Risk
Risk Travels Through Relationships
A bank cannot understand its risk simply by looking at individual clients, products or exposures. It must understand how the participants it deals with are connected — to the bank, to one another and to the wider world.
Risk does not respect the organisational boundaries of a bank.
A geopolitical event, counterparty failure, sanctions designation, supply-chain disruption or financial shock can begin somewhere outside the institution and quickly become material inside it.
For the CRO, the challenge is therefore not only to identify individual risks. It is to understand where the bank is exposed, through whom, in what capacity, through which relationships and activities, and how those connections may transmit risk across the organisation.
That requires a view of the bank as a participant in a much larger network.
The CRO Sees the Bank Differently
Risk cuts across the structures used to organise the bank
A bank is usually organised around businesses, products, legal entities, geographies and functions.
Risk does not follow those boundaries.
The CRO needs to understand how exposures accumulate across the institution, how apparently separate relationships are connected, where common dependencies exist, and how an event in one part of the network could create consequences elsewhere.
That requires a broader view than individual client records, transactions or products.
The CRO needs to see the bank as a connected system of participants, relationships, activities and dependencies — and to understand not only where risk sits, but how it can propagate through that system.
The Risk Universe Is Much Broader Than KYC
Client risk is only one part of the CRO’s enterprise view
KYC and financial crime controls are important, but they represent only part of the risk landscape a multinational bank must manage.
The CRO must consider financial risks such as credit, counterparty, concentration, market and liquidity risk; non-financial risks such as operational resilience, technology, cyber, data, conduct and regulatory risk; and external risks arising from geopolitical change, macroeconomic conditions, climate, supply chains and systemic dependencies.
These risks are managed by different functions and through different systems. But many of them depend on the same underlying questions.
Who is the bank dealing with? In what capacity? How are those parties connected? Through which products, arrangements and markets is the bank exposed? And what changes when circumstances change?
The significance of CLM therefore extends beyond KYC. It provides part of the information and control infrastructure needed to understand how the bank participates in the wider risk environment.
Different Risks Keep Asking the Same Questions
The risk may change, but the information needed is often remarkably similar
A counterparty failure, sanctions designation, country event, fraud case, conduct issue or geopolitical shock may appear to be very different risks.
But when the bank needs to understand its exposure and respond, the same questions repeatedly emerge.
Who or what is involved? In what capacity are they acting? Who are they connected to? Through which relationships, products or arrangements is the bank exposed? What activity is permitted? What has changed? And what needs to happen next?
The answers may come from different systems and different risk functions, but they depend on a common ability to identify participants and understand the relationships between them.
This is where the structure beneath risk management starts to matter.
A Flat Client Record Cannot Answer The Questions
Risk depends on context, connection and the capacity in which an entity acts
A traditional client record is usually centred on a legal entity and a set of attributes held against it.
That is not enough for many of the questions the CRO needs to answer.
The same entity may act as a borrower, guarantor, issuer, counterparty, investment manager, supplier or client. Each role can create different risks, obligations and permissions.
Separate entities may also need to be considered together because they are linked through ownership, control, guarantees, economic dependency or other relationships.
The bank therefore needs to understand more than who an entity is. It must also understand the capacity in which it is participating, how it is connected to others, and the business arrangements through which the bank is exposed.
Without that structure, important relationships can remain hidden inside individual records, products and systems.
The Bank Needs to Understand Participation, Not Just Identity
Knowing who an entity is does not explain how it participates in the bank’s risk environment
Identity establishes who or what an entity is. Risk depends on more than that.
The same entity can participate in different capacities, through different relationships and under different business arrangements. Each can create different exposures, obligations, permissions and control requirements.
A bank therefore needs to distinguish four separate concepts:
Entity — who or what exists.
Role — the capacity in which that entity participates.
Relationship — how that entity is connected to another participant or to the bank.
Business Arrangement — the specific context within which business is undertaken.
This structure allows the bank to understand not simply that an entity exists, but why it matters, how it participates and where risk arises.
For the CRO, that creates a more meaningful view of the bank’s exposure: one based on participation and connection rather than isolated records.
ERR Creates the Risk Information Spine
Entity, role and relationship structure allows risk information to be connected, understood and used
Once a bank can distinguish entities, the roles they perform and the relationships that connect them, risk information can begin to form a coherent whole.
Entity identifies who or what exists. Role explains the capacity in which that entity is participating. Relationship explains how it is connected to other participants or to the bank. Business arrangement provides the context in which the activity takes place.
Together, this creates a structural spine through which different forms of risk information can be linked.
It becomes easier to identify connected counterparties, understand ownership and control, distinguish clients from issuers, guarantors, suppliers or other participants, and connect exposures, permissions, obligations and events to the correct context.
For the CRO, this means risk information is no longer trapped inside isolated records, products or systems. It can be connected across the bank in a way that supports aggregation, analysis, action and response.
ERR does not replace specialist risk systems. It provides part of the underlying structure that allows those systems and the information they produce to connect more meaningfully across the enterprise.
From Risk Insight to Action
Risk management only becomes effective when the bank can act on what it knows
Understanding exposure is not enough.
Once a risk has been identified, the bank must be able to determine which entities, roles, relationships and arrangements are affected, decide what should happen, and translate that decision into operational action.
That may mean allowing activity to continue, applying additional controls, restricting a product, suspending a relationship, initiating remediation or exiting altogether.
This is where CLM becomes critical.
CLM helps connect risk decisions to the actual relationships through which the bank does business. It provides the lifecycle and permissioning mechanisms needed to apply those decisions consistently, monitor what changes and evidence what action was taken.
The flow therefore becomes:
Identify → Connect → Assess → Decide → Permit or Restrict → Monitor → Respond → Evidence
ERR helps the bank understand where the risk sits. CLM helps the bank act on that understanding.
What the CRO Should Expect
Enterprise risk management depends on being able to see, connect and act across the bank
The CRO should expect the bank to have a reliable way to identify the participants that matter to risk, understand the roles they perform, and maintain the relationships that connect them.
The bank should be able to determine where exposures sit, how they aggregate, which dependencies matter, what activity is permitted, and how changes in the external environment affect existing relationships.
It should also be able to act quickly when circumstances change — applying restrictions, initiating remediation, changing permissions or exiting relationships where necessary — and to evidence what was known, what was decided and what action was taken.
This requires more than good data in individual systems. It requires a consistent enterprise structure for connecting entities, roles, relationships, arrangements, exposures and lifecycle decisions.
That creates a clear expectation:
A bank cannot maintain a reliable enterprise view of risk if it cannot reliably identify the participants in its network, distinguish the roles they perform and understand the relationships that connect them.
For the CRO, an Entity–Role–Relationship structure is therefore not simply a CLM design choice. It is part of the information architecture needed to understand and manage risk across the enterprise.