Trade Finance BD · Original revision handnote · Edition 2026.1
RMFI — Risk Management in Financial Institutions
AIBB · Compulsory · 14 October 2026
Identify material risks, quantify exposures and connect controls, governance, capital and resilience.
Use this revision pack with the full syllabus and official papers. Important topics are revision priorities, not a promise of future questions.
Contents
- A · Enterprise risk and risk culture
- B · Identification and assessment
- C · Risk governance and accountability
- D · Operational risk and continuity
- E · Implementing and testing ERM
- F · Core financial and compliance risks
- G · Capital and prudential measures
- Worked example
- Applied case and model response
- Terminology
- Official syllabus and papers
Revision priorities
Appetite, ALCO, settlement risk and E&S controls — Reviewed 7th paper: 7th Banking Professional Exam, page 1, Q1–Q4
Duration sensitivity and capital calculations — Reviewed 7th paper: 7th Banking Professional Exam, page 1, Q5; Q6 on page 2
Syllabus-mapped handnotes
Module A
Enterprise risk and risk culture
Syllabus scope: Appetite; tolerance; inherent/residual risk; governance; risk-return trade-off
Enterprise risk management connects risks across products and the institution instead of treating each department separately. Risk appetite states the risk an institution is willing to accept in pursuit of objectives; limits translate it into operational boundaries. Inherent risk is the exposure before controls; residual risk remains after the controls considered. A sound culture rewards transparent escalation and challenges optimistic assumptions. High returns may compensate for higher risk, but they do not justify a breach of law or an approved limit.
Apply it in bankingExpress appetite through measures such as concentration, loss tolerance and liquidity survival rather than a slogan like “low risk.” Assign owners and escalation triggers.
Practice question: Design a bank risk-appetite framework and connect it to business planning.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Module B
Identification and assessment
Syllabus scope: Risk register; likelihood/impact; ratings; KRI; assessment and monitoring
Identify causes, events and consequences, then assess likelihood and impact using a consistent scale. A risk register records owner, controls, residual exposure, treatment and review date. Key risk indicators warn of exposure changes; performance indicators measure outcomes. Ratings help prioritisation but can create false precision when evidence is weak. Combine historic loss, scenarios, control testing and expert judgement. Assess correlated exposures: small risks across many units may become material under one shared shock.
Apply it in bankingRising overdue renewals can be a leading credit KRI, whereas a reported NPL ratio is largely a lagging outcome. Define thresholds and a response for each.
Practice question: Prepare a risk register and distinguish a leading KRI from a performance measure.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Module C
Risk governance and accountability
Syllabus scope: Board; risk committees; CRO; risk department; management; stakeholders
The board approves strategy and appetite and oversees management; management operates within that framework. An independent risk function measures and challenges exposure, while business owners remain accountable for the risks they take. Committees need defined authority, quality information and follow-up. The CRO requires access, independence and an effective escalation route. Reporting should explain exposure, trends, limits, stress results and decisions required. A committee meeting without a documented response to a breach does not demonstrate effective oversight.
Apply it in bankingIf the business rejects a risk warning, document the disagreement and escalate through the approved route. Independence requires the ability to challenge revenue-generating activity.
Practice question: Explain board, management and CRO responsibilities in a material risk-limit breach.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Module D
Operational risk and continuity
Syllabus scope: People; process; systems; external events; three lines; BCP
Operational risk arises from inadequate or failed people, processes, systems or external events. Controls include segregation, authorisation, reconciliation, access management and exception monitoring. The first line owns and manages risks; the second provides risk/compliance oversight and challenge; the third provides independent audit assurance. A business continuity plan sustains critical services; disaster recovery restores technology. Test plans against realistic dependencies, suppliers and staffing constraints. Record incidents and near misses so controls improve before a severe loss.
Apply it in bankingA backup exists but cannot be restored within the recovery objective. Treat this as a tested control failure, not proof of resilience.
Practice question: Explain operational-risk controls and assess whether a bank’s continuity plan is effective.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Module E
Implementing and testing ERM
Syllabus scope: Treatment; monitoring; stress testing; reporting; feedback and learning
Risk treatment can avoid, reduce, transfer or accept exposure within authority. Transfer arrangements such as insurance retain exclusions, counterparty risk and operational obligations. Stress testing considers plausible adverse conditions and their effects on earnings, liquidity and capital. Reverse stress testing asks what conditions could make the business unviable. Results should influence limits, contingency plans and strategic choices. Track action completion and test whether controls actually work; a closed action log alone is not evidence of reduced risk.
Apply it in bankingA bank passing a regulatory liquidity ratio may still fail under a concentrated-deposit withdrawal scenario. Link stress results to funding diversification and contingency capacity.
Practice question: Explain how stress testing should change risk decisions rather than merely satisfy a reporting requirement.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Module F
Core financial and compliance risks
Syllabus scope: Credit; ALM; FX; AML; internal control; ICT; environmental/social risk
Credit risk concerns failure to meet obligations; market risk concerns adverse market movements; liquidity risk concerns funding payments; FX settlement risk concerns paying one currency without receiving the other. AML and sanctions exposures require purpose, ownership and transaction controls. ICT and environmental/social events can propagate into credit and operational losses. Analyse each risk’s source, exposure, control and monitoring measure. Separate repricing gaps from liquidity maturity gaps: a balance sheet can have one without an equivalent amount of the other.
Apply it in bankingA long-term floating-rate loan funded by short-term deposits has funding rollover risk even if both interest rates reset frequently.
Practice question: Compare credit, market, liquidity and FX settlement risk with banking examples.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Module G
Capital and prudential measures
Syllabus scope: Basel pillars; CET1/AT1/Tier2; RWA; ICAAP; LCR; NSFR; leverage
Capital absorbs losses; eligible regulatory capital depends on qualifying instruments and deductions. RWA adjusts exposures for the applicable credit, market and operational risk frameworks. The capital ratio is eligible capital divided by total RWA. Basel’s pillars combine minimum requirements, supervisory review and market discipline. ICAAP assesses institution-specific capital adequacy, including material risks beyond a simple minimum ratio. LCR addresses short-term stressed liquidity; NSFR addresses stable funding over a longer horizon. The leverage ratio uses a non-risk-weighted exposure measure. Apply current local rules when assessing compliance.
Apply it in bankingA practice question specifying a 12.5% target uses that assumption. Distinguish the stated target from any current minimum, buffer or bank-specific supervisory requirement.
Practice question: Calculate regulatory capital adequacy and explain why meeting the minimum ratio may not be enough.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Worked example
Capital ratio and shortfall
Eligible Tier 1 is BDT 160 crore and eligible Tier 2 is BDT 40 crore. Credit, market and operational RWA are 1,200, 100 and 300 crore. The exercise target is 12.5%. Find total RWA, CAR and capital headroom.
- Total RWA = 1,200 + 100 + 300 = BDT 1,600 crore.
- Eligible capital = 160 + 40 = BDT 200 crore.
- CAR = 200/1,600 ×100 = 12.5%.
- Required capital = 1,600×12.5% = 200 crore; headroom is zero under this exercise target. Additional risk or deductions could create a shortfall.
Common mistake: Use eligible capital after applicable caps/deductions; do not count every balance-sheet reserve as regulatory capital.
Case clinic
Compliance ratios hide a funding concentration
A bank meets its liquidity ratios but depends on a few wholesale depositors. A stress scenario shows a severe cash gap. Recommend an ERM response.
Model response
Identify concentration, rollover and strategic funding risk. Regulatory ratios are snapshots and cannot capture every withdrawal pattern or collateral constraint.
Update appetite and concentration limits; diversify funding and maintain readily available liquidity. Stress deposit outflows, collateral haircuts and market access together. Validate whether contingency funding can actually be drawn in the scenario.
Allocate actions to Treasury and business owners, challenge them through Risk and ALCO, and escalate material decisions to the board. Monitor survival horizons, deposit concentration and action progress.
Practice marking guide · 20 marks- Risk diagnosis (5)
- Limits and stress reasoning (5)
- Practical liquidity measures (6)
- Governance and monitoring (4)
Terminology and comparisons
| Appetite / limit | Strategic willingness to take risk versus a specific operating boundary. |
|---|
| Inherent / residual risk | Exposure before controls versus exposure after the controls assessed. |
|---|
| LCR / NSFR | Short-term stress liquidity measure versus longer-term stable-funding measure. |
|---|
| BCP / disaster recovery | Continuity of critical business activity versus restoration of technology services. |
|---|
Official references
Official papers are linked for comparison; their full text and official model answers are not reproduced. This pack’s explanations, examples and cases are original. Numerical examples are practice assumptions. Current law, instructions and subsequent amendments must be checked for regulatory answers.