A Starling Insights Deeper Dive Report

Supervisors on Supervision

— Closing Comments to Chapter Four —

Access the Full Report

In an era of rapid financial innovation and evolving risks, effective supervision is more crucial than ever. Colin Mayer begins this chapter where supervision fundamentally thrives or fails: with trust. I would frame the destination similarly but my approach to reaching it differs slightly. 

For supervisors, trust is not bestowed; it is built on excellent design. It is earned when we can see clearly the road ahead and navigate not only through the lens of the rear view mirror, when we can explain clearly where we are going with decipherable roadmaps, and most of all when we act clearly with proper use of our blinkers and horns — timely enough to avert accidents and avoidable harm rather than remedy its consequences. Culture is where that design is road-tested in the real world. It is quite literally where the rubber meets the road — where the governance aspect of the financial system is apparent, and where the supervisory regime earns sustained legitimacy — or falls short.  

This chapter encourages us to take the regimes for supervising culture from the theoretical and rhetorical levels to an operational level. The question is not whether culture matters — we have all seen its significance — rather, how we can design and implement the supervisory framework in ways that are consistent, proportionate, explainable, and therefore credible.  

Before we can tackle this, we face a well-known dilemma: supervisory achievements, the “saves” if you will, are invisible to the public eye. Supervisors operate very much like goalkeepers on the soccer field—a place where I have spent countless hours watching my husband coach and all five of my sons and two daughters play. Goals are celebrated with cheers and applause, the spotlight shining on the scorers. But the goalkeeper’s saves? It is the goalie who embodies the supervisor's role. These critical deflections preventing collapse often go unnoticed, blending into the game’s flow. In supervision, we are that goalie—quietly anticipating threats, blocking shots before they hit the net, earning trust not through public display of the scoreboard, but through quiet prevention.

Banks own the responsibility for safe and sound management of risk. Supervisors perform daily prevention work guiding firms to strengthen their line of sight into and management of risk and quietly averting crises. This supervisory work is not the stuff of headlines. It is a supervisory failure to defend which garners the headlines and is dissected in post-mortem studies eager to assign blame for losses. Supervisors are the goalkeepers of financial stability. Without those crucial interventions, the score turns against you, and systemic risk amplifies and manifests. This is true for the “hard,” quantitative concerns that demand our attention. So how are we to avoid exacerbating this imbalance, even while delving into the so-called “soft” qualitative concerns central to this report?

The answer lies not in setting forth a single supervisory blueprint but, rather, in committing to relevant actions. In my own words: supervision must be reconceived as both a moral imperative and a technical challenge. Moral, because public confidence is a precious commodity and our work, including public perceptions of it, either bolsters or undermines this confidence. And technical because this is not mere rhetoric; it is a program of tools, methods, and skills that must withstand scrutiny and deliver reliable outcomes. By shifting from more reactive methods to more focus on strengthening preventative methods, supervisors can foster resilience while demonstrating accountability and integrity.

What this chapter has surfaced — clearly

First, culture is not a “soft” concern. It is foundational. Just as the pilings driven into bedrock and load-bearing beams are the supports in a well-engineered house, culture provides structural resiliency. How this resiliency is engineered, or in other words, governed, is critically important. Non-financial risks — failures of governance, blind spots in decision-making, normalized corner-cutting — manifest as very tangible financial costs. Time after time, we have learned culture is a leading indicator of funding stress, control breakdowns, client harm, and, ultimately, a crisis of confidence, losses and even systemic meltdowns. Ignoring this predictable chain of events in prudential and conduct supervision is to pretend that balance sheets govern themselves. They do not. 

Our credibility is founded on the trustworthiness of our 
own supervisory culture.

Second, a common evidentiary foundation is needed if supervisory judgment is to carry its weight. Good supervision is not about trying to codify the world into rules or models. It is about making informed judgments that translate into effective, preventative supervision, understood by boards, replicated by peers, and verifiable over time. This requires moving beyond impressionism — beyond the maligned “I know it when I see it” explanations increasingly under fire — to patterns that can be identified, measured, and compared across geographies and peer institutions. This does not eliminate judgment; it supports it.

Third, culture applies to supervisors as well as to firms. A supervisory posture that relies too heavily on hindsight, communicates belatedly, and swings between silence and sanction, opacity and lessons-learned reviews, will never convince it is acting for the system’s long-term health. Our credibility is founded not only on mandates but also on the trustworthiness of our own supervisory culture, built on transparency where possible, proportionality as a discipline (not a slogan), and consistency visible to those we oversee. On the playing field, the coach cannot shout from the sidelines of one match and remain silent on the next. The players need predictable signals to build cohesion. Supervisors must model the same.

And fourth, we must be candid. Instead of preempting crises, regulators are often left to react after the fact. We have all seen the reflexive policy cycle that follows. When supervisory failures occur, new rules are adopted— ofttimes breathtaking in complexity, albeit necessary — at the same time based on an incomplete understanding of the full costs and benefits. On the soccer field, waiting for the ball to cross the line before reacting guarantees a loss. The goalkeeper anticipates the play early, positions the defense, and saves the game before danger is even noticed. Predictive supervision is that save — celebrated in outcomes, not fanfare.

Good supervision takes courage and demonstrates the mettle of brave supervisors. They must make the hard decisions, however unpopular they may be, and act with conviction to keep our financial system safe. Supervisors deserve to be supported in this difficult mission. As Stephen Scott notes in the Executive Summary, post-mortems focused on symptoms rather than root causes — or shifting blame rather than bolstering good policy outcomes — do not contirbute to more effective supervision. This runs counter to the over-arching goal of trust stewardship. 

Surely the aim of maintaining resilient financial systems for citizens deserves more than a rounding up of the usual suspects and leaving supervisors bearing the brunt in the aftermath of an “accident”. And it is precisely why this chapter urges a shift from emphasis on "detect-and-correct" supervisory frameworks to ones that deliver a standard of care placing more emphasis on predicting-and-preventing bad outcomes. Such an approach must be grounded in evidence we can demonstrate, and methods we can defend. To achieve greater trust and more credible supervision we must travel in this direction.

What “predictive, culture-aware” supervision requires

The chapter is clear that the work ahead is practical, not theoretical. At least five elements are indispensable.

• A shared operational vocabulary. We do not need uniformity, but we do need intelligibility which enhances fluency — a “shared grammar,” as Sir John Kay terms near the beginning of this report. The goal is not to legislate a single value set; it is to identify the behaviors that reliably influence safety and soundness and fair treatment, and to do so in language that a board can act upon and a court can test. This must include attention to tone and accountability at the top, whether decision-making processes are well-structured and respected, whether challenge and escalation is effective or not, and outliers in peer comparisons. If these topics are addressed differently in every jurisdiction, supervision becomes a cumbersome translation exercise rather than a rigorous discipline. Moreover, a firm may be forced into adopting variegated processes that threaten the effectiveness of the very structures meant to deliver the very safe and sound, conduct objectives which are sought.
• Observable signals and a common evidentiary basis. This is the heart of the technical challenge. We cannot be satisfied with anecdotes and guesswork. There are now mature ways to observe how organizations function — how information flows, how challenge happens (or does not), where bottlenecks and permissive gaps persist, how risk appetite in documents differs from risk-taking in practice. These methods must respect privacy and be explainable, capable of scrutiny. These methods now exist, and this chapter presents a credible path to embed them in standard practice.

If we are to govern tomorrow’s risks, we will need tomorrow’s tools.

• Suptech as supervisory instrumentation. Technology is not a substitute for judgment; it is the instrument-panel that makes judgment timely, proportionate, and defensible. In the European system we have deliberately invested in this — integrated data platforms; delivered workflow “cockpits” that put the relevant evidence in front of supervisors; developed tools that accelerate routine tasks so that precious human judgment to be applied to what really matters. The explosive growth in data volume and velocity makes investment in these tools not a luxury but, rather, a critical necessity. Technology can allow patterns to be observed across firms, benchmarking, targeting, and escalation when remediation is lagging. If we are to govern tomorrow’s risks, we will need tomorrow’s tools — and the courage and conviction to build them together today. Imagine the goalkeeper with real-time analytics: tracking shot trajectories, wind shift signals, player fatigue, formation gaps. Saves become predictive, not reactive.
• A legal and institutional basis that avoids overreach while enabling action. Boards cannot merely aspire to achieving certain outcomes yet reward status quo scenarios such as repeated breaches without consequence, risk limits gamed by the first line, or absence of challenge in the second line. Rather, clear expectations must be set and authentically followed through with rewards and discipline. Several voices in this stock-take speak eloquently to a viewpoint we must respect: supervisors can and should specify the outcomes and behaviors that matter to prudential and conduct objectives and should not try to prescribe a firm’s internal morality. The way forward is to define and monitor expectations that drive those objectives in operations. And if the line between values enforcement and behavioral governance is hard to draw, that is precisely why we must draw it transparently.
• Training, staffing, and incentives inside supervisory agencies. Culture supervision should not be an add-on for teams already stretched on capital and liquidity. It is a capability to develop. This requires bringing expertise in organizational behavior and data science alongside seasoned supervisors, investing in the skills to interrogate evidence, and aligning performance management with desired outcomes (timeliness, clarity, and effective action — ex ante). Today’s technological advances require adjustments to governance of organizational structures. If the industry is asked to strengthen governance, then supervisors must also strengthen how they supervise governance.

What we should do — by constituency

This chapter can either remain a commentary, or it can sound a call to action. I prefer the latter. Here is how we can translate its spirit into immediate commitments.

Supervisory authorities

• Codify the supervisory “grammar” for culture. Publish a concise, operational guide outlining the core phenomena to be examined, the sources of evidence to be used, how peer comparison will be constructed, and how proportionality will be applied. Keep it brief and revise it as new insights emerge.
• Embed pre-action checks. Before taking significant actions, require an internal review for proportionality and consistency, document the evidence, articulate why the measure advances safety and soundness, and design a fair appeals process (right to be heard) with reasonable timelines. Legitimacy is not only about being correct; it is about being understandably correct.
• Consider how to provide more transparency about the “saves”. If reviews are only conducted when failure occurs, we will not gain insights into what supervisory actions effectively move the needle on culture. We need more than handwringing, lessons-learned exercises, and rules re-calibration after failures, even if these are valuable (except for the handwringing). To gain and sustain credibility, we need robust mechanisms for assessing what good looks like. To gain and sustain credibility, we need robust mechanisms for assessing what good looks like. We need to analyze and provide transparency about the positive outcomes achieved when the right preventative supervisory medicine is prescribed at the right time. 
• Invest in SupTech that supervisors will actually use. Tools should align with the work of supervisors. Co-design with frontline teams. Monitor usage and outcomes; retire what does not help. Integrate adoption into workflows, not aspirations. While innovation requires developing tools outside of legacy systems, we must avoid sliding into delivering permanent “side desk” solutions. Instead, we should integrate the tools into core systems by replacing outdated methods once new ones prove effective. 
• Pilot horizontal assessments with third-party support where appropriate. Supervisors do not have a monopoly on methodology. Engage independent experts for cross-firm benchmarking, clearly define governance, confidentiality, and how findings will be integrated into supervisory dialogues.

Legitimacy is not only about being correct; it is about being understandably correct.

Financial institutions

• Make risk culture auditable. Boards should insist that risk appetite — in both financial and behavioral dimensions — be evidenced in daily practice. That means linking stated appetite to ground level conduct, consequences for breaches, and incentives for adherence. Promote a culture of “good news fast, bad news faster”. Reward it as it is the key to a resilient firm. How the firm can be hurt should carry an appropriate weight in reward systems which mainly seek to reward profit objectives. Be transparent about rewarding those who also protect the resiliency of the firm, so it becomes an incentive that drives desired behaviors.
• Invest in the “throughput layer.” Policies and processes are inputs; losses and complaints are outputs. However, we often fail to appreciate and to inspect the connective tissue in between — ownership, challenge, escalation, and follow-through. These flows need to be made visible, measured and acted upon when weaknesses are seen and addressed proactively. Technology makes this much more feasible today.
• Engage in peer-learning with candor. Horizontal benchmarking is not naming and shaming; it is an efficient way to learn. Where confidentiality allows, firms should participate in anonymized comparisons and be prepared to explain their responses.

Standard-setters and international bodies

• Facilitate convergence around methods, not morals. The goal is not uniformity — it is intelligibility. We must speak a shared supervisory language with a high degree of fluency globally, even if we apply it with national nuances. Standard-setters can convene, test, and document what works — frameworks for peer reviews, technological solutions that can be distributed and used by a variety of supervisors, minimal data standards for culture diagnostics, templates for proportionality checks — so that supervisors and firms are not reinventing the wheel.
• Support safe experimentation. Create sandboxes and pilot programs that allow agencies and firms to trial diagnostic tools and supervisory workflows without fear of learning exercises will be treated as precedent. Consider this as infrastructure for institutional learning, not a competition where proprietary objectives prevail. 

Academia and the research community

• Provide the evidence. We need help turning what practitioners’ insights into demonstrable findings. Which indicators travel well across jurisdictions? Which combinations of signals best predict loss of control? How do we credibly distinguish correlation from causation? The questions are knowable — if we care enough to fund and study them. And perhaps in doing so, the answers will become more readily knowable as well.

The innovation agenda is not deregulatory

One potential misinterpretation warrants addressing directly. The modernization we advocate here for is not a call for loosening standards. Indeed, the essence of this chapter is the opposite: to be more disciplined and transparent in how we judge, and timelier in how we act. The last decade required a capital-centric focus to rebuild trust in bank resilience. The coming decade will test whether we can apply the same discipline to the human systems, determining the durability of those load bearing beams when real life challenges arise.

The modernization we advocate here for is not a call for loosening standards.

To achieve this, we must keep a balanced relationship between people and technology. Technology should augment supervisors, and make them “smarter”, not replace them. It should reduce noise so judgment can focus on signals. It should accelerate basics tasks — data integration, pattern detection, horizontal comparison — so that scarce attention is available for engagement that alters behavior. It should be governed by principles that are explainable: auditability of outputs and clear ownership for decisions that remain human.

Guardrails against overreach

A final note on boundaries. Several contributors rightly worry about supervisors straying into value prescription. It is not our role to write a firm’s code of conduct. Our role is to contribute to making sure that the system’s risk is managed. The safest way to delineate this boundary is to insist, publicly and repeatedly, that behaviors with prudential and reputational conduct consequence be governed and managed — how limits are respected, how breaches are handled, how challenge is heard, how accountability is enforced, how gaps between risk appetite and risk taking are detected and mitigated — not mandating specific virtues.

Equally, we must avoid letting good intentions evolve into unchecked authority. That is why proportionality and consistency checks, reasoned decisions, and (where the law allows) delayed transparency are not procedural niceties; they are safeguards of credibility and legitimacy. If we aim to sustain the mandate for delivering effective supervision, we must practice good governance ourselves, demonstrate our work, and welcome scrutiny of our own supervisory cultures.

A closing reflection: what it means to “earn trust” today

The supervisory community has accomplished challenging tasks before. We have devised capital regimes that restored confidence in the financial system. We have built resolution frameworks fostering greater international cooperation when failures loom. We have coordinated across previously impermeable borders. We can do the same with culture. But it will not be achieved by declarations. It will be earned by supervisory systems enabling action when facing uncertainty in ways that are fair, explainable, and effective.

Technology should augment supervisors, not replace them.

This chapter does not ask us to choose between judgment and evidence, between people and technology, between national nuance and global coherence. It asks us to hold those pairs together — anchoring judgment in evidence, equipping people with technology, and pursuing coherence without mistaking it for uniformity.

We will not get everything right the first time. Some tools will disappoint. Some pilots will stall. That is the nature of real innovation. The solution is not to retreat to the familiar but to learn faster and move forward with what works. As one of our contributors warned, “This isn’t work for the immature or ill-informed. It needs a purpose-built venture.” Success will come with leadership that sets forward-looking priorities, protects learning time, and invests in technology enabling smarter supervisors. Successful leadership understands that in so doing some failed projects along the way do not signify “game over” but are part of the necessary learning that will deliver stronger preventative supervisory frameworks. In this way, successful leaders will be equipped to explain credibly — inside our authorities and to the public — why this work matters.

Every cycle of missed signal, late action, ands post-mortems depletes the reservoir of public confidence.

The cost of delay is not theoretical. Every cycle of missed signal, late action, ands post-mortems depletes the reservoir of public confidence upon which financial intermediation depends. If we want the next decade of supervision to be remembered for something better, the path lies ahead. We need to articulate clearly how we supervise and why it works. We need to build and present evidence supporting our decisions, acting proportionately and consistently. We must reject opaque processes in favor of a higher, more credible ground built on transparent supervisory decisions and defensible, improved outcomes. Finally, we must modernize our tools and enhance our culture to deliver timely and trusted interventions.

Modernizing supervision is not just about tools — it is about visionary leadership that prevents problems before they escalate. Like the goalkeeper’s unseen saves that keep the scoreline clean, there are no parades for prevention, yet that is where trust is forged — game after game, with crises averted. Let us lead with prevention, measure with acuity and engender faith in oversight. That is how supervisory legitimacy is earned. That is how it is kept. And it is how we must approach the decade ahead.

Elizabeth McCaul is a Former Member of the Supervisory Board, European Central Bank. She is the first American to serve as a European Central Bank Representative to the ECB's Supervisory Board. Her non-renewable five-year term concluded in 2024. Her mandate included supervisory strategy, consistency and quality of supervision, risk, capital, internal governance, and training. She focused on prudential implications to financial stability, including private credit markets, capital markets and geopolitical risk. She served as the chair of the Board Steering Committee on the Digital Agenda overseeing supervision of operational resiliency, IT risk, crypto, cyber-security, new FinTech entrants and the development and implementation of the SupTech strategy to deliver supervisory tools using AI.