By Rohan Williamson, Ph.D., Professor of Finance and Bolton Sullivan/Thomas A. Dean Chair in International Business, Georgetown University
The nature of risk is undergoing a structural shift in the global banking industry. Traditional categories, such as credit, market, liquidity and operational risk, remain essential, but they no longer fully capture the forces shaping financial institutions today. The change is not simply in the level of the risk, but in its structure: Risks are more interconnected, faster-moving and increasingly endogenous to the financial system. This shift requires banks and other financial firms to rethink risk management not as a set of controls, but as a core capability for building resilience.
This perspective aligns with a growing body of academic and policy research showing that financial instability arises less from isolated exposures and more from interactions across balance sheets, markets and institutions. Work by Markus K. Brunnermeier highlights how coordination failures and funding structures can amplify shocks, while Hyun-Song Shin emphasizes the role of leverage and liquidity cycles in propagating instability. Similarly, institutions such as the International Monetary Fund (IMF) and the Bank for International Settlements (BIS) stress that vulnerabilities increasingly emerge from the interaction of multiple forces, including tightening financial conditions, geopolitical fragmentation, elevated asset valuations and the rapid growth of nonbank financial intermediation. For banks, the implication is clear: Risk management must evolve from siloed functions into an integrated, firm-wide resilience capability.
In practice, resilience is no longer defined solely by a bank’s capacity to absorb losses, but by its ability to continue operating, preserve trust and adapt in adverse conditions.
Historically, bank-risk management has been anchored in capital adequacy and liquidity buffers. These remain foundational. However, recent supervisory perspectives, particularly from the European Central Bank (ECB), make clear that resilience now extends beyond financial metrics. It includes operational continuity, governance effectiveness, technological robustness and the ability to maintain market confidence under stress. In practice, resilience is no longer defined solely by a bank’s capacity to absorb losses, but by its ability to continue operating, preserve trust and adapt in adverse conditions.
A defining feature of the current environment is the expansion of the risk perimeter beyond the traditional banking sector. The Financial Stability Board (FSB) estimates that nonbank financial intermediation now exceeds $250 trillion globally and continues to grow faster than the banking system. This creates both risk-transmission channels and competitive pressures for banks. Exposures originating in private credit, asset management and other nonbank sectors can quickly transmit through funding markets, counterparty relationships and asset-price adjustments. At the same time, competition from these sectors is reshaping bank strategies, particularly in lending and capital markets. As a result, banks must actively manage second-order and indirect risks that may not be fully visible on their balance sheets. This requires more forward-looking risk-assessment frameworks and more comprehensive stress-testing approaches.
Operational resilience and technology
Operational resilience has become a central regulatory and strategic priority. Cyber threats, cloud concentration, third-party dependencies and vulnerabilities in payment systems have elevated the importance of maintaining critical services under stress. Both the Financial Stability Board and the Bank for International Settlements have emphasized that disruptions in payments, clearing and settlement systems can have systemic consequences.
At the same time, the rapid adoption of artificial intelligence (AI) introduces new opportunities and risks. AI is already enhancing fraud detection, risk analytics and operational efficiency. However, it also creates exposures to model risk, data-integrity challenges and evolving regulatory expectations. Industry analyses from PwC (PricewaterhouseCoopers) and Deloitte suggest that many banks are deploying AI capabilities faster than their governance frameworks can adapt. The implied recommendation is not to slow innovation, but to ensure that model-risk management, data governance and stress testing evolve at the same pace as technological adoption.
Risk culture and governance
A consistent lesson from both recent crises and regulatory assessments is that formal risk frameworks are only as effective as the cultures that support them. The Basel Committee on Banking Supervision (BCBS) and the Financial Stability Board emphasize that risk culture, shaped by norms, incentives and behaviors, plays a central role in how risks are identified, escalated and managed.
Academic evidence reinforces this view. For example, Andrew Ellul and Vijay Yerramilli show that banks with stronger risk controls and governance exhibit lower risk profiles (“Stronger Risk Controls, Lower Risk: Evidence from U.S. Bank Holding Companies,” 2013), while Luigi Guiso, Paola Sapienza and Luigi Zingales demonstrate that corporate culture has measurable effects on firms’ outcomes (“The value of corporate culture,” 2015). In practice, risk culture is observable: whether employees escalate concerns early, whether business lines respect risk limits and whether management decisions align with the stated risk appetite. Strong cultures enable rapid responses; weak cultures allow risks to accumulate unnoticed.
Effective governance begins with the board of directors. The Basel framework assigns boards the responsibility of setting the bank’s risk appetite and ensuring that management operates within it. Leading institutions are moving beyond compliance toward integrating risk directly into their strategies. This shift has several practical implications. Risk appetite must be actionable and embedded in capital allocation and pricing decisions. Risk and strategy must be aligned, with risk functions engaged early in decision-making. Accountability must be clear, with business lines owning the risks they take. And boards must engage deeply, bringing both expertise and the willingness to challenge management assumptions, as highlighted in recent work by René M. Stulz and co-authors (Stulz, Tompkins, Williamson and Ye, “Why do banks have a risk committee,” 2026).
Tone at the top remains critical. Governance frameworks that focus narrowly on compliance may satisfy regulatory expectations but do little to enhance resilience. By contrast, governance that embeds risk into strategic decision-making can become a source of competitive advantage.
Conclusion
Bank-risk management is evolving from a control function to a core strategic capability. Institutions that succeed will combine strong financial buffers with robust operational and technological resilience. They will understand risks not in isolation, but as part of an interconnected system. They will cultivate cultures that promote transparency and accountability. And they will embed risk considerations across all levels of decision-making, from the boardroom to the front line.
The objective is no longer simply to manage risk. It is to build resilience in an increasingly complex, fast-moving global system in which risks are interconnected, dynamic and often endogenous.
Rohan G. Williamson, Ph.D., is a Professor of Finance and the Bolton Sullivan/Thomas A. Dean Chair of International Business at Georgetown University. He is a Research Associate at the National Bureau of Economic Research (NBER) and a Member of the European Corporate Governance Institute (ECGI). He brings extensive practical experience through his service on corporate and advisory boards, blending academic insights with real-world corporate-governance expertise.