Bank Risk Taxonomy: The 8 Risk Categories Explained

A bank or credit union risk taxonomy sorts everything that can go wrong into eight categories. Four are financial: credit, interest rate, market and liquidity. Four are non-financial: operational, compliance, strategic and reputational. The list matters less than what it does. A taxonomy decides who owns a risk, which limit applies to it, whether it costs capital, and which committee hears about it.

Why a risk taxonomy is not just filing

A taxonomy can look like an index. In practice it divides up responsibility, and the categories are not always obvious or natural. Somebody chose them, and where they cut the world of possible losses has real consequences.

The main reason a taxonomy exists is aggregation. You cannot add up what you have not agreed how to count. Several other things follow from that:

• A risk with no category has no owner. If nothing in the taxonomy covers a risk, nobody's job description covers it either, and nobody is accountable for watching it.
• Limits attach to categories, not to vague worries. An uncategorized risk is also an unlimited one.
• Capital depends on the category. The capital rules for both banks and credit unions measure some categories directly and leave others out, so the category can decide whether carrying an exposure costs capital at all.
• Reporting follows categories. The category decides which committee hears about a risk, and so whether the board ever finds out.

The gaps between categories are where real losses have historically sat, with nobody watching them. An argument about which box a risk belongs in is really an argument about whose problem it will be.

Financial vs non-financial risks

The first cut splits the eight categories into two groups, and the reason for the split drives how each group is managed.

Financial risks (credit, interest rate, market and liquidity) are taken on deliberately to earn a return. A bank does not accidentally end up with a commercial loan book. It chooses to lend, prices the risk into the rate it charges, and expects to be paid for carrying it. A credit union making personal loans does the same. These risks are the business itself.

Non-financial risks (operational, compliance, strategic and reputational) are almost never taken on purpose. No institution would accept a certain level of wire fraud in exchange for a return. These risks come as a byproduct of being in business at all.

That difference changes the management question:

• For financial risks it is an optimization question: how much do we want, at what price, and within what limit?
• For non-financial risks it is a control question: how much can we reduce this, and what does reducing it cost?

It also explains why non-financial risks are much harder to quantify. A priced risk generates data about itself as a matter of course, because every loan has a rate, a term and an outcome. An operational loss generates data only when it happens, and reputational damage may not generate any data at all. That becomes a real problem when you try to aggregate.

The four financial risks

Credit risk

Credit risk is the risk that a borrower does not repay, repays less than was owed, or repays later than promised. Those are three different events. For a lending institution, credit is usually the largest single exposure.

Credit risk breaks down into three components, each estimated separately and then multiplied together:

1. The probability that the borrower defaults.
2. The share of the exposure the lender loses if default happens.
3. How much is owed at the moment of default.

This breakdown is why credit risk is the most quantitatively developed category in risk analytics. It also introduces a distinction that recurs across every financial category. Expected loss is the product of the three components. It is an average, so it can be anticipated, priced into the loan and provided for. Unexpected loss is the variation around that average, and it is what capital exists to absorb.

Pricing handles expected loss. Capital handles unexpected loss. Confusing the two is one of the most consequential errors in the field.

Interest rate risk vs market risk

These two often look like the same thing, but they are separate categories.

Interest rate risk lives in the banking book, meaning the loans and deposits. It arises because assets and liabilities reprice at different speeds. Mortgages may be fixed for decades while the deposits funding them reprice within weeks, so when rates move, the gap between the two sides changes. That affects current earnings and, separately, the economic value of the institution. These are two measurements of the same exposure, and both are examined. The key word is unavoidable. The maturity mismatch is the business, and you cannot remove it without removing the bank or credit union.

Market risk lives in the securities portfolio and any trading positions. Prices move, positions are marked to market, and the marks flow through to the accounts. The drivers include rates, credit spreads and equity prices. The key word is optional. Nobody had to hold that particular bond, and the position can be unwound if necessary.

The underlying variable is often the same, but the exposure arises differently, is measured differently and is capitalized differently.

Liquidity risk

Liquidity risk moves fastest of all, and it comes in two forms:

• Funding liquidity: the cash is not there when you need it, for example because depositors withdraw, a credit line is drawn, or a maturing obligation has to be repaid.
• Market liquidity: you hold an asset you cannot sell for anything close to what you believe it is worth.

The two combine at the worst possible moment. When you urgently need cash, you sell assets. If everyone else is selling at the same time, market liquidity collapses just as your funding need peaks, and each makes the other worse. Institutions that are perfectly solvent can fail this way: the assets are good, the capital is adequate, and the money is not there this afternoon. Credit deterioration plays out over quarters. A funding run plays out over days, and with a modern deposit base it can take hours.

Liquidity is also different because every other risk can turn into a liquidity event. A credit problem becomes a liquidity problem when the market notices. An operational failure becomes one when it reaches the news.

The four non-financial risks

Operational risk

The industry works from the Basel Committee's definition:

Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk but excludes strategic and reputational risk.

The first half covers a huge range: a payment sent to the wrong account, a trader exceeding their authority, a core banking outage, a hurricane closing branches. The second half is where the definition does its real work. Litigation and the cost of losing a case count as operational risk, not a separate category. Strategic and reputational risk are excluded on purpose, which is why they get their own categories. If operational risk absorbed everything non-financial, calling something operational would tell you nothing.

When you review an institution's taxonomy, look at what it excludes rather than what it includes. The exclusions show whether anyone has thought it through.

Compliance risk

Compliance risk is the rulebook being breached, or the rulebook changing underneath a business built on the old one. People often forget the second form. Compliance risk covers consumer protection, financial crime and fair lending. It is at least measurable after the fact: fines have amounts, consent orders carry requirements, and remediation has a cost. The usual first signal is a supervisory finding.

Strategic and reputational risk

Strategic risk is the plan itself being wrong, or a plan carried out without what it needs to succeed. The OCC counts poor implementation of business decisions as strategic risk. An ordinary process failure along the way is operational, but expanding into the wrong market, acquiring the wrong institution or staying in a disappearing business is strategic. It is the only risk on the list a board can create in a single afternoon.

Reputational risk is the loss of trust. In a deposit-funded institution, trust and funding are close to the same thing. Reputational risk is usually a consequence rather than a cause: a data breach is operational, and the reputational damage follows it.

Neither strategic nor reputational risk has a loss distribution, a natural unit of measurement or any data until it materializes. They stay in the taxonomy anyway, because leaving them out would not make them go away. It would only mean nobody owned them.

Five contested boundaries

In several places the boundaries are genuinely disputed, because the same loss can honestly be described more than one way.

1. Fraud. If a borrower lies on an application and then defaults, is that credit risk or a failed control? Third-party fraud is usually operational. Borrower fraud that leads to default is argued about constantly, and both answers can be defended.
2. Cyber. Under the Basel definition, a cyber incident is clearly operational. Yet most institutions of any size run cyber as its own function with its own reporting line, because the expertise and pace are so different from the rest of operational risk.
3. Model risk. A wrong model output feeds credit decisions, capital calculations and pricing. Model risk sits underneath the other categories rather than beside them.
4. Third-party risk. When a vendor fails, it is the vendor's operational failure but entirely your problem, and the regulator is not interested in the distinction.
5. Climate. Current thinking mostly treats climate as a driver of existing categories rather than a new one, showing up as credit risk on coastal properties or operational risk on flooded branches. That framing is not settled.

Institutions answer these questions differently, and they can defend different answers. What cannot be defended is leaving the question unanswered, because an unanswered boundary is how a risk ends up with no owner.

Key takeaways

• The eight categories are credit, interest rate, market and liquidity (financial), plus operational, compliance, strategic and reputational (non-financial).
• Financial risks are taken on deliberately and priced, so managing them is an optimization problem. Non-financial risks come as a byproduct of operating, so managing them is a control problem.
• Credit risk breaks into probability of default, loss given default and exposure at default. Pricing covers expected loss, and capital covers unexpected loss.
• Interest rate risk is the unavoidable mismatch in the banking book. Market risk comes from optional positions in securities and trading.
• Funding liquidity and market liquidity make each other worse, and every other risk can end up as a liquidity event.
• Operational risk includes legal risk and excludes strategic and reputational risk.
• A taxonomy allocates responsibility. A risk with no category has no owner, no limit and no audience, so contested boundaries have to be decided, not left open.