Three strategic priorities for banking CROs in 2026

The 15th annual EY/IIF survey shows how CROs can serve as strategic copilots in navigating today’s complex and volatile risk landscape.

In brief

• Credit risk and financial crime have re-emerged as top concerns, even as geopolitics, macroeconomics and disruptive technology reshape the CRO agenda.
• Regulatory fragmentation has led to a loosening of supervisory requirements in some jurisdictions but tightening and localization in others.
• CROs see advanced technology, higher-quality data and the right talent as critical enablers for enhancing risk management in the future.
  

Bank chief risk officers (CROs) are operating in a world defined by nonlinear, accelerated, volatile and interconnected (NAVI) risks. Macroeconomic shifts, geopolitical tensions, the prevalence of artificial intelligence (AI) and the growth of private credit add up to more uncertainty. As one CRO put it, “the role is no longer the chief risk officer — it is the chief uncertainty officer.”

Different types of risks are converging and compounding faster than traditional risk management frameworks can respond. Concerns about financial crime and digital fraud are rising in line with accelerating adoption of AI and digital assets. Credit risk is an urgent priority again, because of the increasing likelihood of defaults and the competitive threats posed by private equity firms and other non-banks.

The 15th annual EY/IIF global bank risk management survey shows how CROs are being pushed beyond compliance-focused oversight into a more strategic, forward-looking and decision‑shaping role across the enterprise.

“Proliferating risk profiles are an indicator of the dynamic nature of the banking business. Bold thinking by CROs and adaptive risk strategies have never been more important to sustaining profitability despite persistent volatility”, said Nigel Moden, EY Global Banking & Capital Markets Leader. 

By embracing the strategic priorities outlined below, CROs can build agile, tech-enabled risk management operations that both protect the business and foster responsible growth in this time of uncertainty.

The CRO action plan for navigating uncertainty: three priorities for 2026

Our survey results suggest how CROs can strengthen key capabilities to engage more effectively with other business leaders.

1. Accelerate responsible AI adoption

For all the risks associated with AI, CROs are adopting it as a vital risk management tool. Most banks are still early in their journey: 72% report limited adoption within the risk function, with current use cases focused on fraud and financial crime detection.

At the same time, 55% of CROs said implementing advanced technologies is one of their top three focus areas for managing important risks. That signals a clear shift toward more sophisticated applications. For the next wave of deployments, CROs plan to expand AI into credit and market risk modeling, cyber and operational resilience, and real‑time monitoring.

As AI spreads across the enterprise and agentic AI deployments increase, CROs face a dual responsibility: using AI to strengthen risk capabilities while also putting in place the controls, governance models, and specialist talent needed to ensure that AI enhances decision‑making without creating new vulnerabilities.

Data quality and security remain top barriers, but CROs recognize other challenges to broader adoption. One noted that, while AI’s potential is significant, “the real cost is in change management, underlying infrastructure, people and the time to do it right.” These practical constraints influence how quickly and responsibly AI can scale across the organization.

2. Develop hybrid, high‑performance risk teams

It’s clear that CROs, like their C-suite peers, recognize the need for workforce transformation in banking. This year, respondents reiterated the need for both discrete technical skills (e.g., cybersecurity, AI, data science) and broader knowledge (e.g., digital acumen, business knowledge, critical thinking, ethics). Digital “athletes” proficient in both technical and operational domains will be well suited for hybrid risk-business positions. In these roles, experienced risk professionals are deeply involved with technology transformation, product innovation, and other essential initiatives.

Demand for digital, data and AI proficiency has never been higher, but CROs expect hiring to slow. Thirty percent now anticipate smaller risk teams over the next three years (up from 16% last year), and those expecting to increase hiring has dropped from 68% to 49% since the 2024 survey.

How will they address greater risk with fewer overall resources? AI’s automation of administrative tasks, along with upskilling, specialized talent, and hybrid roles, will help bridge the gap between future capabilities and existing capacity.

Throughout this evolution, the CRO role has expanded significantly. It has moved from a position focused on oversight to one that contributes directly to strategy and enterprise leadership. As Tom Campanile noted, “For years, our survey results have suggested why CROs must push to serve as strategic advisors to the business. This year’s findings show that the time has arrived and highlight how CROs can move forward.”

The current environment confirms that CROs are entering a new phase in which their influence shapes both resilience and growth.

Looking ahead, milestone events, market developments, and diversifying threats will continue to reshape the risk agenda at a faster pace than in the past. The increasing use of AI, the arrival of quantum computing, the growth of private credit and ongoing geopolitical uncertainty will require CROs to broaden their perspective and anticipate risks earlier.