Financial firms need to prioritise agility and resilience and long‑term readiness as risks accelerate in speed, scale and complexity
Our latest Operational Risk Horizon report reveals that uncertainty now dominates operational risk planning, with firms shifting their focus to the shorter-term horizon (6–12 months) as threats evolve more rapidly and grow more complex.
This annual survey collates industry views on emerging risks and was completed by more than 45 global banking, insurance and asset management firms this year.
Advancing cybercrime tops the rankings for the fourth year in a row
Our survey highlights advancing cybercrime as the top category of emerging risk threats for 2026, a place it's held since 2023.Technology and digital strategy came in second for the third year running. While supply chain (including third parties) has risen to third place, reflecting the industry’s increasing exposure to external dependencies.
Concerns driven by cybercrime's interconnectivity and wide-ranging impacts drive
Cybercrime remains the biggest ongoing and future concern across our risk landscape studies. Reasons for this include its interconnectivity with other risks and its severe and wide-ranging potential impacts, in particular on data security, operational resilience and reputation.
Other concerns included:
- The malicious use of new technologies to increase the scale and speed of cyberattacks
- Ongoing geopolitical tensions
- Third-party cybersecurity and concentration risk
Top 5 risks on the 2026 emerging risk horizon
- Advancing cybercrime
- Technology and digital strategy
- Supply chain (including third parties)
- Business service disruption
- Data
We're seeing the industry pivoting strongly toward short‑term prioritisation as evidence of the accelerating complexity, pace and growing interconnectedness of risks. Institutions cite AI, geopolitics, regulation and supply chain fragility as the most significant forces reshaping threat profiles. Against this backdrop of uncertainty, being agile and resilient remain essential priorities for operational risk teams.
Financial firms move to capturing risk interconnectivity in their reporting
As teams face the challenge of understanding and managing a more interlinked landscape, risk interconnectivity reporting continues to mature. Over 50% of firms in our survey are now capturing risk interconnectivity within their material and/or emerging risk reporting. Yet many still face challenges in understanding and presenting relationships between risks in more holistic and actionable ways. Current approaches include thematic scenarios, mapping emerging risk drivers to risk types, thematic issue analysis, using AI tools to help connect the dots and clustering related risk functions.
As organisations direct more attention toward short-term disruption, longer-term threats such as people and skills and conduct have slipped towards the bottom of the industry’s priority list.
Alongside improved understanding – and reporting of – interconnected risks, the report points to the importance of enhancing data governance, technology readiness and future-proofing the workforce. Key areas for investment include improved data structure, hygiene and governance, upskilling teams in AI, cyber, data and resilience.
Find out more in the Operational Risk Horizon report
Understanding emerging risks is vital for strategic risk management. Our annual Operational Risk Horizon survey gathers industry opinion from our members and ORX Lite subscribers to build a picture of the risk landscape. The full report is available to members and ORX Lite subscribers to read. If you're not a member or subscriber, then you can download the executive summary for highlights from the study.
