Risk appetite: where strategy, risk and decisions come together

11 November 2026

Authors: Johanna Spitz, Olga Aloupi

Banks need to understand, manage and monitor risks in line with their strategic goals, while ensuring that their strategy is aligned with sound risk-taking and effective risk management. A robust risk appetite framework (RAF) is a tool that helps them do this.

Risk appetite describes the risks a bank is willing to take, within clear tolerance levels, to meet its strategic and business goals. Banks put this framework into practice through policies, processes, controls and systems. According to prudential regulation and guidelines by the European Banking Authority (EBA), the RAF should cover all material risks with meaningful measures and limits. It should also set clear responsibilities for oversight and daily implementation, so that exposures are tracked, emerging risks are identified and breaches are quickly escalated and addressed in a timely and lasting manner.

The RAF also supports sound decision-making. For example, when a bank enters a new market or launches a product, the RAF helps ensure that the move is disciplined and properly assessed.

Past bank crises show that deficiencies in governance and risk management can serve as early warning signals of later difficulties^[1]. Very often weaknesses in governance are at the root cause of issue that manifest in risks to capital and liquidity. As a concrete example, in the case of Silicon Valley Bank’s collapse in 2023, gaps in risk coverage of RAF and weak escalation of breaches meant there were delays in identifying and mitigating vulnerabilities. Risk appetite metrics, e.g. in relation to interest rate risks, focused on short-term impact on profits and provided limited visibility into the bank’s longer-term vulnerabilities.

ECB supervisors assess banks’ RAFs as part of the Supervisory Review and Evaluation Process based on the applicable prudential framework^[2]. The Financial Stability Board’s Principles for An Effective Risk Appetite Framework provide further guidance. The European framework underpinning the ECB’s supervision is principles-based rather than prescriptive.

Against this background, to help ensure more consistent supervision and effective implementation, the ECB ran a horizontal benchmarking exercise from 2024 to 2026. It compared the effectiveness of RAFs at 47 banks in 14 EU countries.

The exercise assessed four areas: (i) governance, (ii) scope and risk coverage, (iii) the setting of limits and escalation processes, and (iv) how the RAF works in practice. In line with the supervisory priorities for 2024-26 and 2025-27, it also examined how banks include geopolitical risk in their risk management.

Governance arrangements: Effective governance requires the management body to set, approve and regularly review the RAF. Moreover, roles should be clear, breaches closely monitored and the framework independently reviewed by internal audit.

All banks in the sample update their RAF each year with management body approval, and 70% of them present RAF dashboards to the management body in its supervisory function at least quarterly. In addition, 95% have formalised its involvement in RAF approval. In more advanced cases, the management body challenges proposed measures and limits, and asks senior management and the risk management function to follow up. However, 27% of banks do not set a frequency for independent internal audit reviews. For 36% of the banks, oversight by the management body in its supervisory function remains weak, for example because challenge is limited or involvement in the review process is insufficient.

Scope and risk coverage: A sound RAF covers all material financial, non-financial and emerging risks identified through the bank’s annual risk identification process. It uses both quantitative measures and qualitative statements.

The ECB’s horizontal benchmarking exercise found that banks generally cover financial, operational and climate risks well. In addition, it found that almost all banks include geopolitical risk as a driver in their risk identification process, and all use at least some forward-looking measures. One bank stood out for balancing current and forward-looking measures across financial and non-financial risks, including stress tests, scenarios, second-round effects and indicators of how well controls work. Another had already added risks from generative artificial intelligence to its RAF measures and statements.

Yet risk identification does not always feed into the RAF. Around half of the banks in the sample do not cover every material risk with measures or statements, and this could lead to potential blind spots. Coverage of legal, model and reputational risks also needs improvement, as they are often not covered in banks’ RAFs. If these risks are not adequately identified and managed, they can lead to unexpected capital losses or deposit outflows, potentially harming public trust and financial stability. Banks should also make greater use of proactive, forward-looking measures rather than relying mainly on past data. For example, although many banks identify geopolitical risk as material, not all reflect it in their RAF for both financial and non-financial risks.

Limits and escalation processes: All banks in the sample have limits to detect breaches early and escalation processes to help ensure timely action. It is a good practice having a detailed action plan with clear objectives, deadlines and responsibilities, followed by structured monitoring of its delivery.

However, some limits are not sufficiently well calibrated, detailed or conservative. Common weaknesses include missing limits for legal entities, business lines or products; frequent unplanned changes without adequate reasons or approval; and insufficient limits for non-financial risks. In the case of around a quarter of the banks in the sample, the risk management function could also play a stronger role in reviewing limits and addressing breaches, including by challenging decisions taken by business lines.

Implementation of the RAF: The exercise also examined whether banks use the RAF for daily decisions and key processes, such as the annual strategy review and remuneration, and whether they explain it across the organisation to strengthen risk awareness.

Nearly all banks make sure that the annual strategy fits with their RAF and have a formal process linking remuneration to the framework. More than half communicate the framework to all staff. One bank, for example, offers training, exams and certifications on risk appetite, allowing its management body to monitor staff understanding and the bank’s risk culture.

Even where policies are clear, implementation can fall short. In almost half of the sampled banks, internal control functions do not use the RAF, or use it only partly, to challenge management decisions. In some cases, the formal link with remuneration is not supported by evidence showing how the RAF affects bonus pools or the assessment of individuals’ and business areas’ performance.

The way forward

Supervisors are now sharing the results with banks, including through dedicated workshops. They will address the most serious findings through the Supervisory Review and Evaluation Process. ECB Banking Supervision will continue to monitor progress and share benchmarks and good practices.

The aim is not only to identify weaknesses, but also to show what works. The exercise found many good practices, which will feature in a forthcoming report on good practices on governance and risk culture. In today’s uncertain economic environment, a robust and practical RAF is a compass more important than ever!