CONNECT MAGAZINE - ISSUE 16

EDITION 16

Concentration Risk Vendor Risk Deepfake

2026: The Great Risk Reset

Machine Learning Regulation

The Convergence Trap:

How overlapping risks are turning 2026 into a systemic stress test

Algorithms Under Fire:

Why machine-learning models fail the moment markets need them most

Resilience in Name Only:

The unseen weaknesses that will break firms still treating resilience as paperwork

Outsourcing’s Hidden Cost:

How a shrinking vendor ecosystem is quietly creating the next systemic failure

connect.cefpro.com/magazines

1

This month’s regular features in Connect Magazine

16

24

RESILIENCE WITH EMPATHY: BUILDING A CAREER WITHOUT A SAFETY NET Shawn Tumanov tells Chandrakant Maheshwari how disciplined resilience and empathetic leadership shaped his rise in governance

INFOGRAPHIC: THE ESG AND SUSTAINABILITY TUG-OFWAR - A CONTEST WITH NO WINNERS In this issue we look at climate risk and the disconnect between investor and shareholder demand and US domestic policy

36

SPEAKERS ONBOARD Advanced Model Risk USA Stand out Speakers

42

NEWS IN REVIEW Our 3-minute read catches you up on some of the news stories and events that have been on the risk news agenda around the world over the last month

44

2

TRENDWATCH: SIX REGULATORY SHIFTS SET TO RESHAPE RISK MANAGEMENT IN 2026 Our regular monthly look at key trends explains why 2026 will test every assumption in risk management

The views and opinions expressed in this publication are those of the thought leader as an individual, and are not attributed to CeFPro or any particular organization.

12

CONTENTS

WINNING THE WAR ON THE MANY FACES OF DEEPFAKE FINANCIAL CRIME Phil Masquelette argues financial institutions must counter deepfake-driven fraud with layered controls, adaptive technology, and constant human training.

Phil Masquelette is SVP and Chief Risk Officer at Ulster Savings Bank

05

FOREWORD: PREPARING FOR A HARDER, FASTER, RISKIER 2026 Guest editor Emma Hagan welcomes you to a horizon-scanning edition of Connect

20

WHEN VENDOR CHOICES SHRINK, THIRD-PARTY RISK SURGES How a shrinking vendor ecosystem amplifies concentration risk and exposes third party framework vulnerabilities.

Lara Hall, Event Producer, The Center for Financial Professionals

28

MACHINE LEARNING MEETS MARKET TURBULENCE AS RISK CONTROL TIGHTENS Dr Peter Quell explains why machine learning still struggles with noisy markets and demands stronger governance frameworks.

Peter Quell is Head of the Portfolio Analytics Team for Market and Credit Risk at DZ BANK AG

32

NEW YEAR, OLD CHALLENGES: OPERATIONAL RESILIENCE IN AN UNCERTAIN WORLD Andreas Simou on why operational resilience must shift from compliance to strategy to meet hidden vulnerabilities.

Andreas Simou, Managing Director, The Center for Financial Professionals

38

06

WHY TRADITIONAL RISK MODELS FAIL AT REAL TIME SPEED Emma Hagan argues the case for treating speed as a core pillar of financial resilience.

Emma Hagan, CEO, ClearBank UK

ARE YOU READY FOR A PERFECT STORM OF DISRUPTION IN 2026?

Mark Norman looks ahead to what 2026 may have in store for risk managers in 2026.

Mark Norman, Head of Content, The Center for Financial Professionals

3

Preparing for a Harder, Faster, Riskier 2026 Emma Hagan, UK CEO, ClearBank

From Insight To Impact The Smart Knowledge Flow

100s of Articles

Peer-review Interviews

Daily Newsfeeds

Market Intelligence Reports

Join CeFPro’s Member’s hub and expand your risk universe

Where leaders learn.

Where conversations shape change.

Explore CeFPro Connect >

Unlock More with Connect+ >

Or visit, connect.cefpro.com

Magazine team Publisher

Andreas Simou Managing Director CeFPro andreas.simou@cefpro.com

Marketing

Alana Cannatella Junior Marketing Manager CeFPro alana.cannatella@cefpro.com

4

Editor

Mark Norman Head of Content CeFPro mark.norman@cefpro.com

Sales & Advertising

Chris Simou Head of Sales CeFPro chris.simou@cefpro.com

Design

Natasha Marino Head of Design CeFPro natasha@cefpro.com

Hello! I’m delighted to be sitting in the guest editor’s chair to bring you this, the first edition of Connect magazine for 2026. I hope you managed to rest and recharge over the holiday season and have returned to the fray with renewed energy for the challenges that lie ahead.

Something tells me we’re all going to need it!

Hopefully, this edition of Connect will help to frame some of those challenges for us, because, perhaps unsurprisingly, in the following pages we have our eyes very much on the next 12 months.

As we step into 2026, risk managers across the financial services sector face an operating environment defined not by a single disruptive force, but by the convergence of many. Last year’s turbulence - geopolitical volatility, climate shocks, AI acceleration, and a string of high-profile outages - was not an anomaly; it was the prelude to a more complex era now taking shape.

As highlighted in our outlook on the ‘perfect storm’ ahead, institutions enter this year navigating overlapping disruptions that challenge traditional assumptions about stability, diversification, and preparedness.

Across all domains, the message is consistent. Operational resilience is shifting from theory to practice, as DORA, PRA requirements, and real-world stress events force institutions to not just document, but prove their ability to withstand severe disruption.

Meanwhile, the vendor ecosystem on which financial services increasingly rely is quietly contracting, creating

systemic concentration risks that raise difficult questions about exit strategies, substitution, and technological sovereignty.

Technological risk is entering a new phase. AI continues to expand, yet its fragility in turbulent markets and the rising threat of deepfake-enabled fraud illustrate a widening gap between innovation and control.

Robust governance, human judgment, and adaptive monitoring will be essential as agentic systems, behavioural analytics, and generative models reshape risk functions.

At the same time, the geopolitical and regulatory landscape is fragmenting.

Shareholders demand stronger sustainability leadership even as U.S. domestic policy pulls in the opposite direction, widening the tension financial institutions must navigate.

In this issue, we explore these converging forces and look at why 2026 will test not only frameworks and controls, but also foresight, agility, and leadership across the risk profession.

If you’d like to guest edit a future edition of the magazine, or you’re a solutions provider who’d like to explore the benefits of advertising in Connect Magazine, please do get in touch. Our editorial and sales contact details can be found overleaf.

I hope you enjoy the articles that follow – the next edition will be out on February 25.

Emma Hagan 5

WHY TRADITIONAL RISK MODELS FAIL

AT REAL TIME SPEED Emma Hagan is the UK CEO at ClearBank. She was also Chief Risk Officer with the bank, and has previously held senior posts at Silicon Valley Bank, Lloyds Banking Group and HBOS

Risk is accelerating at unprecedented speed, driven by real‑time payments, AI‑enabled threats, and hyper‑connected communications against a backdrop of economic and geopolitical volatility. Traditional frameworks cannot keep pace. This article outlines why speed is now a core dimension of resilience and how financial institutions need to adapt.

6

Risk Has Gone Real‑Time Risk used to move at the pace of quarterly dashboards and monthly committees. Today, it moves at the speed of a post. A viral post can spread news, fake or not, of a liquidity run in hours; an AI‑powered fraud attack can drain millions before lunch and cause damage that lasts for significantly longer.

The acceleration of risk is not a theoretical concept - it’s a lived reality for financial institutions navigating instant payments, hyper‑connected markets, and emerging technologies.

Add into the melting pot a backdrop of unprecedented economic and geopolitical volatility and you have

all the ingredients to test your risk playbook in ways you never imagined.

The question is no longer ‘Do we have the right framework?’ It’s ‘Can we detect, decide, and act before the damage is done?’

7

Three Accelerants Changing the Game 1.Real‑Time Payments and Settlement Faster payment rails compress liquidity risk into minutes and with movements into tokenisation and stablecoins, this speed can now cross borders and become seconds.

2. AI‑Enabled Threats AI is a double‑edged sword. It remains one of the hottest trends, used to power fraud detection and deliver high powered automation, eliminating human intervention but also enabling deepfake scams and more sophisticated and faster forms of cyber-attack alongside changing the nature of operational risk.

Risk management and internal capabilities must evolve to handle the opportunities and threats - at machine speed.

3. Hyper‑Connected Communications Social media amplifies sentiment risk. We have seen the power of influencers (or ‘finfluencers’) which is only expected to grow and a single post by the right person at the right (or wrong time) can spark unintended actions impacting financial markets.

Crisis playbooks must integrate real‑time monitoring across all platforms and rapid response protocols across functions and communications channels, recognizing the unique features associated with social media.

8

Why Legacy Risk Cycles Fail Traditional risk frameworks assume time for deliberation, availability and traditional escalation methods (and speeds!). But when risk events unfold in seconds, static appetites and quarterly reviews are obsolete.

Boards need dynamic metrics that sit alongside traditional measures: Time‑to‑detect, Time‑to‑decide, Time-tocontain, to ensure they understand the organization’s ability to deal with these realtime, fast-moving threats.

It should also review how effective and fit for purpose escalation and decisionmaking methods are – in short, can we get ahead of the issue rather than chasing it to its inevitable conclusion?

Building Standing Capabilities The era of ad‑hoc ‘war rooms’ is over. Institutions need standing, cross‑functional response units with decision making authority and clarity over remit - ready to act without waiting for escalation chains.

They should train like any other team, ensuring they are match fit when the time comes, and be seeded with subject matter experts.

Risk now moves faster than our decisions — resilience depends on speed.

AI at Velocity AI models increasingly underpin key areas, such as fraud, credit and customer interactions. But who in your risk teams has the capability to understand AI to the same level as your subject matter experts?

Avoiding AI is no longer an option, given contagion risk through supply chains and the pressure to find efficiencies in processes and control costs. Equally, speed without control is dangerous.

Practical steps: Implement human‑in‑the‑loop for high‑impact decisions; track model lineage and drift continuously; prioritize automation where risk is low; keep manual oversight for critical exposures and hire experts for your risk teams now.

Cyber and Third‑Party Risks As adversaries weaponize AI and geopolitical uncertainty increases, the risk of state-sponsored attacks, cyber incidents can escalate faster than ever and be even more impactful.

Behavioral biometrics, continuous authentication, and anomaly detection are no longer optional. Add to this the concentration risk in cloud

providers: a single outage can ripple across markets and the use of third parties, only increases the attack surface available.

Operational resilience frameworks must stress‑test these dependencies and prioritize recovery playbooks on the assumption that successful attacks are inevitable.

The Strategic Imperative The acceleration of risk is not a passing trend - it’s a structural shift that is ignored at our peril.

Institutions that adapt and embrace a real-time environment and technological change will thrive; those that cling to legacy cycles and the way things have always been done will be blindsided or slide into slow declines as they are outcompeted on every front.

The winners will be those who treat speed as a core dimension of resilience, embedding it into culture, technology, and governance.

Risk management is no longer about predicting the next storm. It’s about building the reflexes to withstand the lightning strike.

9

COMING SOON

TWO FLAGSHIP

EVENTS ONE GLOBAL RISK NETWORK

Risk

Risk

Evolve APRIL

15-16

Join the global risk community for two landmark gatherings uniting visionary leaders, regulators, and innovators shaping the future of risk.

10

LONDON

Americas MAY

19-20

NYC

Find out more here >

Find out more here >

Or visit www.risk-evolve.com

Or visit www.risk-americas.com

CeFPro Flagship Events in Numbers: Over 700 attendees More than 150 presenters 80 CROs and Heads of Departments 90+ presentations and panel discussions 20+ interactive roundtables

Created by the industry, for the industry 11

WINNING THE WAR on the Many Faces of Deepfake Financial Crime

Phil Masquelette serves as Senior Vice President, Chief Risk Officer, and Chief Information Security Officer at Ulster Savings Bank. He previously held senior attorney roles, contributes to financial risk boards, and leads in cybersecurity and governance

12

Deepfakes have rapidly evolved from a technological curiosity into a direct operational threat for financial institutions, reshaping how fraudsters impersonate customers, infiltrate systems, and exploit human trust.

As AI-generated voices, videos, and documents become increasingly indistinguishable from reality, banks are being forced to rethink longstanding controls, strengthen staff training, and prepare for a new era in which identity itself can no longer be taken at face value.

Phil Masquelette, an experienced chief risk officer at a regional bank with oversight of fraud prevention, cybersecurity, and compliance functions, brings a grounded, often humorous, yet sobering lens to the issue.

With a background in law and cybersecurity, he knows only too well that deepfakes – AI-generated visual and audio fabrications – have moved from novelty to a serious operational threat.

13

The technology response must also evolve. Multifactor authentication, behavioral analytics, and even biometric checks that detect blood flow and liveliness are helping institutions stay one step ahead.

But as he pointed out, technology alone isn’t enough. Fraud is adaptive, and today’s tools will be tomorrow’s vulnerabilities.

With the capability to impersonate real people convincingly via voice, video, or manipulated documents, fraudsters are leveraging these tools not only to deceive customers but to penetrate institutions themselves.

This has shifted the conversation from retail-level phishing attacks to concerns about insider threats and the erosion of traditional trust signals like video calls and voice authentication.

One example that stood out was the emerging threat of fake IT employees – foreign actors, particularly from North Korea, using deepfake-driven interviews and false credentials to secure remote roles within companies, not necessarily to steal data, but to create revenue streams for sanctioned regimes.

Mitigating this threat, Masquelette emphasized, starts with people.

While these stories bordered on espionage, the real takeaway was that such schemes are no longer fringe cases.

They represent a broader trend where criminal syndicates – often with ties to trafficking, organized crime, or hostile state actors – are incorporating deepfakes as part of a diversified fraud strategy.

14

Training remains paramount, because fraudsters count on individuals making split-second decisions under pressure.

Teaching employees and customers alike to slow down and verify, to question urgency and appearance, is often the most effective first line of defense.

Whether it’s a wire request from a fake executive or a deepfake video of a customer requesting a banking change, common-sense checks – calling the person back, validating recent transactions, or using codewords – are still highly effective.

The most resilient institutions are those that take a layered, riskbased approach – blending human oversight with continuous investment in detection technology.

He stressed that institutions must also look inward – at their vendors, at their onboarding protocols, and at the controls in place across departments.

This includes scrutinizing how HR verifies candidates and how financial operations authenticate vendor banking changes.

In a world where identities can be convincingly forged in seconds, internal processes must assume the worst-case scenario and be designed to verify trust, not assume it.

While the panel acknowledged that banks are often seen as slow adopters of new technology, this characterization was challenged.

Financial institutions, particularly in fraud and cybersecurity, have been quick to invest in AI-driven detection tools, behavioral analytics, and voice biometrics.

However, Masquelette says, and as Gartner has warned, even these solutions are becoming unreliable when used in isolation. Voice authentication, once heralded as a breakthrough, may soon be considered insufficient without complementary controls.

From the perspective of a risk leader in a regional bank, where scale demands agility, the solution lies in pragmatism.

When fraud happens in seconds, institutions cannot afford to wait weeks for policy approvals.

The conversation concluded on a forward-looking note. Generative AI can play both sides – while it empowers fraudsters, it also has the potential to be harnessed in fraud detection.

Yet, as Masquelette emphasized, it’s still early days. Until these tools mature, the most immediate safeguard remains human judgment, sharpened through training and supported by systems designed with skepticism and resilience in mind.

In a world where identities can be convincingly forged in seconds, processes must verify trust, not assume it.

15

Some professionals develop discipline gradually as their careers mature.

Resilience with Empathy:

Building a Career Without a Safety Net Until recently, Shawn Tumanov was the former Data, Model and AI Governance Executive with GEICO. He was speaking to Chandrakant Maheshwari

16

Shawn Tumanov did not have that luxury. From the time he arrived in the United States as a seven-year-old immigrant from Ukraine, he internalized one truth that would quietly influence every major choice he later made: no one was going to build the path for him.

He would have to build it himself.

There was no financial cushion behind him and no generational wealth to make the early years forgiving. That absence, instead of constraining him, forged a ‘Founder’s Mindset,’ that would define his career: resilience not as an abstract virtue, but as a working principle.

Choosing the Hard Path Early

The critical moment came when he reached college and confronted a question familiar to many first-generation students: How do you earn a degree without drowning in debt?

Most people respond by borrowing. Shawn responded by restructuring his life. To afford school, he worked continuously and relied on employer tuition reimbursement. That meant altering his academic direction. He had dreamed of becoming a history teacher, but the bank that employed him would only cover a business degree. He chose the path that was strategically viable rather than emotionally convenient.

It was not glamorous or aligned with youthful ambition, but it was sustainable. He worked nights, studied during the day, and organized his early twenties around long-term payoff instead of immediate comfort.

When he later pursued his MBA, he repeated the same logic: weekend programs, flexible schedules, night study, full-time work, and a firm refusal to take loans.

This established the first principle of his journey: delayed gratification.

While others progressed faster in the short run, he was compounding long-term advantage by removing debt from his future.

17

Resilience with Empathy: A Governance Catalyst

Shawn’s shift from credit underwriting to the OCC, consulting, model risk, and eventually AI governance did not follow a rigid plan. It evolved because his mindset was uniquely suited to the environments he entered.

Model risk, AI governance, and regulatory remediation share one feature: resistance.

Model owners resist scrutiny. Technology teams resist controls. Compliance teams resist ambiguity.

Most professionals either push aggressively or retreat entirely. Shawn navigates.

He built a leadership style grounded in resilience paired with empathy, a combination that is essential for institutional transformation.

Resilience allows him to revisit difficult conversations, persist after initial rejection, and continue shaping frameworks even when early responses are negative.

He views empathy as a diagnostic tool to understand what drives the resistance: fear of workload, unclear expectations, competing incentives, or the simple frustration of not feeling heard.

This balance is why he has repeatedly been asked to build or repair governance structures in highly regulated, technology-heavy settings. It reflects the second principle of his story.

18

Systems change not by overpowering resistance, but by solving for its source.

A distinctive element of Shawn’s life is the role of physical health. Many professionals treat fitness as a personal preference. Shawn treats it as Executive Infrastructure.

He arranges his schedule around the gym, not the other way around. He goes even when motivation is low. He uses physical routine as a stabilizer for emotional clarity and decision strength.

This discipline has nothing to do with aesthetics. It is a riskmanagement strategy.

Resilience built his path, empathy moved the obstacles, and discipline kept the journey accelerating.

A stable body enables a stable mind, and a stable mind enables sound judgment.

In governance roles where scrutiny and friction are common, this foundation is an operational advantage.

What makes Shawn’s journey meaningful is not the sequence of roles but the internal architecture behind them. He represents a modern profile in risk and AI governance: a professional shaped by resilience, structured discipline, empathy-driven leadership, and a long-term mindset.

His story illustrates a simple but powerful insight: Success is rarely a straight line. It is the accumulated effect of choosing the harder path early, so the road becomes easier later.

19

WHEN VENDOR CHOICES

SHRINK THIRD-PARTY RISK SURGES Lara Hall is an event producer at The Center for Financial Professionals

The third-party ecosystem that banks and insurers depend on is contracting in ways that are both subtle and increasingly dangerous.

What began as a rational wave of outsourcing - driven by the promise of efficiency, innovation and scale - has matured into a structural dependency on a small group of dominant technology and service providers.

For senior risk managers, this shift represents one of the most consequential non-financial risks looming over 2026.

For years, institutions consolidated vendor lists and concentrated spend with strategic partners, believing fewer relationships meant tighter control.

20

But consolidation across cloud infrastructure, core banking platforms, fraud tools and AI services has created a market where choice is shrinking as complexity grows.

Fourth- and fifth-party dependencies now sit hidden inside supply chains, and exit strategies, though required under DORA and expected by supervisors globally, are often theoretical exercises rather than viable pathways.

The resilience gained from outsourcing has been counterbalanced by the fragility of becoming too dependent on a small number of players.

Regulators have taken notice. The Bank of England has repeatedly highlighted the systemic fragility created by dominant cloud providers.

European authorities are preparing to designate a select group of “critical providers”, placing them under direct oversight.

In the United States, regulators are sharpening their expectations around third-party cybersecurity, data management, resilience testing and supervisory visibility into outsourced arrangements.

Their concern is shifting beyond whether a single vendor is safe. The real question has become what happens when the same vendor supports the majority of the market, and whether a failure could escalate from an institutional problem to a systemic shock.

The reduction in vendor optionality is being driven by several forces working in tandem. Technological complexity has increased dramatically, making it difficult for smaller players to compete in cloud-native, AI-driven or analyticsheavy environments.

Regulatory expectations have intensified to the point where compliance costs push niche vendors out of the market or into the arms of larger acquirers.

Strategic consolidation across technology providers has accelerated, with major firms absorbing smaller competitors to strengthen their vertical integration.

Concentration isn’t a side effect of outsourcing — it’s the hidden risk sitting at its core.

21

While this consolidation may improve commercial efficiency, it increases systemic exposure for financial institutions.

As the vendor landscape tightens, several risks become more pronounced. Operational fragility grows because outages at major providers can now affect dozens of institutions simultaneously.

Cyber concentration risk increases as attackers focus efforts on highly interconnected technology providers. Shared AI platforms amplify correlated model errors and data biases across the industry.

Negotiation leverage shifts toward vendors, making it harder for firms to enforce remediation timelines or obtain robust contractual protections.

And perhaps most critically, exit impracticality becomes a defining feature of modern outsourcing.

Data portability challenges, proprietary architectures and high migration costs make switching providers difficult even when risks become unacceptable.

Scenario analysis should capture multi-vendor failure events, including cloud outages and coordinated cyberattacks.

Fourth-party mapping needs to be far more rigorous, as hidden dependencies are often the weakest points in the chain.

Institutions must also challenge the assumption that large vendors are inherently safer, recognising that scale can increase systemic vulnerability. In some cases, rebuilding selective internal capabilities may be necessary to restore resilience and reduce concentration.

The reality is that third-party risk has evolved into ecosystem risk. Banks and insurers no longer need to assess only whether a vendor is stable; they must assess whether the entire market structure around that vendor is resilient.

As choice continues to narrow, the industry must strengthen oversight, deepen scenario planning and rethink long-standing assumptions about the benefits of outsourcing.

In a world with fewer viable providers, the strategic decisions risk leaders make today will determine how well their institutions withstand the shocks of tomorrow.

22

Treasury & ALM USA

Managing these risks requires more than procedural uplift; it demands strategic realignment. Firms must build genuine exit optionality, supported by realistic migration plans rather than theoretical documents.

MARCH

10-11

NEW YORK CITY

Early Bird Rate Ending February 13

Don’t miss your chance to save $400 and join America’s leading treasury and ALM professionals from

Why attend? You’ll gain:

Proven frameworks to structure treasury & ALM teams for resilience in volatile macroeconomic conditions Actionable strategies to strengthen liquidity management in a fast-changing financial landscape Clear insight into the impact of crypto, stablecoins, and digital currencies - and how to turn disruption into opportunity Effective tactics to navigate interest-rate volatility while protecting profitability

Register now before Early Bird savings end on February 13 >

23

institutions may incorporate climate or sustainability criteria into decisionmaking.

At the federal level, ongoing rollbacks and delays to climate-disclosure requirements further complicate the regulatory landscape, leaving banks and insurers navigating a split-screen reality: a capital market

The ESG and Sustainability Tug-of-War – A Contest with No Winners

In the United States, the gap between investor expectations and federal policy on sustainability is widening at exactly the moment global financial regulators are tightening their focus on climate, transparency and longterm resilience.

Institutional investors continue to channel significant capital toward companies that demonstrate credible ESG strategies, with North America showing some of the strongest appetite worldwide: 77% of institutional investors in the region report already investing in sustainable assets, and 90% plan to increase allocations further according to recent global surveys.

24

At the corporate level, the momentum is equally pronounced - 90% of S&P 500 companies now publish ESG or sustainability reports, signalling that market expectations for environmental and social accountability have become firmly embedded across the banking sector and beyond.

Yet this heightened investor demand contrasts sharply with the domestic political environment.

Over the past two years, U.S. states have advanced an aggressive wave of anti-ESG legislation, with more than 40 laws enacted across 21 states, many directly restricting how financial

that increasingly rewards credible sustainability plans, and a political climate that is moving in the opposite direction.

This infographic illustrates the scale of that tension - and why it matters for financial institutions preparing for 2026 and beyond.

90% of S&P 500 companies publish ESG or sustainability reports

US sustainable/ ESG investments total $6.6 trillion (10.7% of US market)

This reflects how deeply ESG expectations are embedded in U.S. capital markets.

Even without federal mandates, major banks and corporations disclose climate and sustainability data because investors increasingly treat transparency as a prerequisite for long-term value and risk assessment.

Despite political pushback, ESGaligned assets remain a substantial segment of the U.S. financial system.

Investors continue allocating capital to sustainability themes, signalling confidence that environmental and social factors will shape risk-adjusted returns across banking, credit and wealth portfolios.

Source: keyesg.com

Source: ussif.org

77% of North American institutional investors already invest in sustainable assets This widespread adoption demonstrates that ESG considerations have moved from niche to mainstream. For banks, investor expectations now routinely extend to climate governance, transition planning and responsible financing strategies - regardless of federal policy fluctuations.

Source: Schroders

25

90% of North American asset owners plan to increase sustainable allocations Future capital flows are set to deepen the market’s dependence on credible ESG strategies. Banks that scale back sustainability commitments could face widening misalignment with investor priorities, potentially affecting valuations, capital access and stakeholder trust.

Source: ESG Today

Markets are demanding more sustainability just as U.S. policy is demanding less.

At least 19 states now limit ESG use in public investment decisions

Ten state legislatures passed eleven new anti-ESG bills in 2025

These restrictions reshape how banks and asset managers interact with public funds. Policies often prohibit considering climate or social risks, forcing financial institutions to navigate conflicting fiduciary frameworks depending on jurisdiction.

The pace of policymaking shows that ESG has become a political battleground. While global markets push for stronger sustainability integration, large parts of the U.S. regulatory environment are moving toward active resistance - widening the divide banks must manage.

Source: Morgan Lewis

Source: ESG Dive

Sustainable Finance Europe

26

86% of institutional investors generally vote in favor of ESG-related resolutions

More than 40 anti-ESG laws enacted across 21 U.S. states

Shareholder voting behavior underscores long-term preferences. Investors increasingly back proposals on climate oversight, disclosure quality and board accountability, signalling that governance practices aligned with sustainability are considered essential to prudent risk management.

This legislative wave restricts how financial institutions may integrate ESG factors, creating compliance and operational friction.

Banks face diverging expectations - investors reward sustainability, while state laws in some regions penalize it.

Source: EY

Source: Harvard Law Forum

Put Your Solutions in Front of the Market

FEBRUARY

25-26 LONDON

Reach the senior sustainability, risk, and investment decision-makers actively shaping Europe’s sustainable finance strategy.

Sponsor Sustainable Finance Europe to showcase your solutions, generate high-value leads, and position your brand alongside the institutions driving ESG and sustainability adoption.

Attending organisations include:

Make an enquiry here >

Or Email us at sales@cefpro.com

27

MACHINE LEARNING MEETS

MARKET TURBULENCE AS RISK CONTROL TIGHTENS Dr. Peter Quell is Head of the Portfolio Analytics Team for Market and Credit Risk in the Risk Controlling Unit of DZ BANK AG in Frankfurt.

He is responsible for methodological aspects of Internal Risk Models and Economic Capital.

He holds a MSc. in Mathematical Finance from Oxford University and a PhD in Mathematics.

The expansion of machine learning (ML) across the financial industry is undeniable. ML now touches everything from credit decisions to fraud detection, automated trading, anti-money laundering and operational surveillance.

In many of these domains, the uplift is substantial, and the momentum toward automation is only increasing.

But when it comes to financial market risk measurement, the story is different. Time series analysis remains a difficult frontier for ML, and despite the excitement surrounding new architectures and computational power, we still face fundamental constraints that prevent widespread adoption in market-risk functions.

The core challenge is rooted in the nature of financial time series.

Markets are noisy, non-stationary 28

and often offer only short run histories. Traditional machine learning methods thrive on large, stable, repeatable patterns.

Financial markets rarely offer those and the signal-to-noise ratio is chronically low. For many ML models, especially deep learning approaches such as long short-term memory models, there simply is not enough reliable structure for the algorithm to learn from.

This produces a familiar danger: overfitting. When noise overwhelms signal, the algorithm begins to learn randomness. The outcome often looks convincing in training data, but performance collapses once exposed to new regimes.

The speed at which markets change their volatility, correlations and structural characteristics means the

model is almost always behind the curve. A system that appears successful in one environment can deteriorate dramatically when conditions shift.

The question, then, is how to prevent ML from becoming brittle in the very moments when risk teams need it to be resilient.

The answer lies less in finding the perfect algorithm and more in strengthening the governance structures around model development and deployment.

The practical hurdles banks face when moving ML from prototype to production remain significant.

Many institutions already operate robust model risk frameworks, yet these frameworks were not designed for the diversity, opacity and dynamism of modern machine learning. Risk teams must rethink model classification to incorporate new attributes that determine the level of validation required.

A system that appears successful in one environment can deteriorate dramatically when conditions shift.

29

obscure the underlying logic.

Understanding these data dependencies is crucial for determining whether a model is safe to deploy.

A third challenge lies in evaluating ML outputs. Models built on supervised learning come with defined targets that allow accuracy to be measured.

Unsupervised models, however, provide no such clarity.

Model complexity is the first of these. Unlike traditional parametric models, ML systems may contain dozens of hidden layers, thousands of parameters and multiple stages of transformation.

Transparency varies dramatically depending on the architecture, and interpretability is no longer a simple matter. Institutions must develop systematic ways of comparing and categorizing model complexity so that appropriate oversight can be applied.

Data usage introduces another layer of difficulty. Machine learning is inseparable from the data that trains it. The volume, quality and structure of that data are now core drivers of model risk.

Poorly labelled or unstructured data can produce inaccurate outputs that are difficult to detect until damage has been done.

Even high-quality data can become problematic when variable interactions or transformations 30

When a clustering algorithm or sentiment model misbehaves, the error may be subtle or invisible. This demands new standards for output monitoring and stress testing that go far beyond traditional back-testing.

Finally, model recalibration must be considered a core part of the risk framework. Markets evolve, and ML models drift. Some models require full redevelopment when conditions change; others can be retrained quickly.

Banks need a clear understanding of the recalibration pathway for each model, as well as criteria for determining when recalibration is necessary.

Machine learning will continue expanding into market-risk domains, but doing so safely will require a stronger governance foundation.

The goal is not to slow innovation, but to ensure that enthusiasm does not outpace discipline. If ML models are to remain reliable through shifting market regimes, our control structures must adapt with the same speed and rigor that the technology demands.

Advanced Model Risk Europe MARCH

17-18

LONDON

Showcase Your Model Risk & AI Solutions to the Right Decision-Makers Sponsor Advanced Model Risk Europe Connect directly with Europe’s model risk decisionmakers who shape enterprise frameworks across financial institutions. If your solution enables trusted AI, compliant innovation, and resilience model risk management, this is where they’re looking.

Put your solutions in front of the market.

Speakers joining us from:

Make an enquiry here >

Or Email us at sales@cefpro.com 31

As we ease into a new year rich in both opportunity and challenges and we see how quickly the compliance and regulatory landscape is changing both in both scope and complexity, I’m reminded of one of the keynote sessions at our Risk Evolve conference last year.

NEW YEAR OLD CHALLENGES: Operational Resilience in an Uncertain World Andreas Simou is Managing Editor at The Center for Financial Professionals

During the discussion, led by Søren Agergard Andersen and focusing on operational resilience, one thing became abundantly clear: our industry must move past viewing resilience as a compliance exercise and embed it into the core of business strategy.

The conversation underlined how resilience, if designed and owned correctly, has the potential to transition from a passive (and often reactive) regulatory requirement into a proactively driven long-term competitive advantage.

For infrastructure investors and alternative asset managers, the discussion took on a unique dimension.

Unlike banks with centralized structures, infrastructure projects are decentralized, often scattered across geographies with varying operational maturity. Each site must stand on its own while contributing to broader portfolio stability.

This reality makes resilience a more complex - and more urgent - challenge for project-driven businesses.

32

33

Resilience lives in operational details, not in binders of documentation.

There’s no doubt the regulatory landscape is intensifying, and since regression is, by definition, rarely if ever progressive, we can be sure that intensity will grow rather than shrink as we head beyond this year.

In the UK, the Prudential Regulation Authority’s 2025 resilience standards are reshaping supervisory expectations, while the EU’s Digital Operational Resilience Act (DORA) is pushing firms to scrutinize their technology dependencies.

Large, systemic institutions may have been preparing since the financial crisis, but mid-tier and smaller entities now face a steep climb. Regulators acknowledge proportionality, but the principle of tailoring resilience to actual risk profiles still requires significant investment and judgment.

What came through clearly at Risk Evolve is that resilience cannot live in silos. Policies, however wellwritten, mean little if they are not linked across third-party oversight, risk management, compliance, and change management.

Resilience must be designed into procurement decisions, technology rollouts, and strategic moves, not retrofitted after weaknesses appear.

The last few years have served to test many of our industry’s assumptions 34

around this theme. Geopolitical shocks, supply chain breakdowns, and rapid digitalization exposed hidden vulnerabilities.

Cloud dependency and vendor concentration now sit high on the agenda, alongside the unpredictable risks of artificial intelligence.

For firms in infrastructure and alternatives, these challenges multiply across jurisdictions, making local ownership and global coordination indispensable.

Scenario testing has become the crucible where resilience plans prove their worth - or reveal their flaws.

Institutions have discovered that what looks robust on paper often falters in practice.

In one example, a service-level agreement collapsed under realworld conditions when access to critical systems was inconsistent across regions.

The lesson is simple but vital: resilience lives in operational details, not in binders of documentation.

Regulatory compliance is necessary, but it is not sufficient. True resilience requires an enterprise-wide perspective that links operational continuity with credit, market, and liquidity risk.

As with all chains, our systems are only as strong as their weakest links, which often lie in overlooked thirdparty relationships, fragile technology chains, or the unpredictability of human behavior.

Governance remains a defining issue. The consensus is that resilience belongs in the first line of defense those who run the business must own it.

increasingly valued alongside technical skill. In practice, it is judgment - not models - that often makes the difference in navigating a crisis.

The second line must challenge assumptions and monitor effectiveness without creating unnecessary drag on business operations, and this represents a delicate balancing act: too much oversight risks slowing innovation, too little creates systemic blind spots.

Looking ahead, the challenge for financial institutions is to embed resilience as part of organizational culture.

Talent is also a key factor in the resilience debate. Few universities teach resilience as a discipline, yet firms are in desperate need of professionals who can combine technical depth with broad business acumen.

Curiosity, adaptability, and stakeholder management are

This means moving beyond the minimum standards set by regulators and embracing resilience as a marker of trust, stability, and leadership.

When resilience is truly integrated, it ceases to be an obligation and becomes a differentiator.

In an era defined by systemic shocks and relentless change, those who achieve this will not only withstand disruption but emerge stronger because of it.

Advanced Model Risk USA March 3-4, 2026 NYC

Secure your place today>

Ending February 6

This is a must attend event for model risk, validation and AI governance professionals, delivering first hand insights from senior leaders across top financial institutions including.

35

Advanced Model Risk Series In March 2026, CeFPro’s Advanced Model Risk series comes to New York (March 3–4) and London (March 17–18), bringing together senior model risk leaders to tackle the most pressing challenges in an AI-driven financial landscape.

Stand Out Speakers

As AI adoption accelerates and regulatory expectations intensify, these events focus on AI governance, modern model validation, regulatory divergence, and third-party model oversight. Discussions will address bias and fairness, explainability in complex and black-box models, and the governance of generative and agentic AI.

Roderick Powell

Emre Balta

Imir Arifi

Rafic Fahs

FRM Managing Director MRM AI/ML Center of Expertise Bank of America

36

London March 17-18 Agenda >

Director of Model Risk Management Bank of Hawaii

Sofia Rahman

Head of Gen AI Model Compliance Review Citi

Chief Model Risk Officer Fifth Third Bank

Managing Director, General Counsel, Intellectual Property and AI Citi

Maribel Tejada

John McCracken

Nidhi Agarwal

Head of Model Risk Oversight ING

Managing Director - Global Head Model Risk Policy and Governance Standard Chartered Bank

Group Director of Modelling Nationwide Building Society

Ratul Ahmed

Eleimon Gonis

JP Buckens

With insights from regulators and industry experts, our Advanced Model Risk 2026 series equips institutions to strengthen governance, align globally, and stay ahead of evolving supervisory demands.

NYC March 3-4 Agenda >

Chief Model Risk Officer First Citizens

Briony Pentecost

Group Head of Model Risk Management & Validation Commerzbank

Head of Independent Model Validation Virign Money

Head of Model Risk Management Danske Bank

37

ARE YOU READY FOR A

PERFECT STORM OF DISRUPTION IN

2026 Mark Norman is Head of Content at The Center for Financial Professionals, and Editor of Connect Magazine 38

So you thought 2025 was a challenging year? Well, all the signs are that, in the immortal words of Bachman Turner Overdrive, you ain’t seen nothing yet.

Few of us could argue that the last 12 months have been anything less than turbulent.

It’s been a year since the Los Angeles wildfires, yet their aftermath still resonates as we move into 2026; we saw multiple events that raised serious

questions about how we approach TPRM, concentration risk and cyber security.

AI increasingly became, simultaneously, both the opportunity of several generations and the burning platform of threat in a churning sea of governance, compliance and regulatory change.

Geopolitical uncertainty with a change at the heart of American government and the ongoing conflicts in Ukraine and the Middle East also played a starring role in the boardrooms and C-suites of global financial institutions.

And all that barely scratches the surface of a year that was as unpredictable as it was ripe in opportunity.

We head into 2026 facing one of the most complex and volatile operating environments in more than a decade.

For institutions still adapting to postpandemic restructuring and digital transformation, the year ahead, like its predecessor, promises both opportunity and strain.

Geopolitical instability remains the most unpredictable driver of risk. Elections across major economies, ongoing conflicts, trade 39

fragmentation, and sanctions volatility continue to reshape supply chains and exposures.

Banks and insurers are being pushed to revisit assumptions that once felt stable - from country risk ratings to the reliability of cross-border service providers. Contingency planning, once a periodic exercise, is becoming a permanent operating mode.

Layered onto this is the rapid proliferation of artificial intelligence and generative AI. While AI promises efficiency gains across fraud detection, credit decisioning, customer interaction, and operational resilience, its expansion also introduces non-traditional risks that existing frameworks struggle to capture.

Model drift, hallucinations, explainability gaps, and dependency on opaque third-party models are becoming central concerns.

With agentic AI on the horizon systems that make autonomous decisions at machine speed - the challenge shifts from governance to containment.

Concentration risk is expected to be a defining theme of 2026. Banks and insurers are simultaneously increasing reliance on a shrinking pool of critical providers: cloud platforms, cybersecurity vendors, data aggregators, AI foundation model developers, and specialised outsourcing partners.

40

Regulators in the US, UK, and EU are sharpening their scrutiny of systemic single-points-of-failure, and new supervisory frameworks may force institutions to rethink procurement strategies and redundancy planning.

Climate risk remains one of the most stubbornly complex issues. Transition risk is rising sharply as global climate policy diverges.

In Europe, expectations continue to intensify as regulators push for climate scenario analysis, emissionsaligned finance, and robust disclosures. In contrast, US policy has shifted toward deregulation, reducing pressure for climate-aligned financial frameworks.

Risk leaders now face a dual accountability problem: satisfying international investors demanding credible ESG integration while navigating a domestic policy environment that is politically resistant to climate regulation.

This tension is especially evident in capital markets, where large asset managers increasingly expect banks to demonstrate sustainability leadership, even as US political rhetoric encourages firms to deprioritize environmental commitments.

Operational resilience will also dominate executive agendas (read more on this from CeFPro MD Andreas Simou on page 32). Institutions continue to mature their response capabilities, but rising cyberattacks, AI-driven fraud, and high-impact outages remain existential risks.

Regulatory expectations around resilience testing, third-party oversight, and critical service mapping are steepening, particularly as DORA takes effect in the EU and UK standards tighten further.

The speed of digitization compounds everything: payments modernization, open banking, and embedded finance introduce new interdependencies that require cross-functional risk coordination.

Many organizations are discovering that risks previously treated in isolation - cyber, fraud, technology, model risk - now bleed into one another through interconnected systems.

For senior risk leaders, 2026 will require a shift toward anticipatory governance.

The year ahead is not simply another chapter in the story of risk management - it is a stress test for the industry’s ability to adapt to simultaneous, overlapping disruptions. Those who navigate it well will help shape the future of global financial stability.

Risk leaders must navigate 2026 with sharper foresight as disruptions collide at unprecedented speed.

41

JANUARY

News stories round-up

Powell Warns Criminal Investigation Threatens Fed Independence

EU Blocks Capital Relief Route for Bank Owned Asset Managers

European banking rules prevent lenders from using insurance subsidiaries to apply favorable capital treatment to asset managers, the European Banking Authority has confirmed. The clarification shuts down a potential loophole regulators fear could enable capital arbitrage and reshape how banks structure acquisitions. View here >

Criminal Networks Exploit FinTech and Crypto to Reinvent Money Laundering

Modern financial crime is evolving as criminal networks blend traditional banking, FinTech tools, commodities, and crypto to move illicit funds. New laundering models combine legal trade with underground banking and AI driven fraud, challenging regulators and financial institutions to rethink controls, verification, and policy responses. View here > 42

Jefferies Takes $30 Million Hit From First Brands Collapse Jefferies has booked a $30 million pretax loss tied to the bankruptcy of auto parts supplier First Brands, as legal battles intensify and regulators probe investor disclosures. The write down comes even as the investment bank reports strong momentum in dealmaking and capital markets heading into 2026. View here >

Federal Reserve Chair Jerome Powell says US prosecutors have opened an unprecedented criminal investigation into his Senate testimony, warning it risks undermining the independence of monetary policy. The probe follows long running political tensions with President Donald Trump over interest rates and has prompted sharp reactions across Washington and financial markets.

View here >

New Report Suggests CFOs Upbeat on AI Investment as Risk Appetite Grows

UK finance chiefs are growing more optimistic about AI’s impact on performance and expect digital investment to rise, according to Deloitte’s latest CFO survey. While confidence and risk appetite have edged higher from recent lows, geopolitics and weak productivity remain top concerns heading into 2026. View here >

Morgan Stanley Warns AI Push Could Wipe Out 200,000 European Banking Jobs

More than 200,000 banking roles in Europe could disappear by 2030 as lenders accelerate AI adoption and continue to shrink branch networks, according to Morgan Stanley analysis first reported by the Financial Times. The cuts would likely fall hardest on central services teams, including back office, middle office, risk, and compliance, even as industry leaders warn against losing essential banking fundamentals. View here >

NCUA Warns Cyber Vendor Blind Spot Leaves Credit Unions Exposed View here >

Mexico Central Bank Tightens Cyber Rules for Commercial Banks View here >

HSBC Taps BNP Paribas Veteran to Drive Asia Transition Push View here >

PRA Sharpens Climate Rules with Tests on Banks and Insurers

View here >

43

TRENDWATCH: SIX REGULATORY SHIFTS

SET TO RESHAPE RISK MANAGEMENT

IN 2026

01

02

Although the final Basel III reforms were originally delayed in several jurisdictions, 2026 is when many of the most impactful elements will bite - especially capital floors, revised credit risk weightings and the Fundamental Review of the Trading Book (FRTB).

Operational resilience regulations that were once conceptual are now enforceable.

BASEL III IMPLEMENTATION BECOMES A REAL-WORLD TEST

Banks face substantial increases in operational and market risk capital requirements, with global estimates of additional capital ranging from €27–€70 billion across EU banks according to the European Banking Authority (EBA, 2023).

Regulatory change in 2026 is expected to accelerate at a pace not seen since the post-crisis era, placing intense pressure on risk leaders across banking and insurance.

As supervisors pivot from consultation to enforcement, financial institutions must prepare for a year defined by heightened scrutiny, deeper data expectations and stricter accountability.

Institutions must demonstrate not only compliance but credible scenario analyses to validate the sustainability of their capital positions.

For many, this will expose gaps in model governance and challenge aggressive RWA optimization strategies.

OPERATIONAL RESILIENCE ENTERS THE “PROVE IT” PHASE

In Europe, the Digital Operational Resilience Act (DORA) will require firms to demonstrate - not merely document - their ability to withstand ICT disruption.

This includes mandatory incident reporting, mapping of critical functions and rigorous testing of severe-but-plausible scenarios.

UK regulators will similarly expect firms to meet their 2025 impact tolerance deadlines, meaning 2026 supervisors will ask institutions to prove that new frameworks genuinely work under stress.

Six themes will dominate the regulatory landscape.

44

45

03 04 05 06 CLIMATE RISK SHIFTS FROM DISCLOSURE TO PRUDENTIAL IMPACT

AI AND MODEL RISK RULES ACCELERATE UNDER THE EU AI ACT

THIRD-PARTY AND CONCENTRATION RISK OVERSIGHT INTENSIFIES

DATA, DISCLOSURE AND GOVERNANCE CONVERGENCE RAISES THE BAR

After years of climate disclosure requirements, supervisors are moving toward integrating climate risk into prudential frameworks.

The EU AI Act, set to enter force in 2025–2026, will represent the world’s most far-reaching framework for AI governance.

If 2024–2025 revealed the fragility of digital supply chains, 2026 will be the year regulators embed systemic expectations.

Across climate, AI, operational resilience and financial crime, regulators are converging around one theme: governance.

The NGFS continues to expand scenario granularity, while the ECB has warned repeatedly that banks remain “materially unprepared” for climate risk quantification, with 96% of banks lacking adequate methodologies (ECB Climate Stress Test, 2022).

Banks and insurers using models classified as “high risk” - including credit decisioning, fraud detection and biometric verification - must meet strict obligations for validation, transparency, documentation and human oversight.

DORA’s third-party criticality assessments and the anticipated designation of “critical ICT providers” will force firms to document - and test - their dependency on cloud and service partners.

Firms must unify diverse disclosure regimes - from CSRD to ESG taxonomies to model risk reporting - into a coherent data architecture. Senior management accountability regimes will tighten in parallel, placing pressure on executives to demonstrate oversight of risks spanning technology, sustainability and third-party resilience.

In 2026, the focus will shift to whether climate factors - transition pathways, physical event exposures and counterparty emissions - affect credit risk assessments, collateral valuations and provisioning. Insurers face similar expectations under Solvency II reforms.

This comes against a political backdrop of ESG pushback, particularly in the U.S., where federal policy is shifting away from climate initiatives.

Global firms will be forced to balance investor demands for sustainability with more conservative regulatory attitudes in certain markets.

46

Regulators will also intensify scrutiny of Generative AI, particularly around explainability, data lineage, hallucination risk and cybersecurity vulnerabilities.

Model risk teams will need updated inventories, tiering frameworks and monitoring processes that treat AI as a living system prone to drift, bias and third-party dependency.

Regulators are increasingly vocal about concentration risk, warning that the failure of one cloud provider could produce crossmarket operational contagion.

Financial institutions will be expected to demonstrate credible exit strategies, fourth-party mapping and real-time monitoring of outsourced dependencies.

Institutions that integrate data, governance and scenario analysis will be best positioned for a regulatory landscape demanding transparency, agility and assurance.

2026 will be the year regulators move from guidance to enforcement—and risk teams must be ready.

47

Sustainable Finance Europe

Advanced Model Risk USA

February 25-26, 2026 | London

March 3-4, 2026 | NYC

Treasury & ALM USA

Advanced Model Risk Europe

March 10-11, 2026 | NYC

Risk

Evolve

April 15-16, 2026 | London

March 17-18, 2026 | London

Risk

Vendor & Third Party Risk Europe

June 3-4, 2026 | London

Americas

May 19-20, 2026 | NYC

Vendor & Third Party Risk USA

June 9-10, 2026 | NYC

Experience premier risk-focused conferences delivering powerful insights, innovations and discussions shaping financial services View all of our upcoming events here > 48