Enterprise risk management for banks is the governance system that pulls every threat to a bank’s capital and earnings — credit, market, operational, liquidity, compliance, cyber, vendor, and model risks — into one framework with clear ownership, board-approved limits, and defined federal oversight. Instead of each department tracking its own exposures in isolation, ERM gives the institution a single view of what it faces and who is responsible for managing it.
In U.S. banking, that framework is shaped by a mix of structural expectations (how the bank organizes risk responsibilities), substantive rules (how much capital and liquidity it holds, how much it can lend to one borrower), and process requirements (stress tests, vendor diligence, cyber incident reporting). What follows is how the pieces fit together.
What ERM Does at a Bank
A bank runs on leverage and trust, which means a single uncontrolled exposure can threaten the whole institution. ERM exists to prevent that. It identifies risks across every business line, assesses how severe they are, assigns someone to manage each one, and reports the aggregate picture to the board. The output is not a document. It is a set of limits, controls, and escalation paths that constrain what the bank actually does day to day.
The Three Lines of Defense
The structural core of bank ERM is the three lines of defense model, which splits risk responsibilities so no single team both creates risk and polices it.
The first line is the front-line business units — the people who originate loans, execute trades, and open accounts. They own the risks their activities generate and must identify, assess, and control those risks within the limits the board sets.
The second line is an independent risk management function that oversees the first line, assesses risks independently, monitors whether the bank is staying within its risk appetite, and flags concentrations or emerging threats no single department would catch on its own.
The third line is internal audit, which gives the board independent assurance that the first two lines are working. Audit tests the effectiveness of governance, risk controls, and compliance.
Federal regulators formalized this structure for large banks. The OCC’s heightened standards require independent risk management to operate separately from front-line units and report to a Chief Risk Officer with direct access to the board.1eCFR. 12 CFR Part 30, Appendix D – Heightened Standards for Large Banks Smaller community banks often run a less formal version, but the principle holds: the person checking the work should not report to the person doing it.
Risk Appetite and Board Governance
Everything in a bank’s ERM framework traces back to the risk appetite statement. This is where the board formally declares how much risk the institution will take in pursuit of its business objectives. It sets quantitative limits, such as a cap on commercial real estate lending as a percentage of capital, and qualitative boundaries, such as a prohibition on certain products. Every lending decision, investment strategy, and new product launch should fit within those guardrails.
The board carries ultimate responsibility for the risk governance framework. Directors do not manage daily risk operations, but they approve the risk appetite, review aggregate risk reports, and hold senior management accountable when exposures drift. The Chief Risk Officer runs the day-to-day program, leads the independent risk management function, and reports directly to the board’s risk committee. At covered banks with $50 billion or more in assets, the OCC’s heightened standards require this governance structure to be formalized and documented.1eCFR. 12 CFR Part 30, Appendix D – Heightened Standards for Large Banks
The Main Risk Categories
Credit Risk
Credit risk is the chance a borrower will not repay. Banks manage it by analyzing creditworthiness before lending, diversifying across industries and geographies, and setting aside reserves called the allowance for credit losses. Under the current expected credit losses (CECL) standard, banks must estimate expected losses over the full life of a loan at origination rather than waiting until a loss looks probable.2Office of the Comptroller of the Currency. Allowances for Credit Losses That front-loaded approach forces earlier recognition of deteriorating loan quality.
Market Risk
Market risk arises from movements in interest rates, foreign exchange rates, equity prices, and commodity values. Banks holding large bond portfolios face the most visible version: when rates rise, the value of existing fixed-rate holdings drops. Interest rate risk in the banking book affects both the value of investments and the spread between what a bank earns on loans and what it pays on deposits.
Operational Risk
Operational risk covers losses from failed internal processes, employee errors or misconduct, system outages, and external events like natural disasters. It is the broadest category and the hardest to quantify. A ransomware attack on the payments system, a fraudulent wire transfer processed by an employee, a data center lost to flooding — all fall here. Banks address it through business continuity planning, redundant systems, access controls, and training.
Liquidity Risk
Liquidity risk is the possibility a bank cannot meet short-term obligations — customer withdrawals, maturing wholesale funding, new loan commitments — without selling assets at distressed prices. A bank can be solvent on paper and still fail if it cannot convert assets to cash fast enough. Basel III addressed this with the Liquidity Coverage Ratio, requiring banks to hold enough high-quality liquid assets to cover 30 days of stressed outflows.3Bank for International Settlements. Basel III: The Liquidity Coverage Ratio and Liquidity Risk Monitoring Tools
Compliance Risk
Compliance risk is exposure to fines, enforcement actions, and reputational damage when a bank violates laws, regulations, or internal policies. It covers fair lending, consumer protection, and Bank Secrecy Act and anti-money laundering (BSA/AML) obligations. BSA/AML alone demands transaction monitoring systems, suspicious activity reporting, customer due diligence programs, and specialized staff. Compliance is typically managed as a second-line function that feeds into the broader ERM framework.
Capital and Liquidity Requirements
The Basel III accords set the global floor for bank capital. Banks must maintain a minimum Common Equity Tier 1 (CET1) ratio of 4.5% of risk-weighted assets, a Tier 1 capital ratio of 6%, and a total capital ratio of 8%.4Bank for International Settlements. Definition of Capital in Basel III – Executive Summary A separate leverage ratio requires at least 3% Tier 1 capital relative to total exposure, serving as a backstop regardless of how risk-weighted models classify assets.5Bank for International Settlements. Basel III Leverage Ratio Framework and Disclosure Requirements U.S. regulators expect large banks to hold well above these minimums once capital buffers for systemically important institutions are added.
Not every bank faces the same regulatory burden. Since 2019, the Federal Reserve has sorted banking organizations into four categories based on size and complexity:
- Category I covers U.S. global systemically important banks (GSIBs) and carries the most stringent capital, liquidity, and stress testing requirements.
- Category II covers firms with $700 billion or more in total assets, or $75 billion or more in cross-jurisdictional activity.
- Category III covers firms with $250 billion or more in total assets, or $75 billion or more in weighted short-term wholesale funding, nonbank assets, or off-balance sheet exposure.
- Category IV covers firms with $100 billion or more in total assets that do not meet higher-category criteria.
These thresholds determine which stress testing, liquidity, and capital planning rules apply.6Federal Register. Changes to Applicability Thresholds for Regulatory Capital and Liquidity Requirements They have not been adjusted since adoption despite years of asset growth and inflation.
Stress Testing
Stress testing is where the theoretical framework meets arithmetic. The Federal Reserve conducts supervisory stress tests annually for banking organizations with $100 billion or more in total consolidated assets, projecting losses and capital depletion under severely adverse scenarios.
Beyond the supervisory test, certain large firms must conduct their own company-run stress tests. GSIBs and Category II firms run them annually; Category III firms run them every two years.7eCFR. 12 CFR Part 252, Subpart F – Company-Run Stress Test Requirements Firms with significant trading operations, generally those with $50 billion or more in aggregate trading assets and liabilities, face additional scenarios including a global market shock and the hypothetical default of their largest counterparty.
Results directly affect how much capital a bank can distribute through dividends and buybacks. If projected losses under the stress scenario would push capital ratios below minimums, the bank must retain more earnings. Poor risk management reduces the money available to return to investors.
Concentration Risk and Lending Limits
Federal law caps what a national bank can lend to any one person or entity. Unsecured loans cannot exceed 15% of the bank’s unimpaired capital and surplus, with an additional 10% allowed for fully secured loans, for a combined ceiling of 25%.8Office of the Law Revision Counsel. 12 USC 84 – Lending Limits
Beyond single-borrower limits, the OCC flags any group of related exposures exceeding 25% of Tier 1 capital plus the allowance for credit losses as a concentration warranting attention.9Office of the Comptroller of the Currency. Concentrations of Credit A bank with heavy weighting in a single sector will face scrutiny over whether its capital and risk management processes can support that concentration.
Model Risk and the AI Gap
Banks rely on quantitative models for credit scoring, loan pricing, capital estimation, and fraud detection. When those models are wrong, the error ripples through nearly every risk measurement that depends on them. Model risk management exists so the tools used to measure risk do not themselves become a source of risk.
In 2026, the OCC, Federal Reserve, and FDIC issued updated interagency guidance on model risk management covering how banks develop, validate, and govern their models. It applies primarily to institutions with more than $30 billion in total assets.10Office of the Comptroller of the Currency. Model Risk Management: Revised Guidance The guidance does not create enforceable standards — regulators will not issue supervisory criticism solely for noncompliance — but examiners use it as a benchmark when evaluating risk practices.
The 2026 guidance explicitly excludes generative AI and agentic AI models from its scope, calling them “novel and rapidly evolving.”10Office of the Comptroller of the Currency. Model Risk Management: Revised Guidance Banks deploying AI tools for customer interactions, fraud detection, or credit decisioning should not assume this guidance covers those systems. Separate regulatory expectations for AI in banking are still developing.
Third-Party and Vendor Risk
Banks outsource core processing, cloud hosting, cybersecurity monitoring, and payments, and each vendor relationship creates risk that flows back to the bank. Regulators treat accountability as nondelegable: you can outsource the work, not the responsibility.
The OCC, Federal Reserve, and FDIC jointly issued guidance requiring banks to manage third-party relationships across five lifecycle stages: planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination.11Federal Register. Interagency Guidance on Third-Party Relationships: Risk Management The rigor applied at each stage should match the criticality of the relationship. A core lending platform warrants deep financial analysis, security certification reviews, and business continuity testing. An office furniture vendor does not.
Due diligence should evaluate the vendor’s financial stability, information security posture, regulatory compliance history, insurance coverage, and disaster recovery capabilities. Ongoing monitoring then verifies the vendor keeps meeting those standards after the contract is signed.
Cybersecurity Incident Notification
Federal banking regulators require banks to notify their primary regulator no later than 36 hours after determining that a significant computer-security incident has occurred. The trigger is not every phishing email or malware detection. It applies to incidents that materially disrupt banking operations, threaten business lines whose failure would cause significant revenue loss, or could affect the financial stability of the broader system.12Conference of State Bank Supervisors. Notification Requirements – Bank vs Nonbank The 36-hour clock starts when the bank determines an incident qualifies, not when the breach first occurred. Bank service providers face a separate obligation to notify their bank customers “as soon as possible” after identifying a triggering event.
Examinations, Reporting, and Enforcement
Three federal agencies share bank supervision: the Federal Reserve, the OCC, and the FDIC. Examiners assess how well institutions manage risk and the strength of their financial resources.13Federal Reserve Board. Understanding Federal Reserve Supervision The OCC conducts full-scope on-site examinations of national banks at least once every 12 months, with an 18-month cycle available for certain small institutions meeting specific safety criteria.14eCFR. 12 CFR 4.6 – Frequency of Examination of National Banks and Federal Savings Associations
For regulatory filings, banks use the Federal Reserve’s Reporting Central platform, a single point of entry for submitting reports to the Federal Reserve, the Federal Financial Institutions Examination Council, and the Treasury Department.15Federal Reserve Financial Services. Reporting Central Resources These include Call Reports detailing the bank’s financial condition, stress test results, and other disclosures regulators use between on-site exams.
Banks that fail to maintain adequate risk management face a graduated enforcement toolkit. At the less severe end, regulators may issue matters requiring attention or memoranda of understanding setting deadlines for corrective action. When problems persist or are serious enough, regulators escalate.
Federal banking agencies have statutory authority to issue cease-and-desist orders against any institution engaged in unsafe or unsound practices, which includes deficient risk management.16Office of the Law Revision Counsel. 12 USC 1818 – Termination of Status as Insured Depository Institution Those orders can require the bank to restrict growth, dispose of problem assets, rescind agreements, or hire qualified officers. Civil money penalties for knowing violations of laws, regulations, or cease-and-desist orders can reach up to $1 million per day for an individual and the lesser of $1 million per day or 1% of total assets for a bank.17Office of the Law Revision Counsel. 12 USC 505 – Civil Money Penalty In the most severe cases, regulators can remove individual officers and directors or revoke the institution’s deposit insurance.