Risk-Based Supervision

Overview

Risk-based supervision uses information about size, complexity, products, customers, governance, financial condition, control history, and market impact to prioritize examinations and monitoring. Lower-risk entities may receive less intensive attention, not exemption from obligations.

Supervisory judgments depend on timely, accurate data and can change as business models, incidents, or external conditions evolve. Poor categorization can overlook emerging risks or impose disproportionate burden on entities with limited actual exposure.

Supervised organizations should understand applicable expectations, maintain evidence, report material changes, and address findings according to their impact. Regulators need transparent criteria, consistent challenge, skilled reviewers, and feedback loops connecting observed outcomes with supervisory priorities. Supervisory intensity should adapt when control evidence or business complexity changes.

Risk-Based Supervision is a measurable uncertainty or exposure that directs regulatory or oversight attention toward institutions, activities, and controls presenting the greatest assessed risk or potential harm. Risk-based supervision varies oversight intensity according to potential harm while preserving baseline duties, evidence requirements, and accountability for changing exposure.

For Risk-Based Supervision, the assessment should evaluate a measurable uncertainty or exposure that directs regulatory or oversight attention toward institutions, activities, and controls presenting the greatest assessed risk or potential harm. The assessment record should separate observed evidence supporting a measurable uncertainty or exposure that directs regulatory or oversight attention toward institutions, activities, and controls presenting the greatest assessed risk or potential harm from assumptions, state the time horizon and existing controls, and identify who owns any remaining exposure. Monitoring should test whether the conditions described in a measurable uncertainty or exposure that directs regulatory or oversight attention toward institutions, activities, and controls presenting the greatest assessed risk or potential harm have changed enough to require a new rating, treatment, or approval.