C-suite executives report that business conduct risk incidents are rising, with annual average potential exposure of more than USD 43 million 

Business conduct risk management has traditionally been viewed as a compliance exercise and a cost of doing business. Today, however, financial institutions increasingly view business conduct risk data as a strategic capability that helps protect enterprise value, reduce losses, and improve risk-adjusted performance.

The Business Conduct Risk Intelligence Report 2026, commissioned by RepRisk in collaboration with Oxford Economics, shows that C-suite leaders across banks, asset managers, and other financial institutions increasingly view relevant, accurate, and transparent business conduct risk data as essential for managing reputational exposure, improving decision-making, and strengthening long-term performance.

# Rising incidents raise the financial stakes

Executives report that the average number of major business conduct risk incidents impacting their business climbed by 55% between 2023 and 2025, with each incident adding multi-million-dollar costs to the bottom line. 

# Downside risk goes beyond fines 

Beyond direct costs, firms also face commercial fallout. The loss of key investors, AuM, and clients is cited as a top-three consequence by just over half of executives. Regulatory sanctions and reputational brand damage affecting revenue and valuation also rank highly, with potential to put franchise value at risk. 

# Most concerning consequences following a major business conduct incident 

The findings make it clear that business conduct risk incidents are no longer isolated compliance events, but material financial shocks capable of undermining long-term enterprise value. 

# Data investment accelerates

As the financial stakes rise, institutions are stepping up investment in business conduct risk intelligence to strengthen risk identification, risk monitoring, and mitigation capabilities while reducing the likelihood and cost of future incidents.

Most firms reported increasing investment in business conduct risk data over the past 12 months, and 58% say spending rose following a major incident. In some cases, increases were substantial: about a quarter of institutions raised their investment by more than 20% during the past year. 

# Investment in business conduct risk data in the last 12 months 

Looking ahead, the trajectory remains upward. 71% of executives expect their organization’s spending on business conduct risk data to increase over the next three years. The pattern reflects a broader shift: while many firms still invest reactively after incidents, a growing number are beginning to treat business conduct risk data as a long-term strategic capability.

# A stronger value case for data 

Executives increasingly believe that the economic case for business conduct risk data is strengthening. Four in five executives expect business conduct risk data to become more valuable to their organization over the next two to three years as complex and fast-evolving risks intensify.

Companies also see underinvestment as costly. Seven in ten executives agree that the long-term costs of under-investing in business conduct risk data and management will exceed any short-term savings from treating it as discretionary spending.  

Reflecting this perspective, two-thirds of executives now agree that business conduct risk data is now a strategic “must-have” capability rather than a “nice-to-have.”  

# Turning risk exposure into measurable financial returns

For many institutions, business conduct risk data is already delivering measurable returns. When benchmarked against incident costs, even modest improvements in detection and mitigation can generate meaningful returns. Avoid one major incident in your portfolio or balance sheet? Save USD 14M–37M in potential costs.³ Reduce incident frequency or severity? Create multi-million annual impact.

This widening gap between the cost of failure and the cost of prevention is rapidly transforming business conduct risk data into a source of tangible financial value.

# A strategic capability for the next risk cycle 

Emerging risks linked to AI, climate, supply chains, and the energy transition are increasing the speed, scale, and complexity of business conduct risk exposure. In this environment, firms that invest in earlier risk detection and stronger risk intelligence capabilities will be better positioned to protect reputation, reduce financial losses, and strengthen operational resilience.

# Methodology 

# Survey demographics 

This study surveyed 513 C-suite executives of financial institutions with detailed knowledge and oversight into their company’s business conduct risk strategy. Fieldwork was conducted in January 2026. Only companies that used external data to monitor business conduct risk were included in the sample. Percentages may not sum to exactly 100% due to rounding. 

---

Copyright 2026 RepRisk AG. All rights reserved. RepRisk AG owns all intellectual property rights to this report. This information herein is given in summary form and RepRisk AG and/or the third party contributors to this report make no representation or warranty that any data or information supplied to or by it or them is complete or free from errors, omissions, or defects. Without limiting the foregoing, in no event shall RepRisk AG and/or the third party contributors to this report have any liability (whether in negligence or otherwise) to any person in connection with the information contained herein. Any reference to or distribution of this report must include a link to the content to provide sufficient context. The information provided in this presentation does not constitute an offer or quote for our services or a recommendation regarding any investment or other business decision, and is not intended to constitute or to be used as a substitute for legal, tax, accounting, or other professional advice. Please note that the information may have become outdated since its publication. Should you wish to obtain a quote for our services, please contact us.

Decision‑grade means suitable for identifying and prioritizing risk exposure as an input into a broader decision‑making process. RepRisk data does not determine legality, compliance, thresholds, or required actions, and does not prescribe investment, procurement, or engagement decisions.