The Product That Outgrew Its Appetite: Fraud Losses, ROE and the 'Priced In' Argument
A $28bn-asset bank launched a real-time payments product seven months ago. The board's risk appetite statement reads: 'aggregate operational losses from fraud, error and processing failure shall not exceed $40m in any rolling 12-month period; there is no appetite for material regulatory breach.' Actual fraud losses are $4.2m per month and have grown roughly 12% month on month; recovery is 22% against a 60% plan assumption. The business case assumed $1.1m of monthly losses, and the product earns 0.35% of payment volume against a current fraud cost of 0.62%. The division still reports a 22% ROE against an 11% bank target, and its head argues fraud is 'expected loss, priced in.' Complaints about reimbursement timelines have risen to 1,400 per month and the conduct regulator has opened an inquiry. The risk committee meets in five days.
1. Assess whether the division is operating within appetite and quantify the position. Which appetite dimension is breached, and how should the committee deal with the 'priced in' argument?
Read the worked answer
Measure on a gross, forward-looking basis. The annualised run-rate is $50.4m gross (4.2 x 12), already above the $40m tolerance before any growth. Netting the 22% recovery gives $39.3m, which is how the division claims compliance; that is wrong for three reasons: the tolerance is written on aggregate losses, recovery is itself a deteriorating control (22% against 60% planned), and recovery is not certain. At 12% monthly growth the next 12 months accumulate to roughly $4.2m x 27, around $110m - close to three times appetite.
Two dimensions are breached, not one. The quantitative loss tolerance is breached; the 'no material regulatory breach' limb is at high risk given 1,400 monthly complaints on reimbursement timelines and an open inquiry.
Reject 'priced in'. The economics do not support it: revenue of 0.35% of volume against 0.62% fraud cost gives a unit contribution of about -0.27% of volume, before complaint handling, provisioning and remediation. The 22% ROE excludes unprovisioned loss growth and conduct cost; risk-adjusted, the product is loss-making. Fraud is also not stable expected loss - it is trending and concentrated.
Decision. Declare an out-of-appetite event, escalate to the board risk committee within the policy window, and require a remediation plan with a 30-day check-point.
2. Recommend the specific actions and conditions the committee should impose, and explain the sequencing.
Read the worked answer
Contain, then fix, then re-open.
- Immediate containment (0-2 weeks). Freeze new customer onboarding and stop expansion into higher-risk segments; impose per-transaction and daily velocity limits; require step-up authentication above a threshold; block the first-party and account-takeover patterns visible in the loss data. Set a hard monthly gross loss cap of $3.0m, with automatic suspension of new registrations on breach.
- Fix the economics (2-8 weeks). Reprice or re-underwrite so fee exceeds fraud cost plus complaint handling; renegotiate acquirer and merchant terms; tighten mule-account and device controls. Report recovery rate weekly with a named owner.
- Contain the conduct exposure. Clear the reimbursement backlog, set a service standard, report complaint ageing and reimbursement time to the conduct committee, and give the regulator a factual response rather than a defence of the product.
- Governance. Name one accountable executive; report weekly to the risk committee until the metric is inside trigger; do not lift conditions on the strength of ROE.
The purpose of conditions is to make the risk visible and bounded while the business proves the control environment works - not to shut the product down.
3. Design the metric set that would have caught this deterioration earlier.
Read the worked answer
Build around leading indicators, not lagging annual totals:
- Loss rate: gross fraud loss per $1,000 of payment volume, reported weekly with rolling 3-month and annualised projections. An annual tolerance measured monthly is what allowed this to run.
- Early warning: authorisation decline rate, first-party fraud share, account-takeover share, fraud on accounts under 30 days old, mule-account closures, device-reuse rate.
- Control effectiveness: recovery rate against plan, mean and 95th-percentile reimbursement time, complaint volume and root cause, share of transactions above the authentication threshold.
- Appetite architecture: trigger at 60% of tolerance, soft limit at 85%, hard limit at 100%, each with pre-agreed escalation and mandatory action. Add a separate conduct metric with its own tolerance.
- Attribution: report by product, channel and customer cohort so growth in one segment cannot hide inside a portfolio average.
Every metric needs an owner, documented data lineage, a board-level threshold and a defined action on breach.