Proactive by Design:
How Are Banks Embedding Non-Financial Risk (NFR) into Strategy, Growth and Culture?
F ORE C A S T October 2025
Proactive by Design:
Key takeaways
The XLoD Leaders’ Network in New York covered the most critical risks facing the 3 lines of defence.
Banks are drawing a bold line between financial and nonfinancial risks:
- NFR has outpaced the old playbook:
- The risk landscape has exploded across cyber, data, resilience, third parties, and digital assets.
- Firms are moving towards two clear buckets: traditional financial risks on one side, and a unified NFR and resilience discipline on the other, with governance models being rebuilt around this split.
RCSA is being exposed as outdated and reactive:
- 1st line ownership is no longer optional.
- Regulators expect the business to own NFR, not the 2nd line.
- Banks are openly challenging the value of RCSA as a discovery tool. They are turning instead to scenario analysis, root-cause transparency, and end-to-end process mapping to uncover risks before they erupt.
NFR risk appetite is still vague, and culture and strategy are becoming NFR’s real front line:
- Leading firms are setting hard tolerances, linking them to growth plans, and requiring control signoffs before expansion can proceed.
- Businesses must articulate how they will achieve growth and manage the risks involved.
From Reactive to Proactive: How Banks Reshaped Non-Financial Risk Management in an Era of Complexity
The first debate explored how NFR had evolved in scale, complexity, and importance, and participants noted that a significant shift in the risk landscape led to challenges in frameworks and governance. They discussed the varying maturity of different risk types and the crucial role of ERM in bridge-building between them.
- The role of regulators came up repeatedly, emphasizing that governance failures would attract criticism post-incident.
- Firms rely on a mix of internal debate and external consultancies to redefine their risk taxonomies.
Instead, firms are combining RCSA with more forward-looking techniques such as scenario analysis and incident root-cause analysis. Several examples illustrated how significant losses arose from interconnected operational issues.
Operational risk events remained powerful catalysts, and engaging senior business heads with concrete loss stories was crucial for serious conversations about NFR. However, the ambition is to shift focus from reactive responses to proactive planning.
Participants discussed establishing tolerance levels for operational losses, aligning them with growth plans, and requiring explicit sign-offs for business expansions based on risk capacity.
Culture and behaviour were underlying threads throughout the discussion:
- Many acknowledged that NFR is often overshadowed by financial priorities.
- Changing organizational dynamics involves shifting the valuation of NFR insights into strategic decision making rather than merely another compliance requirement.
Why Culture Still Trumps Controls: Lessons on Risk, Conduct and Organisational Behaviour
The second discussion emphasized the importance of culture over controls or conduct in effective NFR management. Participants highlighted the need for the right behaviours and leadership to create an environment of accountability, where self-identification of issues is prioritized, reflecting a strong risk culture.
Measuring culture emerged as a complex challenge, with firms experimenting with various proxies and indicators to gauge the internal environment and effectiveness of communication regarding risks.
This led to a recognition of the interconnectedness of culture, conduct, and controls rather than viewing them as competing priorities. The conversation framed culture as observable behaviours and practices impacting the control environment.
Global
2026
LONDON NEW YORK SINGAPORE
30&1 24 21
June July September October
XLoD Global is the leading event globally for non-financial risk and control leaders from across the 3 lines of defence.