Why the CRO Must Become Banking’s Enterprise Architect

The Chief Risk Officer role is undergoing its most significant transformation since the aftermath of the global financial crisis.

Speaking at Risk Evolve 2026, CeFPro’s flagship European event, the Managing Director and Head of Customer Compliance at one of Europe’s largest banks, told delegates that today's CRO can no longer operate as a specialist focused on individual risk disciplines.

Instead, the role is evolving into that of an enterprise architect, responsible for understanding how risks interact across the organization and ensuring the institution remains resilient amid growing complexity.

Tracing the development of the role, the executive pointed to lessons from historic failures, including Barings and the financial crisis, which exposed weaknesses in oversight, governance, escalation, and organizational culture.

While dedicated risk functions emerged and strengthened in response, many remained siloed, with specialists focused on individual disciplines such as credit, market, liquidity, operational, or conduct risk.

Over time, those disciplines became more connected. Yet, according to the speaker, the next stage of evolution requires something more fundamental.

“Independence alone isn't enough,” she said. “The second line cannot be siloed. We cannot be working in our little worlds of credit, market, operational conduct.”

Instead, she argues, CROs must understand how risks interact across strategy, finance, technology, operations, and culture. That ability to see interconnections is what increasingly distinguishes a modern risk leader from a traditional risk specialist.

The scope of the role has expanded dramatically. Today's CRO is expected to oversee not only traditional financial risks but also operational resilience, conduct, compliance, cyber risk, technology, data, climate risk, artificial intelligence, and a growing list of emerging threats.

At the same time, CROs must balance commercial objectives with prudence.

“The CRO is not expected to oversee just financial risks, but a growing set of non-financial risks,” the executive explained. Yet the role is also becoming increasingly strategic, requiring leaders to support business growth while ensuring organizations remain safe and sustainable.

Regulatory expectations have evolved alongside the role. In the UK, the Senior Managers Regime clearly defines the responsibilities associated with the Chief Risk Officer function, including independent oversight, enterprise-wide reporting, challenge to the first line of defense, and board engagement.

However, the bank chief argued that regulatory requirements describe only what the role must deliver, not how it should be executed.

That distinction is becoming increasingly important.

“We're expected to be independent, but not obstructive. Commercial, but not captured. Forward-looking, but we're always judged in hindsight,” she observed. The role requires balancing competing expectations while maintaining trust across executive teams, boards, and regulators.