By Ron Dembo
Climate risk is now a supervisory risk. This is not new.
The Network for Greening the Financial System (NGFS) has recently published its updated Guide for Supervisors, the first full revision since 2020. It draws on a survey of 67 supervisory authorities, representing 70% of NGFS member countries. The headline findings confirm what most risk teams already know: 77% of supervisors say their mandate covers the assessment of climate-related risk; 73% now run climate scenario analysis or stress tests, up from limited use when the first Guide was published.
The interesting question is no longer whether supervisors will ask about climate risk, it is whether the numbers institutions give them can be defended.
The Guide is clear on where supervisory pressure sits. The Basel Committee on Banking Supervision (BCBS) has made no changes to Pillar 1 minimum capital requirements for climate risk at this stage, and no broad international consensus exists on climate-specific capital treatment. Pillar 2 is where supervisors act. It lets them judge each institution’s governance, risk management and capital against its own exposures, and impose remediation or institution-specific capital requirements where gaps persist.
That route is already in use. The European Central Bank (ECB) has moved from qualitative guidance to binding supervisory decisions and, where findings go unaddressed, periodic penalty payments. The Bank of England’s Prudential Regulation Authority (PRA) required firms to complete a gap analysis within six months of publishing Supervisory Statement SS5/25. Banco Central do Brasil requires financial institutions to run climate stress tests every year. Bank Al-Maghrib may impose Pillar 2 capital buffers on banks with high climate exposures from 2027.
The mechanism is supervisory judgement. Judgement needs evidence an institution can stand behind.
The Guide is candid about the limits of current methods.
The ECB’s 2022 climate stress test produced €70 billion in bank losses across its short-term scenarios. The ECB’s own assessment: those figures could be significantly undervalued, because of methodological constraints and data gaps.
For insurers, the Guide notes that natural catastrophe modules within Pillar 1 already capture elements of physical risk. It then states that these modules were not designed for the evolving nature of climate change, and may not fully capture the frequency, severity and geographic distribution of future hazards.
At system level, the Guide names a key modelling gap. Current frameworks struggle to capture feedback loops and second-round effects, where institutions tighten credit at the same time and the resulting slowdown feeds back into higher losses. It also warns that assessing climate and nature risks in isolation may understate their scale, because they compound in non-linear ways.
These are the same problem, seen from different angles. The models underneath are built for the expected case. The losses that matter sit outside it.
The Guide includes analysis of 2025 disclosures from more than 480 banks, insurers and investors reporting to CDP. 86% say they assess environmental risk across their portfolio activities. 58% run climate scenario analysis covering both acute and chronic physical risk.
The more telling figure is how institutions map hazards to financial risk. 68% of disclosed physical risks are linked to a single financial risk category. Only 32% are treated as multichannel. Yet no major hazard in the data maps to one category alone. Flooding appears across credit, insurance, operational and market risk. A hazard that hits collateral values, claims and operations in the same event is being booked as one line.
Location adds a second gap. The Guide cites 2025 research by De Nederlandsche Bank (DNB) estimating expected annual losses from floods and windstorms for euro area companies. It found areas where relying on headquarter locations, rather than the spread of production facilities, leads to substantial underestimation of risk. The Guide’s own ladder of approaches runs from country level, to district, to facility, to value chain. Much of the exposure data in use still sits near the bottom.
One of the more consequential additions concerns insurance. The Guide encourages supervisors to monitor the insurance protection gap as part of macro-prudential surveillance.
The figures explain why. Between 2012 and 2022, insurance covered 5% of economic flood losses in emerging markets, against 34% in advanced economies (Swiss Re, cited in the Guide). As insurers raise premiums or restrict cover, risk moves to households, companies and lenders, and credit losses are larger where losses are uninsured. The Guide says banks should be able to identify which assets are insured, against which hazards, and which losses they would bear without insurance or government support.
The same logic applies to adaptation. The Guide asks supervisors to distinguish gross physical risk from net risk after adaptation, and to test whether institutions can show the difference credibly. That requires a measure of the risk both before and after the adaptation measure. A single hazard score cannot provide both.
Read together, the Guide sets out the questions a supervisor will now ask. What is the exposure at asset level, not country level? How does one hazard move through credit, market and underwriting risk at the same time? What happens in the tail, not the median? How much of the loss is insured, and for how long?
The Guide puts it plainly: scenario analysis “does not eliminate uncertainty but helps structure it.” The harder question is how much of the uncertainty a given method can see.
Some supervisors are already building that structure on shared data. In December 2024, Canada’s Office of the Superintendent of Financial Institutions (OSFI) and the Autorité des marchés financiers (AMF) selected RiskThinking.AI to provide flood risk analytics from our Climate Digital Twin for their 2024 Standardized Climate Scenario Exercise (SCSE). The data went to approximately 400 federally regulated financial institutions. The Guide notes that supervisor-run exercises give greater comparability across a banking system. That comparability depends on every institution working from the same physical risk data.
Our CDTexpress puts the same engine to work on the tail. Not one projection, but 2,500 plausible climate futures, run together, with compound and multi-hazard interactions modelled at asset level. It covers more than 50 climate hazards across 241 billion geospatially aligned locations in 193 countries. The output is a probability distribution: how much, how often, under which conditions. That is the form a Pillar 2 conversation needs, because it calculates the tail rather than approximating it.
Everyone agrees climate risk belongs in supervision now. The institutions that will be fine are the ones that can show their supervisor the full distribution, and the method behind it.