Banks manage risk by identifying it in categories — credit, market, liquidity, operational, compliance, and capital adequacy — and applying a mix of internal controls and federally mandated rules to each one. Underwriting standards keep bad loans off the books, hedging instruments cushion market swings, liquidity buffers prevent cash shortfalls, cybersecurity and reporting protocols contain operational failures, and capital requirements sit underneath everything as a final shock absorber. None of this is optional: federal regulators set numerical floors, and a bank that falls below them faces escalating consequences up to seizure and forced resolution.
Credit Risk: Keeping Bad Loans Off the Books
The risk that a borrower stops paying is the oldest problem in banking. Every loan carries a probability of default, and underwriting exists to price that probability before money leaves the bank. Lenders pull pay stubs, W-2s, tax returns, and credit reports to build a picture of income, existing debt, and repayment history.
For mortgages, the debt-to-income ratio was long the central screening tool. The Consumer Financial Protection Bureau originally set 43 percent as the ceiling for a loan to qualify as a “qualified mortgage” with built-in legal protections for the lender. In 2021, the CFPB replaced that rigid cutoff with a price-based standard that compares the loan’s annual percentage rate against a benchmark rate.1Consumer Financial Protection Bureau. CFPB Issues Two Final Rules to Promote Access to Responsible, Affordable Mortgage Credit DTI still matters inside a bank’s own underwriting models, but it’s no longer a single pass/fail test for mortgage qualification.
Commercial lending uses a different toolkit. Analysts work through cash flow statements and balance sheets to determine whether a business generates enough revenue to service its debt. When a loan sours, recovery depends on collateral. Real estate secures most commercial loans; equipment, inventory, or receivables back smaller credit lines. If a borrower defaults, federal law lets the secured lender take possession of collateral through judicial process or, where it can be done peacefully, without a court order.2Legal Information Institute. Uniform Commercial Code 9-609 – Secured Party’s Right to Take Possession After Default
Concentration Limits
Spreading loans across borrowers and industries is basic hygiene, and regulators put numbers on it. Federal rules cap a national bank’s total exposure to any single borrower at 15 percent of the bank’s capital and surplus, with an additional 10 percent allowed if the excess is fully backed by readily marketable collateral.3eCFR. 12 CFR 32.3 – Lending Limits A single large default can otherwise devastate a healthy bank. Beyond individual borrower caps, banks diversify geographically and across sectors.
Charge-Off Deadlines
Banks can’t carry delinquent loans indefinitely. Federal interagency policy requires charge-off of credit card balances and other open-ended accounts at 180 days past due, and installment loans at 120 days. Loans to borrowers who file bankruptcy must generally be written off within 60 days of the bankruptcy filing notice; loans found to be fraudulent, within 90 days of discovery.4Federal Reserve Bank of New York. Uniform Retail Credit Classification and Account Management Policy These deadlines force banks to recognize losses instead of pretending troubled loans will eventually pay off.
Market Risk: Hedging Price Movements
Banks hold bonds, currencies, derivatives, and other instruments whose values shift with market conditions. Interest rate movements dominate — when rates rise, existing fixed-rate bonds lose value. Currency swings affect banks with international operations, and equity moves hit any trading position.
The primary measurement tool is Value at Risk, which estimates the maximum likely loss over a set time horizon at a given confidence level. Under Basel standards, banks typically calculate VaR at a 99 percent confidence level with a ten-day holding period for regulatory capital purposes. In plain terms: what’s the worst we’d lose in the next ten trading days, setting aside the most extreme 1 percent of outcomes? When VaR flags elevated risk, banks hedge — interest rate swaps to convert floating-rate exposure into fixed payments, or forward contracts to lock in exchange rates for future transactions.
Regulators draw a hard line between a bank’s trading book and its banking book. Instruments held for short-term resale or to profit from price movements sit in the trading book and must be valued at current market prices. Longer-term holdings like loans and securities held to maturity sit in the banking book and follow different accounting and capital rules.5Bank for International Settlements. RBC25 – Boundary Between the Banking Book and the Trading Book The separation stops banks from hiding trading losses by reclassifying assets after the fact.
Liquidity Risk: Staying Cash-Solvent
A bank can be solvent on paper and still fail if it runs out of cash. Liquidity risk splits into funding liquidity (raising new cash through deposits or borrowing) and market liquidity (selling assets quickly without fire-sale discounts). The 2008 crisis showed how fast both can evaporate, and the regulatory response produced specific numerical requirements.
Liquidity Coverage Ratio
The Liquidity Coverage Ratio requires banks to hold enough high-quality liquid assets — government bonds, central bank reserves — to cover their net cash outflows over a 30-day stress scenario. The minimum ratio is 100 percent, meaning a bank must be able to fully self-fund for a month even if depositors flee and credit markets freeze.6Bank for International Settlements. Basel III: The Liquidity Coverage Ratio and Liquidity Risk Monitoring Tools U.S. regulators adopted the LCR rule in 2014.7Federal Reserve Board. Liquidity Coverage Ratio FAQs
Net Stable Funding Ratio
Where the LCR handles short-term survival, the Net Stable Funding Ratio addresses longer-term structural mismatches. It compares a bank’s available stable funding sources (deposits, long-term debt) against the stable funding its assets require. The minimum is also 100 percent. This prevents banks from financing long-term illiquid assets with short-term wholesale borrowing, which is the mismatch that toppled several institutions in 2008.
Contingency Funding Plans
Banks also must maintain a written contingency funding plan for genuine crises. Regulators expect these plans to identify plausible stress events, quantify how much cash the bank would need under each, and map out specific funding sources in order of severity.8OCC.gov. Comptroller’s Handbook – Liquidity A good plan names a crisis management team, sets communication protocols, and uses early warning indicators. Banks that treat the plan as a compliance exercise tend to find out the hard way that theoretical funding sources dry up in an actual crisis.
Operational Risk: Cyber, Fraud, and Vendors
Operational risk covers what can go wrong inside the bank or from external disruptions: cyberattacks, employee fraud, system failures, vendor breakdowns, natural disasters. It’s pure downside — no revenue attached — and it comes from every direction at once.
Cybersecurity Incident Reporting
When a bank determines it has experienced a “notification incident” — one that materially disrupts banking operations, threatens a significant business line, or could affect financial stability — it must notify its primary federal regulator within 36 hours.9eCFR. 12 CFR Part 53 – Computer-Security Incident Notification That’s a tight window, and banks without automated detection and pre-planned escalation procedures will struggle to meet it.
Suspicious Activity Reports
The Bank Secrecy Act puts banks on the front line against financial crime. Banks must file a Suspicious Activity Report with the Financial Crimes Enforcement Network when they detect suspected criminal activity involving $5,000 or more and can identify a suspect, or $25,000 or more regardless of whether a suspect is identified. Suspected criminal conduct by a bank director, officer, or employee triggers a SAR at any dollar amount.10eCFR. 12 CFR 21.11 – Suspicious Activity Report The filing deadline is 30 days from detection, and BSA violations carry steep civil and criminal penalties.
Third-Party Vendors
Modern banks run on dozens of external technology providers, and regulators treat those relationships as an extension of the bank itself. Interagency guidance from the Federal Reserve, FDIC, and OCC requires due diligence before engaging a vendor — information security, operational resilience, disaster recovery, incident reporting — with monitoring that continues through the relationship and scales to the risk of the activity.11Federal Reserve, FDIC, and OCC. Interagency Guidance on Third-Party Relationships: Risk Management Contracts should cover breach notification, source-code escrow if the vendor fails, and specific recovery time objectives. A bank can outsource the work but not the accountability.
Internal Controls
Inside the bank, layered controls prevent any single employee from initiating and completing a high-value transaction alone. Access logs track who touches which systems, authorization levels limit what one person can do, and internal audits look for gaps. Disaster recovery plans keep physical locations and digital infrastructure running after fires, floods, or hardware failures. Third-party audit firms test these safeguards periodically.
Compliance and Fair Lending Exposure
Regulatory failures can hit a bank’s finances as hard as a wave of defaults. The Equal Credit Opportunity Act prohibits discrimination in lending based on race, sex, marital status, religion, national origin, age, or receipt of public assistance. Violations expose a bank to actual and punitive damages of up to $10,000 per individual action, and the lesser of $500,000 or 1 percent of the bank’s net worth in a class action. Courts can award attorney’s fees and order injunctive relief.12eCFR. 12 CFR Part 202 – Equal Credit Opportunity Act (Regulation B) Borrowers have two years to file suit, and where a pattern of violations emerges, the Attorney General can bring a separate enforcement action.
Beyond fair lending, banks navigate rules covering truth-in-lending disclosures, electronic fund transfer error resolution, and much else. The compliance function has grown substantially since the CFPB’s creation in 2010, and it’s expensive to run — cheaper than the alternative.
Capital Adequacy: The Final Cushion
Capital is what a bank uses to absorb losses before depositors or creditors take the hit. Every other tool described above can fail; capital exists for that moment. The Basel Accords, developed by the Basel Committee on Banking Supervision and implemented in the U.S. by the Federal Reserve, OCC, and FDIC, set the international floor.13Federal Reserve Board. U.S. Implementation of the Basel Accords
Minimum Capital Ratios
Basel III requires banks to hold capital as a percentage of risk-weighted assets. Riskier loans demand proportionally more capital behind them. The minimums:
- Common Equity Tier 1 (CET1), consisting of common stock and retained earnings — the most loss-absorbing form of capital — must be at least 4.5 percent of risk-weighted assets.14Bank for International Settlements. Definition of Capital in Basel III – Executive Summary
- Tier 1 capital, which adds “additional Tier 1” instruments like certain preferred stock to the CET1 base, must be at least 6 percent.
- Total capital, adding Tier 2 items such as subordinated debt and loan loss reserves, must be at least 8 percent.
These are bare minimums. Every major bank operates well above them because of the buffers layered on top.
Capital Conservation Buffer and Leverage Ratio
On top of the minimums, banks must maintain a capital conservation buffer of at least 2.5 percent of risk-weighted assets, held entirely in CET1. A bank that dips into this buffer faces escalating restrictions on dividends, share buybacks, and discretionary bonuses; the further into the buffer it falls, the smaller the share of earnings it can pay out.15FDIC. Risk Management Manual – Section 2.1 Capital The design pushes management to rebuild capital quickly.
Basel III also added a non-risk-weighted leverage ratio as a backstop. The minimum is 3 percent of Tier 1 capital relative to total exposure, including off-balance-sheet items, which prevents banks from gaming the risk-weighted ratios by loading up on assets that models classify as low-risk.16Bank for International Settlements. Basel III Leverage Ratio Framework and Disclosure Requirements
Stress Tests and the Stress Capital Buffer
The Federal Reserve conducts annual stress tests on all bank holding companies with $100 billion or more in total assets, evaluating how they would perform under a hypothetical severe recession combining spiking unemployment, collapsing real estate, and plunging equity markets.17Federal Reserve. Large Bank Capital Requirements Results feed into each firm’s stress capital buffer, calculated as the difference between the bank’s starting and minimum projected CET1 ratio under the stress scenario, plus planned dividends. The stress capital buffer floors at 2.5 percent but can be significantly higher for riskier profiles.18Federal Register. Modifications to the Capital Plan Rule and Stress Capital Buffer Requirement Starting with the 2025 cycle, regulators average the current and prior year’s stress results to smooth out year-to-year volatility.
Prompt Corrective Action
When a bank’s capital falls below required levels, regulators don’t wait. Under the prompt corrective action framework, an undercapitalized bank immediately faces restrictions on dividend payments and management fees, and must submit a capital restoration plan. Failure to implement that plan triggers civil money penalties.19eCFR. 12 CFR Part 6 – Prompt Corrective Action A critically undercapitalized bank faces additional restrictions on business activities and payments on subordinated debt. In extreme cases, regulators can place the institution into receivership to prevent broader damage.
When Banks Fail: Insurance and Resolution
Even with every safeguard in place, banks sometimes fail. The system’s final layer keeps failures from wiping out ordinary depositors or cascading through the financial system.
FDIC Deposit Insurance
The Federal Deposit Insurance Corporation insures deposits up to $250,000 per depositor, per insured bank, per ownership category. A single person can hold more than $250,000 in coverage at one bank when funds sit in different ownership categories — an individual account, a joint account, and a retirement account each carry separate coverage.20FDIC. Deposit Insurance FAQs The coverage is funded by premiums banks pay into the Deposit Insurance Fund, not by taxpayer dollars.
Living Wills and Orderly Liquidation
The Dodd-Frank Act requires large banking organizations to submit periodic resolution plans, commonly called “living wills,” to the Federal Reserve and FDIC. Each plan must describe how the company would be rapidly and orderly wound down in material financial distress or outright failure. The largest and most complex firms file every two years; other large firms file every three.21Federal Reserve Board. Living Wills (or Resolution Plans)
For systemically important firms whose uncontrolled collapse could threaten the broader economy, the FDIC has Orderly Liquidation Authority to step in as receiver. It can form a bridge financial company to maintain critical operations, establish a claims process with a minimum 90-day filing window for creditors, and pursue recovery of compensation from executives substantially responsible for the failure.22eCFR. 12 CFR Part 380 – Orderly Liquidation Authority The point is to dismantle a failing giant in a controlled way rather than let it drag healthy institutions down with it.