Who's this for

This article is for candidates preparing for risk management, compliance, internal control, operational risk, and credit risk roles at securities firms. Rather than memorising buzzwords from job descriptions, we focus on translating those words into actual deliverables — VaR reports, ECL calculations, limit-breach alerts, SAR filings. JD lines like "monitor market risk", "support Basel III implementation", and "detect insider trading" mean specific Excel workbooks, SQL queries, and meetings; we map them out. It is also for people aiming at FRM or CFA who want to see where the credential leads, and for those eyeing a move toward the FSS, KRX, SESC, or SEC.

Why risk and compliance is "the job of control"

If other desks at a securities firm make money, risk and compliance keep money from leaking out. A trader can make or lose USD 1M in a second. A private banker manages client assets but is one conflict of interest away from blowing up the firm. An IB banker closes huge deals but one filing error can trigger massive litigation. Control teams sit behind all of them, designing limits, procedures, evidence trails, and reports.

The word "control" can sound bureaucratic, but it is the last seatbelt that keeps the firm alive. Barings Bank lost 233 years of history because of one Nick Leeson in 1995. MF Global collapsed in 2011 betting on European sovereign debt. Archegos lost USD 10B in days in March 2021. All three are stories of failed limit management and broken controls. Risk and compliance professionals exist so that these events do not happen at your firm.

The four risks: Market / Credit / Operational / Liquidity

The four-way split mirrors the Basel taxonomy. Each has different measurement tools and different control levers.

- Market Risk: loss from moves in equity, rates, FX, vol, or credit spreads. Lives mainly in the trading book. Example: long 100 KOSPI200 futures, the index drops 2%, you lose roughly KRW 500M.

- Credit Risk: loss from a counterparty failing to pay. Bond issuer defaults, margin loans unpaid, securities lending failing, OTC derivative counterparty default. Example: USD 10M of B-rated bonds default with 40% recovery means USD 6M loss.

- Operational Risk: loss from people, systems, processes, and external events. Fat-finger trades, system outages, internal fraud, cyber attacks, natural disasters. Basel classifies this into seven event types. Example: the Samsung Securities employee-share misallocation in 2018.

- Liquidity Risk: split into funding liquidity and market liquidity. Either short-term funding dries up and you cannot roll obligations, or the market freezes and you cannot sell assets at fair price. Example: the corporate bond market that effectively closed for days in March 2020.

When asked "explain the four risks" in an interview, pair the definition with an example. Definitions alone read like a textbook; pairing them with concrete events makes it clear you have seen the trading floor.

Market Risk: VaR (Historical/Parametric/MC), Expected Shortfall, FRTB

The headline market-risk metric is VaR. "Tomorrow, with 95% probability, losses will not exceed X." Three measurement methods exist.

- Historical Simulation: take the last 250 or 500 daily returns and look at the empirical distribution. No distributional assumption needed, but it cannot see events that have never happened.

- Parametric (Variance-Covariance): assume normal returns and use mean, std, and correlations. Fast but ignores fat tails.

- Monte Carlo: pick a model and simulate hundreds of thousands of paths. Strong for options and non-linear products, computationally heavy.

VaR's weakness is that it ignores everything beyond the cut-off. That is why Expected Shortfall (ES, CVaR) — the average loss conditional on exceeding the 95% VaR — sits next to it. Basel's FRTB (Fundamental Review of the Trading Book), effective from 2023, switched the standardised market-risk metric from VaR to ES and introduced asset-class-specific liquidity horizons. Korea is phasing it in from 2025.

In practice the desk watches daily VaR limits, monthly ES limits, and stressed VaR for crisis scenarios. When a limit breaks, the risk team asks the trader to reduce the position or add a hedge.

Credit Risk: PD/LGD/EAD, IFRS 9 Stage 1/2/3, Basel III/IV

Credit risk is decomposed into three parameters.

- PD (Probability of Default): probability of default within 1 year. Varies by rating: AAA around 0.02%, BBB around 0.3%, B around 5%.

- LGD (Loss Given Default): loss rate conditional on default. Lower with collateral, higher for unsecured subordinated. Typical senior unsecured runs around 60%.

- EAD (Exposure at Default): exposure at default. For committed lines, add drawn plus a portion of undrawn.

ECL (Expected Credit Loss) = PD x LGD x EAD. This is the heart of IFRS 9.

IFRS 9 splits assets into three Stages.

- Stage 1: credit risk close to initial. 12-month ECL only.

- Stage 2: significant increase in credit risk (SICR). Lifetime ECL, but interest income on gross basis.

- Stage 3: impaired. Lifetime ECL plus interest income on net basis (principal minus ECL).

Basel III/IV requires a CAR above 8%. RWA is computed via standardised approach or IRB (Internal Ratings-Based). Basel IV imposed an output floor capping IRB at 72.5% of standardised RWA. Korea adopted Basel IV from 2023; Japan is phasing in from 2024.

Operational + Liquidity Risk: KRI, RCSA + LCR + NSFR

Operational risk is about reading signals before incidents happen.

- KRI (Key Risk Indicator): system outage count, order amendment/cancellation ratio, staff turnover, failed settlements, complaint volumes. Reviewed weekly.

- RCSA (Risk and Control Self-Assessment): each business unit assesses its own risks and controls. Refreshed quarterly.

- Loss database: every incident is recorded with amount, cause, and remediation. Basel's standardised approach uses this data to compute operational-risk capital.

Liquidity risk has two Basel III ratios.

- LCR (Liquidity Coverage Ratio): high-quality liquid assets (HQLA) must cover 100% of stressed outflows over 30 days. Korea adopted in 2015; Japan around the same time.

- NSFR (Net Stable Funding Ratio): stable funding over a 1-year horizon must cover 100% of required stable funding.

Securities firms rely more on short-term repo, call money, and CP than banks, so liquidity crises arrive faster. US broker-dealers in March 2020 wrestled with money-market fund redemptions and their LCRs wobbled.

A real day: 7am to 9am Risk Committee to 11am stress test to 2pm trade review to 4pm reg report

An ordinary day for a risk or compliance professional looks like this.

- 7:00 Arrive. Catch up on overnight US/EU events. Check option vol, rates, FX vs. yesterday's close. Pull up the overnight VaR report and limit utilisation.

- 8:30 Team morning meeting. Share yesterday's breaches, new product launch timelines, and regulator data requests.

- 9:00 Risk Committee. CRO, head of trading, treasurer, head of IT. Topics include 95% VaR utilisation, concentration exposures, credit spread widening. 30 minutes.

- 9:30 Market opens. Real-time monitoring mode. When a limit alert fires, you call the trader within five minutes for reason and remediation plan.

- 11:00 Stress test work. Apply the "Lehman scenario" (one-month moves from September 2008), "Black Monday" (October 1987), or "Taper Tantrum" (May-June 2013) to today's portfolio. Pack results into PPT.

- 12:30 Lunch.

- 14:00 Trade review. Look at large trades from yesterday (notional above USD 5M), abnormal trades (price more than 0.5% off market), and employee personal trades. Ask the trader for written rationale where needed.

- 15:00 New product launch review. New ELS underlying volatility, worst-case scenarios, customer loss probability, suitability of marketing materials.

- 16:00 Regulator reports. Month-end means CAR, NCR (Net Capital Ratio), and limit utilisation reports. Pull data from Excel, validate with SQL, fill in the standard template.

- 17:30 Prep for tomorrow. Note maturing trades, upcoming limit pressure, and compliance alerts.

Firms differ in detail but the cycle of monitor, committee, scenario, review, report repeats everywhere.

Compliance: KYC/eKYC/AML/CTR/SAR/Sanctions/Market Surveillance

Compliance is not the team that blocks trades. It is the team that ensures trades happen lawfully and ethically.

- KYC (Know Your Customer): collect ID, real name, address, occupation, source of funds.

- eKYC: non-face-to-face onboarding via video call, ID OCR, facial recognition, one-cent verification transfer.

- AML (Anti-Money Laundering): detect suspicious transactions and report.

- CTR (Currency Transaction Report): cash transactions above KRW 10M (Korea) reported to KOFIU.

- STR / SAR (Suspicious Activity Report): suspicious transaction report. Look for structured deposits, rapid in-out, dormant account reactivation.

- Sanctions Screening: match customers and counterparties against OFAC, UN, and EU lists. Lists update daily, so automation is mandatory.

- Market Surveillance: detect insider trading, manipulation, wash trades. NICE Actimize and Nasdaq SMARTS raise alerts that humans then review.

KYC is one-time at onboarding; ongoing monitoring lasts forever. If a customer's transactions stop matching the income or occupation declared at onboarding, an alert fires.

Regulatory frameworks: Basel III/IV, MiFID II, Dodd-Frank, Volcker, FATCA, CRS

Major frameworks global securities firms must navigate.

- Basel III/IV: BCBS (Basel Committee on Banking Supervision) capital and liquidity rules. CAR, LCR, NSFR, FRTB sit here.

- MiFID II / MiFIR: EU markets directive in force from 2018. Best execution, transaction reporting, research unbundling. Korean firms with EU clients are partially in scope.

- Dodd-Frank Act: US, 2010. Volcker Rule (proprietary trading limits), CFTC swap rules, Title VII.

- Volcker Rule: Dodd-Frank Section 619. Limits proprietary trading by bank holding companies and ownership in hedge funds and PE.

- FATCA (Foreign Account Tax Compliance Act): US citizen and resident account reporting to the IRS. Enacted 2010, effective 2014.

- CRS (Common Reporting Standard): OECD's automatic exchange of information. More than 100 countries participate. FATCA's global cousin.

These rules cannot be ignored "because we are local". A US person opening a Korean brokerage account triggers FATCA; an EU resident buying a Korean ETF triggers parts of MiFID II. Global IBs sit on top of four or five regimes at once.

Korea (FSS/FSC/KOFIU/KRX), Japan (SESC/FSA/JPX), Global (SEC/FINRA/FCA)

Korea:

- FSC (Financial Services Commission): policy-making. Capital Markets Act, Financial Consumer Protection Act, Electronic Financial Transactions Act.

- FSS (Financial Supervisory Service): examination and supervision. Comprehensive exams, focused exams, ongoing surveillance.

- KOFIU (Korea Financial Intelligence Unit): AML reporting authority. Receives CTR and STR.

- KRX (Korea Exchange): the Market Oversight division detects manipulation. Self-regulatory organisation.

Japan:

- FSA (Financial Services Agency): the regulator.

- SESC (Securities and Exchange Surveillance Commission): securities surveillance. Sits within FSA but operationally independent.

- JPX (Japan Exchange Group): TSE plus OSE.

Global:

- SEC (US Securities and Exchange Commission): US securities regulator. Registration, disclosure, manipulation enforcement.

- FINRA (Financial Industry Regulatory Authority): US SRO over broker-dealers.

- FCA (Financial Conduct Authority): UK conduct regulator. MiFID II, Senior Managers Regime.

- BaFin: German federal financial supervisor.

- MAS (Monetary Authority of Singapore).

- HKMA / SFC in Hong Kong.

If you can name three regulators relevant to your target role, you are above the median candidate.

Internal control (COSO / SOX / K-SOX / J-SOX / Three Lines of Defense)

COSO ERM is the de facto framework for internal control. Five components: control environment, risk assessment, control activities, information and communication, monitoring.

SOX (Sarbanes-Oxley Act) was passed in 2002 after Enron. Section 404 requires management to assess internal control effectiveness, with auditor attestation. Korea has K-SOX through the External Audit Act. Japan has J-SOX through the Financial Instruments and Exchange Act.

Three Lines of Defense:

- Line 1: business and operations. Day-to-day control. The trader staying within their own limits.

- Line 2: risk management, compliance, finance. Designs and monitors Line 1's controls.

- Line 3: internal audit. Independent assurance over Lines 1 and 2.

Explaining this model in an interview answers "why are controls split across so many teams?" cleanly.

Tools stack: Bloomberg PORT, MSCI RiskMetrics, Numerix, Murex, NICE Actimize

Tools frequently used by risk and compliance teams.

- Bloomberg PORT: portfolio analytics, VaR, scenarios, credit analytics.

- MSCI RiskMetrics: the market-risk classic. JPMorgan's 1994 release of RiskMetrics turned VaR into an industry standard.

- Numerix: OTC derivative valuation, XVA (CVA/DVA/FVA).

- Murex MX.3: integrated front-to-back ITS used by many global IBs.

- Calypso: competing ITS.

- NICE Actimize: AML, market surveillance, trade surveillance.

- Nasdaq SMARTS: market surveillance.

- Refinitiv World-Check: sanctions and PEP (Politically Exposed Persons) data.

- SAS Risk Management: credit models, capital calculations.

- Python, R: model development, backtesting.

- SQL: data extraction and validation. Used daily.

You do not need to know every tool as a graduate, but interviewers do ask about Bloomberg and SQL.

Failures: Barings, MF Global, SocGen Kerviel, Archegos, Optimus/Lime

Classic case studies of control failure.

- Barings Bank (1995): Nick Leeson in Singapore lost USD 1.4B on Nikkei futures. A 233-year-old bank collapsed. The root cause was a single person running both front and back office. After this, segregation of duties became table stakes everywhere.

- LTCM (1998): hedge fund built by Nobel laureates blew up in the Russian crisis. The Fed coordinated a USD 3.6B rescue from 14 IBs. The lesson was leverage and model risk.

- SocGen Kerviel (2008): Jerome Kerviel lost EUR 4.9B in European index futures. Fake hedge trades bypassed limit checks. After this, the four-eyes principle was strengthened.

- MF Global (2011): chairman Jon Corzine bet USD 6.3B on European sovereigns. Margin calls forced the firm to touch customer assets. USD 1.6B of customer money went missing.

- Archegos Capital (2021): Bill Hwang's family office lost USD 10B via TRS (Total Return Swap). Credit Suisse took USD 5.5B, Nomura USD 2.8B. The lesson was counterparty risk management.

- Optimus (2020 Korea): a private fund pitched as backed by public-sector receivables. KRW 500B lost. Triggered tightening of private-fund rules.

- Lime Asset Management (2019-2020 Korea): KRW 1.6T frozen for redemption. The lesson was mis-selling and weak fund operations.

Interviewers love "pick a recent risk event and analyse it". Archegos remains a strong choice because it touches counterparty, concentration, and TRS in one story.

KPIs: RWA, CAR, VaR limit breach, compliance training, incident count

Risk and compliance KPIs vary, but the common ones are:

- RWA growth and capital efficiency.

- CAR (Capital Adequacy Ratio): at least 8%, with 10.5% commonly targeted.

- NCR (Net Capital Ratio, Korea): 100% minimum, 150% targeted.

- LCR, NSFR: at least 100%.

- VaR limit breach count: target 0 per month, but 1-2 per month is realistic.

- Average time to clear a breach.

- 100% compliance training completion.

- AML alert handling speed.

- Number of findings from regulator exams.

- Operational loss count and amount.

- Personal trading violations.

KPIs shape behaviour. Too strict and the business is choked; too loose and incidents slip.

Interview questions (the scariest risk, five KRIs, your take on Archegos)

- Define the four risks and give a securities-firm example for each.

- Explain VaR vs. ES and give your view on which is better.

- Of the three market-risk methods, when do you use which?

- Explain IFRS 9 Stage 1/2/3 and the ECL formula.

- Summarise Basel III vs. Basel IV in one sentence.

- Pick five KRIs and explain why each is a signal.

- Design the entry schema for an operational-loss database.

- Explain the difference between KYC and ongoing monitoring.

- Describe five suspicious-transaction patterns.

- Analyse three root causes of the Archegos incident and the lessons for us.

- Describe the impact of the Optimus and Lime cases on Korean compliance practice.

- When a limit alert fires, what do you do in the first 30 minutes?

- A trader asks you to lift the limit "just this once". How do you respond?

- Explain the Volcker Rule and its impact on Korean securities firms.

- Pick the three most important sections of the Capital Markets Act.

- Explain Three Lines of Defense and where you fit best.

- Analyse a financial incident from the past six months.

- What is the scariest risk and why?

- Build a ten-item compliance checklist for launching a new ELS.

- Describe your 90-day onboarding learning plan.

These are not memorisation questions. Interviewers are watching your thinking structure: one-sentence conclusion, two or three supporting points, one practical application.

Salary: Korea KRW 50-70M new grad to KRW 150M+, Japan JPY 7-13M, US `$150K-180K`

Approximate. Wide variance by firm and seniority.

- Korea graduate (risk/compliance): KRW 50-70M at large firms.

- Year 5: KRW 80-120M.

- Manager (chajang/team lead): KRW 150-250M.

- Director (bujang/silcheong): KRW 250-400M+ with bonus.

- CRO / CCO: KRW 500M-1B+, more at top houses.

Japan:

- Graduate (証券会社 risk / compliance): JPY 6-8M.

- Years 5-10: JPY 8-15M.

- Department head: JPY 15-25M.

- Foreign firms in Japan pay 1.3-1.5x local norms.

US:

- Analyst (Risk/Compliance): `$80K-120K` plus bonus.

- Associate (3-5 years): `$120K-180K` plus bonus.

- VP: `$200K-350K` plus bonus.

- Director: `$300K-500K` plus bonus.

- MD: `$500K+` plus RSU.

London, Hong Kong, and Singapore sit near US levels or slightly below. Quant risk roles tend to earn a higher bonus mix than compliance.

Career path: Risk Analyst to Senior to VP to Director to CRO

Typical trajectory.

- Analyst (0-3 years): reports, data wrangling, limit monitoring, KYC.

- Senior Analyst (3-6): scenario analysis, new-product review, regulator reporting.

- VP (6-10): team leadership, risk committee presentations, model validation ownership.

- Director (10-15): limit policy design, new-business risk review, deputy to CRO.

- CRO / CCO: C-level, board reporting. Usually 15-25 years in.

Alternative paths:

- Move to a regulator or exchange (FSS, FSC, KRX). Stable, prestigious.

- Risk advisory at Deloitte, KPMG, EY.

- Risk or compliance head at a fintech or crypto firm.

- Asset manager risk team.

Risk and compliance careers travel well within finance. Data, regulation, and product knowledge survive firm changes.

Certifications: FRM, CFA, PRM, CAIA, CIA, CAMS

Recommended order.

- FRM (Financial Risk Manager) from GARP. Part 1 (market/credit/operational/investment) and Part 2 (deeper measurement, integrated risk, current issues). De facto standard for risk roles.

- CFA (Chartered Financial Analyst) from CFA Institute. Levels 1/2/3. Closer to investment but valued for risk and compliance.

- PRM (Professional Risk Manager) from PRMIA. FRM alternative.

- CAIA (Chartered Alternative Investment Analyst) for alternative investments.

- CIA (Certified Internal Auditor) for internal audit.

- CAMS (Certified Anti-Money Laundering Specialist) for AML.

- Korea: Investment Asset Manager, Financial Investment Analyst, Credit Analyst, FP, KIRMA.

- Japan: 証券外務員 Class 1, 金融商品取引責任者.

For graduates, start with FRM Part 1 or the Korean Investment Asset Manager. Both are doable in six months and signal commitment in interviews.

90-day learning routine

- Day 1-15: explain the four risks in your own words. Read the introduction of the Basel framework once.

- Day 16-30: compute VaR, ES, PD/LGD/EAD yourself in Excel or Python. Try 1-day 95% Historical VaR on five years of KOSPI200 data.

- Day 31-45: pick five financial incidents from the past five years and write a one-pager on each. Archegos, GameStop, Optimus, FTX, Credit Suisse are good candidates.

- Day 46-60: cover compliance angles. KYC, AML, market surveillance cases. Read KOFIU's published STR case studies.

- Day 61-75: go deep on one regulatory framework. Basel III or the Korean Capital Markets Act. FSS examination manuals are also valuable.

- Day 76-90: mock interviews. Write answers to the 20 questions and rehearse five of them out loud.

The goal is not to finish all reading but to produce answers in your own words. One deliverable per week (a written analysis, an Excel, or a chart) leaves you with twelve pieces of evidence in 90 days.

References

VaR calculation example

Historical VaR and Monte Carlo VaR

Assume 5 years of KOSPI200 daily returns (1,250 trading days)

np.random.seed(42)

returns = np.random.normal(0.0005, 0.015, 1250) # mean 0.05%, std 1.5%

portfolio_value = 10_000_000_000 # KRW 10B

1. Historical VaR (95% 1-day)

sorted_returns = np.sort(returns)

percentile_5 = sorted_returns[int(0.05 * len(sorted_returns))]

historical_var = -percentile_5 * portfolio_value

print(f"Historical 1-day 95% VaR: {historical_var:,.0f} KRW")

2. Expected Shortfall (CVaR)

tail_returns = sorted_returns[:int(0.05 * len(sorted_returns))]

expected_shortfall = -np.mean(tail_returns) * portfolio_value

print(f"95% Expected Shortfall: {expected_shortfall:,.0f} KRW")

3. Monte Carlo VaR (normal distribution assumed)

mu = np.mean(returns)

sigma = np.std(returns)

n_simulations = 100_000

mc_returns = np.random.normal(mu, sigma, n_simulations)

mc_var = -np.percentile(mc_returns, 5) * portfolio_value

print(f"Monte Carlo 1-day 95% VaR: {mc_var:,.0f} KRW")

IFRS 9 ECL example

Expected Credit Loss = PD x LGD x EAD

Bond portfolio

portfolio = pd.DataFrame({

"bond_id": ["B001", "B002", "B003", "B004"],

"rating": ["AAA", "BBB", "BB", "B"],

"pd_1y": [0.0002, 0.003, 0.015, 0.05], # 1-year PD

"lgd": [0.45, 0.60, 0.70, 0.75], # loss given default

"ead": [10_000_000_000, 5_000_000_000, 2_000_000_000, 1_000_000_000],

"stage": [1, 1, 2, 3], # IFRS 9 Stage

})

ECL by Stage

Stage 1: 12-month ECL

Stage 2/3: Lifetime ECL (assume 3 years)

def calc_ecl(row):

if row["stage"] == 1:

return row["pd_1y"] * row["lgd"] * row["ead"]

else:

Simplified: 3-year cumulative PD = 1 - (1 - PD_1y)^3

pd_lifetime = 1 - (1 - row["pd_1y"]) ** 3

return pd_lifetime * row["lgd"] * row["ead"]

portfolio["ecl"] = portfolio.apply(calc_ecl, axis=1)

print(portfolio)

print(f"Total ECL: {portfolio['ecl'].sum():,.0f} KRW")

-- Limit breach detection query

-- Compare daily trading limits against actual trades

WITH daily_position AS (

SELECT

trader_id,

trade_date,

instrument_type,

SUM(notional_amount) AS gross_notional,

SUM(CASE WHEN side = 'BUY' THEN notional_amount ELSE -notional_amount END) AS net_notional

FROM trades

WHERE trade_date = CURRENT_DATE

GROUP BY trader_id, trade_date, instrument_type

),

limits AS (

SELECT trader_id, instrument_type, daily_limit

FROM trader_limits

WHERE effective_date <= CURRENT_DATE

AND (expiry_date IS NULL OR expiry_date > CURRENT_DATE)

)

SELECT

p.trader_id,

p.instrument_type,

p.gross_notional,

l.daily_limit,

ROUND(p.gross_notional / l.daily_limit * 100, 2) AS utilization_pct,

CASE

WHEN p.gross_notional > l.daily_limit THEN 'BREACH'

WHEN p.gross_notional > l.daily_limit * 0.9 THEN 'WARNING'

ELSE 'OK'

END AS status

FROM daily_position p

JOIN limits l

ON p.trader_id = l.trader_id

AND p.instrument_type = l.instrument_type

WHERE p.gross_notional > l.daily_limit * 0.8

ORDER BY utilization_pct DESC;

References:

- BCBS (Basel Committee on Banking Supervision): https://www.bis.org/bcbs/

- IFRS 9 Financial Instruments: https://www.ifrs.org/issued-standards/list-of-standards/ifrs-9-financial-instruments/

- GARP FRM: https://www.garp.org/frm

- CFA Institute: https://www.cfainstitute.org/

- Korea FSS: https://www.fss.or.kr/

- Korea FSC: https://www.fsc.go.kr/

- KOFIU: https://www.kofiu.go.kr/

- KRX: https://global.krx.co.kr/

- Korea Capital Markets Act portal: https://www.law.go.kr/

- Japan FSA: https://www.fsa.go.jp/

- Japan SESC: https://www.fsa.go.jp/sesc/

- US SEC: https://www.sec.gov/

- FINRA: https://www.finra.org/

- UK FCA: https://www.fca.org.uk/

- FATF (Financial Action Task Force, global AML standard-setter): https://www.fatf-gafi.org/

- COSO ERM Framework: https://www.coso.org/

- Credit Suisse Archegos report: https://www.credit-suisse.com/about-us/en/reports-research/archegos-info-kit.html