Banks may finally be getting the risk-based supervision they asked for. The question is whether the people who actually own risk are ready for what comes with it.
Across the federal banking agencies, the supervisory direction is shifting but it has not yet settled. The Federal Reserve's Statement of Supervisory Operating Principles, the OCC and FDIC's separate proposed rules on what agencies can formally cite as an enforceable violation, and revised ratings criteria for the largest banks all point the same direction: less uniform prescription, more emphasis on material risk and management judgment. None of these are fully final. All of them are shaping examination conversations.
Four Actions. One Direction.
The supervisory reset is not a single rulemaking — it is four distinct regulatory actions moving in parallel. None are fully final. All are active in examination conversations today.
|
Agency |
Instrument |
Status |
|
Federal Reserve |
Statement on Supervisory Operating Principles |
Issued March 2025 |
|
OCC |
Proposed Rule: Supervisory Guidance |
Proposed; not final |
|
FDIC |
Proposed Rule: Supervisory Guidance |
Proposed; not final |
|
Federal Reserve / OCC / FDIC |
Large Bank Rating System Revisions |
Partially implemented; ongoing |
That lag between where supervision is heading and where it has settled is itself a risk.
The Problem Isn't the Framework. It's the Confidence Behind It.
Most large banks already have the architecture: the business risk governance programs designed to guide those calls. The harder question is whether those programs are producing consistent decisions at the point where risk is actually owned — in the business line, at the desk, in the operational process.
Because when an examiner asks a COO or business line head to explain why one issue received resources and another was monitored rather than escalated, the answer cannot be the governance document. It has to be the judgment behind it — a documented rationale that is defensible and consistent enough to hold up across business, risk, and audit review.
That confidence is what many institutions are still building.
Part of why that is hard to build is structural. Business line leaders carry two mandates simultaneously — deliver competitive products and services to clients, and own the risks that come with them. The first mandate has clearer metrics, tighter deadlines, and more immediate consequences. The risk mandate is equally real, but the risk calibration, habits, and decision discipline it requires are rarely developed at the same pace. In nearly every risk and compliance engagement our practice executes, we see this two-pronged accountability scenario create consistent pressure on the risk side — a reflection of how business line roles have historically been built and measured, not a failure of commitment. The supervisory standard is now examining exactly what those historical design choices left underdeveloped — and the consequence of that gap is immediate. The structural separation of the first and second lines — well intended and widely adopted — had an unintended consequence: risk fluency concentrated in the second line, leaving the first line precisely where the new supervisory standard is now looking.
For banks looking to close that gap at scale, AI-assisted decision support — applied to rationale documentation, materiality thresholds, and issue pattern recognition — is emerging as a practical first line tool. But the tool only works if the accountability is already assigned. AI does not create ownership. It supports it.
Three Questions for First Line Risk Owners
1. If your risk and compliance team ranked your top issues independently — would their list match yours?
If the answer is uncertain, the risk decision discipline isn't working at the point of execution. It's working on paper.
2. Can you explain, right now, why a specific issue was monitored rather than escalated?
Not the process that produced the decision. The rationale. Strong governance isn't demonstrated by escalating everything — it's demonstrated by making disciplined choices and being able to defend them when asked.
3. Are your resources concentrated where your risk is highest — or where your next deadline is?
Examination dates and remediation commitments matter. But they are not how risk should be prioritized. The difference between the two is increasingly what examiners are probing.
Why This Moment Is Different
As long as supervision was largely prescriptive, banks could demonstrate compliance through process. Follow the procedure, document the step, close the finding.
That standard is changing. The emerging expectation — still being operationalized across agencies, still unevenly applied across examination teams — is that management judgment effectively becomes part of how risk is actually managed day to day.
Institutions that recognize this early have an opportunity. Those that wait for the standard to fully settle before demonstrating substantive first line accountability may find the examination conversation has already moved past them.
A Final Thought
The shifting supervisory standard is still settling. The examination conversation is not waiting for it.
If there is uncertainty about whether your materiality judgments would hold up under examiner scrutiny, Eliassen Group's Risk & Compliance Advisory practice can help your teams establish the business discipline that turns risk ownership from a mandate into a demonstrated capability.
Author
Steven Engel
Director, Risk & Compliance Solutions