CISI Risk in Financial Services study materials
CISI Risk in Financial Services study resources

CISI Risk in Financial Services: Risk and the Regulatory Environment

CISI Risk in Financial Services · Work through your exam, one topic at a time.

All guide sections

Risk and the Regulatory Environment

What the exam tests

This domain covers the UK regulatory architecture, prudential capital and liquidity rules, and conduct regulation. Expect questions on who regulates what, Basel ratios, ICAAP and SREP, and how recovery and resolution planning work.

Core rules and concepts

  • The Financial Services and Markets Act 2000 provides the framework. The PRA regulates prudential soundness of banks, insurers and major investment firms; the FCA regulates conduct and markets. Many firms are dual-regulated.
  • Basel III sets minimum capital: common equity tier 1 (CET1) 4.5% of risk-weighted assets, tier 1 6%, total capital 8%. Buffers sit on top: capital conservation 2.5%, countercyclical (0 to 2.5%) and higher loss absorbency for global systemically important banks.
  • Basel III also sets a 3% leverage ratio and liquidity standards: liquidity coverage ratio (LCR) for a 30-day stress and net stable funding ratio (NSFR) for one year.
  • In the UK, CRR and CRD IV requirements are applied through PRA rules. Firms produce an ICAAP: their own assessment of capital needed for all material risks over a forward horizon, including stress tests. The PRA reviews it through SREP and may set a Pillar 2 requirement and buffer.
  • Recovery plans set out how a firm restores viability; resolution plans set out how it can fail safely. UK ring-fencing separates core retail deposits from investment banking for large banks.
  • Conduct rules include the Consumer Duty (fair value and good outcomes), MiFID II for investment services, EMIR for derivatives, MAR for market abuse, and money laundering regulations with a risk-based approach, customer due diligence and suspicious activity reports.
  • Senior managers must be fit and proper; the SM&CR links regulatory responsibilities to individuals.

Worked example

A UK bank runs a severe stress scenario: unemployment rises, house prices fall 30% and credit losses triple. Its CET1 ratio falls from 13% to 9.5% after losses. The ICAAP shows the bank needs 11% CET1 to cover Pillar 1, Pillar 2 and buffers through the cycle. The board therefore cuts dividends, slows risk-weighted asset growth and plans a capital raise. In SREP the PRA may add a Pillar 2 requirement and set a buffer. The point is that regulatory capital is not just the 8% minimum; it reflects firm-specific risks and stresses.

Traps that cost marks

  • Saying the FCA sets capital requirements. The PRA does for prudential regulation; the FCA focuses on conduct.
  • Confusing ICAAP with SREP. ICAAP is the firm's assessment; SREP is the regulator's evaluation.
  • Treating Pillar 1 as the whole capital requirement. Pillar 2 and buffers matter.
  • Assuming Basel ratios apply identically to all firms. Proportionality applies, especially to smaller firms.
  • Forgetting conduct regulation in a risk exam. Consumer Duty, AML and market abuse are risk sources, not just compliance topics.