Enterprise Risk Management in US Banks and Credit Unions with Python

Most risk training gives you vocabulary. This course gives you the work.

36 modules. 392 lectures. Python from the first line to the last, on two institutions you come to know so well that by the time you stress their capital you already know how their balance sheets behave.

Two institutions, taught side by side

Acme Bank is a US commercial bank, supervised by the OCC, FDIC, Federal Reserve, and CFPB as applicable. Acme Credit Union is a federally-chartered credit union, supervised by the NCUA. Both appear in every module, so familiarity compounds instead of restarting.

Almost every ERM course picks one and leaves you to translate. This one teaches both regimes together. You will work CET1, Tier 1, Tier 2, and the leverage ratio on one side, and net worth ratio, risk-based capital, and CCULR on the other. You will produce a Call Report and a 5300. If you move between the two sides of the industry, and many risk careers do, you will not be starting over.

The same balance sheet under four economic regimes

Both institutions carry synthetic history across four regimes, so you see the same portfolio behave differently under each:

• Through-the-cycle baseline - the long-run reference every deviation is measured against
• Financial crisis, 2008-2009 - credit-led stress, collateral collapse, capital depletion
• COVID shock, 2020 - a sudden exogenous shock, policy support, deposit surge, forbearance distortion
• Rate shock, 2022-2023 - securities repricing, deposit flight, unrealized loss

Point-in-time versus through-the-cycle measurement is introduced in Module 10, constructed mathematically in Module 13, and revisited in every module where it applies. The recurrence is designed, not accidental.

Free tools, nothing proprietary

Python for all analytics. VS Code as the sole IDE. Quarto for every rendered output. Git and GitHub on the free tier. No R, no SAS, no proprietary risk platform, and no license to buy. Module 1 installs and verifies the whole toolchain starting from nothing on your machine, and Module 9 returns to Quarto, project structure, and Git at depth once you have something worth rendering.

Reproducible, or it does not ship

Every module honors the same six standards without exception:

1. Seeds set at the top of every script
2. Dependencies pinned, and the environment reconstructible from scratch
3. Synthetic data generation code always included and documented
4. Relative paths only, resolved from a project root marker
5. Every rendered document produces identical output on any machine
6. No hand-typed figures in any report - every number is read from a committed artifact

A reproducibility checklist closes every module.

That is not a style preference. It is what makes your work defensible on the day an examiner asks how you arrived at the number.

Regulation verified, not recited

Regulatory content is checked against primary sources before it reaches a lecture. Anything recently changed, currently in flux, or commonly misstated is tracked and resolved to a cited source. Where a point genuinely is unsettled, the course says so plainly rather than smoothing it over.

The same standard applies to the code. No library method, parameter, or CLI flag appears in a lecture without being confirmed against the version you install.

Start from zero. Finish expert.

No prior exposure to enterprise risk management is required. Not the vocabulary, not the regulations, not the frameworks. The course builds all of it from first principles.

That is a statement about where the course starts, not where it stops. The aim is comprehensive coverage of every ERM topic that matters in a US bank or credit union, at the depth a practitioner actually works at: the assumptions behind each method, where it breaks, what an examiner challenges, and what you do when the standard approach does not fit.