RISK MANAGEMENT—Principles for Climate-Related Financial Risk Management for Large Financial Institutions

The financial impacts that result from the economic effects of climate change and the transition to a lower carbon economy pose an emerging risk to the safety and soundness of financial institutions¹ and the financial stability of the United States. Financial institutions are likely to be affected by both the physical risks and transition risks associated with climate change (collectively, climate-related financial risks). Physical risks refer to the harm to people and property arising from acute, climate-related events, such as hurricanes, wildfires, floods, and heatwaves, and chronic shifts in climate, including higher average temperatures, changes in precipitation patterns, sea level rise, and ocean acidification.² Transition risks refer to stresses to institutions or sectors arising from the shifts in policy, consumer and business sentiment, or technologies associated with the changes that would be part of a transition to a lower carbon economy.³

Physical and transition risks associated with climate change could affect households, communities, businesses, and governments—damaging property, impeding business activity, affecting income, and altering the value of assets and liabilities. These risks may be propagated throughout the economy and financial system. As a result, the financial sector may experience credit and market risks associated with loss of income, defaults, and changes in the values of assets, liquidity risks associated with changing demand for liquidity, operational risks associated with disruptions to infrastructure or other channels, or legal risks.⁴

Weaknesses in how a financial institution identifies, measures, monitors, and controls the physical and transition risks associated with a changing climate could adversely affect a financial institution’s safety and soundness. The adverse effects of climate change could also include a potentially disproportionate impact on the financially vulnerable, including low- and moderate-income (LMI) and other underserved consumers and communities.⁵

These principles provide a high-level framework for the safe and sound management of exposures to climate-related financial risks, consistent with the risk-management frameworks described in the agencies’ existing rules and guidance.

The principles are intended to support efforts by financial institutions to focus on key aspects of climate-related financial risk management. The principles are designed to help financial institutions’ boards of directors and management make progress toward incorporating climate-related financial risks into risk-management frameworks in a manner consistent with safe and sound practices. The principles are intended to explain and supplement existing risk-management standards and guidance on the role of boards and management.⁶

Although all financial institutions, regardless of size, may have material exposures to climate-related financial risks, these principles are intended for the largest financial institutions, those with over $100 billion in total consolidated assets.⁷ Effective risk-management practices should be appropriate to the size of the financial institution and the nature, scope, and risk of its activities. In keeping with the agencies’ risk-based approach to supervision, the agencies anticipate that differences in large financial institutions’ complexity of operations and business models will result in different approaches to addressing climate-related financial risks. Some large financial institutions are already developing governance structures, processes, and analytical methodologies to identify, measure, monitor, and control for these risks. The agencies understand that expertise in climate risk and the incorporation of climate-related financial risks into risk-management frameworks remain under development in many large financial institutions and will continue to evolve over time. The agencies also recognize that the incorporation of material climate-related financial risks into various planning processes will be iterative, as measurement methodologies, models, and data for analyzing these risks continue to mature. The agencies encourage large financial institutions to take a risk-based approach in assessing the climate-related financial risks associated with individual customer relationships and to take into account the financial institution’s ability to manage the risk. The principles neither prohibit nor discourage financial institutions from providing banking services to customers of any specific class or type, as permitted by law or regulation. The decision regarding whether to make a loan or to open, close, or maintain an account rests with the financial institution, so long as the financial institution complies with applicable laws and regulations.

The principles are intended to promote a consistent understanding of the effective management of climate-related financial risks. The agencies may consider providing additional resources or guidance, as appropriate, to support financial institutions in prudently managing these risks while continuing to meet the financial services needs of their communities.

Governance. An effective risk-management framework is essential to a financial institution’s safe and sound operation. A financial institution’s board should understand the effects of climate-related financial risks on the financial institution in order to oversee management’s implementation of the institution’s business strategy, risk management, and risk appetite. The board should oversee the financial institution’s risk-taking activities, hold management accountable for adhering to the risk-management framework, and allocate appropriate resources to support climate-related financial risk management. The board should direct management to provide timely, accurate, and well-organized information to permit the board to oversee the measurement and management of climate-related financial risks to the financial institution. The board should acquire sufficient information to understand the implications of climate-related financial risks across various scenarios and planning horizons, which may include those that extend beyond the financial institution’s typical strategic planning horizon. If weaknesses or gaps in climate-related financial risk management are identified, the information provided is incomplete, or as otherwise warranted, the board should challenge management’s assessments and recommendations. The board and management should support the stature and independence of the financial institution’s risk management and internal audit functions and, in their respective roles, assign accountability for climate-related financial risks within existing organizational structures or establish new structures for climate-related financial risks.

Management is responsible for implementing the financial institution’s policies in accordance with the board’s strategic direction and for executing the financial institution’s overall strategic plan and risk-management framework. This responsibility includes assuring that there is sufficient expertise to execute the strategic plan and effectively managing all risks, including climate-related financial risks. This also includes management’s responsibility to oversee the development and implementation of processes to identify, measure, monitor, and control climate-related financial risks within the financial institution’s existing risk-management framework. Management should also hold staff accountable for controlling risks within established lines of authority and responsibility. Management is responsible for regularly reporting to the board on the level and nature of risks to the financial institution, including material climate-related financial risks. Management should provide the board with sufficient information for the board to understand the impacts of material climate-related financial risks to the financial institution’s risk profile and make sound, well-informed decisions. Where dedicated climate risk organizational structures are established by the board, management should clearly define these units’ responsibilities and interaction with existing governance structures.

Policies, procedures, and limits. Management should incorporate material climate-related financial risks into policies, procedures, and limits to provide detailed guidance on the financial institution’s approach to these risks in line with the strategy and risk appetite set by the board. Policies, procedures, and limits should be modified when necessary to reflect (i) the distinctive characteristics of climate-related financial risks, such as the potentially longer time horizon and forward-looking nature of the risks, and (ii) changes to the financial institution’s operating environment or activities.

Strategic planning. The board should consider material climate-related financial risk exposures when setting and monitoring the financial institution’s overall business strategy, risk appetite, and when overseeing management’s implementation of capital plans. As part of forward-looking strategic planning, the board should consider and management should address the potential impact of material climate-related financial risk exposures on the financial institution’s financial condition, operations (including geographic locations), and business objectives over various time horizons. The board should encourage management to consider climate-related financial risk impacts on the financial institution’s other operational and legal risks. Additionally, the board should encourage management to consider the impact that the financial institution’s strategies to mitigate climate-related financial risks could have on LMI and other underserved communities and their access to financial products and services, consistent with the financial institution’s obligations under applicable consumer protection laws.

Any climate-related strategies and commitments should align with and support the financial institution’s broader strategy, risk appetite, and risk-management framework. In addition, where financial institutions engage in public communication of their climate-related strategies, boards and management should assure that any public statements about their institutions’ climate-related strategies and commitments are consistent with their internal strategies, risk appetite statements, and risk-management frameworks.

Risk management. Climate-related financial risks can impact financial institutions through a range of traditional risk types. Management should oversee the development and implementation of processes to identify, measure, monitor, and control exposures to climate-related financial risks within the financial institution’s existing risk-management framework. Financial institutions with sound risk management employ a comprehensive process to identify emerging and material risks related to the financial institution’s business activities. The risk identification process should include input from stakeholders across the organization with relevant expertise (e.g., business units, independent risk management, internal audit, and legal). Risk identification includes assessment of climate-related financial risks across a range of plausible scenarios and under various time horizons.

As part of sound risk management, management should develop processes to measure and monitor material climate-related financial risks and to communicate and report the materiality of those risks to internal stakeholders. Material climate-related financial risk exposures should be clearly defined, aligned with the financial institution’s risk appetite, and supported by appropriate metrics (e.g., risk limits and key risk indicators) and escalation processes. Management should incorporate material climate-related financial risks into the financial institution’s risk-management system, including internal controls and internal audit.

Tools and approaches for measuring and monitoring exposures to climate-related financial risks include, among others, exposure analysis, heat maps, climate risk dashboards, and scenario analysis. These tools can be leveraged to assess a financial institution’s exposure to both physical and transition risks in both the shorter and longer term. Outputs should inform the risk identification process and the short- and long-term financial risks to a financial institution’s business model from climate change.

Data, risk measurement, and reporting. Sound climate-related financial risk management depends on the availability of timely, accurate, consistent, complete, and relevant data. Management should incorporate climate-related financial risk information into the financial institution’s internal reporting, monitoring, and escalation processes to facilitate timely and sound decisionmaking across the financial institution. Effective risk data aggregation and reporting capabilities allow management to capture and report climate-related financial risk exposures, segmented or stratified by physical and transition risks, based upon the complexity and types of exposures. Available data, risk measurement tools, modeling methodologies, and reporting practices continue to evolve at a rapid pace; management should monitor these developments and incorporate them into the institution’s climate-related financial risk management as warranted.

Scenario analysis. Climate-related scenario analysis is emerging as an important approach for identifying, measuring, and managing climate-related financial risks. For the purposes of these principles, climate-related scenario analysis refers to exercises used to conduct a forward-looking assessment of the potential impact on a financial institution of changes in the economy, changes in the financial system, or the distribution of physical hazards resulting from climate-related financial risks. These exercises differ from traditional stress testing exercises that typically assess the potential impacts of transitory shocks to near-term economic and financial conditions. An effective climate-related scenario analysis framework provides a comprehensive and forward-looking perspective that financial institutions can apply alongside existing risk-management practices to evaluate the resiliency of a financial institution’s strategy and risk management to the structural changes arising from climate-related financial risks.

Management should develop and implement climate-related scenario analysis frameworks in a manner commensurate to the financial institution’s size, complexity, business activity, and risk profile. These frameworks should include clearly defined objectives that reflect the financial institution’s overall climate-related financial risk-management strategies. These objectives could include, for example, exploring the impacts of climate-related financial risks on the financial institution’s strategy and business model, identifying and measuring vulnerability to relevant climate-related financial risk factors including physical and transition risks, and estimating climate-related exposures and potential losses across a range of scenarios, including extreme but plausible scenarios. A climate-related scenario analysis framework can also assist management in identifying data and methodological limitations and uncertainty in climate-related financial risk management and informing management’s assessment of the adequacy of the institution’s climate-related financial risk-management framework.

Climate-related scenario analyses should be subject to management oversight, validation, and quality control standards that would be commensurate to the financial institution’s risk. Climate­related scenario analysis results should be clearly and regularly communicated to the board and all relevant individuals within the financial institution, including an appropriate level of information necessary to effectively convey the assumptions, limitations, and uncertainty of results.

A risk-assessment process is part of a sound risk-management framework, and it allows management to identify emerging risks and to develop and implement appropriate strategies to mitigate those material risks. Management should consider and incorporate climate-related financial risks when identifying and mitigating all types of risk. These risk-assessment principles describe how climate-related financial risks can be addressed in various risk categories.

Credit risk. Management should consider climate-related financial risks as part of the underwriting and ongoing monitoring of portfolios. Effective credit risk-management practices could include monitoring climate-related credit risks through sectoral, geographic, and single-name concentration analyses, including credit risk concentrations stemming from physical and transition risks. As part of concentration risk analysis, management should assess potential changes in correlations across exposures or asset classes. Consistent with the financial institution’s risk appetite statement, management should determine credit risk tolerances and lending limits related to material climate-related financial risks.

Liquidity risk. Consistent with sound oversight and liquidity risk management, management should assess whether climate-related financial risks could affect its liquidity position and, if so, incorporate those risks into their liquidity risk management practices and liquidity buffers.

Other financial risk. Management should monitor interest rate risk and other model inputs for greater volatility or less predictability due to climate-related financial risks. Where appropriate, management should account for this uncertainty in their risk measurements and controls. Management should monitor how climate-related financial risks affect the financial institution’s exposure to risk related to changing prices. While market participants are still researching how to measure climate-related price risk, management should use the best measurement methodologies reasonably available to them and refine them over time.

Operational risk. Management should consider how climate-related financial risk exposures may adversely impact a financial institution’s operations, control environment, and operational resilience. Sound operational risk management includes incorporating an assessment across all business lines and operations, including operations performed by third parties, and considering climate-related impacts on business continuity and the evolving legal and regulatory landscape.

Legal and compliance risk. Management should consider how climate-related financial risks and risk-mitigation measures affect the legal and regulatory landscape in which the financial institution operates. This should include, but is not limited to, taking into account possible changes to legal requirements for, or underwriting considerations related to, flood or disaster-related insurance, and ensuring that fair lending monitoring programs review whether and how the financial institution’s risk-mitigation measures potentially discriminate against consumers on a prohibited basis, such as race, color, or national origin.

Other nonfinancial risk. Consistent with sound oversight, the board and management should monitor how the execution of strategic decisions and the operating environment affect the financial institution’s financial condition and operational resilience. Management should also consider the extent to which the financial institution’s activities may increase the risk of negative financial impact and should implement adequate measures to account for these risks where material.