For several years now, cyber threats have consistently topped the list of the most significant risks for banks worldwide. However, in this year’s EY and Institute of International Finance (IIF) global risk management survey, geopolitical risk surged to third place, climbing from twelfth just a year ago—a reflection of escalating global tensions.
According to the 14th edition of the EY–IIF banking risk survey, titled “Agility in the Face of Volatility: Rebalancing CRO Priorities in a Shifting Risk Agenda”, the dominant risks facing banks today stem primarily from external forces—ranging from monetary policy and trade frictions to geopolitical conflict, as well as evolving business models and accelerating digitalization.
Top 10 Risks for Chief Risk Officers (CROs) in the Next 12 Months
The sharp rise in geopolitical risk is directly linked to the war in Ukraine, ongoing conflicts in the Middle East, and intensified global trade tensions. As a result, 38% of CROs now view geopolitics as a major risk, a 137% increase from the previous year (when it was just 16%). That makes it the second most cited risk, after cybersecurity, which remains a top concern for 72% of respondents.
Other top concerns include:
- Regulatory change (36%)
- ESG-related risks (31%)
“Cyber risk continues to dominate year over year, but the rapid ascent of geopolitical risk is striking,” says Paweł Preuss, EY Poland Partner and Financial Sector Leader. “CROs are facing a growing diversity of threats and are taking increasingly proactive and agile approaches to risk management.”
Interestingly, systemically important banks (G-SIBs) ranked regulatory risk higher, with 55% citing it as a top concern, which is unsurprising given their greater exposure to international regulations such as Basel III.
Looking ahead, cybersecurity will remain the top priority for CROs over the next three years, alongside concerns over technology adoption, AI, geopolitical risk, and sustainability.
Geopolitical risk perceptions vary by region and bank size, but among G-SIBs, 64% ranked it among their top five risks.
“Geopolitical risk goes beyond wars or trade conflicts,” notes Janusz Miszczak, EY Partner and Head of Financial Risk Management. “It includes state-sponsored or criminal cyberattacks, making it a critical focus for risk leaders.”
To mitigate geopolitical risks, CROs are focusing on:
- Strengthening IT system security
- Scenario-based risk planning
- Enhancing regulatory compliance frameworks
More than half (56%) of respondents expect geopolitics to become a key strategic priority.
Financial Risk: No Longer in the Spotlight
Interestingly, financial risks no longer feature among the top 10 concerns for CROs. However, some remain relevant:
- Wholesale credit risk (cited by 33%)
- Retail credit risk (24%)
- Liquidity and funding risk (19%)
- Interest rate risk in the banking book (IRRBB) (18%)
“Banking is essentially about managing financial risk, and years of investment in people and systems have paid off. CROs today are confident in their ability to control these risks,” says Miszczak.
Most respondents (67%) feel their financial risk frameworks are adequate, while a quarter say they meet best-practice standards. To mitigate risks further, CROs are planning:
- Tighter credit standards, especially for high-risk sectors
- Stronger collateral requirements
Climate and Sustainability Risk (ESG)
Over half of CROs (53%) identified ESG disclosure as a serious, primarily reputational risk. Other concerns include:
- Direct impacts of climate change (48%)
- Sustainability transition risks (44%)
- Managing public ESG goals (42%)
“Although ESG risk has become slightly less prominent compared to previous years, ESG reporting—especially under the EU’s CSRD directive—remains a central concern,” says Paweł Flak, EY’s FS Regulatory Advisory Leader.
Looking ahead, 63% of CROs believe climate risk will increasingly affect credit risk over the next three years, while reputational risks from ESG issues are expected to gradually decline.
Regulatory Pressure: A Growing Burden
With banks operating across multiple global jurisdictions, regulatory fragmentation is a key challenge. More than half of CROs cited prudential regulation, operational resilience, and cybersecurity regulation as top regulatory concerns.
As for Basel III compliance:
- 21% of respondents are close to finalizing implementation
- 18% have already completed it
- Systemically important banks (G-SIBs) lead the way
Larger banks are especially concerned with how capital requirement changes affect competitiveness and compliance costs. Significant regional differences persist—particularly between the US and the EU—with implications for capital adequacy and liquidity.
Operational Resilience: Still Not a Top Five Risk
The high-profile IT outages of summer 2024 served as a stark reminder of the need for comprehensive business continuity strategies. While CROs rank cybersecurity, data integrity, and technology as key to improving resilience, only 14% of CROs at the largest banks place operational resilience among their top five risks.
Artificial Intelligence in Risk Management
AI adoption is accelerating across risk functions:
- 45% of CROs use AI for data analysis and anomaly detection
- 41% automate operational tasks
- 40% use AI to analyze documents
AI is already being used to manage:
- Fraud risk (59%)
- Regulatory compliance (44%)
- Credit risk (40%)
However, challenges remain:
- Budget constraints
- 60% struggle to implement responsible AI frameworks
- 42% cite a skills gap in AI-related competencies
As a result, CROs are actively seeking talent with both business and technical AI expertise. Half of respondents believe that attracting and retaining such talent will become increasingly difficult in the banking sector.
About the Survey
Conducted between September and November 2024 by EY in collaboration with the Institute of International Finance (IIF), the survey covered 115 banks across 45 countries. The largest respondent groups came from:
- North America (31%)
- Europe (25%)
- Asia-Pacific (16%)
- Latin America (15%)
- Middle East (13%)
Source: CEO.com.pl
