From Rules Met? to Risks Managed? Era of Transformation in Bank Monitoring

Across the world, banking supervision is moving decisively from box-ticking compliance to genuinely risk-based oversight. Gone are uniform rulebooks and identical examinations; in their place stand supervisory systems grounded in proportionality, forward-looking assessment, and deep understanding of institutions’ business models. This evolution is neither cosmetic nor optional. It reflects recognition that as finance becomes more digital, interconnected, and exposed to climate and geopolitical shocks, supervisors must look beyond formal compliance to assess whether firms are actually safe and resilient.

In Singapore, the Monetary Authority of Singapore (MAS) has built an ecosystem that integrates risk-focused supervision with active FinTech development. MAS weaves technology-risk assessments and RegTech adoption into its supervisory processes, reflecting its dual role as both regulator and innovation enabler. The challenge it faces is emblematic of modern supervision: how to promote digital transformation while safeguarding financial stability. By embedding tech-risk expectations within prudential reviews, MAS manages to encourage innovation without compromising resilience.

Meanwhile, the European Central Bank (ECB) has launched one of the most ambitious programs of climate-risk supervision. Its 2020 Guide on climate-related and environmental risks set out expectations that are now embedded in its 2025–27 supervisory priorities. Supervisors find that banks can integrate risks once they are formally defined—such as expected-credit-loss models for climate exposures—but struggle to internalize those that require judgment, including geopolitical tensions. This asymmetry reveals a central challenge of risk-based supervision: institutions are adept at managing quantified risks but less prepared for those demanding foresight and qualitative judgment. The ECB’s horizontal reviews and stress tests show that while progress has been made in climate and environmental domains, gaps persist in forward-looking risk capture (European Central Bank Banking Supervision, 2024).

The United States, characteristically, takes a different path. The Office of the Comptroller of the Currency (OCC), through its 2025 Bank Supervision Operating Plan, focuses on credit-risk transfer transactions and third-party risk management, alongside capital optimization and climate-risk governance for large banks. What seems technical actually signals recognition that financial engineering can shift risk rather than eliminate it. U.S. supervisors, operating within a decentralized system alongside the Federal Reserve and FDIC, are cautious yet attuned to structural complexity. Their aim is not only to verify compliance but to ensure governance systems can detect emerging vulnerabilities created by intricate financial innovations (Office of the Comptroller of the Currency, 2024).

In Australia, the Australian Prudential Regulation Authority (APRA) has institutionalized proportionality more transparently than almost any other regulator. Its Supervision Risk and Intensity (SRI) model ranks institutions from Level 0 to 4 based on risk exposure and systemic significance. This determines the scale of supervisory engagement and resource allocation. APRA’s approach—supported by its PAIRS ratings—ensures that attention is concentrated where it matters most. For a system dominated by housing finance, this model allows supervisors to focus on institutions with heavy property exposure while avoiding unnecessary burden on smaller or less risky firms.

The Hong Kong Monetary Authority (HKMA), navigating one of the world’s most geopolitically complex financial environments, has refined its CAMEL+ framework to manage both cross-border and digital-asset risks. As Hong Kong positions itself as a regulated crypto-friendly hub, the HKMA is introducing a licensing regime for stablecoin issuers and integrating virtual-asset oversight into prudential supervision. Its experience underscores that risk-based supervision must adapt to jurisdiction-specific systemic risks—whether those arise from cross-border operations with Mainland China or from the volatility of emerging asset classes.

Post-Brexit, the Bank of England’s Prudential Regulation Authority (PRA) has championed “proactive judgment-based supervision.” The PRA emphasizes operational resilience alongside capital and liquidity adequacy. Its focus extends beyond balance-sheet strength to the practical question: can firms continue critical operations through severe but plausible disruptions? By embedding forward-looking resilience tests and cross-sector coordination, the PRA exemplifies supervision that prizes judgment, adaptability, and scenario planning.

Substance Behind the Shift

Risk-based supervision (RBS) arose because rules-based oversight was both too rigid and too shallow. Uniform checklists could not account for differences in business models or systemic relevance, while their formality obscured emerging concentrations of risk. The shift, therefore, represents a cultural transformation: supervisors must master banking activities as deeply as the bankers themselves. They must interpret interest-rate exposures, climate scenarios, operational dependencies, and vendor networks—not simply verify compliance documents.

Implementation has exposed methodological challenges. Climate-risk supervision, for instance, requires data and models that barely exist. The ECB’s horizontal assessments found that banks have advanced in integrating novel risks like climate but remain ill-prepared for less-codified risks such as geopolitics (European Central Bank Banking Supervision, 2024). Similarly, operational resilience has tested traditional supervisory tools. Under Europe’s Digital Operational Resilience Act (DORA), entering into application in 2025, supervisors must evaluate ICT risk management, incident response, and third-party oversight amid rising cyber incidents. Such supervision demands technical expertise rarely native to financial authorities.

Beyond banks, the expanding universe of non-bank financial intermediaries (NBFIs) complicates RBS further. The Basel Committee warns that NBFI growth introduces opacity and potential contagion channels between traditional banks and shadow banking entities. Supervisors must now assess not only the risks of individual banks but the resilience of entire financial ecosystems (Basel Committee on Banking Supervision, 2024).

The 2024 Basel Core Principles

The Basel Committee’s 2024 revision of the Core Principles for Effective Banking Supervision—the first since 2012—anchors these global shifts in a new normative framework. Endorsed in April 2024, the update integrates lessons from the pandemic, the 2023 banking turmoil, and structural changes in digital and climate finance. The revision highlights operational resilience, systemic-risk management, and proportionality as central pillars. Crucially, it embeds climate-related financial risk into global supervisory standards, signaling that climate considerations are now fundamental to prudential soundness, not experimental add-ons (International Monetary Fund, 2024).

Operational resilience occupies similar prominence. The pandemic and subsequent banking stresses proved that capital adequacy alone cannot preserve stability if operational functions fail. The updated principles thus require supervisors to ensure institutions can maintain critical services under extreme conditions, including cyberattacks and digital runs. Proportionality, likewise, is emphasized: supervisory intensity should match an institution’s size, complexity, and systemic footprint. The objective is efficient risk mitigation, not uniform burden.

Emerging Frontiers

Despite progress, the risk-based transformation remains incomplete. The Basel Committee is continuing work on supervisory effectiveness after the 2023 turmoil, targeting liquidity risk, interest-rate risk in the banking book, business-model sustainability, and—critically—the exercise of supervisory judgment (Basel Committee on Banking Supervision, 2024). The challenge lies not in identifying risks but in acting decisively. Recent bank failures demonstrated that supervisors often saw problems early yet hesitated to intervene.

Digital-finance supervision presents another frontier. The Committee’s November 2024 technical amendments brought crypto-asset exposures into the Basel framework, yet DeFi and tokenized assets still defy traditional categories. Supervisors must reconcile prudential logic with decentralized infrastructure—an inherently moving target. Similarly, third-party risk management has risen to the top of agendas. Banks’ deep dependence on cloud providers and fintech vendors creates concentration and transparency problems that supervision must now encompass.

Geopolitical risk is perhaps the most conceptually difficult domain. Fragmented global trade, sanctions, and regional conflicts affect supply chains and payment systems in ways that evade quantitative modeling. Supervisors must therefore blend financial insight with geopolitical awareness—an uneasy but unavoidable expansion of their remit.

Globally, supervisory convergence is visible in four areas: climate and environmental risk, cyber and operational resilience, third-party dependencies, and NBFI linkages. All major regulators—from the ECB and PRA to MAS, APRA, OCC, and HKMA—now share these priorities. Yet implementation diverges widely due to differing legal powers, political contexts, and institutional capacity. Some supervisors can compel rapid remediation; others must navigate political hesitation or resource constraints. As a result, identical principles can yield disparate outcomes.

Risk-based supervision also introduces new opacity. Under rule-based systems, compliance was binary; under RBS, assessments depend on judgment. This enhances nuance but reduces predictability. Institutions can no longer rely solely on meeting quantitative thresholds—they must persuade supervisors that their risk management is substantively sound. This subjectivity, while necessary, demands robust governance to ensure fairness and consistency.

Future RBS will hinge on three reinforcing developments. First, advanced analytics and AI will augment supervisory efficiency, enabling pattern detection and early-warning systems across large data sets. Second, climate transition risk will remain central, requiring scenario models that capture long-term uncertainty. Third, cross-border coordination must deepen even as political fragmentation grows; financial risks still transcend national lines. The Basel III implementation timeline and the Committee’s ongoing work on supervisory judgment will be key tests of global resolve (Basel Committee on Banking Supervision, 2024).

Ultimately, the transformation from rule-based to risk-based supervision embodies a deeper tension between certainty and judgment. Rules provide clarity but can be blind to evolving risks; judgment captures substance but invites subjectivity. The success of RBS will depend on whether supervisors worldwide can institutionalize sound judgment—through training, accountability, and culture—at scale. When they do, supervision can truly shift from enforcing compliance to safeguarding resilience.

References

SUNANDO ROY – On Banking, Finance and Society

Embedding AI Around the Deterministic Core of SupTech: Where AI Adds Real Supervisory Value

Balancing Supervisory Demands with Licensee Burden — A Perspective

Value Proposition of SupTech Applications

Your cart (items: 0)