Operational Risk: Key Risk to the Canadian Financial System in a Rapidly Evolving Environment

Financial institutions' exposure to operational and nonfinancial risks has grown substantially, with operational resilience requiring commensurate strong risk and control infrastructure as part of operational risk management frameworks. Vulnerabilities are rising as a result of the evolution in technology and innovative products, the increased prevalence and reliance on third-party arrangements, escalating geopolitical tensions, and large-scale mergers and acquisitions that test the viability of newly integrated systems. Further, rapid advancements in artificial intelligence and digitization, along with increasingly sophisticated techniques from bad actors -- in some cases state supported -- are amplifying risks related to cyber security, fraud, and anti-money laundering.

Key Highlights
-- Operational risk events are complex and diverse, and the fast-paced operating landscape is making it increasingly challenging to systematically manage these risks.
-- Operational risk management frameworks should be sufficiently dynamic to identify, measure, and monitor rising threats, while allowing senior management and the board of directors to provide effective oversight.
-- Significant operational risk events can result in negative credit rating actions. We incorporate relevant risks in our analysis through the evaluation of quantitative and qualitative factors.

According to Shokhrukh Temurov, CFA, Vice President, North American Financial Institution Ratings, "Operational risk events could materially affect the credit profile of financial institutions, changing the credit ratings and/or the credit rating trends. Recent examples in our coverage universe include The Toronto-Dominion Bank (rated at AA (high) with a Negative Trend) and Credit Suisse AG (the credit ratings were discontinued and withdrawn upon the completion of its merger with UBS AG, rated at AA (low) with a Negative trend). Significant failures in compliance and corporate governance related to anti-money laundering were among the key negative credit rating drivers for these institutions."