Enterprise Risk Management in US Banks and Credit Unions with Python

Most risk training gives you vocabulary. This course gives you the work.

36 modules. 400 lectures. Hands-on Python on two institutions you come to know so well that by the time you stress their capital you already know how their balance sheets behave.

Two institutions, taught side by side

Acme Bank is a national bank: the OCC supervises it, the Federal Reserve supervises its holding company, the FDIC insures its deposits, and the CFPB supervises its consumer compliance. Acme Credit Union is a federally chartered credit union: the NCUA charters, supervises, and insures it, and at its size the CFPB supervises its consumer compliance too. Both run through the whole course, so familiarity compounds instead of restarting.

Almost every ERM course picks one and leaves you to translate. This one teaches both regimes together. You will work CET1, Tier 1, Tier 2, and the leverage ratio on one side, and net worth ratio, risk-based capital, and CCULR on the other. You will build Call Report and 5300 schedules from their data and tie them out. If you move between the two sides of the industry, and many risk careers do, you will not be starting over.

The same balance sheet under four economic regimes

Both institutions carry synthetic history across four regimes, so you see the same portfolio behave differently under each:

• Through-the-cycle baseline - the long-run reference every deviation is measured against
• Financial crisis, 2008-2009 - credit-led stress, collateral collapse, capital depletion
• COVID shock, 2020 - a sudden exogenous shock, policy support, deposit surge, forbearance distortion
• Rate shock, 2022-2023 - securities repricing, deposit flight, unrealized loss

Point-in-time versus through-the-cycle measurement is introduced with its mathematics in Module 10, applied to probability of default in Module 13, and revisited in every module where it applies. The recurrence is designed, not accidental.

Free tools, nothing proprietary

Python for all analytics. VS Code as the sole IDE. Quarto for every rendered output. Git and GitHub on the free tier. No R, no SAS, no proprietary risk platform, and no license to buy. Module 1 installs and verifies the whole toolchain starting from nothing on your machine, and Module 9 returns to Quarto, project structure, and Git at depth once you have something worth rendering.

Reproducible, or it does not ship

The code follows the same five standards throughout:

1. Every random process seeded, so a synthetic dataset comes out the same each time it is generated
2. Dependencies pinned, and the environment reconstructible from scratch
3. Synthetic data shipped with the assumptions that produced it, and the Acme data estate with the code that generates it
4. Relative paths only, resolved from a project root marker
5. No hand-typed figures in any report - every number is read from a committed artifact

That is not a style preference. It is what makes your work defensible on the day an examiner asks how you arrived at the number.

Regulation verified, not recited

Regulatory content is checked against primary sources before it reaches a lecture. Anything recently changed, currently in flux, or commonly misstated is tracked and resolved to a cited source. Where a point genuinely is unsettled, the course says so plainly rather than smoothing it over.

The same standard applies to the code. No library method, parameter, or CLI flag appears in a lecture without being confirmed against the version you install.

Start from zero. Finish expert.

No prior exposure to enterprise risk management is required. Not the vocabulary, not the regulations, not the frameworks. The course builds all of it from first principles.

That is a statement about where the course starts, not where it stops. The aim is comprehensive coverage of every ERM topic that matters in a US bank or credit union, at the depth a practitioner actually works at: the assumptions behind each method, where it breaks, what an examiner challenges, and what you do when the standard approach does not fit.