Banks Lose Regulatory Safety Net

A fundamental shift is underway in banking supervision, one that is forcing institutions to rethink how risk is defined, governed, and ultimately owned.

The move away from highly prescriptive rulemaking toward a more principle based approach is reshaping the relationship between regulators and banks, placing far greater responsibility on firms themselves to determine what good risk management looks like in practice.

For Darrin Benhart, Chief Regulatory Officer at KeyBank, this transition marks a decisive break from the past.

“Previously regulators often set a large portion of the risk management organization’s priorities,” he said, describing an environment where compliance agendas were often driven externally rather than aligned with the institution’s strategic objectives.

That model is now evolving. Banks are increasingly being given the latitude to define their own priorities, recalibrate risk appetites, and tailor frameworks to reflect their business models.

“Today, banks definitely have a lot more flexibility to set their own priorities,” Benhart said, noting that this newfound autonomy is prompting institutions to re examine how decisions are made across the organization.

This shift is not merely procedural. It is fundamentally changing how risk management functions operate. Historically, there was a tendency for decisions to be escalated upward, often in response to regulatory expectations.

Now, banks are pushing accountability closer to the front line, ensuring that decisions are taken at the appropriate level within the business.

That realignment is particularly visible in areas such as credit risk and financial crime compliance, where operational judgment plays a critical role.

At the same time, regulators themselves are recalibrating their focus. Benhart observed that examiners are moving away from an emphasis on policies and procedures toward a sharper focus on tangible outcomes.

“Examiners are getting much more focused on the traditional financial risk,” he said, highlighting credit risk, private credit exposures, and non-depository financial institutions as areas of growing scrutiny.

This return to fundamentals reflects a recognition that governance structures alone are insufficient if they are not supported by effective execution.

Over the past several years, many banks invested heavily in building out frameworks, documentation, and control structures.

While these efforts improved consistency and transparency, they also risked creating a disconnect between process and outcome.

The current supervisory approach seeks to close that gap by focusing on whether banks can demonstrate real control over the risks they face.

The way supervision is conducted is also changing. Large scale, multi week examinations or “horizontal reviews” that once dominated the regulatory calendar are becoming less common. In their place, banks are seeing shorter, more targeted reviews that focus on specific risk areas.

“You’re going to see much more short-term exams covering narrower areas,” Benhart said, adding that these reviews are often more agile and responsive to emerging risks.

This more surgical approach has implications for how banks prepare for regulatory engagement.

Without long lead times and extensive information requests, institutions must be ready to demonstrate ongoing risk management processes rather than preparing for periodic deep dives.

The emphasis shifts from reactive compliance with material prepared specifically in response to examination requests to continuous readiness, and a reliance on the sufficiency of existing recurring reporting.

Feedback mechanisms are evolving in parallel. Instead of formal supervisory letters that outline major findings, regulators are increasingly using observations to highlight potential gaps.

These observations do not carry the same weight as formal Matters Requiring Attention, but they signal areas they may represent a risk management gap.

“There will be a lot more flexibility in the way bank management can address these items,” Benhart said, noting that banks can choose how best to respond within their own governance frameworks.

However, this flexibility introduces new complexities. Benhart cautioned that regulators may be more inclined to cite violations of law in situations where issues are identified, even if they do not escalate to broader supervisory action.

This creates a nuanced environment in which banks must balance discretion with caution, ensuring that decisions not to act are fully justified and defensible.