The Risks a Macro Model Cannot See

A regional bank can be well calibrated in a macro stress test and still be exposed to a cyberattack, a fraud pattern, a sanctions failure, or an unsafe technology decision. The subject here is the part of regional-bank resilience that does not appear directly in PPNR, loan-loss, and CET1 projections. The practical question is which risks belong in a macro estimate, which require operational or compliance evidence, and how a bank can adopt new tools without treating innovation as a substitute for control.

Operational and compliance risks follow different transmission paths

A macro-credit model begins with an economic variable such as a rate, unemployment, or property-price measure and follows its effect into income, losses, and capital. Cyber and fraud risks do not wait for those variables to move. They can create operational losses or disrupt financial services, and their trigger and early evidence are operational rather than macroeconomic. The financial consequences may eventually appear in expenses, provisions, or capital, but the path begins outside the macro variables.

The OCC’s Spring 2026 risk perspective identifies sophisticated cybercriminal groups and foreign state-sponsored actors as continuing threats to financial institutions and service providers. It warns that geopolitical tensions can increase malicious activity against the financial sector. That statement applies across the federal banking system; it does not establish that regional banks are more exposed than large banks. It does establish why a lower regional-bank sensitivity to aggregate rates or unemployment cannot be used as a score for operational resilience.

Artificial intelligence changes both sides of this threat. The OCC says AI can lower the barrier to entry for attackers and increase the speed, scale, and sophistication of attacks. The mechanisms it names include automated reconnaissance, rapid vulnerability discovery and exploitation, targeted social engineering, adaptive malware, and fraud. The same technology can also support defensive monitoring and risk-management processes. The result is not a simple “AI is good” or “AI is bad” conclusion. It is an arms race in which the bank’s controls, visibility, and response capacity determine whether a new capability reduces or increases net risk.

The practical controls cited by the OCC are not exotic. Multifactor authentication and timely patch management can mitigate some AI-enabled cyber risks. Their importance is precisely that a sophisticated threat still meets ordinary control points. A bank that adopts an advanced detection tool but leaves identity, patching, or recovery weaknesses unresolved may increase complexity without addressing the path by which an attack succeeds. Conversely, a bank can use AI defensively while preserving human accountability for decisions that affect customers or critical operations.

Fraud is a related but distinct operational channel. The OCC describes fraud as a key driver of operational losses and points to impersonation scams facilitated by text messages and social media. The pattern changes as criminals adapt their stories, channels, and targets. A current low charge-off rate says little about whether a bank can detect a convincing impersonation attempt, stop an unauthorized payment, or resolve a customer complaint. Evidence of fraud resilience therefore comes from controls, alert quality, response time, losses, and recurrence—not from the bank’s macroeconomic coefficients.

Compliance risk follows another path again. The OCC says geopolitical tensions raise sanctions and money-laundering risk, strain compliance systems, and may increase the potential for sanctions and Bank Secrecy Act/anti-money-laundering violations.