Economic Dimension
Risk Management &
Business Resilience
We operate in a dynamic global environment, with emerging risks that may not yet be fully recognised or understood but could significantly impact society, organisations, individuals and the planet. Effective risk management is therefore critical to strengthening business resilience by mitigating these impacts and enabling a quick and adaptive response.
A robust risk management framework guides us in ensuring business continuity. Our goal is to enhance our risk management capabilities to meet regulatory expectations, safeguard the Bank’s interests, as well as those of our stakeholders, and promote long-term value creation.
Enterprise-Wide Risk Management (EWRM) Framework
CIMB operates under a comprehensive Enterprise-Wide Risk Management (EWRM) Framework, which provides a structured and standardised approach to identifying, assessing, managing and monitoring risks across the Group.
The framework integrates a top-down strategic perspective with bottom-up risk identification, enabling proactive management of evolving business, market and regulatory developments. Key risk categories include credit, market, operational, liquidity and sustainability risks.
Risk management processes are embedded across the Group, encompassing:
- Risk identification and assessment
- Risk measurement, including stress testing
- Risk management and control through defined limits and mitigation actions
- Ongoing monitoring and reporting to senior management and the Board
Process for Determining Risk Appetite
The determination of CIMB’s risk appetite is an integral part of the Group’s risk management process. It is guided by:
-
-
2. Stakeholder Inputs
Inputs from the Board of Directors, Group Risk and Compliance Committee (GRCC), and senior management guide the development of risk appetite parameters.
-
3. Quantitative and Qualitative Factors
These include financial metrics (e.g., capital adequacy, liquidity ratios), macroeconomic trends, regulatory requirements and scenario analysis of emerging risks, including sustainability and climate risks.
-
4. Approval and Oversight
The Board of Directors approves the Group’s Risk Appetite Framework, while the GRCC reviews and monitors adherence to the framework through periodic reports and assessments.
Risk Management Process
-
1. Business Planning
Risk management is central to the business planning process, including setting frameworks for risk appetite, risk posture, new products and business activities.
-
2. Risk Identification and Assessment
Risks are systematically identified and assessed through the robust application of the Group’s risk frameworks, policies, methodologies, standards and procedures. A risk matrix is utilised to depict the short- and long-term impact, as well as the likelihood of each individual risk.
-
3. Risk Measurement
Risks are measured and aggregated using Group-wide methodologies across each of the risk types, including stress testing.
-
4. Risk Management and Control
Risk management limits and controls are used to manage risk exposures within the risk appetite set by the Board. These limits and controls are regularly monitored and reviewed in light of evolving business needs, market conditions and regulatory changes. Corrective actions are taken to mitigate risks.
-
5. Risk Monitoring and Reporting
Risks on an individual and portfolio basis are regularly monitored and reported to ensure they remain within the Group’s risk appetite.
Application of Risk Appetite to Specific Risks
Risk appetite is cascaded across all risk categories, including sustainability risk. For instance:
- Sustainability Risks: The Sustainability Risk Management Framework integrates risk appetite into sectoral policies and transaction assessments, ensuring alignment with CIMB’s commitment to sustainable finance
- Credit Risks: Credit risk limits are set based on the likelihood and impact of default scenarios, informed by stress testing and historical data
Ongoing Review & Adjustment
CIMB conducts periodic reviews of the risk appetite framework to ensure alignment with evolving business needs, market conditions and regulatory developments. These reviews include scenario analyses, stress testing and consultation with key stakeholders to recalibrate risk thresholds where necessary.
Governance & Accountability
CIMB adopts a Three Lines of Defence model to ensure clear ownership, independent oversight and assurance across all risk types.
-
Board of Directors
Approves the risk appetite framework and provides strategic oversight
-
Group Risk and Compliance Committee (GRCC)
Oversees implementation and monitors risk exposures
-
First Line of Defence
Business units manage risks in day-to-day operations
-
Second Line of Defence
Group Risk provides oversight and guidance
-
Third Line of Defence
Internal Audit provides independent assurance
This structure reinforces accountability and supports disciplined risk-taking across the Group.
Sustainability Risk Management Framework
Sustainability risk is embedded within CIMB’s EWRM Framework and is treated as a cross-cutting risk that can influence traditional financial risk categories, including credit, market, liquidity, operational and reputational risks.
Environmental, social and governance considerations — including climate change, nature, human rights and institutional integrity — are systematically integrated into risk assessment and decision-making processes.
Sustainability risks are:
- Identified and assessed using established frameworks, policies and procedures
- Measured using tools such as scenario analysis and stress testing
- Managed within defined risk appetite through controls, due diligence and client engagement
- Monitored and reported regularly to relevant management and Board-level committees
We assess a wide range of factors in our business transactions and operations, including environmental issues such as climate change, nature impacts and resource use; social considerations, including community wellbeing and workplace practices; economic challenges, such as market shifts and resource costs; and ethical concerns, including transparency and responsible governance. By addressing these considerations, we aim to mitigate potential risks to CIMB and our stakeholders who depend on our products and services, reinforcing our commitment to long-term stability and shared success.
-
Climate Change
Physical risks such as extreme weather events and transition risks, including regulatory changes that may lead to business disruption and negative financial impacts
-
Deforestation
Land-use changes, including forest clearing for logging, agriculture, livestock ranching, industrialisation and urbanisation
-
Energy Use
High or inefficient consumption of electricity from non-sustainable sources, leading to increased GHG emissions
-
Biodiversity Loss
Activities that damage natural habitats, introduce invasive non-native species or lead to the overexploitation and depletion of biodiversity stocks
-
Water Scarcity
Excessive water use, particularly in waterscarce regions or catchment areas, where development may impact water availability
-
Ecosystem Degradation
Permanent or significant impacts on sensitive ecosystems such as mangrove, peat swamp or limestone areas
-
Waste and Pollution
Poor waste and by-product management, contributing to terrestrial, freshwater, and marine pollution
-
Marine Environment
Pollution and destructive activities, such as bottom trawling, that negatively impact marine ecosystems
-
Health and Safety
Unsafe working conditions, including the lack of personal protective equipment, the absence of workplace safety policies and procedures and insufficient medical coverage
-
Communities
Activities that impact native customary rights and inhabited areas, including failure to obtain the Free, Prior and Informed Consent of communities impacted by business activities
-
Human Rights and Labour Issues
Factors affecting workers’ rights and wellbeing, including discrimination, debt bondage, unfair benefits, remuneration and contractual agreements; and lack of rights to form unions, freedom of movement, access to remedy and provision of basic needs such as housing, water, healthcare and education
-
Diversity, Equity and Inclusion
Behaviours that do not contribute to a fair and equitable work environment or dishonour the dignity and respect of employees including any form of harassment, whether sexual or otherwise
-
Institutional Integrity
Poor management practices that may result in failure to meet commitments, environmental, social or reputational risks, as well as concerns related to governance, bribery, corruption, cybersecurity and data privacy
The environmental, social, economic and ethircal risks outlined can result in financial risks to our clients and other stakeholders, and ultimately to CIMB. In making financing and business decisions, we consider these risks in line with our sustainability commitments.
Emerging Risks
We assess our company-specific risk exposure using a risk matrix to depict the likelihood of each individual risk, as well as its potential short- and long-term impact.
For two identified risks — namely, biodiversity loss and ecosystem collapse and anti-ESG sentiments — the likelihood and impact are rated as High-High and Medium-High, respectively.
| Emerging Risk | Potential Business Impact | Mitigating Actions |
|---|---|---|
Biodiversity Loss and Ecosystem Collapse (high likelihood; high impact)
Biodiversity Loss
| Biodiversity loss and ecosystem collapse present significant risks to human wellbeing and both the ASEAN and global economies. Key impacts include:
• Reduced agricultural productivity, disrupting supply chains and impacting food security
• Increased disease transmission due to the loss of natural pest control mechanisms
• Disproportionate harm to vulnerable communities
• Business disruptions for sectors dependent on ecosystem services
For financial institutions, negative impacts can be both direct and indirect through lending, financing, investment and underwriting activities. | We recognise the importance of biodiversity protection and restoration in maintaining ecological balance. Our key actions include:
• Engaging with industry players to understand challenges and explore ways forward
• Participating in international discussion forums to implement best practices.
In 2024, we published our Statement on Biodiversity and Nature and commenced development of a strategy and roadmap. Set for publication in 2025 alongside sectoral assessments, these initiatives build on our NDPE commitment requirement, which has been in place since 2022 |
Anti-ESG Sentiments (medium likelihood; high impact)
The growing political divide on climate change has led to rising anti-ESG sentiments, particularly in the US, where regulatory pushback has resulted in bans on ESG-based investments and corporate retreats from sustainability commitments. Major banks, asset managers and insurers have exited climate coalitions, while some companies have scaled back Diversity, Equity and Inclusion (DEI) initiatives due to shifting political and investor pressures.
Despite these headwinds, global climate action continues. COP29 secured commitments to mobilise US$300 billion annually for developing nations by 2035, though this remains short of what experts say is needed. As the ESG landscape evolves, financial institutions must balance regulatory, political and stakeholder expectations while staying committed to longterm sustainability goals. | The rise of anti-ESG sentiments is reshaping the global sustainability landscape, introducing geopolitical and economic uncertainty. Key potential impacts include:
• A shift towards non-ESG sectors could divert financing away from sustainable projects, impacting the growth of green industries and increasing investment volatility
• Reduced policy support for ESG initiatives may delay advancements in green technologies, such as carbon capture and renewable energy, potentially slowing the transition to a low-carbon economy | We take a structured, science-based approach to climate commitments, upholding transparency, collaboration and measurable outcomes. We are therefore:
• Engaging policymakers, regulators, investors, industry bodies and businesses to share knowledge and develop solutions that drive meaningful progress
• Grounding our targets in scientific methodologies keeping them robust, data-driven and aligned with international frameworks
• Adhering to local regulations and referencing local taxonomies while actively contributing to the development of climate policies
• Monitoring evolving market trends and public sentiment to refine strategies
• Engaging and supporting high emission industries in transitioning sustainably |
Greenwashing Risk (medium likelihood; high impact)
CIMB’s commitments, such as achieving Net Zero by 2050, and No Deforestation, No Peat and No Exploitation are typically phased in across our operating markets. For example, in 2022, we rolled out our NDPE commitment requirement in larger markets, while smaller markets adopted the policy in 2023.
At the same time, expectations and standards for responsible banking are rising rapidly. With multiple parties within CIMB communicating sustainability efforts across various channels, there is a risk of miscommunication or overstating sustainability claims. | Greenwashing – or even an allegation of it – can harm the Bank’s reputation and erode trust, making it critical to maintain credibility in our commitments. Potential impacts include:
• Reputational damage, affecting stakeholder trust and market competitiveness
• Loss of investor confidence, potentially impacting funding and partnerships
• Decline in employee morale and productivity
• Challenges in attracting quality candidates | To mitigate greenwashing risks, we focus on:
• Regularly reviewing policies and commitments to align with evolving expectations
• Strengthening governance and monitoring mechanisms to uphold transparency and accountability
• Minimising the time gap between announcing and implementing policies across our footprint
• Implementing the Sustainability Communications Procedure to guide sustainability-related communications
• Mitigating inaccurate disclosures by aligning with recognised reporting frameworks and obtaining third-party verification |
Related Material Matters
-
Learn More
Sustainable & Responsible Finance
Delivering products and services to support people, businesses and activities that create positive impacts on society, from economic, environmental and social perspectives. Managing risks and potential negative impacts arising from the activities that CIMB finances, including impacts on environment, society and the economy in general.
-
Learn More
Governance & Ethics
Strengthening our value proposition and ability to deliver returns to investors and shareholders. Allocating resources strategically and reinforcing our ability to plan and achieve resilient value creation. Reinforcing a healthy culture of ethics, integrity and transparency throughout the organisation.
-
Learn More
Cybersecurity & Data Privacy
Safeguarding CIMB’s data and systems, and customers’ data and privacy. Protecting customers from fraud and scams.
-
Learn More
Digitalisation & Innovation
Ensuring a seamless digital experience for customers. Transforming our operations by deploying tools such as data analytics capabilities and artificial intelligence to be a data-first organisation.
-
Learn More
Customer Experience
Engaging in responsible marketing and fair dealing practices to strengthen customer trust. Going the extra mile for our customers and delivering excellent customer experience that builds long term relationships.
2025 Sustainability Report
Dive deeper into CIMB’s latest sustainability progress, commitments and impact across economic, environmental and social priorities.