Key Takeaways on Risk in 2025, Straight From the CROs

As banks begin the year, risk leaders are contending with a mix of persistent financial risks, escalating cyber threats, and the lingering effects of 2023’s regional banking crisis. At RMA’s recent Annual Risk Management Virtual Conference, CROs Jodi Richard (U.S. Bank) and Kieran Fallon (PNC) shared insights on how banks are managing these risks and more in 2025. Here’s what they had to say.

The Speed of Risk Is Reshaping Banking

The 2023 regional banking crisis showed how quickly risks can escalate, whether through social media-driven deposit flight or macroeconomic shifts. In RMA’s latest CRO survey, 82% of respondents said the industry was caught off guard by the speed of risk in the crisis.

For risk leaders, the acceleration of money movement, financial market changes, and digital communications means banks must build resilience. “Consumers expect 24/7 access to their money,” Richard said, noting that real-time payments introduce new liquidity and operational risks.

Cyber and Fraud Risks Keep Evolving

Cyber risk topped the CRO survey for the third time in four years, with fraud not far behind. “The threat actors keep changing their tactics,” Richard said, making it essential for banks to continually adapt their defenses. Fallon pointed out that cybercriminals are no longer small-scale operators—many work in organized groups with significant resources.

The second line of defense plays a growing role in cybersecurity oversight, he added, helping ensure banks have monitoring systems and strong incident analysis and response plans in place.

Credit Risks Are Mounting

On the credit risk front, office real estate remains a slow-burning concern, with banks closely watching delinquencies and occupancy trends. Meanwhile, consumer delinquencies are starting to tick up as pandemic-era savings have run out.

Depositor behavior also remains uncertain. “A lot of customers moved deposits around as interest rates rose, trying to chase higher yields,” Fallon noted. The question now: Will deposits stabilize if interest rates decline, or will outflows continue?

AI Is a Double-Edged Sword

Generative AI presents both opportunities and risks. While banks are eager to explore efficiency gains, Fallon cautioned that AI models require careful governance. “The quality of the output is only going to be as good as the quality of the data you put in,” he said.

Richard added that prioritization is critical, as banks juggle multiple AI initiatives. “How do we prioritize all the potential uses to an extent where we can appropriately manage and control the risk of rolling them out?” she asked. By moving too slowly banks risk falling behind competitors—but moving too fast without strong controls could introduce new vulnerabilities.

A Strong Risk Culture Is Essential

With limited resources and an ever-growing list of risks, CROs emphasized the importance of foundational risk management. Richard stressed that “the foundation of a strong risk culture in your organization” is essential, along with “good governance routines, reporting, communication, and escalation processes.”

A strong foundation allows risk teams to stay agile. “You have to have a good ability to be nimble, reprioritize where you’re going, and make sure that you can shift resources around when you need to,” she said. Without that, “it’s whack-a-mole, and you never really feel ready to manage the next crisis.”