But they are not the only conduits: markets too raise risk capital and increasingly quasi-banks, in the 'shadow' banking system, are taking on the role of banks at the riskier end of the curve.
That's why the most astute observers are not focussed on banks per se but the whole financial system. The analogy often used is the balloon - try and squeeze it in one place and it inflates in another.
Christian Noyer, governor of the Bank of France and current chairman of the Bank for International Settlements, the central banks' central bank, made this clear in a recent speech.
“The approach of shadow banking has progressively expanded to a variety of actors and activities: Money Markets Funds; Securitisation, Repos and Securities Financing Transactions," he noted.
But more importantly, measures to manage risk in this realm are not separate to the regulatory approach on banks: “The work dedicated to preventing the financial risks arising from the shadow banking system became intertwined with the work aiming at ending 'too big to fail'," Noyer said. “In the wake of the Globally Systemically Important Banks, the Financial Stability Board started working on identifying and defining a regulatory regime applicable to Globally Systemically Important Insurers (GSIIs), Non-Bank-Non Insurance SIFIs (NBNIs), Critical Market Infrastructures/CCPs."
But even this is not enough in the risk universe. Consider the recent collapse in the share price of commodities trader and miner Glencore. While the company acted quickly to alleviate fears about its debt level and liquidate assets, the concern at the acute phase of the crisis in confidence in Glencore was not the failure of one company but the collateral damage to markets in which the scale of Glencore's role was unknown.
After all, it wasn't the collapse of Enron or Lehman Bros or Bear Stearns per se that roiled economies but how deeply interwoven they were in the fabric of the global financial system – as debtors, financiers, market makers and counter-parties.
This more expansive view of risk is evident in the pronouncements of regulators but also internally in banks.
EY has just released it latest Global Banking Risk survey, the sixth since the financial crisis, done in conjunction with the Institute of International Finance (IIF) and based on the views of risk officers and senior risk executives from a total of 51 banks across 29 countries, including Australia.
Bank boards and management are increasing their focus on risk management and are holding front-office staff more responsible as they address regulatory pressure, investor demands and the high cost of past misconduct.
Nearly nine out of 10 banks reported increased board and senior management attention to conduct risk with the major concerns also money laundering and market abuse. Three quarters of banks are making changes to their culture while 81 per cent say cultural change is very much a work in progress.
EY's Oceania risk head Rob Walsh has said risk culture is increasingly a focus for regulators globally. But the nature of risk remains a challenge.
“While everyone may be talking about risk culture, some banks have found it a struggle to define what 'it' actually is and how to go about measuring it," he said. “Effective risk culture measurement should be both qualitative AND quantitative – it's not enough to just rely on surveys."
Walsh has argued this becomes even more of a challenge in diverse institutions operating across diverse markets.
“It's unrealistic to expect large, diversified financial institutions with regional footprints to have one culture," he said. “This is particularly pertinent across the Asia-Pacific region, which has a significant diversity of national cultures. But, although cultures may vary based on national and professional biases, values shouldn't. While there's unlikely to be a single correct answer to what a 'good' culture looks like, it's important to have an understanding of vertical and horizontal 'gaps' within an organisation."
Walsh's view is the idea of a strong “risk culture" differs across geographies. Australia and Canada are considered to have a good understanding. The US is still evolving its position.
“For over 10 years, the contribution of behaviours to risk and compliance failures in Australia has been an area of specific attention for regulators," Walsh said, adding “three common questions being posited to banks' boards and management are: what's your organisation's risk culture; what facts do you base your assessment on; and what are you doing to nudge your risk culture and further strengthen it?"
The UK, given the market rigging issues at some banks, is also extremely pro-active on risk culture while Walsh says Asian regulators are certainly turning their attention to the topic.
“Rarely is a key note speech made without reference to it but, in recent times, there have also been more pointed surveillance enquiries within organisations," he said.
But not only is the appropriate risk culture a challenge across jurisdictions, regulators realise prescriptive measures can actually increase risk. As Noyer noted of shadow banks, if they face the same demands as banks, risk may well be concentrated.
“Duplicating the GSIBs approach to these non-bank actors may either lead to inadequate policy options or to fostering pro-cyclicality," he said. “In this latter case, all market players would take the same positions, on the same financial instruments at the same time fostering a 'one way' market. This herd behaviour can lead to detrimental consequences in terms of financial stability by amplifying an irrational market decision based upon no fundamentals, which could rapidly spread to the whole financial sphere."
That's why culture is so important with risk. Just relying on regulation, an always imprecise and lagging – though necessary – approach, is not enough.