of the failure of Silicon Valley Bank and its smaller peer Signature Bank – something many see as a knee-jerk response to accusations of regulatory shortcomings. 

One op risk quant at a US superregional describes a “rapidly shifting regulatory landscape and divergence in global regulatory focus and expectations”. 

They add: “Exposure has increased due to increased regulatory scrutiny after the SVB failure. The risk has manifested itself for our institution through various remediation efforts.”

Related

Top 10 operational risks for 2023 

That’s even before prudential watchdogs review the scope of liquidity risk, bank resolution and stress-testing frameworks in the wake of the twin failures, with a keenness not to let a crisis go to waste.

Though regulatory risk has slipped a couple of places in this year’s poll, firms say their exposure to compliance breaches has increased compared with 12 months ago, giving a joint-third highest risk rating of 0.8 on the Likert scale constructed from responses. 

The aggregate dip in fines from 2022 – the year of industry-wide penalties for regulated front-office staff’s use of private messaging platforms such as WhatsApp – may be short-lived. At time of publication, JP Morgan was whacked with $350 million in fines for gaps in its trade surveillance data. Another respondent mentions an ongoing regulatory reporting dispute with authorities. 

Such actions are no longer confined to US and European regulators: two banks in Asia say regulators are taking an increasingly interventionist stance for run-of-the-mill rule breaches. 

“Most regulatory changes are now coming in the area of conduct,” says the chief risk officer at one. “The changes imply moving goalposts and ex-post standard setting, with strong reputational implications.”

Other executives cited sanctions breaches as an area of concern, as western governments intensify trade restrictions on countries such as Iran and Russia. The US currently has sanctions programmes in place against 25 countries, as well as 12,000 named individuals, for example.

“Sanctions are increasing around the world, and while exposure to specific countries can be reduced for particular financial service organisations, on aggregate, losses are expected to increase,” says a senior risk manager at another European G-Sib.

The long tail of conduct losses  continues to slither: a number of UK banks have already begun provisioning for losses linked to legacy claims around motor financing provision – some dating back to the financial crisis. Depending on the scope of regulators’ investigation, some analysts expect the final tally to run into double-digit billions of pounds. 

While exposure to specific countries can be reduced for particular financial service organisations, on aggregate, losses are expected to increase

Senior risk manager at a European G-Sib

New regulations bring new compliance headaches. Many cite the broad scope of the UK’s incoming operational resilience framework – under which firms will be held to specified impact tolerances from 12 months’ time – as one ruleset with the potential for clear pass/fail penalties governing risks that may lie outside a firm’s direct control.

“Increased digital and operational resilience regulations will provide significant changes – it will also generate losses when regulators start being allowed by governments to fine and enforce the regulations,” says the chief risk officer of one securities firm. 

Watchdogs are also trying to keep pace by crafting new rules on the risk management and governance of artificial intelligence – but duplication and overlaps with existing rules around information security and model governance threaten new compliance headaches for banks, as well as the potential for regulatory competition on standards. 

“[We face a] big challenge in complying with new regulations – Dora, CRR3, crypto regulations, ESG financial reporting regulations, digital fraud – in some cases with a short period of time to comply, especially for large and complex institutions,” grumbles the chief operational risk officer at a European G-Sib. 

The post-Brexit evolution of the UK as a distinct regulatory jurisdiction has added to the cost and complexity of navigating this fragmented landscape. On the buy side, “compliance with regulations such as IFRS and consumer duty have made it an incredibly challenging year, alongside legislative changes related to operational resilience,” says a senior op risk manager at one European insurer.

---

5. Change management

Change management is another risk reaching an unwelcome milestone this year, climbing to a record fifth place. Chief risk officers and heads of op risk at a dozen firms on the buy and sell side as well as financial market infrastructure firms cite change management as their top concern this year, ahead of seeming existential threats like cyber or geopolitical risk – a stark acknowledgement by the industry that it doesn’t always handle change well. 

“Change management has and will become increasingly complex with advancements in technology, evolving consumer demands and preferences and working in more agile operating models,” says a senior enterprise risk manager at one large US insurer. “Strategic change has become more heavily reliant on data in recent years in addition to the reliance on technology and people, which poses an increased risk to the firm.”

Taxonomy may vary – but firms are united on the need to do a better job of focusing on the consequences of operational change and managing the risks associated with it. In the latest Op Risk Benchmarking survey, eight of the 12 regional and domestic banks polled acknowledged change management as a risk consideration. 

£50 million

TSB fine after botched migration of a retail banking platform left customers without access to their accounts for a week

Many banks are adapting their frameworks in response, with some moving to set risk appetite for change backed by risk metrics. Some reported establishing project review committees and increasing dedicated headcount. Several say their senior management teams – and their regulators – are taking a keen interest: five of the eight said their regulator had shown a greater focus on their ability to manage big projects during the past year. In most cases, watchdogs simply demanded enhanced reporting and monitoring – but at least one institution said it had been subject to an on-site inspection.

One driver of change compared to previous years has been the cautious adoption of AI-led solutions, with most firms exploring ways they can harness artificial intelligence to improve their internal processes and products. Many survey respondents say they are already attempting to introduce AI into their processes at the same time as other technological changes. 

An op risk manager at a US G-Sib describes the torturous process of onboarding a new trade surveillance vendor, with the added complexity that the solution promised incorporates elements of AI – necessitating a multi-year due diligence process he likens to “a game of three-dimensional chess”. 

“There is regulatory risk, functional risk, vendor risk, audit risk, coverage risk, monetary risk from regulatory fines, and reputational risk,” the manager says. “Onboarding a vendor who employs AI in this area can take 15 to 18 months, as the AI must pass through model review. I am onboarding potential vendors now for a decision that might not be made for one to two years.”

Even managing the due diligence and risk assessment aspects of change, before a decision is taken and a shift can begin, costs firms an inordinate amount, the manager adds.

Strategic change has become more heavily reliant on data in recent years in addition to the reliance on technology and people, which poses an increased risk to the firm

Senior enterprise risk manager at a large US insurer

Change can be humdrum – one respondent at a US pension plan cites replacing its portfolio accounting system in a typical example – but no less critical in the event it goes wrong. Ramifications, including reputational damage can be enormous: the botched migration of a retail banking platform at TSB left customers without access to their accounts for a week, saw the bank fined almost £50 million ($40 million) by UK regulators, impacting its profitability and capital position – and prompted the UK to become the first major jurisdiction to draft an operational resilience regime, a regulation which takes effect in 12 months’ time.

Many respondents complain current management practices around technological change often end up overwhelming business objectives, furthering delivery risks. An operational risk manager at another bank says: “We have a lot that is now driven by technology teams rather than business teams. Our technology teams sit under the chief operating officer, who is a technology person,” they say. 

Business change often entails replacing personnel. In some cases, this can reinvigorate an organisation by cutting away the so-called dead wood. The op risk manager at the US G-Sib cites the recent management changes at Citi, in which a number of long-serving employees departed the bank, as an example of painful but necessary change: “I would enter into evidence the pain being displayed over at Citi, when management becomes so thick with layers that calcification sets in until, finally, it can no longer be tolerated.”

Citi's re-org, which concluded during the first quarter of 2024, has seen the bank deduplicate management positions and cut intermediate reporting levels, with 1,500 management positions being axed – part of a broader drive to trim headcount and save a $1 billion a year in costs. The changes have been broadly welcomed by bank analysts. 

For financial market infrastructures (FMIs), managing change can have far-reaching implications for the firm’s business – whether a rolling programme of minor deployments to improve stability and functionality of core trading platforms, or an overhaul of client onboarding processes in response to regulatory change. 

The head of op risk at one European FMI worries about his firm’s “ability to deliver large external client change programmes on time, within budget and to required quality while ensuring limited operating issues for external stakeholders”.

---

6. Resilience risk

The era of codifying elements of business continuity and disaster recovery planning is to hit full speed in 2025. Both the EU’s Digital Operational Resilience Act and the UK’s Operational Resilience Regime are entering full force, while in the US, prudential watchdogs also said earlier this month they would consult on a more granular set of requirements. 

To be sure, there is significant category bleed here, with industry practitioners struggling to separate resilience as a risk distinct from its drivers – geopolitical, cyber and third-party, among others. “Ultimately, it is about our ability to maintain operations and recover rapidly in the event of multiple significant crises unfolding,” says the head of op risk at one US G-Sib. “What we are seeing is a higher likelihood of simultaneous macro events occurring requiring a resiliency response – eg, multiple geopolitical events: Ukraine, Middle East, US elections and so forth – occurring simultaneously, while also coping with a related or unrelated cyber attack on a third party.”

How quickly can we actually get back up? The regulator wants to know if our targets are sufficiently severe

Head of op risk at one UK bank

While the shifting threat landscape is the concern for some, the bigger change in qualitative reasons cited has been the pending final phase-in of regulators’ rulesets in 12 months’ time – after which, as one respondent frets, regulators can start issuing fines. 

Plenty are upfront about this: “The materialisation of this risk increased somewhat due to business continuity events that impacted our client services and were visible to regulators,” says a senior op risk quant at one US super-regional bank. “Risk exposure increased due to ageing technology, reliance on third parties and supply chain, increasing client and regulatory expectations, and workforce resource constraints.”

“It's the regulatory expectations more than actual risk,” agrees the head of markets operational risk at a UK bank. 

For most firms in scope, getting ready to comply with specified impact tolerances has been a multi-year journey towards maturing controls and doing a better job of endpoint management. Still, all these plans have yet to be tested in anger. “How quickly can we actually get back up?” asks the head of op risk at one UK bank. “The regulator wants to know if our targets are sufficiently severe.”

Others choose to see the positives in this codification. According to the head of op risk at one G-Sib, a focus on outcomes rather than risk drivers has helped the bank obviate unnecessary delineation of risk types. The lender increasingly looks at its various resource pillars – people, technology and third parties – responds to those exposures from a resilience perspective, and triages them appropriately.

 

The EU’s Dora will also be a step change for FMIs, which will designate many as critical third-party suppliers. The UK regime too will force trading and clearing providers to set impact tolerances and timed return to operations targets in the event of major outages. 

An FMI cites their concern over “potential inability to meet the UK op resilience expectations by March 2025 and to articulate consistent goals to staff and stakeholders”.

In the most recent round of Op Risk Benchmarking, all FMIs responding said their primary regulator had shown an increased interest over the past 12 months in how they manage resilience risk – the only unanimous verdict for this question across all risk types during the first three rounds of Risk.net’s survey. Besides closer monitoring, three FMIs said they had been subjected to enhanced reporting, while another said they had been requested to make enhanced disclosures, beyond the scope of the PFMIs.

On the buy side, the codification of resilience expectations has been about growing fast. 

“Meeting the operational resiliency requirements has been challenging and uplifting,” says the head of op risk at one UK insurer. “Educating the business and vendors on the discipline of ops resilience has been something that may take further time in line with the 2025 deadline. As others have observed, this discipline has highlighted various weaknesses that may have been previously okay, but [are] now something the regulator expects to be addressed.”

---

7. Geopolitical risk

Geopolitical risk may defy traditional management or measurement approaches, but the data from this year’s survey is still instructive. Forward-looking indicators for geopolitical risk, compiled from responses to the follow-up questions that accompanied this year’s survey, sound a louder warning than other categories. 

For instance, asked whether geopolitical risk had increased for the industry versus the same period a year earlier, 20 firms said it had risen significantly and six somewhat, giving a risk score of 1.8 (see methodology) – double that of information security. 

Asked whether their own exposure had increased in that time, firms gave a risk score of 1.2 – well clear of the next category of change management. Participants also expect the trend to continue, giving a forward-looking risk score of 1.5 when asked whether they saw exposure increasing over the coming year. 

Geopolitical risk is at a high that I have not seen before in my career

Veteran CRO of one bank

The only question where geopolitical was not the top answer was aggregate losses. That makes sense: when firms consider the operational impact of geopolitics, “losses are more opportunity costs than direct financial costs”, says a senior risk manager at one European G-Sib. 

Unfortunately, those opportunity costs might be about to get much bigger. 

The chief risk officer at one US FMI highlights four current or potential conflict zones for 2024: Israel, Iran, China/Taiwan and Russia/Ukraine. Other risks to global stability come from a string of national elections, including Donald Trump’s run for the US presidency.

“Geopolitical risk is at a high that I have not seen before in my career,” agrees the veteran CRO of one bank. 

Geopolitical risk frameworks don’t compare easily to those of other, classical op risks. Only one G-Sib in our Op Risk Benchmarking survey said they maintained dedicated in-business or second-line teams with a specific focus on geopolitical risk, and few respondents incorporated traditional measurement tools like key risk indicators into their frameworks. More banks said they modelled their exposure, however, while almost all said they used scenario analysis to gauge geopolitical tail risk. 

Only one FMI reported setting key risk indicators for geopolitical risk or modelling the firm’s exposure – though most respondents at FMIs said they report to their chief risk officer and boards on the operational implications of geopolitical risk, including both scenario analysis and qualitative discussions in board packs. 

If a US/China decoupling is to occur, the operational costs could be significant, notes one adviser, “particularly a drive to exit or decrease significantly China and Chinese operations. Large banks’ customers are also part of this drive to reduce exposure to China”.

For FMIs, too, costs can be more direct, particularly if relations between the US and China deteriorate and the countries escalate sanctions, notes the head of op risk at one European FMI. In such a situation, firms are more exposed to the “risk of the business having a direct or indirect exposure to a party or an affiliate of a party being included on the sanctions lists”, the head adds.

On the buy side, too, one senior risk practitioner at a UK fund manager sees costs as likely accruing in the form of sanctions.

“While markets tend to self-correct to price the impacts of geopolitical risk into securities, operational risk can be realised as asset managers adapt operational workflows to deal with responses to regulators [or] governmental sanctions,” they add. 

---

8. Execution and process errors

Though the financial industry has changed dramatically in the near-two decades since Risk.net began running its survey, execution and process errors have been ever-present. Firms are split, however, on whether the accompanying technological change – the electronification of almost all securities and derivatives markets, faster payments and the advent of shorter settlement cycles as well as real-time transaction monitoring – has made banks more or less safe. 

“Large cash and security movements can be made very rapidly with technology and better connectivity,” says the head of op risk at one US G-Sib. “But there are elements that remain manual, especially for non-standard events, and it remains a concern that a large unintended movement of cash or securities could put a firm at risk. In some cases, the high-speed nature of tech also facilitates high-speed propagation of errors.” 

The 2023 round of Op Risk Benchmarking highlighted methodological disparities in the industry’s approach to gauging execution errors: more regional and domestic banks said they modelled their exposure to execution errors than did a sample of G-Sibs, and used the outputs to inform capital-setting accordingly. 

As one participant in the follow-up study noted, that may be a quirk of prudential regulation. The issues that dominate op risk events in this category, such as payments that go missing, trades that are disputed or fail to reconcile, are usually resolved quickly – sometimes as soon as the next business day, with no net losses. Under the incoming Basel III prudential regime, banks will no longer be required to model near-misses – something that can give false assurance as to true risk exposure, some argue.

Conversely, for the buy side, this category can often be the biggest source of operational losses. “Execution and process error, particularly around trading activity, typically results in the most significant losses experienced by the firm year on year,” says the head of operational risk at one UK asset manager. 

 

In the follow-up questions to the Top 10 survey, when asked Has your organisation suffered a greater aggregate loss from this risk type over the past 12 months?, buy-side firms gave their joint third-highest risk score, behind only third-party and geopolitical risk.

Others see the consolidation of many systems, especially post-Covid, into the hands of a few vendors responsible for most firms’ IT platforms, as dramatically increasing the potential fallout when internal human management of those systems is found wanting.

“The centralisation of IT, cloudification and outdated systems increase risk; diligent monitoring and safeguarding mitigate it. Nonetheless, disruptions caused by, for example, the failure of end-to-end or user acceptance testing, human error in plugging in servers, ‘phantoms’ in the network or software are increasing,” says a senior risk manager at the Asia-Pacific subsidiary of one large European insurer. 

Managing new processes can bring with it risks, according to the UK asset manager, such as the rollout or rapid re-bucketing of investment products. He cites the need to “code new ESG-type restrictions” as having the potential to increase the risk of error for related trades. 

“Building new capabilities will mean introducing new risks into the system,” agrees the head of op risk at one UK insurer. “Training and resourcing are crucial here.”

---

9. External fraud

Fraud makes an unwelcome return to the top 10 this year, with survey respondents linking its rise to the development of artificial intelligence tools that can transform “smaller-dollar criminals” into “sophisticated threat actors”, as one puts it.

“There is a concern about the change in the way fraud is happening,” says a senior op risk quant at one European G-Sib. For example, generative AI tools can now create deep fakes with “ridiculous ease”, the quant adds.

The technology to create deep fakes has existed for several years, and scammers have already used it against financial firms with success. However, several large banks privately cite increasingly sophisticated attempts at penetrating their defences. 

In one notable incident last February, a multinational firm in Hong Kong suffered a $25 million fraud when scammers used deep-fake technology to impersonate a senior officer and trick a staff member to transfer funds. 

$25 million

Fraud suffered by one multinational firm in Hong Kong when scammers used deep-fake technology

Rising fears of external fraud among the largest banks have helped propel the risk to sixth place in the top 10 for G-Sibs. Respondents cite deteriorating economic conditions and increased geopolitical risk as factors contributing to the threat of fraud.

As well as the risk of elaborate deep-fake scams and customer impersonations, financial firms are also worried about frauds that stem from internal failings such as a breakdown in financial crime detection systems.

In response, banks are deploying an old-fashioned aid: the telephone. One US super-regional has tightened up its controls so that bankers must call customers to verify transactions in person, rather than relying on email confirmations. Another survey respondent, an FMI, says staff call customers if any bank account information is to be changed. The firm also emphasises the importance of training staff to boost their awareness of developing risks such as generative AI.

Fraud is on regulators’ radars too, as recent action shows. In the UK, the Economic Crime and Corporate Transparency Act 2023 has brought an increased focus on corporates’ responsibility to handle their third parties and fraud risk. 

The UK government also published a draft amendment to the Payment Services Regulation, which will allow banks to further delay outbound payments they consider likely to be fraudulent. Tighter rules have also been proposed in the UK and Europe on refunding customers in the case of payments made by fraudsters using customer accounts. 

---

10. Conduct risk

History doesn’t repeat itself, but it often rhymes. The aphorism attributed to Mark Twain could also apply to banks scarred by a 15-year cycle of regulatory fines totalling at least $1 trillion for failings related to conduct and internal fraud.

The notoriously long tail of conduct risk also means cases that banks might have considered closed can resurface sometimes decades later: so it has proved for banks active in UK motor financing, as Lloyds Bank last month provisioned £450 million ($568 million) against the impact of a UK Financial Conduct Authority review of historic commissions, as well as others such as Close Brothers moving to provision for potential claims – some dating back to the era of the financial crisis. 

The case has strong echoes of the decade-long drip-drip of payment protection insurance (PPI) claims during the 2010s – something many privately complained was effectively used as a one-size tax for regulators to punish banks for a multitude of crisis-era misdeeds. Banks will be hoping the final tally doesn’t bear comparison to that episode’s £50 billion bill, which brought extra pain through Pillar 2 capital add-ons.

The macro environment is expected to remain volatile, which brings along changes to expectations from consumers and regulators. That tends to increase conduct risk

Senior op risk quant at a European G-Sib

Losses may have dipped slightly in 2023, but watchdogs such as the US Department of Justice have long memories, as the largest global banks have found in recent years. 

Cries of unfairness abound, with a senior risk manager at one large European insurer accusing their regulator of using conduct fines as “ex-post standard setting” – grave charges to lay at the door of those entrusted with ensuring the safe and smooth running of markets and protection of consumers. 

A senior op risk quant at a European G-Sib notes that mis-selling losses tend to spike during choppy markets. One reason is that customers are more likely to claim for mis-selling if a financial security or product has lost money. 

“The macro environment is expected to remain volatile, which brings along changes to expectations from consumers and regulators. That tends to increase conduct risk,” they add.

It’s not just long-tail claims: products that banks are selling now using machine learning approaches to divine customer behaviour and gain an edge in speed and pricing could find themselves in scope should regulatory attitudes change, some fret. 

“Losses in this category take a while to be identified, investigated by regulators, and penalties applied,” says a senior op risk manager at a second European G-Sib. “The underlying cause may be things like model risk, system error,” they add; but “mis-selling has the biggest impact in direct costs: fines and reputational damage. Exposure is increasing as more use is made of AI to make decisions on what products customers should be offered, at what rates.”

Many G20 jurisdictions, including the US and UK, also have government elections this year, which could result in changes in administration and policy – and regulatory attitudes, as well as government resourcing. 

On the buy side, the extension of the UK’s Consumer Duty regime last year has highlighted the levels of risk in how financial firms treat customers, says a senior risk manager at one UK insurer. For example, firms are required to ensure customers in vulnerable circumstances receive due consideration. “This feeds into customer conduct risk management,” the risk manager adds.

---

Methodology

Alongside the top 10, Risk.net has once again produced cohort splits for the four sub-groups to which most respondents belong: Banks – G-Sibs (15 banks out of the 29 Financial Stability Board/BCBS 2023 G-Sib list are represented); Banks – non-G-Sibs (34 firms, including both regional, specialist and retail lenders); Institutional investors (16); and Financial market infrastructures (10), as well as a small number of other firms not represented by these categories.

The top 10 rankings are derived from respondents’ individual votes, which are then aggregated and ranked on a weighted basis, with ranked choice voting used to break any ties. The weighting system employed is as follows:

• Five points are awarded to a respondent’s top-ranked risk;
• Four to their second-top-ranked;
• Three to their third;
• Two to their fourth;
• And one to their fifth.

In addition, we have once again produced a risk score for every risk featured, designed to show the direction of travel for each. The scores are derived from respondents’ answers to four follow-up questions about the risks they chose:

• Is this a bigger risk for the industry today than it was 12 months ago?
• Do you expect this to become a bigger risk for the industry over the next 12 months?
• Has your organisation’s exposure to this risk increased, compared to the same time last year?
• Has your organisation suffered a greater aggregate loss from this risk type over the past 12 months?*

Their answers are then weighted on a Likert scale to produce a risk score, on a similar basis to the system used to weight the raw results:

• Where respondents say a given risk has gone up significantly, their answer is given a +2 weighting;
• Where it has gone up somewhat, +1;
• If a manager believes a risk has stayed about the same, their answer is given a 0 weighting;
• Risks that have gone down somewhat, a -1 rating;
• Risks going down significantly, -2.

The scores from every manager are then tallied, and divided by the number of answers to produce a risk score for each question, of between -2 and +2.

Given regional and domestic banks make up a plurality of responses, risk scores for the survey population as a whole will be dragged towards their average; therefore, the risk scores for individual cohorts are shown separately. Risks in the lower half of the tables for smaller cohorts have been included for completeness, but, given the relatively small sample counts, readers should be wary of ascribing too much weight to them. 

If you’d like to see the full breakdown of the votes behind each of the scores, including sample counts for each, please let us know.

A final note on the taxonomy employed: in a few places, we’ve taken the decision to aggregate some votes – ‘Unauthorised trading’ and ‘Mis-selling’ were aggregated into ‘Conduct risk’, for instance.

If you’d like to offer feedback – or if you have any questions on navigating the results, or any suggestions – please drop us a line: [e-mail]

*For risk types that did not result in financial losses, respondents were asked instead to give an estimate of the aggregate severity of any breaches, attacks, failures or other risk events – and whether this risk type was more ‘harmful’ or ‘damaging’ over the past 12 months.