The fastest-growing risks in banking today no longer appear in the credit book or on the trading floor. They hide in data pipelines, cloud servers, and AI models.
Cybersecurity, data governance, and artificial intelligence are no longer back-office concerns - they are balance sheet issues.
As digital systems underpin nearly every transaction, regulators and risk managers are waking up to the realization that operational resilience is now financial resilience.
A senior risk executive at a global investment bank recently remarked that “the line between technology risk and financial risk has evaporated.”
That sentiment reflects a broader industry consensus emerging from recent supervisory guidance by the European Central Bank, the Federal Reserve, and the Bank for International Settlements.
Each has warned that cyberattacks, data breaches, or AI malfunctions can trigger liquidity and capital implications as material as credit shocks.
In the past two years, cyber events have escalated in both scale and sophistication. Attacks on third-party providers and cloud service dependencies have exposed vulnerabilities that traditional vendor risk frameworks fail to capture.
According to a report by Deloitte, global financial institutions now face an average of over 1,000 attempted cyber intrusions per week, with 70 percent of those targeting data-rich environments such as payments, treasury, and trading infrastructure.
The financial impact can be devastating. The World Economic Forum estimates that a severe cross-border cyber event could erase up to $3 trillion in market capitalization globally.
Yet most banks still treat cyber risk as an operational issue, managed by IT rather than integrated into treasury, balance sheet, and capital planning frameworks.
That siloed approach is changing fast. Regulators are demanding that banks incorporate technology-driven losses into stress testing and capital adequacy assessments.
The Basel Committee’s principles for operational resilience now require firms to map critical functions end to end - including digital dependencies - and demonstrate recovery capability within set time limits.
This has transformed cyber preparedness into a board-level risk discipline.
Artificial intelligence adds another layer of complexity. Generative AI tools and machine learning models are being adopted across credit underwriting, fraud detection, and liquidity forecasting.
But without robust governance, these same tools can amplify systemic risks. An AI model that misprices credit risk or misinterprets market data could distort portfolio valuations and lead to cascading financial losses.
A chief data officer at a major retail bank recently warned that “AI risk is data risk.” He explained that flawed or biased training data can produce models that behave unpredictably when market conditions change.
