The rising importance of risk culture in banking supervision

In the wake of financial crises, the question ‘Where was the board?’ has become a rallying cry, reflecting the demand for greater accountability within banking institutions. Recent high-profile bank collapses underscore the necessity of robust internal governance frameworks that include a strong risk culture at their core.

Supervisors worldwide continue to elevate risk culture as a supervisory priority, albeit with different supervisory approaches. In the EU, addressing deficiencies in the functioning of banks’ management bodies has been a supervisory priority of the European Central Bank (ECB) since 2020. This remains central to the ECB’s supervisory priorities for 2025–2027, to adequately address the diverse and interconnected risks they face in the current macroeconomic and geopolitical landscape. This increased ECB supervisory focus is reflected in the ECB Draft Guide on Governance and Risk Culture, published in July 2024 and expected to become final in the coming months.

This article explores the evolving dynamics of risk culture, focusing on regulatory approaches in the EU, UK, and US. It examines the ECB’s draft Guide on governance and risk culture and its potential implications for the financial sector.

“Various banking crises have shown that it is often in a bank’s culture that the first whispers of trouble can be discerned.”

Frank Elderson, ECB, Speech “Exchanging views for better bank governance and risk culture”, September 2024

The importance of risk culture in banking governance

Risk culture is the backbone of a robust governance framework in banking, reflecting an institution’s collective norms, attitudes, and behaviours concerning risk awareness, risk-taking, and management. It determines how effectively a bank identifies, manages, and mitigates risks while ensuring alignment with strategy and long-term objectives. Deficiencies in risk culture often lead to operational lapses, regulatory non-compliance, and failures to timely identify material risks.

The 2008 Global Financial Crisis highlighted the need for resilient risk culture. More recently, the collapses of Silicon Valley Bank (SVB), First Republic Bank, Signature Bank and Credit Suisse underlined the consequences of neglecting this critical component.

Despite progress, many banks globally still face persistent weaknesses in this area, streaming from structural and behavioural factors. Structural weaknesses include limited diversity in board composition (e.g. gender, geographical provenance, skills, education, experience) while behavioural issues involve inadequate oversight and ineffective management practices.

In today’s uncertain economic and geopolitical environment, addressing such deficiencies for strengthening governance structures and aligning cultures with prudent risk management are essential. Banks must timely identify and adequately manage the multifaceted and increasingly complex risks they face to ensure stability and resilience.

“From my experience on multiple bank boards, I have seen how a strong risk culture transforms decision-making and resilience. It is not just about policies — It is about fostering accountability and alignment at every level to safeguard the institution’s future.“

Sylvie Matherat, Senior Global Advisor, Forvis Mazars 

While effective governance and risk culture are universal concerns, the regulatory responses to these challenges vary significantly across jurisdictions. The European Union (EU), the United Kingdom (UK), and the United States (US) provide distinct yet complementary approaches to addressing risk culture deficiencies.

The EU Approach: Internal Governance and Risk Management as key Pillars of Banking Supervision

In the EU, internal governance and risk management are key pillars of the Supervisory Review and Evaluation Process (SREP) under the Single Supervisory Mechanism (SSM). Given the current environment, addressing serious deficiencies in banks’ governance arrangements and risk cultures remains critical.

ECB priorities for 2025-2027

The ECB’s supervisory priorities for 2025-2027 continues to emphasise governance and risk culture through numerous planned supervisory activities:

• Continuous monitoring: Horizontal reviews and on-site inspections to monitor banks’ progress in addressing governance deficiencies, taking enforcement actions where necessary to ensure compliance.
• Enhanced governance reviews: Targeted assessments of management bodies, focusing on diversity, collective suitability, and the effectiveness of oversight functions.
• Risk culture audits: Evaluation of how banks embed risk culture at all levels, including the integration of accountability frameworks and whistleblowing mechanisms.
• Proactive climate and digital risk supervision: Intensified scrutiny of governance frameworks for managing climate-related risks and digital transformation, ensuring alignment with long-term strategic goals.

ECB Draft Guide on Governance and Risk Culture

The ECB Draft Guide on Governance and Risk Culture (the Guide), published in July 2024 and expected to become final in the coming months, sets expectations for addressing governance challenges in an interconnected risk landscape. While not legally binding, it provides clear supervisory expectations from banks and includes good practices to leverage. Key elements include:

• Risk culture: Must be embedded into governance by ensuring clear accountability, tone from the top, and effective mechanisms for challenge. Leadership should foster risk awareness and alignment with strategic and regulatory objectives. Mapped across four key axes: (1) tone from the top and leadership, (2) effective communication, challenges, and diversity, (3) incentives, and (4) accountability for risks.
• Functioning and effectiveness of management bodies: Must ensure strong oversight, clear roles, and effective decision-making. Diverse, independent, and skilled management bodies, and ensuring collective suitability.
• Internal control functions: Clear roles and independence for risk management, compliance, and audit functions, to monitor emerging risks and providing timely insights. Supported by advanced tools like data analytics.
• Risk appetite frameworks (RAF): Dynamic RAFs integrated into strategic objectives, linking risk appetite to remuneration policies to ensure accountability and prudent risk-taking across all levels. Boards must rigorously oversee the RAF to ensure it reflects the institution’s risk culture.

The Guide replaces the 2016 Supervisory Statement on Governance and Risk Appetite. It was developed in alignment with international standards and European standards, including with the European Banking Authority (EBA) Standards on Internal Governance.

The ECB stresses that sound risk culture does not mean avoiding risks entirely but ensuring risk perspectives are integrated into strategy, decision-making, and remuneration structures. Banks are expected to proactively address any deficiencies and align governance with best practices.

ECB-supervised banks can expect a more intrusive approach in overseeing risk culture, with more direct engagement to assess the implementation of these expectations by banks. This will be driven by the planned activities mentioned in the ECB priorities. Compliance will be enforced if critical deficiencies persist.

“A strong governing body and a risk culture integrated across the bank are essential pillars for navigating today’s complex risk landscape. The ECB’s intensified focus on accountability, diversity, and forward-looking frameworks sets a clear expectation in this regard.“

Eric Cloutier, Group Head of Banking Regulations / Head of Global FS RegCentre, Forvis Mazars UK

The UK approach: a proactive, dialogue-based model

In the UK, the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) adopt a  dialogue-driven approach to governance. Supervisors focus on fostering a culture of accountability and continuous improvement through:

• Dear CEO Letters: These communications highlight supervisory priorities and provide actionable insights to enhance board and management oversight. Recent letters have emphasised the importance of strengthening non-executive directors’ independence and improving governance practices.
• Senior Managers and Certification Regime (SM&CR): A regulatory framework holding senior managers personally accountable for compliance within their areas of responsibility, with potential fines or bans for non-compliance. The regime aims to embed a culture of individual accountability, ensuring that decision-making aligns with the firm’s risk appetite and regulatory requirements.
• Tailored Supervision: UK regulators use tailored supervisory models, taking into account each institution’s specific risk profile and governance structure. This collaborative approach, which includes regular bilateral discussions and feedback loops, fosters accountability and supports gradual, sustainable improvements in banks’ governance and risk culture.

Recent initiatives focusing on diversity, inclusion, and addressing non-financial misconduct further demonstrate the UK’s commitment to enhancing governance and fostering a strong risk culture within the financial sector.

Ireland: an EU country inspired by the UK’s senior management regime

In Ireland, the Central Bank has introduced the Senior Executive Accountability Regime (SEAR), inspired by the UK’s Senior Managers and Certification Regime (SMCR). SEAR, enacted through the broader Individual Accountability Framework (IAF), enhances accountability by defining senior executives’ roles and responsibilities.

While SEAR reflects SMCR principles, it incorporates unique enforcement mechanisms tailored to Ireland’s regulatory landscape. This framework addresses local governance challenges while aligning with EU and global standards.

For more information, read What is an IAF and SEAR? – Forvis Mazars – Ireland and our article on Being an Independent Non-Executive Director in different jurisdictions for more information.

The US approach: enforcement as a key deterrent

In contrast to the EU and the UK, the US regulators and supervisors, such as the Federal Reserve and the Office of the Comptroller of the Currency (OCC), emphasise a more punitive approach to governance and risk culture, using enforcement actions to drive accountability and compliance.

Enforcement actions in the US

Enforcement actions in the US often include detailed public disclosures, providing transparency on violations and corrective measures. This approach prioritises immediate remediation, with institutions compelled to implement extensive reforms under regulatory oversight.

Recent years’ examples illustrate this approach, such as Wells Fargo fined $3 billion for systemic governance issues tied to a toxic sales culture, and Citigroup fined $400 million and required a comprehensive overhaul of its governance practices. More recently, in December 2024, Bank of America received a cease-and-desist order from the OCC for systemic failures in governance and risk culture, including significant lapses in controls and compliance with anti-money laundering regulations.

Limitations of the US model

The US model focuses on deterring misconduct through strong penalties and public accountability. While this strategy effectively addresses immediate compliance failures, some may argue it may lack collaborative elements essential for fostering sustainable cultural changes. For instance, the emphasis on enforcement does not always engage institutions in dialogues about embedding long-term risk awareness and cultural shifts. 

The path forward for banks: embedding risk culture as a strategic imperative

The global banking sector faces unprecedented challenges, including geopolitical tensions, economic volatility, and the transformative pressures of climate change and digital innovation. These factors make governance and risk culture more critical than ever.

Management bodies must ask themselves: Are our governance frameworks adaptable to emerging risks? Do our incentives align with long-term objectives? Have we integrated diverse perspectives to avoid blind spots? Addressing these questions is key to fostering accountability and resilience.

Increasing regulatory and supervisory pressures across jurisdictions reflect a shared global imperative: governance and risk culture must be embedded into the strategic priorities of banks. Management bodies must act decisively to meet these demands in an era of heightened supervisory scrutiny and rapid change.

Resolving issues with risk culture may, however, present broader challenges to be considered. For example, addressing inadequacies in board and management bodies’ diversity must be balanced with ensuring adequate experience in banking risks. Additionally, addressing behavioural factors related to risk culture must carefully consider the banks’ historical culture, particularly its failures. Recent tragic incidents in investment banking, related to the fatal exhaustion of junior employees, remind us that a strong culture is not only about ensuring sound risk management but also the wellbeing of employees.

“Banks’ management bodies must focus on embedding risk culture into their strategic priorities, ensuring it drives not only compliance but also innovation and resilience. This means asking the tough questions, fostering diverse perspectives, and aligning incentives to long-term value creation.”

Gregory Marchat, Group Head of Financial Services Advisory, Forvis Mazars UK