Financial, technological, and operational risks are becoming inseparable.
Getty Images
The Office of the Comptroller of the Currency’s latest risk assessment offers a striking message for the banking industry: the U.S. financial system may appear stable on the surface, but underneath, risks are becoming more interconnected, more operationally complex, and potentially more difficult to contain.
In its Spring 2026 Semiannual Risk Perspective, the OCC, one of our nation’s key bank regulators, stated that the federal banking system “remains sound and resilient.” Yet, it warns that banks face “elevated and interconnected” risks tied to commercial credit deterioration, technology disruption, cyber threats, fraud, and persistent uncertainty around interest rates and liquidity.
The report reflects a regulatory mindset that has evolved significantly since the regional banking turmoil of 2023. Back then, bank supervisors were focused primarily on deposit runs and unrealized losses. Today, regulators appear increasingly concerned about a broader structural problem: whether banks can safely adapt to a higher-rate, digitally accelerated financial system where operational failures could trigger the next crisis as easily as credit losses.
“The OCC continues to identify operational risk as elevated,” the report states, citing “cyber threats, fraud, third-party risk, and challenges associated with implementing new technologies and products.”
That emphasis is notable. The report repeatedly returns to operational resilience as a central concern — not as a secondary issue, but as a core systemic vulnerability.
Commercial Real Estate Still Looms Large
While headlines around commercial real estate have faded somewhat compared with 2023 and 2024, the OCC makes clear that regulators still view the sector as one of the most important credit risks in the banking system.
“Commercial credit risk is increasing,” the report says, particularly in sectors exposed to refinancing pressure and weakened property fundamentals.
Office properties remain a primary focus. The OCC notes that net absorption of office space turned positive in the second half of 2025—a sign of gradual stabilization—though some banks continue to work through legacy problem loans, and elevated financing costs still pressure borrowers and lenders. Banks are now confronting a difficult transition period as loans originated during the era of ultra-low interest rates mature into a dramatically different rate environment.
The OCC notes that “refinancing risk remains elevated,” especially for loans backed by properties with declining cash flows or uncertain valuations.
The concern is not necessarily that losses will be catastrophic across the system. Rather, regulators appear worried about prolonged earnings pressure and gradual balance-sheet deterioration — particularly among regional and midsize institutions with concentrated CRE exposure.
Net Loan Charge-Off Rates
OCC
Consumers Are Holding Up — For Now
The OCC describes consumer credit performance as generally stable, supported by a still-resilient labor market and continued wage growth. But the tone of the report is cautious.
“Consumers continue to face pressure from inflation, higher interest rates, and rising debt burdens,” the agency writes.
That pressure is becoming increasingly visible in certain borrower segments. Lower-income households, in particular, are experiencing reduced savings buffers and higher delinquency rates on some forms of unsecured debt. Importantly, the OCC draws a distinction here: while market-level data show rising past-due consumer loans driven by lower-credit-score borrowers, retail loan performance at OCC-supervised banks has generally “improved in the past year” because their exposure to higher-risk consumer segments remains manageable.
The report stops short of predicting a consumer downturn, but regulators clearly see growing vulnerability beneath aggregate economic data that has remained surprisingly strong.
A Different Kind of Liquidity Risk
One of the more subtle but important themes running through the OCC report is that liquidity risk has changed shape since the banking panic of 2023.
The agency says overall liquidity conditions are stable, but it warns that banks must remain prepared for “rapid changes in depositor behavior” and market sentiment. The important lesson regulators appear to have drawn from the collapse of several regional banks in 2023 is that digital banking and social media can accelerate funding stress far faster than traditional liquidity models anticipated.
At the same time, unrealized losses on securities portfolios continue to matter. Although interest rates have moderated somewhat from peak levels, many banks still hold large volumes of lower-yielding assets purchased during the zero-rate era.
“Unrealized losses on securities portfolios… fell and are at their lowest levels since 2021,” the report notes, while still emphasizing the need for continued stress testing and scenario analysis.
Cybersecurity and Fraud Become Front-and-Center Risks
Perhaps the most striking aspect of the report is the extent to which operational threats now dominate the regulatory narrative.
Cybersecurity, fraud, third-party dependencies, and technology modernization are treated not merely as operational headaches, but as strategic and systemic risks.
“Banks continue to face an elevated threat environment from cyber actors,” the report says.
The OCC also warns that fraud activity remains high across multiple payment channels, including checks, wire transfers, and peer-to-peer systems.
The report also highlights risks tied to vendor concentration and third-party service providers — a growing concern as banks outsource more technology infrastructure and operational functions.
“Third-party risk management remains critical ,” the report emphasizes—though note this paraphrase is not a verbatim quote from the Spring 2026 SARP; verify exact wording before publication.
The Technology Dilemma
Underlying the entire report is a tension that increasingly defines modern banking.
Banks must modernize rapidly to remain competitive. But every technological upgrade introduces new operational, compliance, and cybersecurity risks.
“Banks should ensure that risk management and controls keep pace with changes in products, services, and technologies,” the report states.
Across the industry, institutions are simultaneously attempting to digitize customer experiences, integrate artificial intelligence tools, modernize payments infrastructure, reduce operating costs, and defend against increasingly sophisticated cyberattacks.
The OCC’s report suggests regulators increasingly believe that operational resilience — not just capital strength — may determine which institutions prove durable in the next phase of banking stress.
Geopolitical Risk: The Wild Card
One of the most striking additions to the Spring 2026 report — largely absent from recent prior editions — is the prominent role of geopolitical risk. The ongoing conflict in the Middle East has moved from background concern to a central variable shaping the OCC’s economic outlook.
The report’s economic forecast anticipates that headline inflation could peak at an annualized rate of 5.1 percent in the second quarter of 2026 — a materially higher number than prior projections — driven in significant part by energy price disruptions tied to the Persian Gulf conflict. The potential closure of the Strait of Hormuz looms over forecasters: if shipping disruptions persist, higher energy and commodity costs would raise business expenses, fuel inflation, and erode consumer purchasing power. The April Blue Chip consensus forecast, which the OCC cites, now anticipates only one Federal Reserve rate cut in 2026, down from two in the March forecast — and financial markets have begun pricing in the possibility of no cuts at all.
The compliance dimension of geopolitical risk is equally important. Elevated tensions increase the risk of sanctions violations and Bank Secrecy Act/anti-money laundering (BSA/AML) failures, straining bank compliance systems that were already under pressure. The Financial Crimes Enforcement Network recently issued an advisory highlighting the growing use of Chinese money laundering networks by transnational criminal organizations to move illicit funds through the U.S. financial system — a reminder that the geopolitical threat landscape affects not just energy prices, but the integrity of the payments system itself.
Digital Assets Enter the Mainstream Regulatory Conversation
For the first time in recent memory, digital assets appear in the OCC’s Semiannual Risk Perspective not as a cautionary footnote, but as a substantive regulatory agenda item. The passage of the GENIUS Act — signed into law in July 2025 — has fundamentally changed the landscape. The law establishes a federal regulatory framework for payment stablecoins and limits which entities can issue them in the United States, and the OCC is now actively working to implement it.
In February 2026, the OCC issued a notice of proposed rulemaking under the GENIUS Act — a significant signal that bank-issued stablecoins are no longer a distant prospect, but an approaching reality. Separately, the OCC, Federal Reserve, and FDIC issued joint guidance clarifying that the technology used to issue or transact in a security does not change its regulatory capital treatment — a ruling designed to remove uncertainty for banks exploring tokenized assets.
The OCC’s posture here is notably supportive of innovation rather than restrictive. The agency frames digital asset activities — done safely and in compliance with applicable law — as consistent with responsible bank strategy. For bankers and their boards, the message is clear: the regulatory runway for stablecoins and tokenized assets is being built, and institutions that begin building their own capabilities now will be better positioned than those that wait.
The Bigger Regulatory Shift
Taken together, the OCC’s Spring 2026 Risk Perspective reveals an important evolution in supervisory thinking. The report does not read like a warning about an imminent banking collapse. Nor does it suggest regulators believe the industry faces a replay of the 2008 financial crisis. Instead, the OCC appears increasingly concerned about cumulative fragility: the idea that multiple manageable risks — commercial real estate stress, funding pressure, cyber threats, technology failures, fraud, and geopolitical uncertainty — could interact in unpredictable ways.
The OCC’s Interconnected Risk Framework
OCC
The banking system, in the OCC’s view, remains resilient. Resilience, however, now depends on far more than capital ratios and credit quality. It depends on whether banks can operate safely and continuously in an environment where financial risk, technological risk, and operational risk are becoming inseparable.
Forbes Articles By Mayra Rodriguez Valladares
Congressional Testimonies By This Author
Strengthening Accountability at the Federal Reserve: Lessons and Opportunities for Reform
A Holistic Review of Regulators: Regulatory Overreach and Economic Consequences