How banks respond to regulations and manage risk isn’t always what it seems. Research by Brian Clark, assistant professor of banking and corporate finance at the Lally School of Management — “Risk Shifting and Regulatory Arbitrage: Evidence from Operational Risk” (2017) with Alireza Ebrahim of the Office of the Comptroller of the Currency — studied this concept closely.

The researchers examined the state of the banking industry leading up to and including the financial crisis of 2007-2009, using data collected by regulatory agencies on operational losses incurred by a sample of large U.S. banks. They attribute the drastically increased exposure of banks to operational risk in the years leading up to the crisis to a lack of prudent regulations during this time. This increased exposure then contributed to the severity of the crisis.

Generally, operational risk is seen as the risk of a loss resulting from the failure of a bank’s people or processes. It does not include credit or market risk. Credit risk arises when a bank makes bad loans and market risk arises when it makes poor investment decisions. Operational risk, however, refers to losses that may arise from the way a bank is managed, induced by poor systems and controls that leave it vulnerable to setbacks from activities such as fraud, legal exposure, and business disruptions caused by “acts of God.”

So how important are these losses in the big picture? One public study by the Boston Consulting Group (2017) estimates that approximately $321 billion in fines were paid by North American and European banks in the aftermath of the recent financial crisis. Moreover, authorities estimate that operational risk composes roughly 25 percent of large U.S. banks’ risk profiles.

Clark and Ebrahim argue that banks amassed operational risk to get around regulations meant to limit total risk exposure, a process known as regulatory arbitrage. The authors note that before the financial crisis, regulators considered operational risk benign, so they didn’t closely examine it in financial institutions. This opened the door for banks to increase their exposure over time without having to account for this risk on their books, ultimately allowing banks to become riskier without regulators knowing it.

“Our research explains that operational risk offered a way for banks to leverage themselves in the moment but not have to pay for the consequences until later. Typically, there is a delay between the time of the risk and the financial loss,” says Clark. “For example, banks can increase their exposure by not investing in or maintaining the latest information technology infrastructure or by cutting governance costs such as monitoring of employees. These actions can reduce costs or increase revenues in the short term, but in the long term they may lead to large losses from IT failures or misconduct by unmonitored employees.”

Ultimately, the study found that insufficient regulation prior to the financial crisis allowed banks to make risky operational decisions, which backfired on them during the crisis, thus exacerbating the severity of the crisis.