This article has been offered in response to the “Supervisors on Supervision” Deeper Dive, as part of the Public Comment Period. We invite you to submit your own comments during the Comment Period, which runs until March 15, 2026.
For too long, culture risk governance and supervision has been confined to the margins of financial oversight. Supervisors agree that culture matters, and firms have been repeatedly told to attend to it. Yet the tools used to assess it have rarely moved beyond interviews, surveys, thematic reviews, and post-hoc enforcement, approaches which frequently lack consistency, scalability, and defensibility. As a result, culture is recognised as important, but treated as something inherently resistant to systematic oversight.
That tension is summed up by Simone di Castri, CEO of Digital Transformation Solutions and Co-Founder of the Cambridge SupTech Lab, in his closing reflections in the 2024 Starling Compendium, where he points to the persistent gap between supervisory ambition and operational reality. The leaders of supervisory authorities acknowledge that misconduct is rarely an isolated event and that culture often shows up as a root cause. Yet, supervisors in the field are still left to rely on indirect proxies and lagging indicators to assess it.
“SupTech tools powered by developments in computational social science now allow us to put data-driven, quantitative analyses to the qualitative challenge of managing cultural contributors to organizational conduct,” di Castri writes. “With the right data-pooling protocols, supervisors might harness predictive behavioral analytics to conduct more effective horizontal peer reviews and perhaps to identify and cure culture-related risks across the financial system as they develop in real-time.”
Rather than framing culture and conduct as “soft” risks adjacent to prudential concerns, the supervisors who contributed views to Starling’s “Supervisors on Supervision” Deeper Dive more often position such risks as systemic, data-rich phenomena that can be observed, tested, and monitored. What supervisors currently lack are tools that allow them to observe behavioural signals early, across institutions, and at scale. Supervisory technology (SupTech) is now positioned to fill that gap, and the maturity of the tools available is rapidly progressing year to year.
Of course, no one is calling for reducing culture to a score or an algorithmic judgement, nor would that be practical. Rather, these tools can enable supervisors to detect predictive signals of behavioural drift and, utilising their experienced judgement, act upon them before harm has occurred. As Elizabeth McCaul , former member of the Supervisory Board of the European Central Bank, outlined in her closing comments to the final chapter of the Deeper Dive report, "Technology is not a substitute for judgment; it is the instrument-panel that makes judgment timely, proportionate, and defensible.”
“These tools can enable supervisors to detect predictive signals of behavioural drift and act upon them before harm has occured.”
SupTech’s expanding role in non-financial risk supervision
The State of SupTech Report 2025 provides the clearest empirical picture yet of how this shift is playing out globally. Drawing on responses from 148 financial authorities across 105 countries, the report shows that SupTech is no longer confined to prudential or AML use cases but is increasingly applied to consumer protection and market conduct, climate and ESG risk, as well as operational risk. In total, 197 financial authorities across around 140 countries have deployed at least one SupTech solution, a more than threefold increase since 2022. Five data points strike as particularly relevant from the perspective of culture and conduct supervision:
Where culture rears its head
While consumer protection and market conduct are prominent entry points, SupTech-enabled culture supervision extends further. Several authorities are now applying natural-language processing to board and committee minutes, looking for patterns in challenge, escalation, and decision-making. The objective is to identify governance dynamics that may warrant supervisory attention.
Others are using analytics to assess greenwashing risk, comparing firms’ sustainability claims against disclosures, product data, and external datasets. In this context, culture manifests in how consistently institutions translate stated values into operational decisions.
Similar approaches are being explored in whistleblowing analysis, remuneration reviews, and supervisory correspondence. Culture leaves signals in how organisations communicate, prioritise, and respond, and those signals can be analysed responsibly if governance is in place.
The promise and limits of foresight
As mentioned earlier, culture-related failures rarely emerge overnight. Cameron Lawrence, Director of Research at Starling, emphasised during a SupTech Week 2025 workshop that culture shows up in patterns of behaviour, escalation, language, incentives, and decision-making long before it crystallises into enforcement cases or public scandal. Culture failures emerge gradually, through tolerated behaviours, missed signals, and misaligned incentives. By the time they surface in enforcement statistics, the damage is already done.
The SupTech Generations 2.0 framework was originally published by the Bank for International Settlements (BIS) in 2019 and has since been advanced by Digital Transformations as a framework for categorizing the relative sophistication of SupTech technologies. Predictive analytics tools are considered advanced SupTech (3G) and refer to the advanced analysis of historical data to create statistical models that can predict future events, values, facts, or characteristics.
Predictive approaches allow supervisors to test hypotheses about how observed factors interact and can change how supervisors prioritise. One of the most striking themes in an internal session with members of the Cambridge SupTech Lab Innovation Leaders Residency was the recognition that technology changes supervisory power, even when introduced with benign intentions. As one participant put it, “the moment you can see patterns others cannot see, you have a responsibility to be very clear about what those patterns mean, and what they don’t.”
Another participant added that predictive tools are most valuable when they “challenge comfortable narratives, rather than confirm existing assumptions.” Instead of betting on predictive analytics to foresee misconduct with certainty, they can support earlier engagement, proportional intervention, and targeted dialogue, but only if supervisors remain accountable for how insights are interpreted and take measures to avoid entrenching potential bias.
When tools outpace governance
As SupTech moves deeper into behavioural and predictive analysis, ethical considerations need to be placed front and center. According to the State of SupTech Report 2025, only 26.1% of financial authorities currently have a formal ethical framework for AI or advanced analytics. Meanwhile, 12% offer mandatory training for developers and users on ethical AI principles, 6% conduct regular audits or reviews of AI systems for ethical compliance, and only 5% publish transparency reports on their AI use.
Concerns about opacity and “black-box” decision-making are already salient. The report finds that 18% of authorities explicitly identify a lack of explainability in AI systems as a key challenge to deployment, placing it among the top governance-related barriers to scaling advanced analytics. If an algorithm flags a bank for “poor risk culture” or elevated misconduct risk, supervisors must be able to explain (whether internally, to the institution, or, if necessary, to courts and the public) how that assessment was generated, what data it relied on, and how human judgement was applied. Without explainability safeguards, predictive tools risk undermining due process, accountability, and trust in supervision.
Conduct supervision often involves vulnerable consumers, power asymmetries, and subjective interpretation of harm. When SupTech tools surface behavioural patterns, supervisors must still exercise their judgement on how those signals are used, escalated, or contextualised.
Behavioural indicators are inherently noisy and rely on context. For example, a rise in complaints could reflect market-wide product confusion, a social media campaign, or external news influences rather than an intrinsic systemic conduct issue. Quantifying these signals is powerful, but it requires an interpretive context. Without that context, there’s a real risk of misattributing cause and effect. So, while new data sources offer richer behavioural insight, they also introduce risks around bias, representativeness, and unintended surveillance.
We mentioned earlier that the State of SupTech report highlights a growing interest in risk scoring and early-warning systems that integrate non-financial indicators. This is often framed as objectivity by removing subjectivity from conduct supervision. But behavioural science tells us that measurement itself changes behaviour. If firms know that internal communications, escalation rates, or employee survey results may feed into supervisory analytics, we should anticipate that incentives will shift. Risk management may become performative, and silence can look like stability. If tools are poorly designed, they risk rewarding data cleanliness rather than ethical robustness.
In summary, without clear accountability for model design, feature selection, and interpretability, supervisors risk acting on signals they cannot fully explain or contest. In predictive contexts, this is particularly sensitive, as models shape expectations before harm occurs, making robust ethical scaffolding even more important.
“Without clear accountability for model design, feature selection, and interpretability, supervisors risk acting on signals they cannot fully explain.”
A brief note on supervisory culture
The reflections so far focus on the supervision of culture in financial institutions, not on the internal culture of supervisory agencies themselves. That said, the two intersect in important ways. As Bank of Canada Governor Tiff Macklem notes in the closing comments of Starling’s 2025 Compendium, culture risk governance “applies to regulators as much as to firms.” The State of SupTech Report 2025 finds that 38% of financial authorities identify organisational culture that is not aligned with innovation as a key barrier to SupTech adoption, placing it among the most frequently cited governance and trust constraints ahead of many technical issues.
During SupTech Week’s Leading Innovation session, speakers stressed that SupTech adoption often stalls not because tools fail, but because agencies struggle to internalise new ways of working. The State of SupTech Report 2025 similarly shows that authorities with coherent strategies and clearer governance frameworks are significantly more likely to scale pilots successfully — suggesting that culture, including how uncertainty, failure, and cross-disciplinary collaboration are treated, conditions whether SupTech moves beyond experimentation. Traditional supervisory cultures, which tend to reward caution, procedural certainty, and individual accountability, do not always align easily with iterative development, model refinement, and probabilistic outputs.
In the context of ethics, this cultural dimension is decisive. Where supervisory cultures emphasise defensibility over transparency, or compliance over learning, ethical safeguards risk being treated as constraints that slow innovation. By contrast, cultures that value challenge, documentation, and reflective judgement are better positioned to treat ethics as an enabler of credible and sustainable SupTech, providing the structures that allow supervisors to trust, contest, and ultimately rely on advanced analytics in high-stakes supervisory decisions.
"Traditional supervisory cultures do not always align easily with iterative development, model refinement, and probabilistic outputs."
Ethical foundations for culture risk governance & supervision
SupTech can help supervisors test assumptions, identify systemic pressures, and move away from individual blame. It can support a shift from punishment to prevention. But this potential is realised only through deliberate ethical design choices. Supervisors need to be clear about purpose: Are tools designed to prioritise attention, to explain behaviour, or to justify intervention? They need governance structures that allow challenge and not just validation by model outputs. And they need to engage openly with supervised entities about how behavioural data is interpreted. That means:
The challenge ahead is not whether SupTech should be utilised to improve culture risk governance and supervision. It already is, and supervisors will continue to develop new capabilities in this direction. Rather, the risk lies in doing so without systematic ethical safeguards, because the consequences extend beyond misclassifying a firm’s risk profile.
Algorithmic models learn from historical data that often reflects inequality, structural bias, and past misjudgements. Left unchecked, such models can perpetuate and amplify those biases, reinforcing discriminatory patterns in risk assessment and resource allocation rather than correcting them, and eroding both fairness and trust in regulatory judgement over time.
In practice, biased models in financial decision-making have been shown to compound inequities and disadvantage particular groups, precisely because the systems replicate patterns that were never neutral in the first place. When behavioural and risk models embed historical bias or opaque assumptions, their use at scale can misallocate supervisory attention and capital, reinforcing correlated behaviour across institutions and creating systemic vulnerabilities that ultimately threaten financial stability and consumer trust.
Centering ethics in innovation questions is about ensuring that increasingly powerful tools improve the quality of supervision, instead of becoming a new source of fragility. The early stage of SupTech in this domain of culture risk governance and supervision offers a narrow window to embed ethical safeguards before practices harden and become difficult to reverse. Let’s lead by example.
Join The Discussion
Sign in and be the first to comment.