Ethics, Conduct, Sustainability and the Future of Risk

Introduction

Investment banking risk management is no longer confined to market, credit, liquidity and operational losses. A bank may be legally solvent yet suffer severe damage because employees manipulate a benchmark, misuse confidential information, mis-sell a complex product, conceal a conflict, or make unsupported sustainability claims. Conduct failures can generate fines, litigation, remediation costs, loss of clients, regulatory restrictions and long-term damage to the institution’s licence to operate.

Contemporary risk management therefore combines financial measurement with ethical judgement, professional accountability and an understanding of social and environmental dependencies. Climate change, biodiversity loss, geopolitical fragmentation, artificial intelligence, digital assets and quantum computing are changing both the sources of risk and the tools available to manage them.

This chapter examines how an investment bank should identify, govern and control these risks. It treats ethics not as an abstract personal virtue but as an element of enterprise risk management, internal control and institutional resilience.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain conflicts of interest, insider information, market abuse, suitability and misconduct risks.
2. Design practical controls for information barriers, surveillance, client classification and accountability.
3. Distinguish legal compliance from ethical conduct and sound risk culture.
4. Integrate climate, environmental, social and governance (ESG) factors into investment-banking risk assessment.
5. Evaluate geopolitical, digital-asset, decentralised-finance, tokenisation and quantum-computing risks.
6. Critically assess evolving regulatory expectations and propose proportionate governance responses.

1. Ethics and conduct as risk disciplines

1.1 Compliance, ethics and culture

Compliance asks whether conduct meets applicable law, regulation and internal policy. Ethics asks whether conduct is fair, honest, responsible and defensible even where a rule is incomplete or ambiguous. Culture concerns the shared behaviours and incentives that determine what employees actually do when supervision is limited.

A rules-only approach is inadequate because financial markets evolve faster than legislation. For example, a transaction may technically satisfy disclosure requirements while being structured to exploit a client’s lack of understanding. A strong conduct framework therefore combines:

• clear standards and professional principles;
• effective supervision and challenge;
• incentives that do not reward harmful behaviour;
• reliable escalation and whistleblowing channels;
• consequences for misconduct, including for senior staff; and
• continuous learning from incidents and near misses.

The board is responsible for setting the tone, but accountability must extend through the three lines of defence. The first line—front-office and business management—owns risks arising from its activities. The second line—risk and compliance—sets standards, advises and challenges. The third line—internal audit—provides independent assurance.

1.2 The ethical decision test

When a proposed action is uncertain, professionals should ask:

1. Is it lawful and consistent with policy?
2. Is the relevant information being disclosed to affected parties?
3. Would the decision remain defensible if reported publicly?
4. Does it treat the client and market fairly?
5. Who benefits, who bears the risk, and is that distribution justified?
6. Can the bank evidence the reasoning, approvals and controls?

These questions do not replace legal advice. They help identify conduct risk before it becomes a regulatory breach.

2. Conflicts of interest and information governance

2.1 Types of conflict

A conflict exists when an interest, relationship or duty may improperly influence a professional decision. In investment banking, conflicts commonly arise between:

• underwriting and research, where investment-banking fees may influence analyst independence;
• a bank’s proprietary position and a client order;
• two clients competing in an acquisition or financing;
• employees’ personal investments and client transactions;
• issuer fees and the objective assessment of securities;
• lending, advisory and restructuring interests;
• remuneration targets and client suitability; and
• environmental or social commitments and revenue opportunities.

Conflicts may be actual, potential or perceived. Perceived conflicts matter because confidence in market integrity can be damaged even where no improper act occurred.

2.2 Conflict-management hierarchy

The preferred sequence is avoidance, prevention, disclosure, informed consent and, where necessary, withdrawal. Disclosure alone is not always sufficient. A client may not understand the significance of a conflict, or the conflict may be so severe that consent cannot make the activity fair.

A conflict inventory should record the source of conflict, affected parties, materiality, owner, control, disclosure requirement, review date and residual risk. Controls can include independent committees, restricted lists, deal teams, recusal, allocation rules, supervisory approval and separation of duties.

2.3 Information barriers

Information barriers restrict the movement of confidential or price-sensitive information between units. They require more than physical separation. Effective barriers include:

• need-to-know access rights;
• secure deal rooms and monitored communications;
• restricted and watch lists;
• separation of research, sales, trading and advisory functions where appropriate;
• pre-clearance of personal transactions;
• training and attestations; and
• surveillance capable of detecting unusual trading before and after announcements.

Barriers must be flexible enough to permit legitimate information flow for risk management, legal review and senior oversight. Each permitted crossing should be documented, authorised and time-limited.

3. Insider information and market abuse

3.1 Inside information

Inside information is generally non-public information that is sufficiently precise and likely to have a material effect on the price of a financial instrument or related asset. Examples include an unpublished takeover, earnings surprise, major refinancing, regulatory decision or credit deterioration.

The core prohibitions usually include dealing, recommending or inducing another person to deal, and unlawful disclosure. The exact legal tests differ by jurisdiction, so firms must map policies to each relevant market.

Possession alone may not always establish a breach, but it creates a control obligation. Employees who receive such information should stop relevant trading, protect confidentiality, notify compliance and follow restricted-list procedures.

3.2 Market abuse

Market abuse includes insider dealing, unlawful disclosure, manipulation and misleading conduct. Manipulation can involve false orders, wash trades, spoofing, marking the close, dissemination of misleading information or transactions designed to create an artificial price or volume.

A modern surveillance programme combines trade data, orders, communications, news and reference data. Detection models are useful but generate false positives; human investigation and contextual judgement remain essential. The bank should preserve an auditable trail from alert generation to closure.

3.3 Research and communications

Analysts and bankers must distinguish fact, estimate, opinion and promotional language. Communications should not imply certainty where outcomes are uncertain. Selective disclosure to favoured clients, inappropriate “wall crossings”, and informal messaging channels create serious evidential and supervisory risks. Record retention must cover approved communication channels and be proportionate to the firm’s obligations.

4. Client suitability, appropriateness and fair dealing

Suitability concerns whether a recommendation or managed investment is appropriate for a particular client, considering objectives, risk tolerance, financial capacity, knowledge and experience. Appropriateness commonly concerns whether a client understands the risks of a product when the firm is not providing a full suitability recommendation. The terminology and obligations vary across regulatory systems.

A robust client assessment should consider:

• investment horizon and liquidity needs;
• loss-bearing capacity, not merely stated risk appetite;
• concentration and correlation with existing exposures;
• leverage, optionality and complexity;
• tax, legal and fiduciary constraints;
• sustainability preferences where relevant; and
• the client’s ability to understand scenario outcomes.

Product governance should define the target market, excluded clients, distribution strategy, stress scenarios, fees, conflicts and review triggers. A product can be profitable and legally permitted yet unsuitable for a particular customer.

Worked application: leveraged note

Suppose a client with a short-term liquidity need is offered a note linked to an equity index. The note promises enhanced income but includes leverage, limited secondary-market liquidity and principal loss if the index falls beyond a barrier. A suitability analysis should not focus only on the client’s income objective. It must examine whether the client can bear the barrier loss, understand path dependence, tolerate illiquidity and survive the stressed outcome. If the client cannot, the bank should not recommend the product, even if the client signs a generic risk disclosure.

5. Misconduct, accountability and risk culture

Misconduct includes bribery, corruption, fraud, improper gifts, harassment, retaliation, mis-selling, manipulation, unauthorised trading and concealment of errors. It can be intentional or result from reckless disregard, weak supervision or unrealistic targets.

Accountability mechanisms should include:

• clearly allocated responsibilities and decision rights;
• senior-manager statements of responsibility where required;
• conduct-risk metrics in performance reviews;
• remuneration deferral, malus and clawback arrangements;
• protected whistleblowing and non-retaliation policies;
• investigation protocols preserving independence and evidence; and
• root-cause analysis rather than punishment of only the final actor.

A useful distinction is between individual blame and system accountability. An employee may breach policy, but management may also have created conditions in which misconduct was likely—for example, unattainable sales targets, inadequate staffing or tolerance of repeated control exceptions.

Quantitative indicators can support judgement. A conduct-event rate may be expressed as:

The rate has no universal benchmark. Its interpretation depends on reporting quality, business mix and whether increased reporting reflects improved speak-up culture rather than worsening behaviour. Metrics must therefore be combined with qualitative evidence.

6. Climate and ESG risk in investment banking

6.1 From ethical concern to financial risk

Climate and ESG factors become financial risks when they affect cash flows, asset values, funding, counterparties, collateral, legal liabilities or reputation. Climate risk is often divided into:

• physical risk: acute events such as floods and storms, and chronic changes such as heat or sea-level rise;
• transition risk: policy, technology, market and consumer changes during decarbonisation; and
• liability risk: claims arising from alleged harm, inadequate disclosure or failure to meet duties.

ESG is broader. Environmental issues include pollution, water and biodiversity. Social issues include labour standards, human rights and community impact. Governance includes board quality, corruption controls, ownership rights and executive incentives.

6.2 Transmission channels

For an investment bank, ESG risks may enter through lending, underwriting, mergers and acquisitions, trading, collateral, asset management and supply chains. A carbon-intensive borrower may face higher costs, stranded assets or refinancing difficulty. A project may face delay because of community opposition. A misleading sustainability claim may trigger litigation and reputational loss.

Scenario analysis is more appropriate than relying solely on historical data because climate conditions and policy regimes are changing. A simplified expected-loss relationship is:

Here probability of default is dimensionless, loss given default is the proportion of exposure lost, and exposure at default is a monetary amount. ESG factors should inform each component rather than being treated as an automatically additive “ESG premium.” The formula is a simplified credit-risk identity and does not capture all market, liquidity, migration or model risks.

6.3 Greenwashing and sustainability claims

Greenwashing occurs when communications create a misleading impression about environmental or social characteristics. Controls should include evidence standards, defined taxonomies, product-level claim approval, data lineage, independent review and ongoing monitoring. Claims should distinguish ambition, target, methodology and achieved result. A financed-emissions estimate is not the same as a direct operational-emissions measure, and neither should be presented without boundaries and assumptions.

6.4 Limitations of ESG data

ESG ratings may disagree because providers use different scopes, weights, estimates and objectives. Private-company data may be incomplete, while historical emissions may not predict transition readiness. Banks should document data gaps, use conservative assumptions, apply sensitivity analysis and avoid false precision.

7. Geopolitical risk and systemic interdependence

Geopolitical risk includes war, sanctions, export controls, political instability, election-driven policy change, trade fragmentation, cyber conflict and state intervention. Its effects may include market gaps, payment disruption, asset seizure, counterparty default, supply shortages and forced divestment.

A practical framework maps four dimensions:

1. Exposure: countries, currencies, clients, assets, suppliers and critical infrastructure.
2. Transmission: market, credit, liquidity, operational, legal and reputational channels.
3. Time horizon: immediate shock, medium-term adjustment and structural realignment.
4. Control capacity: hedging, exit options, collateral, diversification and contingency funding.

Scenario analysis should test correlated effects rather than isolated variables. For example, sanctions may simultaneously reduce a client’s revenue, impair settlement, increase margin requirements and make collateral difficult to realise. Reverse stress testing asks what combination of events could threaten the firm’s viability and whether management could respond in time.

8. Digital assets, DeFi and tokenisation

8.1 Digital assets

Digital assets introduce risks beyond conventional securities: private-key loss, custody failure, smart-contract bugs, oracle manipulation, fragmented liquidity, pseudonymous transactions and uncertain legal classification. Market prices can be highly volatile, and settlement may depend on infrastructure outside the bank’s control.

Controls include segregation of client assets, wallet governance, multi-party authorisation, transaction limits, chain analytics, incident response, sanctions screening, code review and clear disclosure of irreversibility and recovery limitations.

8.2 Decentralised finance

DeFi protocols may automate lending, trading and collateral management through smart contracts, but “decentralised” does not mean risk-free or without accountability. Governance-token holders, developers, interfaces, validators and liquidity providers may each influence outcomes. Risks include protocol exploits, oracle failure, governance capture, liquidity spirals and regulatory uncertainty.

Due diligence should examine the code, audit quality, upgrade keys, concentration of governance, economic incentives, dependency on external protocols and emergency controls. A bank must also determine which legal entity or responsible function owns the relationship.

8.3 Tokenisation

Tokenisation represents rights to an asset or claim through a digital token. Benefits may include fractional ownership, programmable settlement and improved transparency. It does not automatically eliminate legal, credit or liquidity risk. The underlying asset, redemption obligation, transfer restrictions, custody arrangement and insolvency treatment remain critical.

A tokenised bond, for example, still exposes investors to issuer default and interest-rate risk. The distributed ledger may improve recordkeeping while introducing technology concentration and operational dependencies.

9. Artificial intelligence and quantum computing

AI can improve surveillance, document review, scenario generation and anomaly detection. It can also create bias, explainability problems, privacy breaches, model drift, fabricated outputs and uncontrolled automated decision-making. Governance should require approved use cases, data controls, validation, human oversight, access restrictions, testing for discriminatory outcomes and clear accountability for decisions.

Quantum computing is not presently a routine replacement for conventional banking systems, but it has strategic implications. A sufficiently capable quantum computer could threaten some widely used public-key cryptographic systems. “Harvest now, decrypt later” attacks involve collecting encrypted information today for possible decryption in the future. Banks should inventory cryptographic dependencies, classify data by confidentiality lifetime, monitor post-quantum standards and develop migration plans. Quantum technologies may also eventually support optimisation or simulation, but claims should be distinguished from demonstrated production capability.

10. Regulatory expectations and future risk governance

Regulation is increasingly outcome-oriented. Supervisors expect firms to demonstrate—not merely declare—that they understand their exposures, manage conflicts, protect clients, preserve records, oversee models and allocate responsibility. Common expectations include:

• risk-based proportionality;
• documented board challenge;
• credible data and model governance;
• operational resilience and third-party oversight;
• climate and sustainability disclosures supported by evidence;
• surveillance of electronic communications and trading;
• effective remediation and lessons learned; and
• rapid notification of material incidents.

Global firms face overlapping and sometimes inconsistent regimes. The solution is not to select the lowest standard, but to establish a global control baseline and add jurisdiction-specific requirements. Regulatory change management should identify obligations, owners, implementation dates, evidence and residual gaps.

Integrated case study: Project Northstar

The following is an illustrative case.

Background

Northstar Bank advises a technology company on a takeover, arranges a sustainability-linked loan for an energy client and permits selected institutional customers to trade tokenised private-credit interests. The same senior banker has relationships with both companies and receives a bonus linked to transaction completion.

Problem

During negotiations, the banker learns that the technology company is likely to announce a major contract. A colleague in sales asks whether the bank should increase exposure to the company’s shares. At the same time, the energy client’s sustainability-linked margin adjustment depends on emissions data supplied by an unaudited affiliate. The tokenised-credit platform experiences an oracle failure, causing temporary under-collateralisation.

Analysis

The takeover and contract information may be inside information. The banker’s dual relationships create conflicts, and the bonus creates an incentive risk. The emissions data creates greenwashing and credit-model uncertainty. The oracle event creates operational, valuation and client-asset risks. These are interconnected: reputational damage from one failure could reduce confidence in the others.

Approach and solution

The bank should wall-cross relevant personnel, place securities on a restricted list, stop personal and proprietary trading, and document all permitted information sharing. An independent deal team should manage the conflict, while remuneration governance reviews the bonus arrangement. The sustainability-linked loan should include verification, fallback calculations and a right to suspend the sustainability adjustment if data is unreliable. Tokenised assets should be valued conservatively, withdrawals assessed, and the platform’s emergency controls activated. Clients and regulators should receive accurate, timely communication.

Outcome

The bank avoids trading on confidential information, corrects the sustainability metric before certification and limits client losses through pre-agreed suspension procedures. It nevertheless identifies weaknesses in incentive design, third-party due diligence and cross-business escalation.

Learning points

Conduct risk is rarely isolated. Information governance, remuneration, ESG data, technology resilience and client protection must be assessed as one control system. A documented decision trail is essential to demonstrate accountability.

Challenges and limitations

No framework eliminates judgement. Conflicts may be hidden, clients may provide incomplete information, and surveillance can miss novel manipulation. ESG data remains inconsistent, geopolitical scenarios are uncertain, and emerging technologies evolve faster than internal policies. Excessive controls can also impede legitimate business, encourage workarounds or exclude responsible innovation.

The appropriate response is proportional governance: clear risk appetite, credible escalation, tested controls, independent challenge and periodic reassessment. Boards should avoid treating zero incidents as proof of zero risk; silence may indicate under-reporting.

Best-practice checklist

An investment bank should:

• maintain a live conflict and information inventory;
• apply need-to-know access and monitor restricted activity;
• test suitability using stressed and liquidity-sensitive outcomes;
• align remuneration with long-term conduct and risk outcomes;
• protect whistleblowers and investigate root causes;
• integrate climate and ESG factors into credit, market and operational processes;
• challenge sustainability claims and document data provenance;
• run geopolitical and reverse stress scenarios;
• govern digital assets through custody, code, liquidity and legal controls;
• inventory AI and cryptographic dependencies; and
• preserve evidence demonstrating who decided, challenged and approved each material action.

Chapter Summary

Ethics and conduct are core components of investment-banking risk management. Conflicts must be identified and managed through avoidance, segregation, disclosure and independent challenge. Insider information and market abuse controls require information barriers, restricted lists, surveillance and disciplined communications. Suitability depends on client capacity, objectives, knowledge, liquidity and product complexity; disclosures cannot cure every unsuitable recommendation.

Misconduct is shaped by incentives, supervision and culture, so accountability must extend beyond individual employees to management systems. Climate and ESG factors create financial risks through physical, transition, liability and reputational channels, but data limitations require scenario analysis and transparent assumptions. Geopolitical shocks can transmit simultaneously through market, credit, liquidity, operational and legal channels.

Digital assets, DeFi and tokenisation offer potential efficiency while introducing custody, code, governance, valuation and legal risks. AI can strengthen controls but requires human accountability and model governance. Quantum computing creates a long-term cryptographic-transition issue. Future-ready risk governance therefore combines ethical judgement, evidence-based controls, technological awareness, regulatory adaptability and an organisational culture willing to challenge profitable but unsafe conduct.

Key Terms

Conflict of interest: A situation in which competing interests or duties may improperly influence judgement.

Conduct risk: The risk that behaviour causes unfair client outcomes, market harm or damage to integrity.

Inside information: Precise, non-public information likely to materially affect a financial instrument’s price.

Market abuse: Illegal or improper conduct such as insider dealing, manipulation or unlawful disclosure.

Information barrier: A control restricting confidential information to authorised persons.

Suitability: Assessment of whether a recommendation fits a client’s circumstances and objectives.

Appropriateness: Assessment of whether a client can understand the risks of a product or service.

Greenwashing: Misleading representation of environmental or sustainability characteristics.

Physical climate risk: Financial risk arising from acute or chronic climate effects.

Transition risk: Financial risk arising from changes toward a lower-carbon economy.

Liability risk: Risk of legal claims arising from harm, misstatement or failure of duty.

ESG data lineage: The documented origin, transformation and use of ESG information.

Geopolitical risk: Risk arising from political conflict, state action or international instability.

Digital asset: A digitally represented value or right transferred or stored electronically.

Decentralised finance: Financial activity conducted through software protocols rather than conventional intermediaries.

Tokenisation: Digital representation of an asset, claim or right through a token.

Model risk: Risk that a model is unsuitable, incorrectly implemented or misused.

Operational resilience: The ability to continue important services during disruption.

Post-quantum cryptography: Cryptographic methods designed to resist future quantum attacks.

Whistleblowing: Reporting suspected wrongdoing through protected internal or external channels.

Review Questions

Short Answer Questions

1. Why is disclosure alone sometimes insufficient to manage a conflict of interest?
2. What is the purpose of an information barrier?
3. Distinguish physical climate risk from transition risk.
4. Identify two risks specific to digital assets.
5. Why should conduct metrics be interpreted alongside qualitative evidence?

Long Answer Questions

1. Explain how an investment bank can build an effective conduct-risk framework across the three lines of defence.
2. Discuss the relationship between client suitability, product governance and remuneration incentives.
3. Analyse how climate and ESG risks can affect credit, market, operational and reputational risk.
4. Evaluate the governance challenges created by decentralised finance and tokenisation.
5. Explain why geopolitical risk requires correlated scenario analysis and reverse stress testing.

Analytical / Application Questions

1. A banker advising two competing acquisition clients receives confidential information about one client’s earnings collapse. Design the immediate control and escalation response.
2. A bank wants to market a bond as “green” using estimated emissions data from an unaudited supplier. Identify the principal risks and propose evidence and governance requirements.
3. A tokenised private-credit platform suffers an oracle failure during a market decline. Assess the implications for valuation, collateral, liquidity, client protection and regulatory reporting.

Multiple Choice Questions with Answers

Question 1

Which response is generally the strongest first step when a material conflict of interest cannot be managed fairly?

A. Disclose it after the transaction

B. Avoid or withdraw from the conflicted activity

C. Increase the employee’s bonus

D. Rely on a generic disclaimer

Correct Answer: B. Avoid or withdraw from the conflicted activity

Question 2

Which activity most directly indicates possible insider dealing?

A. Trading after a public announcement

B. Trading after receiving material non-public takeover information

C. Diversifying a portfolio quarterly

D. Buying an index fund under a standing instruction

Correct Answer: B. Trading after receiving material non-public takeover information

Question 3

A client needs short-term liquidity but is offered a highly leveraged, illiquid note. Which suitability factor is most concerning?

A. The client’s office location

B. The product’s complexity and potential loss relative to liquidity needs

C. The bank’s brand colour

D. The number of pages in the prospectus alone

Correct Answer: B. The product’s complexity and potential loss relative to liquidity needs

Question 4

Which is an example of transition risk?

A. A flood damaging a factory

B. A cyclone interrupting settlement operations

C. A carbon tax reducing the value of a carbon-intensive asset

D. A database outage caused by hardware failure

Correct Answer: C. A carbon tax reducing the value of a carbon-intensive asset

Question 5

Why may ESG ratings for the same issuer differ substantially?

A. All providers use an identical methodology

B. Providers use different scopes, weights, data and objectives

C. ESG ratings measure only share price momentum

D. Ratings are determined solely by government tax rates

Correct Answer: B. Providers use different scopes, weights, data and objectives

Question 6

Which control is most relevant to detecting spoofing?

A. Monitoring orders and trading patterns with contextual investigation

B. Annual office fire drills only

C. Limiting holiday entitlement

D. Replacing all client disclosures with advertisements

Correct Answer: A. Monitoring orders and trading patterns with contextual investigation

Question 7

Which statement about tokenisation is correct?

A. It eliminates issuer default risk

B. It automatically guarantees liquidity

C. It digitally represents an asset or claim but does not remove underlying risks

D. It makes legal ownership irrelevant

Correct Answer: C. It digitally represents an asset or claim but does not remove underlying risks

Question 8

What is a principal governance risk of decentralised finance?

A. There can never be software vulnerabilities

B. Oracle manipulation or smart-contract failure can transmit losses automatically

C. All transactions are guaranteed by a central bank

D. Liquidity is always constant

Correct Answer: B. Oracle manipulation or smart-contract failure can transmit losses automatically

Question 9

Which formula represents the simplified expected-loss relationship discussed in the chapter?

A. Expected loss = Probability of default × Loss given default × Exposure at default

B. Expected loss = Revenue + Assets + Equity

C. Expected loss = Volatility ÷ Temperature

D. Expected loss = Tax rate − Inflation rate

Correct Answer: A. Expected loss = Probability of default × Loss given default × Exposure at default

Question 10

Why should banks begin preparing for post-quantum cryptography?

A. Quantum computers already replace every banking system

B. Future quantum capabilities may threaten some current public-key encryption

C. It eliminates the need for access controls

D. It guarantees that digital assets cannot lose value

Correct Answer: B. Future quantum capabilities may threaten some current public-key encryption