Beyond the black box: Flood risk, regulation, and the future of capital markets

In March 2026, Fathom gathered senior leaders from risk, banking, and climate analytics to examine a pressing question for financial institutions: how should capital markets respond when flood risk becomes both financially material and regulatorily unavoidable?

Featuring commentary from:

• Jo Paisley, President, GARP Risk Institute
• Nicolas Fournier, Climate Scientist, HSBC
• Katie Towey, Senior Associate, MSCI Research & Development
• Dr Oliver Wing, Chief Scientific & Product Officer, Fathom

Key topics discussed

• Climate risk is no longer just a tick-box exercise
• Why modeling flood risk is difficult, but unavoidable
• Clarity and the challenges for financial institutions
• Are black-box models a liability?
• The problem of using open-source data for granular assessment
• Why material risk is not always visible
• How do banks navigate the current landscape?

For years, climate risk was treated largely as a capability-building exercise: scenario analysis was conducted, disclosures expanded, and frameworks were developed, but with limited impact on day-to-day financial decision-making. That era is ending. As flood losses rise and increasingly spill from insurance markets into lending, investment, and asset valuation, physical risk is becoming materially relevant to capital markets. At the same time, regulatory measures such as the UK’s SS5/25 are accelerating the shift, requiring banks to demonstrate that physical climate risk is embedded meaningfully within governance and decision processes.

A decade ago, few banks addressed climate risk in a systematic way and where they did, it was often approached as an exploratory or experimental exercise. More recently, regulatory requirements have become much more demanding and more prescriptive, with a need for climate risk to be meaningful and embedded in the bank’s decision making.

Regulators are expecting banks to not only be using a flood model, but can actually explain the limitations, defend the outputs, and ultimately trust it when making decisions. They are moving from, ‘are you doing something?’ to, ‘are you doing something that you can genuinely trust?’.

“(The regulators) need to make sure this doesn’t turn into some enormous compliance exercise… It needs to be genuinely about risk management.”

— Jo Paisley, GARP

Live polling from our audience of financial institutions and industry stakeholders revealed how uneven that transition still is in practice:

How prepared is your organization for regulatory changes (such as SS5/25 in the UK) in 2026?

Webinar polling reveals a readiness gap where, despite having the data, the majority of institutions remain stalled at the operational integration phase with none yet achieving full compliance for 2026.

For banks, physical climate risk is a relatively new and unfamiliar discipline compared with the insurance sector, where catastrophe risk has long been embedded in underwriting and pricing models. Flood, in particular, is one of the most important and difficult to model but heat, wildfire and other perils are also increasingly driving losses.

Panelist Nicolas Fournier, Climate Scientist at HSBC believes it’s very clear what the bank has to achieve. Flood is a very serious peril at a global level, it’s also very difficult to model, which is why the PRA places so much emphasis on it. One big issue is how models represent uncertainty, future climate projections and the data dispersion spread among the service providers, as highlighted in the GARP Report for the CFRF. Banks, according to Fournier, must use sound decision making, and show their workings.

When it comes to size, the speakers raised concerns that smaller banks that are regionally constrained and concentrated could have their solvency jeopardized, whereas the larger banks are able to pivot out of high-risk regions.

Another critical challenge is granularity. Portfolio-level assessments often obscure material exposures because many companies operate globally, with assets, supply chains, and revenue streams distributed far beyond their headquarters location. Looking only at country or regional averages can therefore create a false sense of security. Since “all flooding is local,” asset-level precision and accurate high resolution data is the only way to identify hidden “hot spots” within a portfolio.

One of the sharpest points of tension in 2026 is the demand for model transparency,  particularly about uncertainty. Opaque black box models are increasingly viewed as a liability, with Oliver Wing (Fathom) suggesting recent supervision might even render them practically unusable for banking use cases. 

If institutions cannot see under the hood of a model, they cannot properly assess whether its outputs are fit for purpose. Errors in something as basic as elevation data can distort flood results, and if the methodology cannot stand up to scientific scrutiny, the outputs become hard to defend. For institutions making major financial decisions, that lack of transparency is a real risk.

A fascinating contradiction emerged during the session’s live polling. While 86% of participants prioritize asset-level precision, the majority are still relying on open-source or free data, which tends to be of a much lower accuracy. Nicolas and Oliver were quick to flag this as a major risk. Open-source data often lacks the resolution required for meaningful financial assessments.

“There is no such thing as regionally average flooding. It doesn’t exist… All flooding is local.”

— Dr Oliver Wing, Fathom

What data are you currently using to measure your flood risk?

Webinar polling reveals a heavy reliance on open-source or free data for flood risk measurement, suggesting that while most institutions are active, a significant majority have yet to transition to more advanced paid or bespoke solutions.

In a report published by Swiss Re and MSCI last year, 18 portfolios covering $4 trillion in AUM of global asset owners were studied. They found that 55% of companies held already face significant exposure to physical hazards today, and that includes flood risk. That’s roughly a quarter of the total equity holdings in those portfolios, and with small and mid-cap firms particularly exposed in those portfolios due to being more geographically concentrated.

“The physical risk, and flood risk in particular, is already embedded in portfolios. The challenge now is making that decision-useful, and that really comes down to linking the portfolio-level views to individual assets,”

— Katie Towey, Senior Associate, MSCI Research & Development

If, for example, we look at a bank that specialises in agricultural loans, the challenge isn’t just the flood itself, but also how it interacts with other perils – a “compound risk” of heat, drought, and water stress. This will be very different to an infrastructure or retail lender.

Looking at where a company is headquartered is useless if most of its revenue or critical supply chain is in an area of high flood risk.

“You look at what are the most damaging locations, and it might be the top 5 that account for 90% of the risk. It’s still local. It’s always local, and you’ve got to make sure that your model can be skillful at that sort of scale.”

— Dr Oliver Wing, Chief Scientific & Product Officer, Fathom

This sentiment was shared by the audience, who clearly favoured data which had the resolution necessary to look at asset/property level risk.

When assessing flood risk, what level of granularity does your team currently prioritize?

Webinar polling indicates a strong shift toward sophistication, with a clear majority of institutions now prioritizing asset-level data and property-specific coordinates over high-level portfolio averages or proxy metrics.

Want a free Flood Risk Snapshot for your asset? Let us know here

Inside banks, validating flood models has become a huge challenge because the risk is uniquely hyper-local. Traditional model risk management (MRM) systems, which are also used for high-stakes financial models like credit risk, now demand proof of performance at the asset level rather than just the portfolio level. 

For global institutions, this means a model is often only considered “usable” in specific regions where its accuracy has been locally proven, requiring extensive validation across a wide global footprint. While having a peer-reviewed scientific foundation is essential, it is often not enough to satisfy internal reviewers who require deeper ground-truthing, such as high-resolution flood depth data from Earth observation satellites.

Ultimately, banks must prove a model’s present-day reliability to justify its use for long-term 2080 climate projections, a necessity as regulators like the PRA increasingly expect firms to rigorously characterize and manage modeling uncertainties.

“It’s a massive task, especially on the flood modeling side. It’s very granular, it’s very localized, and so we have to be able to prove to our model risk management that the model performed that it should do, and especially for the present day.”

— Nicolas Fournier, Climate Scientist, HSBC

• Regulatory shift: Supervisory expectations have moved from “experimentation and capability building” to an active demand for firms to show how physical risk data actually influences their operational decisions.
• Asset-level precision is critical: Because all flooding is local, analyzing risk at the asset or property level is essential to avoid obscuring concentrated risks within a portfolio.
• The end of the black box: Regulators now require transparency; firms must be able to “see under the hood” of their models to explain assumptions, limitations, and how results are derived.
• Evolving validation standards: Traditional financial model validation (like backtesting) is often insufficient for long-term climate projections. Instead, firms must rely on peer-reviewed science, sensitivity analysis, and “ground-truthing” through Earth observation data.
• Integration of uncertainty: Uncertainty should not be a barrier to action; rather, it must be incorporated into decision-making frameworks through prudent management and sensitivity testing.
• Market readiness gaps: While most organizations recognize the importance of asset-level data, many still rely on open-source data that may not meet the rigorous standards required for large-scale financial decisions

The message from the panel was clear:

Flood risk is no longer a peripheral climate disclosure issue. It is becoming a core financial risk variable that demands board-level attention, model transparency and decision-grade data. 

For banks and investors alike, the challenge is no longer whether to integrate flood risk but whether they can do so with enough precision and confidence to act before losses crystallize.