Most risk appetite statements could be swapped between two institutions without anyone noticing. “Low appetite for credit risk.” “Zero tolerance for regulatory breaches.” “Moderate appetite for operational risk in pursuit of growth.” Each line is approved, filed and never used to decide anything.
Two kinds of risk, two kinds of statement
This guide’s position has two parts. First, an appetite statement means something only when a breach of it changes a decision: a loan declined, an exposure cut, a product paused, remediation funded. Second, the statement must separate risks the institution chooses to take from obligations it must meet. The first kind can be accepted within limits. The second kind cannot be accepted at all, only managed.
| Business risks you choose | Obligations you must meet | |
|---|---|---|
| Examples | Credit concentration, liquidity, market, operational losses, growth in new segments | AML/CFT/CPF, sanctions, prudential ratios, consumer protection, data protection |
| What the statement sets | Appetite, a limit and an early-warning trigger for each | No appetite for a knowing breach; a measured tolerance for process failure, with remediation from the first failure |
| Who can accept a breach | Management, within delegated authority, for a stated period | Nobody. A breach is reported, remediated and, where required, notified |
| What a breach should change | Pricing, approvals, exposure, capital or funding plans | Controls, resources and, where needed, activity limits |
“Zero tolerance” causes trouble when it hides the difference between those two right-hand cells. Nobody can promise no late STR, no missed screening update and no incomplete file. What the institution can promise is no knowing breach, a measured failure rate, and remediation that starts with the first failure. Write that, and the statement becomes something staff can follow and the board can test.
What the standards expect
| Source | Expectation |
|---|---|
| CBK Risk Management Guidelines (January 2013), 6.2.1 | The board approves and reviews a risk appetite and tolerance statement for operational risk, setting out the nature, types and levels of risk the institution is willing to assume |
| Draft CBK Risk Management Guidelines 2026, 1.6 | An independent risk function develops risk tolerance limits for senior management and board approval, and monitors exposures against them |
| Same, 2.2.1 | The board ensures the risk appetite is aligned with strategy and capital |
| Same, 6.2.5 | Operational risks are monitored and reported to identify potential breaches of risk appetite and limits |
| FSB, Principles for an Effective Risk Appetite Framework (November 2013), 2.1(f) | Qualitative statements for risks that are hard to measure, such as reputational and conduct risks, with some form of boundaries or indicators to monitor them |
| Same, 4.1(b) and 4.6(b) | The board holds management accountable for timely escalation of limit breaches; internal audit checks that breaches are identified, escalated and reported |
The CBK texts are issued to Banking Act institutions, and the 2026 guidelines are a draft for comment. For microfinance banks, payment service providers, insurers and other licensees, the same structure is the sensible benchmark.
From statement to decision
Every appetite line should cascade to a metric, a limit and a response. An illustrative cascade, with invented figures:
| Statement | Metric | Board limit | Management trigger | Owner | Response at trigger |
|---|---|---|---|---|---|
| We do not let one sector dominate the loan book | Largest sector as % of gross loans | 25% | 22% | Head of Credit | No new approvals in the sector above KES 10M without credit committee sign-off |
| We hold enough liquidity to meet a severe outflow | Internal liquidity ratio | Board-set floor above the regulatory minimum | Floor plus 5 points | Treasurer | Funding plan to ALCO within five working days |
| We do not breach AML/CFT/CPF obligations knowingly | STRs filed after the two-day limit | No appetite for knowing late filing; every late STR is a breach | First late STR | MLRO | Root cause and fix reported to the board risk committee at its next meeting |
The third row shows how an obligation is written: no appetite for a knowing breach, and a response that starts at the first failure.
When a limit is breached
A breach protocol needs four rules, written into the framework before the first breach:
- Report first. Every breach is reported to the level that set the limit, within a set time, before any remedy is agreed.
- Choose one of three responses. Restore the position within a stated period; accept it temporarily, with the approver, the reason and an expiry date on record; or change the limit.
- Only the body that set a limit can change it. A board limit changed by management is still a breach.
- Record breaches before changing limits. A limit raised after it was breached is reported as a breach first and a change second, so the history stays honest.
What committee reporting has shown me
A risk appetite statement is tested when respecting a limit becomes inconvenient. Reporting exposures to executive management and board committees, I have watched the distance between approved appetite and actual decisions widen under commercial pressure, operational constraints and control weaknesses left open too long. A worsening credit concentration, a repeated operational loss, a tolerance breached persistently: each has at times passed without the response the board intended when it set the limit. The arrangements that held translated appetite into measurable limits, early-warning triggers and escalation that management was prepared to enforce. They also separated exposures that can be accepted within delegated authority from obligations that no risk acceptance can waive. Reporting a breach is the minimum. Appetite means something when the breach changes a lending, onboarding, investment or remediation decision, including one that costs money now.
The one-page test
Ask management for a single page: the decisions taken in the past twelve months because of the risk appetite. Declined business, reduced exposures, paused products, remediation funded ahead of plan. If the page is blank, the statement is decorative, whatever its wording.
Riskill’s Risk Appetite & Board Reporting Pack includes a risk appetite statement template, a threshold library, a breach protocol, a board dashboard and an executive commentary template: riskilled.com/toolkits. For an independent review of your risk appetite framework and board reporting, talk to the advisory desk: riskilled.com/engage.