Every major risk pillar in banking has its own metric except one. Credit risk relies on probability of default (PD) and loss given default (LGD), market risk uses value at risk (VaR), and liquidity is measured through the liquidity coverage ratio (LCR).
According to Corlytics, non-financial risk (NFR), which drives the largest operational losses and almost every conduct fine, is still largely assessed using traffic-light colours.
That gap has real consequences. Risk and control self-assessment (RCSA) processes often end in a red, amber or green rating, which leaves business heads and risk owners struggling to decide whether to accept, mitigate or avoid a given risk.
The lack of practical modelling reflects the manual nature of RCSA itself, a process that typically costs a global bank between $10m and $50m a year. Regulators, particularly in EMEA, now expect firms to produce more quantifiable methods and outputs.
RegTech firm Corlytics believes it has an answer. The company has launched its Emerging Risk Quantification (ERQ) engine, which brings together four capabilities developed separately over the past decade.
These are structured, machine-readable regulatory obligations under continuous curation; codified policy content mapped granularly to those obligations; control data linked back to policies and obligations, making completeness objective and testable; and 12 years of enforcement data capturing global fines at event level, with 150 data points per event.
Each capability was built to solve its own problem. Combined, they feed a model in which obligations define the risk surface, controls define mitigation, enforcement defines severity and horizon scanning signals direction of travel. According to Corlytics, AI with traceability and precision was the breakthrough, since a quantified figure that cannot be traced cannot be attested to.
To test the concept, Corlytics partnered with a global bank, and the promising early modelling results turned the pilot into a co-build. The work also suggests that 50 to 70% of the RCSA process could be automated. Rather than replacing subject-matter experts, this shifts them away from filling in spreadsheets and towards challenging an explainable, modelled output.
The result is an RCSA that produces an expected annual loss and a 95th-percentile tail figure in dollars, with visible drivers, versioned assumptions and the probability and severity of enforcement. The bank then applies control effectiveness and its own judgement to set residual risk, with clear visibility of inputs and any control gaps.
Corlytics points to its unified data model, integrated platform, proprietary enforcement evidence and peer weighting as key differentiators, ensuring outputs reflect a specific bank’s exposure rather than an industry average.
Looking ahead, the company sees a networked future. No single bank holds enough internal loss events to calibrate a tail credibly, but peer-weighted industry evidence allows each institution to benchmark against a wider population instead of relying on its own limited history.
Read the full Corlytics post here.
Copyright © 2026 FinTech Global
