LabHub

Blog

Securities Risk Management and Compliance: The Job of Controlling Speed

2026-05-27 · 19 min read · #finance-career#risk-management#compliance#internal-control#securities-career

한국어English日本語

Who's this for

This article is for candidates preparing for risk management, compliance, internal control, operational risk, and credit risk roles at securities firms. Rather than memorising buzzwords from job descriptions, we focus on translating those words into actual deliverables — VaR reports, ECL calculations, limit-breach alerts, SAR filings. JD lines like "monitor market risk", "support Basel III implementation", and "detect insider trading" mean specific Excel workbooks, SQL queries, and meetings; we map them out. It is also for people aiming at FRM or CFA who want to see where the credential leads, and for those eyeing a move toward the FSS, KRX, SESC, or SEC.

Why risk and compliance is "the job of control"

If other desks at a securities firm make money, risk and compliance keep money from leaking out. A trader can make or lose USD 1M in a second. A private banker manages client assets but is one conflict of interest away from blowing up the firm. An IB banker closes huge deals but one filing error can trigger massive litigation. Control teams sit behind all of them, designing limits, procedures, evidence trails, and reports.

The word "control" can sound bureaucratic, but it is the last seatbelt that keeps the firm alive. Barings Bank lost 233 years of history because of one Nick Leeson in 1995. MF Global collapsed in 2011 betting on European sovereign debt. Archegos lost USD 10B in days in March 2021. All three are stories of failed limit management and broken controls. Risk and compliance professionals exist so that these events do not happen at your firm.

The four risks: Market / Credit / Operational / Liquidity

The four-way split mirrors the Basel taxonomy. Each has different measurement tools and different control levers.

When asked "explain the four risks" in an interview, pair the definition with an example. Definitions alone read like a textbook; pairing them with concrete events makes it clear you have seen the trading floor.

Market Risk: VaR (Historical/Parametric/MC), Expected Shortfall, FRTB

The headline market-risk metric is VaR. "Tomorrow, with 95% probability, losses will not exceed X." Three measurement methods exist.

VaR's weakness is that it ignores everything beyond the cut-off. That is why Expected Shortfall (ES, CVaR) — the average loss conditional on exceeding the 95% VaR — sits next to it. Basel's FRTB (Fundamental Review of the Trading Book), effective from 2023, switched the standardised market-risk metric from VaR to ES and introduced asset-class-specific liquidity horizons. Korea is phasing it in from 2025.

In practice the desk watches daily VaR limits, monthly ES limits, and stressed VaR for crisis scenarios. When a limit breaks, the risk team asks the trader to reduce the position or add a hedge.

Credit Risk: PD/LGD/EAD, IFRS 9 Stage 1/2/3, Basel III/IV

Credit risk is decomposed into three parameters.

ECL (Expected Credit Loss) = PD x LGD x EAD. This is the heart of IFRS 9.

IFRS 9 splits assets into three Stages.

Basel III/IV requires a CAR above 8%. RWA is computed via standardised approach or IRB (Internal Ratings-Based). Basel IV imposed an output floor capping IRB at 72.5% of standardised RWA. Korea adopted Basel IV from 2023; Japan is phasing in from 2024.

Operational + Liquidity Risk: KRI, RCSA + LCR + NSFR

Operational risk is about reading signals before incidents happen.

Liquidity risk has two Basel III ratios.

Securities firms rely more on short-term repo, call money, and CP than banks, so liquidity crises arrive faster. US broker-dealers in March 2020 wrestled with money-market fund redemptions and their LCRs wobbled.

A real day: 7am to 9am Risk Committee to 11am stress test to 2pm trade review to 4pm reg report

An ordinary day for a risk or compliance professional looks like this.

Firms differ in detail but the cycle of monitor, committee, scenario, review, report repeats everywhere.

Compliance: KYC/eKYC/AML/CTR/SAR/Sanctions/Market Surveillance

Compliance is not the team that blocks trades. It is the team that ensures trades happen lawfully and ethically.

KYC is one-time at onboarding; ongoing monitoring lasts forever. If a customer's transactions stop matching the income or occupation declared at onboarding, an alert fires.

Regulatory frameworks: Basel III/IV, MiFID II, Dodd-Frank, Volcker, FATCA, CRS

Major frameworks global securities firms must navigate.

These rules cannot be ignored "because we are local". A US person opening a Korean brokerage account triggers FATCA; an EU resident buying a Korean ETF triggers parts of MiFID II. Global IBs sit on top of four or five regimes at once.

Korea (FSS/FSC/KOFIU/KRX), Japan (SESC/FSA/JPX), Global (SEC/FINRA/FCA)

Korea:

Japan:

Global:

If you can name three regulators relevant to your target role, you are above the median candidate.

Internal control (COSO / SOX / K-SOX / J-SOX / Three Lines of Defense)

COSO ERM is the de facto framework for internal control. Five components: control environment, risk assessment, control activities, information and communication, monitoring.

SOX (Sarbanes-Oxley Act) was passed in 2002 after Enron. Section 404 requires management to assess internal control effectiveness, with auditor attestation. Korea has K-SOX through the External Audit Act. Japan has J-SOX through the Financial Instruments and Exchange Act.

Three Lines of Defense:

Explaining this model in an interview answers "why are controls split across so many teams?" cleanly.

Tools stack: Bloomberg PORT, MSCI RiskMetrics, Numerix, Murex, NICE Actimize

Tools frequently used by risk and compliance teams.

You do not need to know every tool as a graduate, but interviewers do ask about Bloomberg and SQL.

Failures: Barings, MF Global, SocGen Kerviel, Archegos, Optimus/Lime

Classic case studies of control failure.

Interviewers love "pick a recent risk event and analyse it". Archegos remains a strong choice because it touches counterparty, concentration, and TRS in one story.

KPIs: RWA, CAR, VaR limit breach, compliance training, incident count

Risk and compliance KPIs vary, but the common ones are:

KPIs shape behaviour. Too strict and the business is choked; too loose and incidents slip.

Interview questions (the scariest risk, five KRIs, your take on Archegos)

These are not memorisation questions. Interviewers are watching your thinking structure: one-sentence conclusion, two or three supporting points, one practical application.

Salary: Korea KRW 50-70M new grad to KRW 150M+, Japan JPY 7-13M, US $150K-180K

Approximate. Wide variance by firm and seniority.

Japan:

US:

London, Hong Kong, and Singapore sit near US levels or slightly below. Quant risk roles tend to earn a higher bonus mix than compliance.

Career path: Risk Analyst to Senior to VP to Director to CRO

Typical trajectory.

Alternative paths:

Risk and compliance careers travel well within finance. Data, regulation, and product knowledge survive firm changes.

Certifications: FRM, CFA, PRM, CAIA, CIA, CAMS

Recommended order.

For graduates, start with FRM Part 1 or the Korean Investment Asset Manager. Both are doable in six months and signal commitment in interviews.

90-day learning routine

The goal is not to finish all reading but to produce answers in your own words. One deliverable per week (a written analysis, an Excel, or a chart) leaves you with twelve pieces of evidence in 90 days.

References

# VaR calculation example
# Historical VaR and Monte Carlo VaR

import numpy as np
import pandas as pd

# Assume 5 years of KOSPI200 daily returns (1,250 trading days)
np.random.seed(42)
returns = np.random.normal(0.0005, 0.015, 1250)  # mean 0.05%, std 1.5%
portfolio_value = 10_000_000_000  # KRW 10B

# 1. Historical VaR (95% 1-day)
sorted_returns = np.sort(returns)
percentile_5 = sorted_returns[int(0.05 * len(sorted_returns))]
historical_var = -percentile_5 * portfolio_value
print(f"Historical 1-day 95% VaR: {historical_var:,.0f} KRW")

# 2. Expected Shortfall (CVaR)
tail_returns = sorted_returns[:int(0.05 * len(sorted_returns))]
expected_shortfall = -np.mean(tail_returns) * portfolio_value
print(f"95% Expected Shortfall: {expected_shortfall:,.0f} KRW")

# 3. Monte Carlo VaR (normal distribution assumed)
mu = np.mean(returns)
sigma = np.std(returns)
n_simulations = 100_000
mc_returns = np.random.normal(mu, sigma, n_simulations)
mc_var = -np.percentile(mc_returns, 5) * portfolio_value
print(f"Monte Carlo 1-day 95% VaR: {mc_var:,.0f} KRW")

# IFRS 9 ECL example
# Expected Credit Loss = PD x LGD x EAD

import pandas as pd

# Bond portfolio
portfolio = pd.DataFrame({
    "bond_id": ["B001", "B002", "B003", "B004"],
    "rating": ["AAA", "BBB", "BB", "B"],
    "pd_1y": [0.0002, 0.003, 0.015, 0.05],   # 1-year PD
    "lgd": [0.45, 0.60, 0.70, 0.75],          # loss given default
    "ead": [10_000_000_000, 5_000_000_000, 2_000_000_000, 1_000_000_000],
    "stage": [1, 1, 2, 3],                     # IFRS 9 Stage
})

# ECL by Stage
# Stage 1: 12-month ECL
# Stage 2/3: Lifetime ECL (assume 3 years)
def calc_ecl(row):
    if row["stage"] == 1:
        return row["pd_1y"] * row["lgd"] * row["ead"]
    else:
        # Simplified: 3-year cumulative PD = 1 - (1 - PD_1y)^3
        pd_lifetime = 1 - (1 - row["pd_1y"]) ** 3
        return pd_lifetime * row["lgd"] * row["ead"]

portfolio["ecl"] = portfolio.apply(calc_ecl, axis=1)
print(portfolio)
print(f"Total ECL: {portfolio['ecl'].sum():,.0f} KRW")

-- Limit breach detection query
-- Compare daily trading limits against actual trades

WITH daily_position AS (
    SELECT
        trader_id,
        trade_date,
        instrument_type,
        SUM(notional_amount) AS gross_notional,
        SUM(CASE WHEN side = 'BUY' THEN notional_amount ELSE -notional_amount END) AS net_notional
    FROM trades
    WHERE trade_date = CURRENT_DATE
    GROUP BY trader_id, trade_date, instrument_type
),
limits AS (
    SELECT trader_id, instrument_type, daily_limit
    FROM trader_limits
    WHERE effective_date <= CURRENT_DATE
      AND (expiry_date IS NULL OR expiry_date > CURRENT_DATE)
)
SELECT
    p.trader_id,
    p.instrument_type,
    p.gross_notional,
    l.daily_limit,
    ROUND(p.gross_notional / l.daily_limit * 100, 2) AS utilization_pct,
    CASE
        WHEN p.gross_notional > l.daily_limit THEN 'BREACH'
        WHEN p.gross_notional > l.daily_limit * 0.9 THEN 'WARNING'
        ELSE 'OK'
    END AS status
FROM daily_position p
JOIN limits l
  ON p.trader_id = l.trader_id
 AND p.instrument_type = l.instrument_type
WHERE p.gross_notional > l.daily_limit * 0.8
ORDER BY utilization_pct DESC;

References:

Comments

No comments yet.

Sign in to leave a comment