Risk-based supervision in one minute
No supervisor has the people to examine every firm closely every year. Risk-based supervision accepts that and makes it a method: understand where the risks are, rate each firm on the harm it could cause and how likely that is, and set supervisory intensity to match. The highest-risk firms get close, continuous attention. The lowest get lighter monitoring, but never none.
It is not optional. The Basel Committee’s Core Principles, revised in April 2024, are the minimum standard for banking supervision that the IMF and World Bank assess countries against (BIS). Insurance supervision follows the same logic, and the FATF Recommendations require a risk-based approach to anti-money laundering supervision of both financial institutions and DNFBPs.
The supervisory cycle
Risk-based supervision is a loop, not a one-off rating exercise.
- 01UnderstandBuild a picture of the risks in the sector and in each firm, from returns, inspections, intelligence and the wider market.
- 02RateScore each firm on the harm it could cause and how likely that harm is, using criteria that are written down and applied consistently.
- 03PlanSet supervisory intensity by rating: close engagement for the highest, lighter-touch monitoring for the lowest.
- 04SuperviseDesk-based reviews, onsite examinations and thematic work, focused where the rating says the risk is.
- 05ActFindings, requirements, and where needed, enforcement. Every decision recorded with its evidence.
- 06UpdateFeed what you learned back into the rating, so the next cycle starts from a better picture.
Impact and probability
Most frameworks rate firms on two axes. Impact is the harm a firm could do if things went wrong: to depositors, policyholders, markets or the financial system. Probability is how likely that is, given the firm’s business model, risks, controls and governance. A large firm with strong controls and a small firm with weak ones can end up needing similar attention for very different reasons. The ratings only work if the criteria are written down and applied the same way by every supervisor, so two teams looking at the same firm reach the same answer.
What it needs from data
Risk-based supervision runs on information: regulatory returns, inspection findings, complaints, intelligence and market data. If returns arrive late, need cleaning by hand or sit unread, the rating reflects last year’s firm. The data foundations are unglamorous: returns that are validated as they arrive, consistent definitions across firms, and an evidence trail from every rating back to the information that drove it.
Where it goes wrong
Three failure patterns are common. Ratings refreshed once a year, so a firm’s risk changes for months before anyone notices. Judgement that is never recorded, so a rating cannot be explained to the firm, a board or a court. And the long tail of low-rated firms that nobody ever looks at, which is where problems hide. Scale makes the last one worse: the FCA expects around 60,000 firms to enter its anti-money laundering remit in 2028 and plans to use AI tools to supervise them (Insurance Times).
Where AI fits, and where people decide
AI changes the economics of the long tail. It can read every return and attachment as it lands, so even a low-rated firm gets looked at every cycle, and point a supervisor at the firms whose filings suggest the rating may be out of date, with the evidence attached. Supervisors already use AI widely, but mostly to summarise and draft (Central Banking, Jul 2026). Using it inside the supervisory cycle is the bigger step.
The rating and the action stay with supervisors. AI can propose. Deterministic rules apply the written criteria the same way every time. A supervisor decides, and the decision is recorded with its evidence. As evaluation sets show AI suggestions matching expert judgement over time, it can earn more responsibility, but never the final say.
- 1Are your rating criteria written down, and would two supervisors rate the same firm the same way?
- 2How old is the data behind your average firm rating?
- 3When did someone last look at your lowest-rated firms, and what did they find?
- 4Can you show, for any rating, the evidence and the judgement behind it?
- 5Which signals in returns would tell you a rating is out of date, and who sees them?
Questions
What is risk-based supervision?
Risk-based supervision is an approach in which a supervisor directs its attention and resources to the firms, activities and risks that pose the greatest threat to its objectives, instead of applying the same intensity to every firm.
Is risk-based supervision required by international standards?
Yes. International standards for banking, insurance and anti-money laundering supervision all expect supervisors to take a risk-based approach. The Basel Committee published revised Core Principles for Effective Banking Supervision in April 2024, and the FATF Recommendations require a risk-based approach to AML/CFT supervision.
How do supervisors rate firms?
Most frameworks combine impact, meaning the harm a firm could cause if it failed or misbehaved, with probability, meaning how likely that is given its risks and controls. The combination sets how closely the firm is supervised.
What is the difference between risk-based and rules-based supervision?
Rules-based supervision checks every firm against the same requirements on the same schedule. Risk-based supervision still enforces the rules but varies the depth and frequency of supervision according to risk.
How can AI support risk-based supervision?
AI can read every return and document as it arrives, so even low-rated firms get some attention, and it can suggest when a rating may need to change, with the evidence. Supervisors decide the ratings and the actions.