Risk v Consequence

I'm a climber.

It is one of my greatest passions, and I spend as much time as I can climbing. In fact, I love the outdoors. Hiking, camping, climbing, skiing...all of it. It's all great fun, but it all carries an element of danger.

Unfortunately, I don't have too many exciting stories of my own adventures. However, as part of a mountaineering club, I spend time with people who do live these incredible lives. People who take on extreme challenges, climb the Matterhorn, travel the world, and constantly push their limits.

In recent years, mainly thanks to climber Alex Honnold, his Oscar-winning film Free Solo, and climbing's inclusion in the Olympics, the sport has become far more mainstream. These days, my non-climbing family and friends actually pay attention when I talk about it!

Whether you're climbing in the snowy Alps, hiking across the Dolomites, free soloing 3,000-foot rock faces like Alex Honnold, or, like me, topping out on a modest 30-foot gritstone route with a rope, we're all choosing to expose ourselves to an element of danger that we don't have to. Nobody is forcing us to do these things. We choose to, knowing that if something goes wrong, the consequences could be unpleasant.

So why do it at all?

When people find out that I enjoy climbing, one of the first things they usually say is, "That sounds dangerous," or, "You're brave." The same questions are often asked in documentaries and interviews with famous explorers and adventurers. Why do they do something so dangerous?

But I don't actually think climbing is particularly risky. If I genuinely believed it was, I wouldn't do it.

I think this is where people often confuse risk with consequence.

Let's use Alex Honnold (who, if you hadn't guessed, is a bit of a hero of mine) as an example. In 2017, he became famous for completing the first free solo ascent of El Capitan; a notoriously difficult 3,000-foot climbing wall in Yosemite National Park. Climbing with no rope or protection, he reached the top safely, just as he had on hundreds of previous free solo climbs.

Now imagine I attempted to free solo El Cap tomorrow. I'd die.

There is virtually no chance I have the technical ability, experience or fitness to survive such a climb without divine intervention. Alex is one of the greatest climbers of all time and has dedicated his life to mastering his craft. I write financial crime articles.

Yet if we were both climbing the same route, would the risk not be the same?

If Alex fell, he would almost certainly die.If I fell, I would almost certainly die. The outcome of falling is identical for both of us.

The difference only becomes clear when you separate risk from consequence.

Risk = The probability of falling.

Consequence = The outcome if you fall (Death!).

If I free solo El Cap, the risk is extremely high and the consequence is extremely high.

If Alex free solos El Cap, the risk is comparatively low, but the consequence is just as high as it would be for me.

That's why Alex is comfortable attempting something I never would. His confidence isn't based on the consequence being lower...it isn't. It's based on his assessment that the likelihood of that consequence occurring is acceptably low. For me, the probability of that consequence happening is so high that the climb simply isn't worth attempting.

If I wanted to climb El Cap, I'd need to reduce the risk and/or reduce the consequence. I'd take a rope, protection, a helmet and, worst of all, a climbing partner who I'd unfortunately have to make small talk with.

All of those things add inconvenience. I'd have to carry heavier equipment, drag a rope up the wall, spend time placing protection, and wait while my partner climbed. The climb becomes slower, heavier and arguably less enjoyable. But now, if I fall, the likelihood of dying is dramatically reduced. It's a trade-off. Risk v Reward.

The following week, however, I might head to my local crag in the Peak District and free solo a simple 30-foot route. For me, the likelihood of falling is low, and although the consequence could still be serious injury, it's far less likely to be fatal. This time, I'm comfortable leaving the rope behind because the balance between risk, consequence and reward feels acceptable.

So what does any of this have to do with financial crime?

Quite a lot, actually.

Every day in financial crime we describe activities as "high risk" or "low risk", but what we're often talking about is consequence.

Let's look at some examples.

Fraud

Most of us make contactless payments on a daily basis. A simple tap of the card and you've bought your lunch. But the reality is that this simple tap is taking money directly from your bank account, making it an attractive target for fraudsters.

The Risk of contactless fraud is relatively high.

However, there are limits on how much can be spent using contactless payments—currently around £100 per transaction in the UK. This means that if a card is lost or stolen and falls into the hands of a fraudster, the amount of damage they can do is relatively limited.

The consequence of a successful contactless fraud is therefore comparatively low.

Banks, card issuers and customers are all aware of the risks of contactless payments, but we generally accept them because there is only so much that can be lost. Banks are typically liable for the financial loss and will usually reimburse the customer. They could introduce additional security, lower the spending limit or require more authentication, but doing so would weaken the customer experience and reduce one of the product's biggest benefits: convenience.

In this scenario, the balance of high risk but relatively low consequence is considered acceptable.

Now let's look at the opposite end of the spectrum.

Large-value bank transfers, particularly CHAPS payments, can involve millions of pounds. If a fraudster successfully compromises an account and makes an unauthorised payment, the financial loss could be enormous. The consequence is high.

So what about the risk?

As I'm sure you're aware, you can't simply pick up someone's phone, log into their banking app and send millions of pounds. Large payments are typically protected by multiple layers of security. Biometrics, additional authentication, payment delays, identity checks and, for business payments, multiple internal approvals all help reduce the likelihood of fraud.

These controls make the payment process slower and less convenient for the customer, but they significantly reduce the risk.

The result is a transaction with low risk but very high consequence.

Customers generally accept this inconvenience because large-value transfers are relatively infrequent and the potential consequences of getting them wrong are so significant.

Sanctions

Now let's consider sanctions.

For a bank, the risk is that a payment is successfully made to or received from a sanctioned individual or entity.

The consequence of that happening can be severe: regulatory action, significant fines, reputational damage and, in the most serious cases, restrictions on a bank's ability to operate. It's therefore no surprise that many banks have an extremely low (if not zero) risk appetite when it comes to sanctions breaches.

Imagine you're a bank that only processes domestic UK-to-UK payments. The likelihood of a sanctions breach is actually very low. Counterparty banks are subject to the same regulatory framework, and all are expected to carry out robust customer and payment screening. As a result, it is relatively unlikely that a designated person could successfully open and operate a UK bank account.

So we have low risk but very high consequence.

Unlike our contactless fraud example, however, banks don't simply accept that low risk. Instead, they screen every single payment for potential sanctions matches.

Why?

Because the potential consequences of getting it wrong are so significant that even a very low likelihood isn't considered acceptable without strong controls.

Again, the controls introduce friction. Payments may be delayed while alerts are reviewed, customers may experience inconvenience, and banks invest significant resources into sanctions screening. But that is the trade-off. The consequence of failure is so high that the additional controls are considered worthwhile.

Conclusion

When I'm climbing, I don't just think about whether something is dangerous.

I think about how likely something is to go wrong and what happens if it does.

The exact same thinking applies in financial crime.

Risk and consequence are often used interchangeably, but they're different concepts. Understanding that difference changes the way you think about alerts, controls, customer experience and, ultimately, better decision-making.

This article wasn't intended to teach you how to assess or manage risk, that comes later. It was simply to explain the difference between two concepts that are often confused but are fundamental to understanding financial crime.

In future articles, we'll explore how financial crime professionals use these concepts every day when designing controls, assessing customers, balancing customer experience with financial crime risk, and making difficult operational decisions.

For now, the next time you hear someone describe something as "high risk", stop for a second and ask yourself:

Do they really mean it's likely to happen, or do they mean the consequences would be severe if it did?