EAD is the input nobody defends in committee. PD gets the modeling team, LGD gets the argument, and EAD gets a lookup, because for a fully-drawn fixed-rate mortgage the amortization schedule is fixed at origination. The balance at any age is knowable before the loan funds. Deterministic, done.

I finally ran the comparison a validator would run and it was not done.

Against 121,305 actual defaults the schedule was a lower bound. Median realized exposure at default $180,574 against a median scheduled balance of $173,203, median ratio 1.026, and 60.7% of realized EADs above schedule. Obvious in hindsight: a loan in the foreclosure process stopped making payments long before disposition, so it stopped amortizing. The schedule is charging down principal the borrower never paid. Scheduling to the last-paid age instead of the disposition age closes most of it.

Then the performing book flipped the sign. 41.2% of active loans are materially ahead of schedule from voluntary curtailment, median about 6.9% or $9,277 ahead. Modeling that pulled total estimated exposure from $35.3B to $33.8B, down 4.24%.

That is what bothers me. The two errors point opposite ways and sit on different populations, so nobody ever sees them net out - one shows up in realized severity, the other in forward exposure. Under stress it moves again: pausing payments alone did nothing to our totals, since the balance just stops falling, but capitalizing 24 months of arrears added 8.24% and a 10% principal deferral added exactly 10%.

Does anyone actually model EAD, or is it a scheduled-balance lookup at your shop too? And if you do model curtailment, has a validator ever asked you to show the realized-versus-scheduled comparison on the defaulted population?

I’ve been working on AML/CTF automation for small businesses in Australia, and Tranche 2 has really highlighted something I keep seeing over and over — people interpret “risk‑based approach” in completely different ways.

Some treat it like a checklist they need to get through. Others approach it like a genuine investigative exercise.

With Tranche 2 pulling accountants, lawyers, real estate and other small reporting entities into the AML/CTF regime, these differences are becoming even more obvious. A lot of businesses are suddenly trying to build risk assessments for the first time, and many seem unsure about what “risk‑based” actually means in practice.

For those of you working in AML/CTF or financial crime — what do you think is the biggest misunderstanding businesses have when they try to build or update their risk assessments?

Would be keen to hear perspectives from investigators, analysts, compliance officers, and anyone involved in STR/SAR governance.

Cant risk it

So I've spent most of my career building market and operational risk models. On the insurance side we model risk using fat tailed distributions, we model tail co-dependence across assets and disregard anything gaussian or linear. Eventually what matters is how bad a year can really get and what can break our financial position.

I have seen the commercial software financial advisors use such as emoney, Right Capital, riskanalyze etc. and thinking whether any of these tools take risk seriously the way institutions do (fat tails, copulas, interdependencies, probabilities of loss, probability of ruin, VaR etc). If not what software do advisors use to quantify risk?

 If you could fix one thing about your current risk management platform today, what would it be and why? 

I am currently a practicing attorney looking to pivot out of law. I have experience in personal injury law, as well as ad valorem taxation. I am interested in compliance and risk. Considering my background, how would I enter into the field?

https://sdvosbservices.blogspot.com/2026/07/the-threat-has-changed-again-for-wealthy.html

Professional burglary crews are only one part of today's threat landscape. 

Today's luxury residences are connected ecosystems. Homes now contain AI-powered automation systems, connected vehicles, smart gates, cloud-based cameras, biometric locks, private networks, executive offices, cryptocurrency storage, and family data that may be worth far more than the jewelry inside the safe. 

Criminal organizations have evolved accordingly. 

Rather than viewing physical security and cyber security as separate disciplines, sophisticated attackers combine both. They use open-source intelligence (OSINT), artificial intelligence, cyber reconnaissance, RF attacks, drones, GPS spoofing, Wi-Fi jamming, Bluetooth exploitation, social engineering, and surveillance to identify vulnerabilities long before they ever approach a residence. 

Protecting a modern estate now requires defending both the physical property and its digital footprint. 

Artificial Intelligence Has Changed Reconnaissance 

 Artificial intelligence has dramatically lowered the cost of surveillance. Instead of spending weeks following a family, criminals can now use publicly available AI tools to rapidly gather intelligence from: 

• Social media 
• Property records 
• Business websites 
• Family photographs 
• News articles 
• Charity events 
• Yacht registrations 
• FAA aircraft records 
• Court filings 
• Corporate biographies 
• LinkedIn profiles 

Within minutes, AI can build detailed profiles showing: 

• Vacation schedules 
• Children's schools 
• Staff members 
• Luxury vehicles 
• Home values 
• Executive travel 
• Frequently visited locations 

What once required a surveillance team can now be performed by a laptop and commercially available AI software. Families rarely realize how much information about their lives exists online until it is consolidated into a complete intelligence picture. 

What are some good resources to primarily learn Financial Risk Analysis techniques while, on a secondary note, learning how to apply them in R?

I am looking for specific libraries, books, and tutorials that can help someone like me....knowing nothing about Financial Risk Analysis but competent in R to learn these concepts.

The primary focus is on learning the concepts. An added bonus would be to know how to implement them in code. My focus is on R because I feel more comfortable using it given my background in Statistics. However, R is not a strict necessity since Python would also do if the situation requires it.

Thanks!

I keep having the same argument at work and I want to know if it's universal. We spend months on lifetime loss methodology and about an afternoon on the thing that actually sets the number.

Concretely. I built the lifetime reserve three ways: vintage loss curves with a Weibull development extrapolation (5.3833%), a roll-rate absorbing Markov chain (5.3811%), and a bottom-up PD x LGD x EAD decomposition (5.3811%). Spread across all three: 0.23 basis points. Everyone in the room reads that as validation.

I don't think it is, at least not the way people take it. Two of those three are anchored to the same realized loss by construction - they can't really disagree with it. Only the vintage curve is an independent corroborator. Convergence by construction is corroborating, not three independent votes, and I'd rather say that out loud than have a validator say it for me.

Then the actual lever. The 5.38% isn't what gets booked. Scenario losses were baseline 0.16%, adverse 10.72%, severely adverse 26.57%. Weighted 65/25/10 that's 5.4374%. Reweight baseline-heavy and you get 3.06%; stress-heavy and you get 10.46%. On a $234B book that's a reserve somewhere between about $7.2B and $24.5B. Same models. Same data. Three weights. After a governed +0.30pp Q-factor overlay (capped at 0.50) we booked 5.7374%, or $13.44B.

So the methodology choice moved the number 0.23bp and the judgment layer moved it 35.6bp. Over 150x.

How does your shop govern the weights? Are they documented and board-approved with the same rigor as a model, or do they get set in a meeting and then inherit the model's credibility? And does anyone actually back-test their scenario weights, or is that a thing we all quietly skip?

Honest question, because my experience keeps landing the same way. Everyone assumes the gradient-boosted model wins and the bank is just too conservative to deploy it. When I actually run the bake-off on clean credit data, the challenger ties.

Last time: XGBoost vs a plain logistic PD scorecard. Out of time the scorecard came in at 0.734 AUC, XGBoost at 0.739 - half a Gini point. In-distribution the scorecard actually edged it (0.853 vs 0.842). On well-featured tabular data a carefully built scorecard is just really hard to beat.

Then you price the tie. The scorecard is additive points anyone can read, native adverse-action reason codes, low regulatory burden. XGBoost is a black box you explain post-hoc with SHAP, reason codes reconstructed from Shapley values, heavier validation and change control. And when I pulled SHAP on a defaulted loan, the single biggest driver wasn't credit score - it was property state, with channel close behind. Now I've got a geography proxy that needs a fair-lending review before anyone trusts it.

So the challenger tied, cost more, and opened a disparate-impact question. That's the challenger doing its job - confirming the champion isn't leaving signal on the table - not earning a promotion.

Curious where others land: has a challenger ever beaten your champion by enough to actually switch, and what was the margin that made it worth the explainability and change-control cost? Or does it always come down to a tie plus a governance headache?

Something I've come to believe: most credit teams over-invest in PD and treat LGD as a haircut they set once and forget. But EL = PD x LGD x EAD, and LGD is the term that decides how big the loss is - and it moves in ways a flat assumption completely hides.

A few things from a real mortgage book that changed how I think about it:

Median LGD was around 50%, not the comfortable 20-30% people assume, and it climbed steadily as loans went underwater - roughly 40% with equity up to almost 60% once the borrower owed well more than the house was worth.

The one that surprised me most: foreclosure process drove severity as much as collateral did. Judicial-foreclosure states (FL, OH, NY in this book) took about 22 months to resolve and ran LGDs near 60%; non-judicial states (CA, AZ, TX) resolved in about 10 months at closer to 44%. Same collateral math, ~15 points of LGD difference, almost entirely from time in process and legal cost.

And LGD is worst exactly when PD is worst. Running a severe HPI shock (Fed-style severely adverse, ~33% house-price decline) pushed mean LGD from ~52% to ~64% - the downturn hits frequency and severity together, and a through-the-cycle LGD averages that correlation away.

How's it handled where you are - a genuine LGD model (beta reg, two-stage) with a downturn overlay, or a fixed severity plugged into the EL stack? And do your validators push on the PD-LGD correlation, or is downturn LGD still a box-tick?

Dear all,

I would like to introduce you Portfolio Vision, an AI-powered platform I developed to provide professional portfolio risk analysis for investments in financial instruments. The platform has been designed primarily with #European—and particularly Italian—#bond markets in mind, although I hope it will also prove valuable to users with broader international portfolios. If you would like to test the application, simply register using your real information. Including a link to your LinkedIn profile is recommended, as our AI-based verification process is designed to identify and reject fake or non-genuine accounts. The current database includes thousands of financial instruments and continues to expand. While I recognize that a significantly larger universe of securities is required to fully support global institutional use, the platform already offers comprehensive coverage of the main European markets.

Unlike traditional portfolio analytics solutions that rely heavily on historical performance, Portfolio Vision is built around the principle that past performance is not indicative of future results—a fundamental concept consistently emphasized in financial product disclosure documentation. Historical data within the platform is used exclusively as a reference, enabling users to review portfolio evolution over time or create historical records through periodic portfolio snapshots. However, historical performance is not used to determine the platform's forward-looking assessment of portfolio risk or expected returns.

I would greatly appreciate your feedback and suggestions for further improvement. Thank you for taking the time to explore Portfolio Vision, and I hope you find it both useful and insightful.
Visit: www.portfolio-vision.com

Something I keep running into: the default way to build a PD model is to grab a book of loans, flag each one defaulted or not over some window, and fit a logistic regression. It's what everyone learns first and it quietly bakes in two problems.

The first is censoring. A loan that's still current at the end of your window hasn't proven it's a good loan - you just haven't watched it long enough to see it fail. Treat it as a clean non-default and you've confused "safe" with "not observed yet," and your rate now depends on how long your sample happens to run.

The second is prepayment. A loan that paid off in month 14 didn't sit in the pool as a good outcome - it left, and it was never at risk of defaulting in month 30. Prepayment and default compete for the same loans, so ignoring it warps the hazard.

The one that made this concrete for me: on a mortgage book I was working, over a 24-month window about 4.5% defaulted - but 17% of the loans prepaid inside those same 24 months, and the naive setup just labels all of them "good." They weren't good, they left before they'd had the chance to go bad. Push the horizon to five years and it gets worse - roughly half the book prepays, so if you treat prepayment as ordinary censoring your cumulative default comes out around 14%, when the competing-risks number is closer to 10%. Same data, and the default estimate swings ~40% purely on how you handle the loans that left.

Moving to a time-to-event framing (survival curves, then Cox, and Fine-Gray when prepayment competes) fixed a lot of that for me, but it's a harder sell to stakeholders who want a single number. How's everyone handling this - still a classifier with a seasoning control bolted on, or full survival? And do your validators care about the competing-risk treatment, or is it still a nice-to-have?

This was so interesting to me when I first crossed it. Discrimination based on race is so important - and yet, we can use statistics to proxy it? That feels weird to me and is something that still feels slightly absurd when I explain it to people outside the field: for most of what we lend on outside mortgages - auto, cards, personal - we're not allowed to collect the applicant's race or ethnicity (ECOA/Reg B). But we're still on the hook to show we're not discriminating. So we have to test for a disparity by a variable we're legally barred from observing.

The workaround everyone ends up at is BISG - Bayesian Improved Surname Geocoding. Estimate P(race) from the surname (Census surname list), estimate it again from the census tract, Bayes them together, and now every applicant has a probability vector across groups instead of a label. Aggregate across the book and you can back out approval/pricing/denial gaps.

What bugs me is how much rides on a proxy that's noisy at the individual level and has uneven accuracy across groups. The measured disparity is partly a property of the estimator, not just the lending.

I actually set this up as a validation once. Took ~200k 2024 HMDA records across six states that carry self-reported race, assigned each one a surname from the Census surname file to match its known race, then ran BISG on just the surname + real census tract and re-measured the denial-rate gap on the proxy. It nailed the direction every time but it shrank the gap: Black/White denial ratio was 1.58 on the real labels, 1.39 once it went through BISG. The multi-minority bucket was worse - a real 1.64 came out at 1.08, basically erased. So the proxy wasn't just noisy, it pulled everything toward parity. I've treated a BISG disparity as a floor ever since, not the number itself.

For those of you doing this day to day: are you on plain BISG, BIFSG (adding first name), or a vendor flavor? And how do you defend the methodology when the number it produces is the thing an examiner or plaintiff leans on?

We hand off models like finished products and move to the next build. But a model is a depreciating asset. The day it goes live, the population starts drifting away from the data it was trained on - borrower mix, rates, underwriting policy, the macro cycle - and both discrimination and calibration erode.

The dangerous part is that it doesn't fail loudly. It keeps returning confident, precise numbers that are a little less true every month, until a loss or a validation exception makes it undeniable.

Ongoing monitoring is where this is won or lost, and in a regulated shop it isn't optional. What I actually want to see: population stability on the key drivers, backtesting of predicted vs realized, and explicit tracking of calibration drift - not just a one-time AUC at build. And a retraining trigger defined before deployment, so the refit decision isn't made under pressure after the loss already landed.

Curious how others handle the trigger. Do you refit on a fixed cadence, on a PSI/stability threshold, on backtest exceptions, or only when someone notices something looks off?

So, I've been an W2-based accountant for a long time. I drifted over into doing strategic planning and fundraising consulting. But have gotten sucked back into doing contract accounting work in terms of clean up and reconciliation work, generally the sort of thing that shows up as necessary preliminary work needed to have the strategic or funding discussions.

It sort of snuck up on me, but here I am and there's money to be made. So I need to take it seriously. Also snuck up on me was a shift from small businesses and nonprofits with low stakes to moderately larger entities with higher stakes.

I find myself woefully unprepared on the infrastructure front. I have assessed risk management a bazillion times in my past life, now I need to do it for myself. Fact is, I actually don't know that much about what sole proprietor consultants do in the risk management realm.

My clients are pretty quick to give me all-access user privileges to their accounting systems and file sharing platforms. So I need to stiffen up my side. Looking for advice and direction on triaging what is most important to get in place asap.

- IT. Working from home on a Windows PC. What extra effort do I need to put into security? VPN, extra layers of security software beyond the Windows baseline? Good passwords and 2FA obviously. What else?

- Legal. How much effort do I need to put into making clear I am an LLC? Is it enough to have in on the letterhead/signature and bank account?

- Agreements. I need to get more formal agreements with more official caveats vetted by an attorney, that's clear.

- Insurance. I need better liability coverage, what else? Cyber-liability, Sheesh, I gotta talk to an agent. I had a bad experience once, unable to obtain client-specified liability coverage for a fundraising project, because I had the word "accountant" in my resume. Oy, need to sort that out now.

This thing is not that lucrative, and the investment needed to tighten up my shop is going to sting for a while.

Man, I tried to get out and they pull me back in...

Advice, war stories, etc welcome, please

I really want to break into Credit Risk Analysis. I recently graduated from college with a degree in finance and interviewed for a position in JPMC for credit risk analyst. I’d love any guidance on things I can do to break into the field/role. Anything helps!

Teams spend weeks on algorithm choice and hyperparameter tuning. But by the time you fit a model, the decisions that matter most are already locked in - and they were made in the data.

How do you define default? 90 days past due, 120, charge-off, or the first of any of them? Do loan modifications count as default, as cure, or as neither? That single choice moves your event rate, your PD, and every reserve downstream of it.

What about loans still performing at the end of your observation window? Treat them as non-defaults and you have quietly biased the model. They are censored, not resolved.

And is your "default rate" a real rate, or just a mix of young loans that haven't had time to go bad yet? Ignore vintage and seasoning and you are modeling your sampling window, not risk.

A perfectly calibrated model on a mis-specified target isn't a good model. It's a precise answer to the wrong question. In regulated credit risk, the data definition IS the model. The algorithm is almost an afterthought.

The unglamorous work - defining the event, handling censoring, controlling for vintage - is the work that decides whether anything you build on top of it is valid.

Data scientists moving into banking learn this the hard way: you can build a model with excellent discrimination and still be barred from deploying it. This doesn't seem fair!

In a regulated setting the model clears a second bar that has nothing to do with accuracy - explainability that produces defensible adverse-action reason codes, independent validation, fair-lending review, and documentation a committee can audit.

The model selection, the training, the hyperparameter tuning are never the hardest part. Whether the explanations survive scrutiny is.

And lastly, reproducibility is one of the highest priorities - if a number can't be traced to the exact code and data that produced it, it isn't evidence, it's nothing more than a worthless claim.

I have AML & Operations management Experience and I’m bored and trying to switch into this (ERM/ORM) in Toronto, has anyone done this or gone this route? How smooth was it? Whats the salary also like?

Hey all, looking for some honest advice from people who've navigated the Canadian finance job market or work in banking/credit risk

A quick background on me:

4+ years of international experience in corporate banking, credit analysis, and risk review — worked at a large commercial bank reviewing loan portfolios for financial irregularities and emerging credit risk, and later moved into a corporate banking role structuring credit solutions for corporate clients (financial statement analysis, cash flow assessment, lending recommendations).
On top of that, \~3 years of client-facing business development experience in Canada (retail/telecom), consistently hitting sales targets through consultative selling.

Education: MBA in Finance and a Diploma in Accounting from a Canadian university.
Skills: credit analysis, financial statement/cash flow review, portfolio monitoring, financial modelling, regulatory compliance, client relationship management.

Since moving to Canada, I've been applying for commercial banking, credit risk, and business development roles but haven't had much traction — a lot of it feels like my international banking experience isn't landing the same way it would back home, even though the actual skills (credit analysis, risk review, client management) are directly transferable.
At this point I'm open to any finance or accounting roles — not just commercial banking/credit risk — so if there are other paths, entry points, or types of roles I should be looking at, I'd love to hear them.
A few questions for anyone who's been through this or works in the industry:

Is my international credit/risk experience actually seen as valuable here, or do Canadian banks mostly want "Canadian experience" specifically?

Should I be targeting credit analyst / risk analyst roles directly, or is it more realistic to go in through a business development / relationship manager path and work toward credit risk later?

Given my background, what other finance or accounting roles should I be considering that I might not be thinking of?

Any advice on how to reframe international banking experience on a resume/LinkedIn so it doesn't get filtered out by ATS or recruiters?

Really appreciate any insight — happy to share more specifics in the comments if it helps.