Risk appetite

The Financial Stability Board defines risk appetite as the aggregate level and types of risk a financial institution is willing to assume within its risk capacity to achieve its strategic objectives and business plan. Risk capacity is the maximum risk it can bear before breaching constraints such as regulatory capital and liquidity. A risk appetite framework comprises the risk appetite statement, risk limits and the roles of those who oversee them.

Terminology differs by jurisdiction. FINMA Circular 2017/1 speaks of risk tolerance: quantitative and qualitative considerations on the key risks an institution is prepared to take, set per risk category and at institution level within a risk policy approved by the board. FINMA Circular 2023/1 requires the board to approve the risk tolerance for operational risk at least once a year. MaRisk requires the executive board to set the risk appetite for all material risks in its risk strategy. The PRA expects boards to set a model risk appetite, and DORA requires a risk tolerance level for ICT risk.

Pitfalls include statements too generic to guide decisions, limits that do not cascade from the statement, non-financial risks such as conduct, operational and model risk left out, and breaches that are reported without consequences or escalation.

In practice

1. 01
   Expresses appetite in qualitative statements and measurable indicators, including for non-financial risks.
2. 02
   Cascades the appetite into limits and key risk indicators per risk category, business line and legal entity.
3. 03
   Monitors the risk profile against appetite and escalates breaches according to defined rules.
4. 04
   Reviews the statement at least once a year together with strategy, capital and liquidity planning.

Sources

• FSB, Principles for an Effective Risk Appetite Framework, 18 November 2013 →
• FINMA Circular 2017/1, Corporate governance (banks), consolidated version, last amended 4 November 2020 →
• FINMA Circular 2023/1, Operational risks and resilience (banks), 7 December 2022 →
• BaFin Circular 06/2026 (BA), Mindestanforderungen an das Risikomanagement (MaRisk), 30 June 2026 →
• PRA Supervisory Statement SS1/23, Model risk management principles for banks (updated April 2026) →
• Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) →