The banking world is at a turning point in 2026. While the complexity of the global financial system has not decreased, the regulatory cadence has shifted. We are seeing a move away from an era of regulation by accumulation, where agencies piled new rules atop old ones, towards a principles-based approach focusing on fundamental soundness.
For many financial institutions, this does not offer a moment to relax, but rather a critical window to modernization.For years, institutions were forced to prioritize speed over sustainability, rapidly layering on numerous, manual “check-the-box” controls to satisfy immediate regulatory demands or quick fixes for the organization. To maintain this volume, organizations were forced to increase their risk and compliance headcounts, creating a fixed cost structure that effectively taxes every business line. While effective for passing previous exams, reacting to every new mandate with a localized fix has created an expensive inventory that is operationally brittle. Smart institutions are now using this window to reimagine the existing manual state and build a streamlined, automated foundation.
The Reality of Risk Management Today
Currently, most organizations operate within a control environment that is characterized by reactive, manual, and inefficient processes. Driven by years of responding to immediate regulatory pressures, the standard risk and control lifecycle has evolved into a rigid, linear path that struggles to keep pace with dynamic business environments.
When we evaluate current operating models across the industry, the standard lifecycle generally follows four steps:
The Traditional Controls Lifecycle
- Risk Identification and Assessment: The lifecycle begins with periodic Risk and Control Self-Assessment (RCSA) cycles. During this phase, risks are identified, documented based on static inputs, and given an inherent risk rating.
- Control Identification and Mapping: Organizations then map controls against these identified risks to mitigate exposure. This inventory consists of several manual detective controls.
- Periodic Control Testing: Testers operate on a set control testing schedule (typically monthly, quarterly, or annually). During these cycles, teams select a small sample (e.g., 25 files) and manually test whether the assigned controls are designed to mitigate a given risk and operating effectively. Risks are given a residual risk rating based on the test results.
- Issue Identification and Remediation: Based on the results of that periodic testing, control failures or exceptions are officially identified, which typically occurs months following an event. Only then are remediation plans initiated to address the gap.
Compounding Operational Challenges
While this sequential framework was designed to create order, its reliance on retroactive, manual execution introduces operational bottlenecks that can plague an organization:
- Inefficient Manual Control Testing: The heavy reliance on the manual review of static evidence, such as system screenshots, emails, and spreadsheets, drains tester capacity.
- Control Accumulation and Redundancy: Over time, institutions have added “band-aid” controls to quickly address specific regulatory findings or audit issues. This reactive accumulation results in a highly inefficient, redundant control inventory that requires significant upkeep.
- Blind Spots from Sample-Based Testing: Relying on sample-based methodologies inherently limits risk visibility. By reviewing only a small fraction of the data, institutions leave much of the population entirely unverified, obscuring their true risk exposure.
- Reactive Exception Identification: Since testing is performed retroactively, control failures are identified months after an event occurred. This causes the risk organization to operate in a reactive state, initiating fixes long after customer or financial impact has already taken place.
The Future State: Continuous, Outcome-Based Monitoring
The future of risk management lies in evolving the control environment from a static compliance exercise into a dynamic, data-driven engine. This shift is increasingly viable today due to advancements in technology that can easily convert unstructured documents — such as PDFs, scanned contracts, and emails — into structured data. As a result, institutions can significantly broaden the scope of automated testing. By prioritizing continuous visibility and automated analysis, financial institutions can establish real-time feedback loops that directly inform risk scoring and operational strategy.
Strategic Opportunities for Improvement
Transitioning to an optimized operating model requires executing on four fundamental shifts:
- Real-Time Feedback: Organizations should implement “always-on” monitoring logic that flags anomalies in near real-time, effectively moving from delayed, detective lookbacks to continuous visibility.
- Full-Population Monitoring: Risk functions should shift away from manual sampling and deploy automated scripts that validate 100% of the population, eliminating the blind spots inherent in sample-based testing.
- Outcome-Based KRIs: The testing focus should pivot to whether the actual risk objective was met using data, rather than manually verifying if a procedural control step was taken. Ultimately, if the objective is not met, the controls are not effective.
- Streamlined Controls: Institutions should conduct a review of their inventory to retire redundant tasks and leverage artificial intelligence (AI) to optimize retained controls.
The Automated Controls Lifecycle
By capitalizing on these opportunities, the rigid, periodic risk lifecycle transforms into a dynamic and highly efficient workflow:
- Risk Identification and Feedback Loop: The modernized RCSA is no longer a static, annual exercise. It leverages a dynamic feedback loop where active key risk indicator (KRI) performance data is used to continually inform and refresh likelihood and impact risk scoring over time.
- Automated Outcome Monitoring: Instead of manual testing, outcome-based KRIs are utilized to continuously monitor 100% of the population against defined risk tolerances. This provides the exact real-time visibility needed to constantly evaluate control effectiveness in managing risk objectives.
- Streamlined Control Environment: As a result of the control rationalization effort, the inventory heavily emphasizes preventative and automated controls and minimizes the organization’s reliance on manual, inefficient, and redundant detection.
- Targeted Testing and Remediation: With “always-on” monitoring handling the heavy lifting, the testing scope targets focused reviews of actual KRI breaches rather than relying on random sampling. When an issue is identified, remediation efforts address the underlying process or control logic rather than applying temporary patches to individual transactions.
Real-World Application: Transforming SCRA Interest Rate Compliance
To illustrate the impact of this transition, consider the operating model for Servicemembers Civil Relief Act (SCRA) compliance. The regulation mandates that financial institutions cap interest rates, including most fees, at 6% for eligible active-duty military members.
The Risk: Failure to correctly identify eligible servicemembers or accurately cap their effective interest rate at the maximum 6%, leading to regulatory enforcement, mandatory lookbacks, and customer restitution.
The Current State: Manual Control Testing
In a traditional framework, verifying SCRA compliance is a highly manual, periodic exercise. To ensure the first line of defense is properly applying the rate caps, the testing team relies on sampling:
- Control Test A (Reperformance): Testers pull a monthly sample of 25 to 50 accounts flagged for SCRA protection. They manually review the loan origination system, the billing statements, and the Department of Defense (DOD) active-duty database to verify the customer’s eligibility dates.
- Control Test B (Manual Calculation): Testers manually extract all interest charges and eligible fees assessed during the billing cycle, recalculating the effective Annual Percentage Rate (APR) to ensure the total burden did not exceed the 6% threshold.
The Future State: Automated Outcome Monitoring
In an optimized target state, the risk organization stops manually recalculating a few dozen files and deploys an automated KRI to monitor the entire protected portfolio continuously.
- KRI Name: SCRA Accounts Exceeding 6% Effective APR
- Data Source: Core Servicing Platform, LexisNexis API Feed
- Description: An automated script continuously cross-references the active-duty status of a loan via the LexisNexis API. For all eligible accounts, the logic independently sums the daily interest charges and applicable fees to calculate the true effective rate prior to statement generation.
- KRI Thresholds:
- Safe (Green): <=6%
- Exception (Red): > 6% (Immediately flagged for remediation).
The Result: By transitioning to this automated KRI calculation, the institution monitors 100% of its SCRA-eligible population in real-time. This eliminates the need for testers to perform manual math on retroactive samples. If the calculated effective rate exceeds 6% due to a newly assessed fee, the system flags the anomaly immediately, allowing operations to reverse the charge before the cycle closes and a violation occurs.
Conclusion: Securing the Future State
The path to long-term efficiency and operational resilience is through modernization and rationalization. By leveraging the current regulatory landscape to streamline frameworks and eliminate manual testing, financial institutions can transform risk management from a cost center into a source of competitive advantage. Building an automated, data-driven foundation today is the definitive step toward securing the operational stability of tomorrow.
How Ankura Can Help
Modernization is not just about digitizing manual work; it starts with objective assessment and rationalization. We partner with financial institutions to navigate the complex 2026 landscape, helping you transition from a reactive posture to a streamlined, automated framework.
To ensure a successful transition without disrupting your daily operations, we execute this modernization through three focused pillars:
- Strategic Rationalization: We review your existing inventory to identify control candidates to eliminate redundancy, optimize for efficiency, or retain as core protections.
- Automated KRI Engineering: By analyzing risk objectives independent of legacy controls, we help you design smart KRIs that leverage available data, monitor control effectiveness, and can replace manual controls testing in many cases.
- Targeted Piloting: We identify specific, high-manual-effort areas to prove the return on investment (ROI) of automation, creating the internal momentum needed to scale enterprise-wide.
To learn more about how our Financial Services Advisory can help your organization navigate the complexities of control optimization, visit our dedicated Financial Services Advisory page.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
