Managing Risk and Regulation in Retail Banking

Why is risk management central to retail banking?

Banks cannot eliminate risk because taking and managing risk is part of their business model. Accepting deposits creates liquidity responsibilities, lending creates credit risk, payment services create operational and fraud risk, and digital services introduce cyber and data risks.

The objective is therefore to manage risk within clearly defined limits. A bank’s risk appetite sets out how much and what types of risk it is prepared to accept. The Board approves this overall appetite, while policies, limits and controls translate it into day-to-day decisions.

Who is responsible for managing risk?

The Three Lines Model, often called the Three Lines of Defence, helps clarify responsibilities.

The first line consists of the business teams that take and manage risk as part of their activities. The second line includes functions such as risk and compliance, which establish frameworks, monitor exposures and challenge decisions. The third line, internal audit, provides independent assurance that governance, risk management and controls are working effectively.

Clear accountability is essential, but effective risk management also depends on cooperation between all three lines.

What are the main risks retail banks face?

Credit risk arises when borrowers fail to repay as agreed. Liquidity risk is the risk that a bank cannot meet payments or withdrawals when due, while interest-rate risk arises when changes in rates affect assets and liabilities differently.

Banks also face operational risk from failures in people, processes, technology or external providers; fraud risk from criminal activity; and conduct risk where poor products, communications, sales practices or service cause harm.

Banks manage these risks through controls including affordability assessments, monitoring, limits, liquid-asset buffers, diversified funding, authentication, fraud detection and stress testing.

Why are retail banks regulated?

Banks are heavily regulated because failures can affect customers and the wider financial system.

Prudential regulation focuses on keeping banks safe, sound and resilient through requirements covering capital, liquidity, governance, stress testing and risk management.

Conduct regulation focuses on fair customer and market outcomes, including product design, disclosure, responsible lending, complaints and treatment of vulnerable customers.

Retail banks also play an important role in preventing financial crime through customer due diligence, sanctions screening, transaction monitoring and suspicious activity reporting. These controls can add friction, but they help protect both customers and the integrity of the financial system.