About

The thesis

Operational risk is being rewritten by AI. Not in the distant, speculative sense that dominates most conference panels, but in the concrete, working sense that shows up in how scenarios get designed, how controls get tested, how regulators frame their expectations, and how risk teams allocate their next hour of attention.

I write about that rewrite.

The premise is simple and, I think, under-appreciated: the operational risk discipline was built for a slower world. Loss Distribution Approaches were calibrated on pre-2008 data. Scenario libraries were assembled in a pre-multipolar era. Key Risk Indicators were designed when a geopolitical shock took weeks to cascade, not hours. The tools worked, but they are no longer fast enough for the environment risk teams are actually operating in.

AI changes the tempo. A bank that can generate Basel-mapped stress scenarios against live geopolitical signals has an entirely different relationship to emerging risk than one still running annual scenario workshops. A resilience program that can simulate third-party concentration shocks overnight is playing a different game than one assembling tabletop exercises twice a year.

This is what I believe, and what oprisk.ai is a working argument for.

The career arc

The path to this thesis wasn't theoretical. It ran through eighteen years of North American banking risk, three regulators, and the unglamorous work of actually building things that supervisors would accept and models that would hold up under stress.

It started at IIT Delhi, where I read engineering and learned, though I couldn't have named it at the time, how to decompose complicated systems into their governing mechanics. Then IIM Calcutta, where I learned that the hard part of finance was rarely the math. It was the institutional context around the math: who had to agree with the answer, who had to defend it, and who had to be protected from it.

In 2008 I joined ICICI Bank Canada, arriving into the Canadian banking system in the middle of the financial crisis. In retrospect, that was an exceptional time to learn what operational risk actually means. The theoretical frameworks mattered less than the texture of how a bank responds when the world tilts.

Four years later I moved to TD Bank, where I have spent the last fourteen years across stress testing, operational resilience, and risk analytics, most recently as Vice President. I have engaged with the FRB, OCC, OSFI, FDIC, and CDIC across CCAR submissions, resilience assessments, and model validation exercises. What I am most proud of is driving successful transformations, again and again: programs delivered on time, models that held up under supervisory scrutiny, and resilience frameworks that banks actually adopted. That discipline of building things supervisors can live with and businesses can operate is what I am now trying to translate into writing and into tools other risk teams can use.

oprisk.ai is that translation.

Credentials

CFA · MBA, IIM Calcutta · B.Tech., IIT Delhi · 18 years across three regulators

Expertise

Six areas of practice. Each has shaped what I write and what I build.

Enterprise Risk Governance. Board reporting, risk appetite frameworks, three-lines-of-defense architecture, and the structural questions of how risk functions relate to the businesses they oversee.

Stress Testing & CCAR. Scenario design, qualitative and quantitative narrative construction, supervisory engagement through the submission cycle, and the craft of writing stress tests that regulators find credible.

Operational Resilience. Important Business Services mapping, impact tolerance design, third-party and concentration risk analysis, and BOE/FRB/OSFI resilience frameworks as implemented inside a large bank.

Quantitative Modeling. Monte Carlo simulation, Loss Distribution Approach, scenario analysis, and the working relationship between modeling choices and the regulatory scrutiny those choices invite.

Regulatory Engagement. Direct engagement across FRB, OCC, OSFI, FDIC, CDIC on CCAR, DFAST, operational resilience reviews, model risk, and resolution planning.

AI in Risk. The newest layer, and the one this platform is organized around: where large language models, agentic systems, and live search fit into the identify-measure-test-respond-govern lifecycle of operational risk management.

Beyond the work

I live in Mullica Hill, New Jersey, in the Philadelphia area, with my wife and two children. I watch a great deal of cricket, read more geopolitics than is strictly necessary, and maintain a working affection for the two institutions, IIT Delhi and IIM Calcutta, that shaped how I think more than I usually admit.

The shortest version of what keeps me at this: the belief that operational risk is one of the most intellectually demanding disciplines in finance, and the most under-served by quality writing and tooling. I am trying to contribute to both.

Connect

I read everything sent to chitresh@oprisk.ai.

For newsletter subscriptions, The OpRisk Signal goes out bi-weekly: one core idea, a framework from practice, a geopolitical lens, and two or three things I am reading. Subscribe at the bottom of any page.

For speaking opportunities or constructive conversations, please reach me at chitresh@oprisk.ai or via LinkedIn. I am selective about engagements and responsive about replies.

For everything else (pieces you'd like me to read, frameworks you'd like me to critique, disagreements with anything I have written), the email address is the same.

Chitresh Sainia