Dear RiskBowl, Thoughts on where Compliance typically sits in the risk taxonomy? We’ve gathered examples of Compliance as a Level 1 risk category, but have you seen examples of when Compliance is at Level 2 under Operational Risk at Level 1? Thanks

Oliver Wyman is conducting a Risk Modelling Technology Benchmarking Survey to gather insights into risk modelling technology stacks, challenges, cost drivers, and migration plans within the banking sector across the UK and EU. The survey mainly consists of multiple-choice questions and is targeted at the risk modelling technology users (including regulatory change programs leaders, regulatory model owners and model developers). RiskBowl users are invited to participate – your input will help generate valuable benchmarking data, which will be shared exclusively with participants. We kindly request that the survey be completed by 21st November, with a view to share results by the end of November Access the survey here Should you have any questions, please feel free to reach out to Angelina Egorova, who is leading this initiative within our London F&R team. Thank you for your time and cooperation.

Risk Function of the Future As banking leaders look beyond 2025 toward 2030 and beyond, a series of “big debates” are emerging within the industry. How individual banks and banking sector as a whole resolve these debates will in large part shape the environment in which Risk functions operate, influencing priorities, resourcing, and governance structures over the coming decade. The Risk function of the future will need to be prepared for multiple, simultaneous pressures. First, it must respond to growing end-customer expectations for seamless experiences, while maintaining resilient performance, a combination that increasingly carries a high premium in competitive markets. Second, Risk functions must be ready for the next financial crisis, which many analysts view as increasingly “due” given historical cycles and macroeconomic pressures. Third, the function must confront actual climate-related risks, moving beyond scenario exercises to tangible, measurable mitigation and monitoring. Fourth, AI mastery will no longer be optional; it is rapidly becoming a table-stakes capability for Risk teams, both for efficiency and for insights-driven decision-making. While AI presents significant opportunities, Risk functions must approach it with both enthusiasm and realism. Many of the tasks performed by Risk involve “trust functions” i.e., oversight, challenge, and independent verification, which cannot be fully automated. Therefore, AI should be leveraged strategically, deployed where it adds measurable value, and integrated thoughtfully into existing control and assurance frameworks. Beyond technology, we also see a broadening of Risk’s remit. The Risk function is increasingly positioned to serve as the bank’s protector of truth, ensuring that information, assumptions, and metrics across the institution remain reliable, consistent, and auditable. In this sense, Risk is not just a defensive or compliance-oriented function; it is a guardian of credibility, playing a central role in how the bank navigates uncertainty, innovation, and stakeholder expectations over the next decade. Risk Vision and Strategy AI in Risk In the near term, Risk will enhance human productivity with GenAI as a supportive ‘co-pilot’, while waiting for more reliable technology before fully evolving into dynamic, specialized AI-human collaborative networks in 2030 In the next two to three years, leading Risk functions will deploy GenAI as a disciplined co‑pilot to amplify human productivity, prioritizing discovery and drafting tasks, supported by expert predictive scaffolding and anchored in high‑quality data repositories (including GRC/ RCSA tooling). Scope for holistic process reimagination however remains limited in scope until reliability materially improves, which we anticipate in the next decade and beyond As AI accuracy surpasses 99%, Risk will then transition into dynamic, specialized AI‑human collaborative networks, where orchestrated agents operate in real time under human supervision, unlocking scale, speed, and sharper decisioning across the enterprise Governance Future Risk Governance will strike a dynamic balance between 1/2LOD responsibilities, embrace (some) agile FinTech-inspired practices, deeply embed risk culture in the organization, and streamline governance Risk governance is migrating to a pragmatic equilibrium in the three lines of defence, with mature-risk activities moving closer to the first line for tighter business alignment while the second line rapidly builds expertise in novel risk types. At the same time, agile practices borrowed from FinTechs are reshaping ways of working, integrating risk early in decisions, preserving independence, and elevating a strong, lived risk culture across the enterprise To make this shift stick, successful Risk functions will simplify and rationalize committee structures, delegate more decision rights to where the information is richest, and advance the governance toolkit so oversight becomes faster, clearer, and more effective in a more volatile world Risk Pillars Credit risk The Credit Risk Function of the Future will reduce involvement in individual transaction approval and annual reviews, assessing risk based on real-time data In the near term, leading institutions will deploy AI to strengthen origination and monitoring, using targeted automation to boost coverage, consistency, and speed without compromising control or judgment Over time, these capabilities will converge into a fully integrated human-AI credit system that continually assesses risk using real‑time data and drives decisions through a “zero‑ops” approach—minimizing manual intervention while elevating oversight and outcome quality As accelerated digitalization and lending commoditization reshape the market, automated decisioning systems will expand in scope and ticket size, becoming a core engine of scalable growth and disciplined risk management Non-Financial Risk, Compliance and Economic crime The NFR function will revolutionize into a real-time and strategic response unit, integrating automation, AI and strategic accountability As non-financial risk capabilities modernize, previously manual processes will be seamlessly automated and orchestrated in real time, elevating regulatory adherence while shifting the function from reactive remediation to proactive risk management Continuous control testing, real-time compliance execution, and end-to-end accountability will hardwire strategic collaboration across the bank and direct control spend to the highest‑impact areas, creating a faster, clearer, and more anticipatory line of defence Model risk MRM is evolving into a proactive enabler of safe AI adoption, balancing innovation with oversight Model Risk Management is shifting from gatekeeper to catalyst, embedded in high‑impact initiatives to enable AI‑driven innovation, while moving earlier into the model lifecycle to strengthen oversight and collaboration with the first line. At the same time, supervisors are raising the bar on transparency and accountability for AI and third‑party models, pushing firms toward materially stronger governance frameworks that balance speed with safety Enablers Risk analytics, Modelling and Data Future Risk Analytics will leverage modularized toolkit powered by centralised data assets, and expand insights by harnessing unstructured big data for stronger predictive power Successful Risk functions will industrialize analytics by building centralized toolkits with standardized code modules that can be reused across multiple use cases, all powered by centralized data assets that act as a single “golden source” for the entire analytical suite Risk specialists will then harness GenAI to accelerate documentation, code generation, and peer reviews, shifting time from manual effort to deeper analysis and faster decisioning In parallel, the function will broaden its data universe by incorporating unstructured big data to materially strengthen predictive power, improving the accuracy, timeliness, and relevance of insights delivered to the business Talent The future Risk workforce will blend critical thinking, tech savvy, and risk intuition, while winning talent through diverse experiences, agile work styles, cutting-edge tech, strong culture, and inspiring leadership To build the risk function of the future, CROs must cultivate a more well‑rounded cadre of professionals, combining critical thinking, a big‑picture perspective, risk intuition, and strong technology literacy and analytics, while competing effectively in the war for talent by offering diverse experiences, more agile ways of working, advanced tooling, a strong, lived culture, and thoughtful leadership that inspires and retains new generations of risk experts In sum, the Risk function’s next chapter will be defined by its ability to simultaneously elevate customer experience, withstand systemic shocks, operationalize climate risk, and master AI, while preserving the integrity of core “trust functions” through disciplined oversight and human judgment. As governance evolves toward a pragmatic equilibrium across the lines of defence, with agile, FinTech‑inspired practices and a lived risk culture, Risk will increasingly act as the bank’s protector of truth, ensuring reliable, auditable decisioning in a more volatile world. Credit will transition toward integrated, real‑time, human‑AI systems that expand automated decisioning without sacrificing outcome quality; NFR and Compliance will become proactive, real‑time control engines; and Model Risk will shift from gatekeeper to catalyst, enabling safe, transparent AI at scale. Underpinning this transformation, centralized data assets, modular analytics, and GenAI‑accelerated workflows will industrialize insight generation, while unstructured data broadens the field of vision. Ultimately, success will hinge on talent i.e., blending critical thinking, risk intuition, and technology literacy, supported by inspiring leadership and agile ways of working. Those banks that commit early, invest thoughtfully, and embed these capabilities end‑to‑end will not only manage risk more effectively; they will compete and differentiate in the decade ahead