Accenture Global Risk Study Banking 2019
Accenture Global Risk Study Banking 2019
Accenture Global Risk Study Banking 2019
of control
Accenture 2019
Global Risk Management Study
Banking Report
Discover how banking leaders are taking a holistic
view of the risk landscape, prioritizing what they
do know and preparing for what they don’t.
Contents
3 17
INTRODUCTION SECTION 4
Evolving ecosystems, Combatting cyber threats
evolving threats in a digital, open banking era
7 21
SECTION 1 SECTION 5
Financial crime: a Don’t overlook LIBOR
disaggregated ecosystem retirement
exposes new vulnerabilities
25
SECTION 6
12
SECTION 2 How banks can manage
Credit risk: a new way today’s major threats
to tackle an old foe
28
CONCLUSION
14
SECTION 3 Define your sphere of control
AI tools ease compliance
with new regulation
INTRODUCTION
Evolving ecosystems,
evolving threats
Banking risk teams need a fresh approach to manage
the threats unleashed by emerging technology,
open banking, and relentless competition.
Welcome to This year we explore how banks are responding to emerging risks,
particularly those relating to financial crime, credit risk, changing
Accenture’s
regulation, cyber threats and LIBOR retirement.
Management
which uncovers how 683 surveyed risk interconnected new risks are emerging at
executives across the entire financial a more rapid pace than ever before. Nearly
services industry, including those working six in ten say that disruptive technology
on banking.
increasing pace and volume of change
outside the four walls of the organization. A major cause of their concern relates to
the growing adoption of new technologies
What did we find in the survey? across the organization. Of course, these
Let’s quickly recap before delving technologies hold immense potential
deeper into the banking findings. to unleash growth and drive efficiencies,
but risk functions worry about the potential
for unforeseen consequences, which
they are currently not capable of
identifying or assessing.
57%
Faced with an increasingly complex, but data-rich Technology aside, an effective risk function is one
risk environment, risk functions should invest in that is armed with the data it needs to anticipate,
smart technologies such as artificial intelligence assess, and ultimately mitigate emerging threats.
(AI) and natural language processing (NLP) that
have immense potential to improve effectiveness But today, many are not. For example, 57 percent
and efficiency. Indeed, survey respondents that of our study respondents expect to use marketing
have deployed machine learning feel much more data to support their risk management activity in
of our study respondents confident that they have prepared their business two years’ time, but only 39 percent do so today.
expect to use marketing for volatile future scenarios.
Getting access to relevant data is one thing, but
data to support their risk But while the benefits are significant, risk functions’ maintaining the quality and knowing how to analyze
management activity in use of the most sophisticated technologies is it effectively to generate useful insights remains a
two years’ time, but only currently limited. Our study findings indicate that significant challenge. The risk managers we surveyed
as part of the 2019 Global Risk Management Study
39 percent do so today. the risk function is aware of the need to embrace
realize that they fall short here, so they are urgently
these new tools, but is simply slow in making
effective use of these to date. seeking to improve both their data-collection and
analysis skills: 63 percent are urgently improving
their ability to collect enterprise-wide data, and
66 percent are honing their ability to analyze it.
Which threats are our cohort Top of the list is financial crime. Credit risk This creates a long-term strategic threat in
is second, and evolving regulation and the form of loss of market share. But it also
of 255 bank risk executives most cyber threats are joint-third. causes immediate vulnerabilities that make
concerned about? We asked risk financial crime and cyber attacks harder
managers as part of Accenture’s Risk leaders have grappled with these to detect and prevent.
2019 Global Risk Management threats for years. But the nature of each
of them is now changing, which demands This report looks at the most pressing risks,
Study, and found them concerned new responses. Traditional risks have explores how threats are changing, and
about the old and the new. morphed into more challenging threats, sets out a way for banks to respond.
in part due to the banking ecosystem being
in flux. Gone are the days when customers
purchased all of their banking services from
large household names; new entrants,
open banking regulation and advances in
technology mean that the heritage industry
players now face stiff competition from
challenger banks and FinTechs (financial
technology firms) for an increasing scope
of products and services.
Financial crime:
a disaggregated
ecosystem exposes
new vulnerabilities
Surveyed banks pinpoint financial crime
as their top concern (see Figure 1).
That is no surprise: Every year, banks have to invest millions Figure 1. Areas of greatest concern to the banking industry
in anti-money laundering (AML) and know-your-customer Thinking specifically about the banking industry, which of the following
areas are currently causing your business the greatest amount of concern?
compliance. Research puts the total figure at $25bn annually
for U.S. financial services,1 and at $20bn annually in Europe.2
Those that don’t make this investment also run the risk of
incurring significant regulatory fines and reputational damage. Financial crime, including AML & fraud 49%
Costs aside, risk and compliance procedures implemented to Credit risk 35%
prevent financial crime can themselves create a risk of adding Financial crime and credit
too much friction to the customer journey, whether it be the risk cause greatest concern
identification requirements for opening a new bank account or
credit card transactions that are declined due to fraud concerns. Evolving regulation 29%
Increasing frequency & sophistication of cyber threats 29%
This all represents a huge headache, but it is not necessarily Customer interest in technology-enabled offerings 25%
new. So why is financial crime the top worry today? Emergence of non-traditional competitors 20%
Shifts in the macroeconomic variables 19%
Open banking models 15%
Impact of geopolitical change in key regions 13%
Maturity of the business cycle 13%
Growth in sub-prime 11%
Retirement of LIBOR 7%
Figure 2. Level of confidence in managing Put simply, financial crime is becoming more
the impact of financial crime complex. Today, bad actors use sophisticated
How confident are you that your risk function is set up to fully support cyber attacks and seek to exploit gaps in the
your business in managing threats related to financial crime? increasingly complex banking ecosystem
to perpetrate financial crime.
12%
Instead, they are encouraged to do two things.
First, they should explore how smart technologies But these tools are only as good as the data
such as AI and machine learning can assist in that feeds them. Unless banks devote effort and
detecting and preventing financial crime. We know resources into cleansing and synthesizing their
that only 12 percent of surveyed risk functions use data, these technologies could spit out false
machine learning, but it could be invaluable in positives. So, significant investment in data
Only 12 percent of
spotting the anomalies in data that might indicate should accompany investment in analytical tools.
financial crime. They can also learn patterns in surveyed risk functions
data—such as a known risk entity combined with Second, risk managers should reconsider how use machine learning.
an obscure structuring arrangement—that indicate financial crime risk is managed. Threats are now
malicious activity, and flag when they occur. appearing at the intersections of previously
discrete risks, so a siloed approach—where specific
To be effective, this should take place in real time in teams manage individual threats—won’t work.
multiple channels across the enterprise. Of course,
firms should strike the right balance between Instead, risk teams should explore a ‘hub and spoke’
limiting fraud and not introducing significant model. The ‘hub’ provides centralized expertise
friction into the customer experience. and oversight, and the spokes specialize in specific
categories of financial crime.
AI tools ease
compliance with
new regulation
The post-crisis tidal wave of financial services regulation has
passed, but banks surveyed as part of the 2019 Global Risk
Management Study still cite evolving regulation as their
joint-third most pressing concern, alongside cyber threats.
Why is regulation still such a concern? How can regulatory risk be managed more Banking risk managers should also get better
For a start, there is the cost. Banks have effectively? The first step is to clarify where at engaging with regulators. As regulators ask
invested significantly in complying with the balance of responsibility lies between the for more and more datasets, risk teams are
privacy regulations such as the General Data first and second lines of defense for designing expected to improve their ability to produce
Protection Regulation (GDPR), and are vulnerable and testing the risk controls adopted in data and analytics on demand. And effective
to huge fines if they do not comply or suffer a response to new regulation. engagement is consistent engagement:
significant data breach. Then there is increased Banks should look at their internal organization
supervision of banks. Rather than just laying In parallel, risk managers should investigate and decide who will be responsible for
down the law, regulators are now more proactive and deploy some of the latest tools and work working with regulators so that a consistent
in checking compliance and requesting data processes that identify and then assess the response is provided.
that demonstrates compliance. consequences of regulatory changes.
Risk functions should also demonstrate data
Indeed, we have observed that leading risk transparency and traceability to regulators.
That is all taking its toll: functions have deployed AI and machine learning- In the future, they may have to articulate how
based technologies that scan speeches, news
Just 10 percent of surveyed outlets and regulators’ websites for information
their organizations are deploying technologies
such as AI responsibly so that certain sections
banks are highly confident that indicates that new regulation is being of society are not discriminated against.
in their ability to manage considered. These tools then track proposed
regulatory risk. regulation as it passes into law. When it is, they scan, One simple practical step that can be taken to
synthesize and de-duplicate relevant regulatory bolster relations is to invite relevant regulatory
text before it is ingested into the organization, stakeholders to observe the disruptive work
where it is analyzed in order to create actionable that is happening at innovation labs.
objectives. This approach has the added benefit of
creating an audit trail of how banks apply new rules.
Combatting cyber
threats in a digital,
open banking era
The increasing frequency and sophistication of cyber
threats is surveyed as banks’ joint-third greatest risk.
43%
for example, detect and classify malware or to identify suspicious
activity across the network, new technologies such as AI and
machine learning offer one answer.
However, only 43 percent of banks The organization should train its people
surveyed as part of Accenture’s 2018 to spot malicious activity, such as phishing;
State of Resilience Study use machine categorize its most important data; and
Only 43 percent of banks
learning and AI for cyber security.4 make sure that this data is protected.
That might be a disappointingly
use machine learning and
low proportion, but it does offer Banks should also make sure that their AI for cyber security.
immediate scope for banks to improve ecosystem alliances are getting the cyber
their cyber resiliency by deploying security basics right. Only 38 percent of the
sophisticated technology. State of Resilience banking respondents
hold their alliances to the same cyber
Yet there is work to do first. These security standards as themselves,5 so they
technologies should only be deployed should prioritize a collaborative approach
once the basics have been implemented: to getting cyber defenses up to standard.
Don’t overlook
LIBOR retirement
The 2021 retirement of LIBOR and transition to
other interbank offered rates (IBORs) may not
pose an immediate threat that is of the same
magnitude as other risks discussed in this
report, but it can’t be ignored.
Whether it is the risk of basis But our Global Risk Management Study
exposure, the sheer effort required to reveals that this call has, to date, gone
update LIBOR provisions in contracts, unanswered. Tellingly, just 7 percent
or managing conduct risk, LIBOR of banking risk managers cite LIBOR
transition is a major undertaking that retirement as a top-three concern.
demands proactive risk management. They have not even recognized it as
a major threat, let alone started to act.
Non-risk business leaders
acknowledge this and have called Now it is time for risk leaders
on risk teams to assist. Almost to step up. Instead of simply
three-quarters of financial services recalibrating risk models, they
businesses surveyed in Accenture’s should work collaboratively
2019 LIBOR Survey say risk with other business functions
management and front-office quant to unearth the impact on
teams are of greater importance the entire business.
in supporting LIBOR transition.6
Second, risk managers should establish Conduct risk should also remain in focus.
a robust framework to assess and manage Whether in relation to client interactions
the risks associated with the transition. This or contributing to the new benchmark,
should cover how the transition impacts a risk managers should devise measures
range of risks, including foreign exchange to protect clients and markets from abuse.
(FX) risk, liquidity risk and operations risk. This could involve enhanced training
Importantly, risk teams should assess how controls or market education programs.
these risks materialize both internally and
externally. A poorly timed and ill-executed In parallel, risk teams should review new
transition strategy—both internally and amended products to make sure
and across the entire financial services they do not adversely impact clients.
industry—could potentially leave firms The outcome of this, and the fact that
with illiquid assets, higher capital charges it has taken place, should be clearly
and significant operational risk. communicated to customers and built
into outreach and negotiation strategies.
But there are a number of steps that risk managers can take to effectively
position their business to cope with new threats. These are:
Risk managers should first map out how risks are related It is impossible to standardize data across the
before they can organize their teams to manage them. entire organization. But risk managers should still
For example, it is impossible to adequately manage implement the necessary structures and governance
financial crime without an understanding of cyber controls to keep data as clean as possible. AI tools
security risk and open banking. can also be deployed to cleanse data.
Define your
sphere of control
Unknown, interconnected risks are multiplying at a
faster rate than ever before. It is impossible to try and
control all aspects of the complex business environment
in which banks operate, and the faster that risk leaders
acknowledge this fact, the better.
Firstly, risk functions should prioritize what matters most. Those who can draw a clear line between the factors
Taking a holistic view of the risk environment, they should
have clear criteria to gauge the value of their assets and
they control and the factors they cannot are taking
assess which are most critical to protect. an important step towards focus and prioritization.
Equally, the risk management function should focus
Secondly, leaders should prepare their function by allocating
its efforts and energy on preparation and planning,
resources smartly, embracing the latest tools and technologies,
and upskilling their people so they can wield them reliably.
rather than on prediction—so irrespective of the
cause of the issue, the bank is ready to respond
Finally, risk leaders should build a more proactive function, effectively to mitigate the impact.
diligently scanning the horizon for the next threats, as risks
evolve and approach in unfamiliar forms. Rather than plan for This is how to manage your sphere of control.
specific eventualities, they should continue to prepare for
disruption—looking outwards in every direction.
2 ”Europe is losing the fight against dirty money,” Politico, April 5, 2018.
Access at: https://www.politico.eu/article/europe-money-laundering-
is-losing-the-fight-against-dirty-money-europol-crime-rob-wainwright
4
“2018 State of Cyber Resilience for Banking & Capital Markets,” Accenture 2018.
Access at: https://www.accenture.com/us-en/insights/financial-services/
2018-state-of-cyber-resilience
5
Ibid
6
“Accenture 2019 LIBOR Survey,” September 2019
Contributors: Sam Regan, Andrew Solow, Tales Lopes and Jeff Jamison
@AccentureFSRisk