When the Culture Turns: Supervising the Risks That Hide in Plain Sight 

Culture. Systemically-encouraged behaviour ingrained into the DNA of a financial entity.

Culture in a financial institution is not a soft concept. It is the accumulated sediment of values, habits, and unspoken expectations that determine how people actually behave, as distinct from how policy manuals say they should.

Over the past decade, regulatory bodies including the Financial Stability Board, the Basel Committee on Banking Supervision, and a number of national supervisors across Europe, Canada, and Australia have converged on an important recognition: that sound institutional culture underpins prudent risk-taking, effective governance, and ultimately the safety and soundness of banks. What has lagged behind this recognition is the supervisory will to treat culture risk with the same rigour applied to capital adequacy or liquidity.

Culture, in its broadest sense, is the preserved stock of norms and values that transcend any particular moment or circumstance. It embeds itself so deeply in an institution's DNA that individuals begin to internalise it, filtering new events through its lens and calibrating their responses accordingly.

For an outsider, it is notoriously difficult to read. For insiders, the very familiarity that comes from living within a culture makes it equally hard to see. In a financial entity, culture is the aggregate output of countless interactions between functional units, individuals, and the logic of the business itself. It is, in effect, systemically encouraged behaviour: a manifested summary of the behavioural inputs that collectively define how an institution operates in practice.

The Trust Variable
Good institutional culture defines success, while toxic culture mars its prospects. 

The distinction between a culture that sustains and one that destroys is not always visible until the damage is done. Indian Bank offers an instructive example from a few decades ago. Deep in financial trouble, the institution faced widespread predictions of collapse and a depositor exodus. Neither materialised. Deposits continued to grow, sustained by a culture of trust and loyalty so deeply embedded that it outlasted the crisis, and the bank recovered. That culture of trust, the FSB has argued, is not incidental to institutional resilience: it makes it more likely that a firm and its people will be trusted, reinforcing the predictability of future behaviour in ways that no compliance framework can fully replicate.

Toxic cultures, however, have repeatedly proven capable of overriding formal risk management systems entirely. These reward short-term gain, suppress dissent, or erode ethical standards over time. The 2008–09 global financial crisis offered a stark lesson: the prevailing social norm of light-touch regulation had become a cultural artefact, encouraging wealth creation for institutions and individuals while systematically diluting public objectives.

Enron articulated a purpose built on honesty and transparency but drifted steadily into misconduct under the cover of supervisory indifference. India, too, has seen its share of institutional failures in which greed and self-promotion became the unacknowledged operating norms. 

Beyond the Boundary
Regulators have long drawn a distinction between culture as a risk management variable and culture in the broader managerial sense. The former concerns whether leadership and staff behave in ways consistent with the firm's risk appetite and governance framework — a supervisory question with direct links to material financial risk. The latter concerns the institution's values, brand, and broader priorities, which is generally treated as management's domain. That boundary is reasonable. But it has also served, in some quarters, as a convenient excuse for supervisory inaction.

The Canadian Banking Association has been explicit on this point: culture risk falls legitimately within the prudential supervisor's mandate precisely because culture shapes how decisions are made and how risks are identified, managed, and escalated. 

The Financial Conduct Authority in the United Kingdom takes a similarly direct approach, examining whether practices around recruitment, performance management, and reward embody the behaviours that serve the long-term interests of firms, customers, and market integrity. Its argument is pointed: if culture is ignored, an opportunity is lost to address one of the deepest root causes of conduct failure. The answer lies not in prescribing cultural outcomes but in acting on the variables that determine culture — governance and remuneration foremost among them.

The Basel Committee's principles for culture risk supervision require supervisors to assess not just the formal risk culture of an institution but the norms, attitudes, and behaviours related to risk awareness and decision-making, and to verify that management communicates corporate values effectively.

The European Banking Federation reinforces this with a preference for "observing and listening" to people within the firm, rather than articulating prescriptive rules designed to produce a supervisory score. The difficulty, even for those committed to treating culture with the same rigour applied to capital, credit, and liquidity, lies in assessment: the skills required are scarce, and the subject resists the kind of quantification that supervisors are most comfortable with.

Supervisors should instead focus on whether sufficient controls exist to detect and remediate cultural deficiencies before they harden into financial exposures. Assessing culture, the EBF concedes, is more an art than a science. But an experienced supervisor "joins the dots" by checking financial reports against direct information from employees, absorbing the institutional atmosphere without crippling the organisation through formal surveys.

The dominant framework for culture assessment has long centred on tone from the top: what leadership says, signals, and sanctions. That remains important. But two other registers deserve equal attention. The first is the whisper in the middle: what managers say to each other in the absence of senior oversight, and how they translate institutional values into operational decisions. The second is the silence at the bottom: the absence of challenge, the grievances unvoiced, the concerns raised once and then abandoned. Both are diagnostic of a culture in difficulty.

Supervisory frameworks that attend only to formal leadership communication will, by definition, miss them.

The case for treating culture risk with the same analytical seriousness as credit, capital, and liquidity is no longer a matter for debate. The tools and frameworks exist. What remains is the institutional commitment to deploy them.