Banking risk management: the top risks 89 banks disclose
Good banking risk management starts with knowing which risks your peers actually face. Every bank discloses interest rate risk — literally every one in our sample. But what comes next, and what separates banking risks from those of other industries? We counted how many of 89 US-listed banks and savings institutions disclose each risk in their latest annual report. Use it as a checklist for banking risk management, not as a forecast.
All 89 banks in our sample disclose that interest rate changes can compress their net interest margin; competition for loans and deposits, banking regulation and funding follow. The distinctively banking risks are about margins, liquidity, credit losses, capital, outsourcing and financial crime.
- Net interest margin compression: 100% of banks (2% on average in the other fourteen industries).
- Competition for loans and deposits: 99%. Extensive and changing banking regulation: 96%. Outside banking, both are close to zero (1% and 0%).
- Bank funding shortfall to meet obligations: 85% (0% elsewhere).
- Credit risk features heavily: commercial and small business loan losses (63%), an insufficient credit loss allowance (58%) and real estate collateral shortfalls (56%).
- Cyberattack: 71% — lower than the 86% average elsewhere, but still in the top ten.
Turn this list into your own risk registerRisk Samurai starts you with the risks typical for banks, then helps you score them, assign owners and track actions.
Get early accessHow we built this. We took the Risk Factors section of the latest annual report of 89 US-listed banks on SEC EDGAR (filed 24 June 2025 to 2 September 2026), recorded every disclosed risk and grouped equivalent risks across companies. “Share” is the percentage of banks whose filing discloses the risk. Disclosure is not likelihood: filings are written by lawyers, are over-inclusive and come from public companies that are mostly larger than a typical small business, and shares are approximate. Full method and caveats.
Who is in the sample
The benchmark covers 89 banks: all 89 filed a Form 10-K, with filing dates between 24 June 2025 and 2 September 2026. By SEC industry code (SIC), the group is made up of 49 state commercial banks (6022), 25 national commercial banks (6021), 9 federally chartered savings institutions (6035) and 6 other savings institutions (6036).
In plain words, this is mostly a sample of community and regional banks. The median bank reports annual revenue of about $97 million; the smallest about $2.8 million and the largest about $182.4 billion. The median filing yields 49 distinct risks (range 19–102), shorter than in most industries we studied. Only 2.5% of company-level risks are explicitly described as new this year, the lowest of the fifteen industries — bank risk factors are stable from year to year.
| Measure | Value |
|---|---|
| Companies | 89 |
| Annual reports | 89 × 10-K |
| Filing dates | 24 June 2025 – 2 September 2026 |
| Annual revenue | median $97 million; smallest $2.8 million; largest $182.4 billion |
| Risks identified per filing | median 49 (range 19–102) |
| Company-level risks the filing explicitly calls new this year | 2.5% |
The top 30 risks banks disclose
The table ranks risks by the share of banks whose annual report discloses them. The last column is the average share across the other fourteen industries in our study, so you can see at a glance whether a risk is generic to listed companies or particular to this sector. Risks marked distinctive are disclosed by at least 20% of banks and by at least 15 percentage points more than in any other industry.
| # | Risk | Banks companies | Other industries (avg) |
|---|---|---|---|
| 1 | Net interest margin compression distinctive Interest rate changes and asset-liability repricing mismatches compress net interest margins and spreads, reducing net interest income and earnings. | 100% | 2% |
| 2 | Competition for loans and deposits distinctive Larger banks, credit unions, fintechs and non-bank lenders, plus lending limits and small scale, pressure loan and deposit pricing and constrain growth. | 99% | 1% |
| 3 | Extensive and changing banking regulation distinctive Extensive bank supervision and changing rules may raise compliance costs, restrict activities and expose the institution to penalties. | 96% | 0% |
| 4 | Bank funding shortfall to meet obligations distinctive Inability to access deposits, wholesale borrowings or central bank facilities on acceptable terms leaves the bank unable to fund loans, withdrawals or commitment draws. | 85% | 0% |
| 5 | Acquisitions fail to integrate or deliver benefits Poor selection, valuation or integration of acquired businesses diverts management and disrupts operations, so expected synergies and returns are not realised and results suffer. | 78% | 73% |
| 6 | Failure to keep pace with technological change Rapid technological change outpacing investment and adoption leaves products, platforms and systems obsolete or uncompetitive, causing lost customers, market share and profitability. | 72% | 31% |
| 7 | Cyberattack exposing data and disrupting operations Hacking, malware or ransomware against company systems exposes confidential or personal data and disrupts operations, causing liability, regulatory penalties, financial loss and reputational damage. | 71% | 86% |
| 8 | Economic downturn reducing customer demand Recession, inflation, tariffs or geopolitical shocks lead customers to cut or delay spending, reducing demand, volumes, prices and revenue. | 69% | 30% |
| 9 | Outsourced service provider failure distinctive Underperformance or failure of outsourced providers of critical business functions, with weak oversight, may disrupt operations, raise costs and be hard to replace. | 64% | 16% |
| 10 | Commercial and small business loan losses distinctive Commercial and small business borrowers dependent on volatile cash flows fail to repay in downturns, causing greater credit losses than residential lending. | 63% | 0% |
| 11 | Negative publicity damaging brand and demand Adverse media, press or public commentary about the company, accurate or not, damages reputation and trust, reducing customers, referrals, talent, partners and share price. | 63% | 27% |
| 12 | Loss of senior executives or key employees Unexpected departure of senior executives or key employees without ready replacements could disrupt operations, impair strategy execution and harm financial results. | 60% | 55% |
| 13 | Credit loss allowance proves insufficient distinctive Flawed credit models, limited data or worse-than-expected conditions cause losses to exceed allowances, requiring additional provisions and reducing earnings and capital. | 58% | 0% |
| 14 | Changes in accounting standards distinctive New or reinterpreted accounting standards may alter reported results and comparability, requiring costly system changes or restatement of prior periods. | 58% | 17% |
| 15 | Geographic concentration of operations Concentration of operations, customers or assets in a few regions exposes results to local economic, regulatory, competitive or natural-disaster shocks. | 57% | 16% |
| 16 | Real estate collateral value shortfall distinctive Falling property values or overstated appraisals leave loan collateral insufficient, reducing recoveries on default and foreclosure. | 56% | 0% |
| 17 | Lender failure to fund committed facilities distinctive Distress at lenders or financial institutions leads to failure to honour funding commitments, reducing available liquidity and access to financing. | 56% | 3% |
| 18 | Ineffective internal control over financial reporting Weak internal controls or unremediated material weaknesses may cause misstated or late financial reports and restatements, leading to sanctions and loss of investor confidence. | 56% | 53% |
| 19 | Adverse litigation and legal proceedings Lawsuits, claims and legal proceedings may produce adverse judgments, settlements and defence costs exceeding insurance, diverting management and harming reputation. | 55% | 64% |
| 20 | Anti-money laundering and sanctions failures distinctive Weak AML, KYC or sanctions controls, or criminal misuse of services, may lead to enforcement, fines, restrictions and reputational harm. | 54% | 5% |
| 21 | Regulatory capital and liquidity requirements distinctive Stricter or unmet capital and liquidity requirements may force capital raising and restrict lending, dividends and growth. | 54% | 1% |
| 22 | Investment portfolio value losses Adverse interest rate, credit or market movements reduce the value and liquidity of investment portfolios, causing impairments, realised losses and lower income. | 53% | 10% |
| 23 | Dependence on restricted subsidiary distributions Legal, regulatory or contractual limits on subsidiary dividends leave the holding company without cash to service debt, pay taxes, expenses or shareholder dividends. | 52% | 22% |
| 24 | Evolving AI laws and liability New, divergent AI laws and flawed AI outputs may restrict AI use, require costly compliance changes and expose the company to fines and liability. | 49% | 41% |
| 25 | Economic downturn raises borrower defaults distinctive Downturns, inflation or rising rates weaken borrowers' repayment capacity, increasing delinquencies, charge-offs and credit losses. | 49% | 1% |
| 26 | Contamination on collateral or foreclosed properties distinctive Contamination on financed, mortgaged or foreclosed properties may reduce collateral value and borrower repayment, and expose the lender to remediation liability and credit losses. | 48% | 1% |
| 27 | Inability to raise additional capital Adverse market or company conditions prevent raising debt or equity on acceptable terms, forcing curtailed growth or operations, or dilutive and restrictive financing. | 48% | 48% |
| 28 | Flawed or misused AI causing harm Poorly governed AI use by the company or vendors produces inaccurate, biased, infringing or data-leaking outputs, causing legal liability, regulatory action and reputational damage. | 48% | 26% |
| 29 | Ineffective risk management framework and controls distinctive Gaps in the risk management framework, policies and internal controls leave risks unidentified or unmitigated, causing unexpected losses, regulatory action and reputational harm. | 46% | 4% |
| 30 | Wire, payment diversion and social engineering fraud distinctive Fraudsters using phishing, spoofed instructions or social engineering divert company or client payments to illegitimate accounts, causing unrecoverable losses and reputational harm. | 45% | 1% |
The list reads like a summary of a bank balance sheet. Interest rates, funding, credit losses, capital requirements (54%) and the value of the investment portfolio (53%) all appear in at least half of filings, and most are disclosed by almost no company outside banking. The failure of lenders and other financial institutions to honour funding commitments (56%) is a direct legacy of the 2023 regional bank failures, which reshaped how banks write about deposit concentration and liquidity.
Generic “intense competition” does not appear in the bank top 30 because banks describe competition in their own terms: competition for loans and deposits from larger banks, credit unions, fintechs and non-bank lenders (99%). Geographic concentration (57%, against 16% elsewhere) is just as characteristic of community banking, but real estate companies disclose it almost as often, so it does not count as distinctive.
Operational risks are less visible but significant: outsourced service provider failure (64% — far above the 16% average elsewhere), an ineffective risk management framework (46%) and wire, payment diversion and social engineering fraud (45%). For most community banks the core banking system, card processing and digital banking are run by a small number of providers, which is why third-party risk ranks so high.
Two newer themes are worth noting. Evolving AI laws (49%) and flawed or misused AI (48%) now appear in roughly half of bank filings. And contamination on collateral or foreclosed properties (48%) is an old but persistent banking risk that few other sectors mention.
What is distinctive about banks
More than fifteen risks meet our test for being distinctive to banks: disclosed by at least 20% of banks and at least 15 percentage points more often than in any other industry. We list the fifteen most widely disclosed; most of them are disclosed by essentially no company outside banking. Five areas deserve particular attention in any bank risk register.
Net interest margin compression
100% of banks disclose it, against 2% on average in the other industries.
Net interest income is most of a typical community bank’s revenue, and it depends on the gap between what the bank earns on loans and securities and what it pays for deposits and borrowings. When those reprice at different speeds, margin moves. The control set is asset-liability management: regular repricing-gap and earnings-at-risk analysis, rate-shock scenarios, limits approved by the board and a committee that actually acts on breaches. Deposit behaviour assumptions deserve the most scrutiny, because they are where models most often diverge from reality.
Funding shortfall and failing lenders
“Bank funding shortfall to meet obligations”: 85% (other industries 0%). “Lender failure to fund committed facilities”: 56% (other industries 3%).
Deposits can leave much faster than they used to: digital banking and social media turned slow runs into fast ones, and the distress of other institutions can cut off funding lines a bank was counting on. The risk is less about average liquidity than about concentrations — large uninsured depositors, a few industries, a single referral channel, one or two wholesale lenders. Practical controls include monitoring the largest depositors and uninsured balances, a contingency funding plan with tested access to secured borrowing, and stress scenarios that assume outflows on the scale seen in 2023 rather than historical averages.
Credit losses, commercial loans and real estate collateral
“Commercial and small business loan losses”: 63% (other industries 0%). “Credit loss allowance proves insufficient”: 58% (other industries 0%). “Real estate collateral value shortfall”: 56% (other industries 0%).
These three risks describe the same exposure from different angles: loans that depend on business cash flows and property values, and an allowance that may not keep up when conditions turn. Commercial real estate concentrations — especially office and construction lending — are where supervisors focus. Concentration limits by property type and geography, independent loan review, and stress tests that link rates, vacancies and collateral values to expected losses keep the allowance honest.
Outsourced service provider failure
64% of banks disclose it, against 16% on average in the other industries.
Core processing, card services, digital banking and much of the security stack sit with a handful of providers, and replacing one is a multi-year project. A provider outage or breach becomes the bank’s incident, and supervisors expect the bank to have managed the provider as if it were an internal function. Tier providers by criticality, review the critical ones at least annually, test exit and recovery plans, and make sure contracts give you audit rights and incident notification times you can actually work with.
Anti-money laundering and sanctions failures
54% of banks disclose it, against 5% on average in the other industries.
Deficient anti-money laundering, know-your-customer or sanctions controls lead to enforcement action, fines and, often more damaging, restrictions on growth and acquisitions until the programme is fixed. Common weak points are alert backlogs, outdated customer risk ratings and thin oversight of fintech partners whose customers become the bank’s customers. Independent testing and a realistic staffing model for investigations are the controls examiners look at first.
The remaining distinctive banking risks in our list, several of which (capital requirements, the risk management framework itself) belong in almost every bank register:
| Risk | Banks companies | Other industries (avg) |
|---|---|---|
| Competition for loans and deposits Larger banks, credit unions, fintechs and non-bank lenders, plus lending limits and small scale, pressure loan and deposit pricing and constrain growth. | 99% | 1% |
| Extensive and changing banking regulation Extensive bank supervision and changing rules may raise compliance costs, restrict activities and expose the institution to penalties. | 96% | 0% |
| Changes in accounting standards New or reinterpreted accounting standards may alter reported results and comparability, requiring costly system changes or restatement of prior periods. | 58% | 17% |
| Regulatory capital and liquidity requirements Stricter or unmet capital and liquidity requirements may force capital raising and restrict lending, dividends and growth. | 54% | 1% |
| Economic downturn raises borrower defaults Downturns, inflation or rising rates weaken borrowers' repayment capacity, increasing delinquencies, charge-offs and credit losses. | 49% | 1% |
| Contamination on collateral or foreclosed properties Contamination on financed, mortgaged or foreclosed properties may reduce collateral value and borrower repayment, and expose the lender to remediation liability and credit losses. | 48% | 1% |
| Ineffective risk management framework and controls Gaps in the risk management framework, policies and internal controls leave risks unidentified or unmitigated, causing unexpected losses, regulatory action and reputational harm. | 46% | 4% |
The category mix
Every identified company-level risk is classified into one of nine groups. The table shows how banks’ risk mentions split across them — a rough picture of where their attention goes, not of where losses come from.
| Risk group | Share of risk mentions |
|---|---|
| Financial | 35.1% |
| Strategic | 19.8% |
| Compliance and legal | 18.3% |
| Operational | 13.3% |
| IT and cyber security | 4.4% |
| ESG and sustainability | 3.8% |
| People | 3.1% |
| Reputational | 2% |
| Project | 0.1% |
Financial risks dominate bank filings at 35.1% of mentions — second only to real estate among the fifteen industries — followed by strategic (19.8%) and compliance and legal (18.3%). ESG and sustainability (3.8%) is higher than in the other financial industries we studied, mainly because of environmental liability on collateral and climate-related property risk.
How to use this in your own risk register
A benchmark is a checklist of what peers disclose, not a risk assessment of your business. Use it to spot gaps, then do the real work yourself.
- Pick. Read the distinctive risks and the top ten first. Tick the ones that genuinely apply to your business model, size and markets, and drop the rest. Most items in the distinctive list apply to any deposit-taking institution; holding-company items such as restricted subsidiary distributions apply only if you have that structure.
- Rewrite for your business. Filing wording is deliberately generic. Turn each risk into a specific statement of cause, event and consequence — see what a risk register is for the format.
- Score likelihood and impact. Score each risk on your own risk matrix. Do not use the share column as a likelihood: it measures how many companies mention a risk, not how often it happens.
- Name an owner and controls. Each risk needs one accountable person and a short list of the controls that actually reduce it today.
- Add indicators. Pick one or two key risk indicators for the risks that score highest, with thresholds that trigger action.
For example, “Bank funding shortfall to meet obligations” becomes: “Withdrawals by our 20 largest depositors, who hold a significant share of uninsured deposits, exceed available liquidity within a week, forcing high-cost borrowing or securities sales at a loss.” That version points straight to the controls (depositor concentration limits, a tested contingency funding plan) and the indicator to watch.
Indicators that suit banks include:
- Uninsured deposits and the top 20 depositors as a share of total deposits.
- Net interest income at risk under a +/-200 basis point rate shock, against the board limit.
- Commercial real estate loans as a multiple of capital, by property type.
- AML alert backlog older than 30 days.
- Critical outsourced providers without a current due diligence review.
Because so much bank operations risk sits with outsourced providers, our third-party risk assessment guide is a natural next step. For banks and other APRA-regulated entities in Australia, the CPS 230 guide explains the operational risk and service provider requirements in force since July 2025.
Frequently asked questions
What are the biggest risks for banks?
In 89 US bank annual reports, the most widely disclosed risks are net interest margin compression (100% of banks), competition for loans and deposits (99%), extensive and changing banking regulation (96%), funding shortfalls (85%) and acquisitions that fail to deliver (78%). Cyberattack is disclosed by 71%.
What are the main types of risk in banking?
The classic categories are credit, interest rate (market), liquidity, operational, compliance and strategic risk. The filings in our sample map onto them closely: financial risks such as margin, funding and credit losses make up 35.1% of risk mentions, followed by strategic (19.8%), compliance and legal (18.3%) and operational (13.3%).
Which risks are specific to banks?
Compared with fourteen other industries, banks almost uniquely disclose net interest margin compression, competition for loans and deposits, funding shortfalls, the adequacy of the credit loss allowance, regulatory capital and liquidity requirements, anti-money laundering compliance, commercial loan and real estate collateral risk, and wire and payment diversion fraud.
How was this list built?
From the Risk Factors section of the latest annual report of 89 US-listed banks on SEC EDGAR. We recorded every distinct risk each section discloses, grouped equivalent risks across companies and counted the share of companies disclosing each one.
Does a higher share mean a risk is more likely?
No. The share measures how many companies chose to disclose a risk, not how often it happens or how much it costs. Annual reports are written by lawyers to protect the company, so they are over-inclusive: a risk can appear in nearly every filing and still be unlikely in any given year. Score likelihood and impact for your own business separately.
Start your register from this benchmark
Risk Samurai uses this benchmark to suggest the risks companies in your industry typically face — interest rate, liquidity, credit, AML and outsourcing risks for a bank — when you build your register. You then rewrite, score and assign owners to them.
Get early access