Reputational risk is the risk that a firm loses customers, funding, partners or market value because of how it is perceived, rather than because of a direct financial loss. In banking and payments it usually arises from something else going wrong first, such as a scandal, a data breach, a fraud wave, a sanctions failure or a public dispute, and then spreading through the press, social media and word of mouth.
Reputational risk is often called a "secondary" or consequential risk, because it sits on top of other categories such as operational risk and compliance failures. Its treatment by supervisors has changed: the Basel Committee lists it among risks banks should consider under supervisory review, while in 2025 the main US federal bank regulators stopped using it as a separate category in examinations.
Reputational risk in plain terms
Picture a popular neighbourhood restaurant. One night a few diners fall ill. The actual cost, a few refunds, is small. But if the story spreads, half the regular customers stop coming, the landlord gets nervous and suppliers ask to be paid up front. The damage from what people believe is far larger than the damage from the original event.
Financial firms run on trust in the same way. A bank only works if depositors believe their money is safe and other banks are willing to deal with it. A payment company needs card networks, partner banks and merchants to keep vouching for it. When that trust slips, money and relationships can leave very quickly, sometimes faster than any balance sheet number would suggest.
How reputational damage happens
Common triggers in financial services include:
- Misconduct and fines. Enforcement actions for anti-money laundering or sanctions breaches make headlines and lead partners to review the relationship.
- Security incidents. A data breach or ransomware attack raises questions about whether customer data and money are safe, which links reputational risk closely to cybersecurity risk.
- Fraud against customers. Waves of authorised push payment fraud or account takeovers that a firm is seen to handle badly.
- Outages. Long failures of online banking or card payments, often caused by a supplier, which connects it to third-party risk.
- Association. Serving clients or sectors that the public or partners regard as controversial, or a partner firm's own scandal spilling over.
The speed of the effect is what makes it dangerous. In March 2023, depositors withdrew money from Silicon Valley Bank within roughly a day after news of a securities loss and a planned capital raise spread among a closely connected customer base, an example of how loss of confidence can turn into a bank run.
Managing reputational risk
Because it follows other failures, the main defence is good control of the underlying risks: sound know your customer checks, strong security, fair complaint handling and clear governance. On top of that, firms typically:
- Screen new clients, products and partners for reputational sensitivity, often through a committee that can refuse business that is legal but likely to cause controversy.
- Prepare incident and crisis-communication plans, so that customers, regulators and partners hear facts quickly and consistently.
- Track indicators such as complaint volumes, social media sentiment, press coverage and ratings from customers.
- Protect channels for whistleblowing, so problems are raised internally before they become public.
Reputational risk is hard to measure in money. Some firms estimate it through scenarios, for example the deposit outflows or lost merchant volume that might follow a named incident, and fold those into liquidity risk stress tests.
Regulatory treatment and the debanking debate
In the United States, reputation risk was for decades one of the categories used by the Office of the Comptroller of the Currency (OCC) in bank supervision. Critics argued that examiners used it to pressure banks into dropping lawful but unpopular customers, contributing to complaints of people and businesses being debanked and to broad de-risking. In 2025 the OCC removed reputation risk from its handbooks and guidance, and on 23 June 2025 the Federal Reserve Board said it would no longer include reputational risk in its examination programmes. On 7 October 2025 the OCC and the FDIC jointly proposed rules to prohibit the use of reputation risk in supervision, and they adopted a final rule in April 2026, effective 9 June 2026, which also bars them from pressing banks to close accounts over customers' political, religious or other protected views or speech.
These changes concern supervisors, not banks' own judgment. Banks remain free to weigh how a relationship could affect their standing, and most continue to do so within their risk management frameworks. Outside the US, supervisors such as the UK's Financial Conduct Authority focus more on conduct outcomes for customers than on reputation as such, but the practical result for firms is similar: poor treatment of customers becomes both a regulatory and a reputational problem.
Criticism and limitations
The concept is criticised for being vague. Because almost any event can harm a firm's image, "reputational risk" can be used to justify decisions that are really about cost, politics or convenience. It also overlaps heavily with other categories, which makes double counting likely when firms try to quantify it. Supporters reply that ignoring perception is unrealistic in a business built on confidence, and that the vagueness is a reason to manage the underlying causes well, not to drop the idea.