Who Owns Liquidity Risk: How Banks Organise Treasury, Risk and Finance

Who owns liquidity risk when it moves fast

Liquidity risk ownership across the three lines of defence: who runs the position, who challenges it, who signs off, and why coordination is the real control.

Liquidity risk is unusual. It can sit quiet for months and then move in hours. When it moves, no single team holds the full picture. The position, the challenge, and the reporting all sit in different places. That is why the organisational design matters as much as the numbers. This post walks through who does what, where independent challenge sits, and why coordination, not any single control, is what actually keeps a bank safe.

Why the org chart matters for a fast moving risk

Most risk types give you time. Credit losses build over quarters. Liquidity does not. A funding market can close, a large depositor can pull, or a rating action can trigger collateral calls inside a single day. When that happens, the question is not "what is the number" but "who is allowed to act, who checks them, and who signs off the decision".

If those answers are unclear, you lose time you do not have. So the structure is a control in its own right. Get the split of responsibility right and the bank responds. Get it wrong and everyone waits for someone else to move.

The three lines applied to liquidity

The three lines model is the backbone here, and liquidity maps onto it cleanly. If you have been in the industry a while you will know this as the three lines of defence; the IIA dropped "of defence" a few years back, but the idea is the same.

• First line: Treasury. Owns and runs the position. Takes the funding decisions, holds the buffer, manages market access.
• Second line: Liquidity Risk Management. Independent oversight. Sets and monitors limits, runs stress testing, and challenges Treasury's assumptions.
• Third line: Internal Audit. Checks the framework itself works. Not the daily numbers, but whether the controls, models, and governance do what they claim.

The point of separation is simple. The people running the position should not also be the people who decide whether the position is safe. That independence is what the PRA looks for, and it is a core theme in the ILAAP, the Internal Liquidity Adequacy Assessment Process, where the firm has to show its own assessment of liquidity adequacy stands up to scrutiny.

What Treasury owns

Treasury is the first line and the closest thing to a single owner of the position. Day to day, that means:

• Managing the cash position. Knowing where cash is, in which currency, and whether it can actually be moved when needed. Trapped liquidity in a subsidiary is not group liquidity.
• Funding strategy. Deciding the mix of retail, wholesale, secured and unsecured funding, and the tenor of it. Cheap short funding looks good until it all rolls at once.
• Buffer composition. Choosing what sits in the HQLA buffer. Level 1 gilts behave differently from Level 2 assets under stress, and the haircut and encumbrance profile matter as much as the headline size.
• Market access. Keeping repo lines, counterparties and central bank facilities live and tested. Access you have never used is access you cannot rely on.
• Intraday needs. Meeting payment and settlement obligations through the day, which is a real and separate discipline from the end of day position.

To make that concrete, take an illustrative firm running an LCR of 130 percent. A single large wholesale depositor pulls funding and a chunk of the buffer gets committed to intraday needs. The ratio drops to 118 percent overnight. Still above 100, but the direction and speed are what Treasury has to explain and act on, not the static number.

Treasury lives inside the limits. It does not set them. That is the second line's job.

Where independent oversight sits

Liquidity Risk Management is the second line. Its job is to challenge Treasury, not to run the desk. In practice that challenge shows up in a few concrete ways.

Limits. LRM sets the limit framework: survival horizons, concentration limits, buffer floors, currency limits. It monitors them and owns the escalation when they are breached or approached.

Stress testing and scenario analysis. This is where independence earns its keep. LRM designs the scenarios, idiosyncratic, market wide, and combined, and challenges the run off rates and behavioural assumptions Treasury would prefer to use. If Treasury assumes a deposit category is stickier than the evidence supports, LRM is the team that pushes back.

Regulatory engagement. LRM typically leads the day to day liquidity relationship with the PRA and owns the ILAAP narrative. It is worth being precise here: under the senior managers regime, accountability for that relationship sits with named senior managers and the board, not with a team in the abstract. LRM does the work; a senior manager owns it.

The tension between first and second line is healthy. It is meant to exist. A useful way to think about it is the difference between running the position and governing it, which touches on the wider point about leadership versus management in finance roles.

Finance: the data and reporting engine

Neither Treasury nor LRM can do anything without reliable data, and that is Finance's contribution. Finance is the engine underneath the whole thing.

• Balance sheet data. The source of truth for what the bank holds and owes. Every liquidity metric starts here.
• Behavioural assumptions. How deposits actually behave, how facilities are drawn, how quickly assets can be sold. These assumptions feed directly into the LCR and the internal stress tests, and they are contested precisely because they move the answer.
• Regulatory reporting. LCR, NSFR and PRA110 all have to be produced accurately and on time. PRA110 gives the regulator a granular, cash flow based view of the liquidity position out across maturity buckets. It is reported at a frequency that depends on firm size (broadly, more often for larger firms and less often for smaller ones, subject to thresholds), so the data quality behind it is under real scrutiny.

The mechanics of how the LCR itself is built from this data, high quality liquid assets set against net stressed outflows, are worth studying in their own right.

The friction point is ownership of a number. When the LCR moves, is it a Finance data issue, a Treasury position change, or an LRM assumption change? If nobody owns the explanation, you get three teams pointing at each other while the regulator waits.

ALCO, risk appetite and senior ownership

Above all three lines sits the Asset and Liability Committee, ALCO, and senior management. This is where risk appetite is set and where the real decisions are owned.

ALCO decides how much liquidity risk the bank is willing to run. That appetite then cascades down into LRM's limits and Treasury's targets. When a scenario bites, ALCO is where the response is agreed: draw the buffer, curtail lending, activate a contingency funding plan, or approach the central bank.

The critical word is own. In a genuine liquidity event, the decision to burn through the buffer or restrict business is not Treasury's alone and not LRM's alone. It belongs to senior management, because it has consequences for the whole franchise. A governance structure that leaves that decision ambiguous will fail at the exact moment it is tested.

Technology and the plumbing underneath

None of this works without the plumbing. Technology and data infrastructure determine whether the bank has a timely position or a stale one.

The gap between an end of day report and a real time view is the gap between managing a crisis and reading about it after the fact. Good infrastructure gives Treasury an intraday view of cash and collateral, gives Finance a clean pipeline into PRA110 and the LCR, and gives LRM the ability to rerun a stress scenario quickly when conditions change.

Where the plumbing is weak, you see the symptoms: reconciliations that take days, positions assembled by hand in spreadsheets, and a stress test that takes a week to rerun. In a fast moving event, a week is useless.

This is also why practical data skills matter for analysts across all three teams. Being able to pull and check a position yourself, rather than waiting on a report, is a real advantage. Even a few lines of pandas gets you a total and a currency breakdown you can sanity check:

import pandas as pd

positions = pd.read_csv("cash_positions.csv")  # columns: entity, currency, amount

# Total position and a quick split by currency
total = positions["amount"].sum()
by_ccy = positions.groupby("currency")["amount"].sum()

print(f"Group cash position: {total:,.0f}")
print(by_ccy)

That is enough to spot a currency where cash is trapped or a total that does not match the report you were sent.

Where coordination breaks down

The structure looks clean on a slide. In practice it fails in predictable ways, and knowing them is half the battle.

• Assumptions that drift. Treasury, LRM and Finance can end up using slightly different run off rates or behavioural assumptions for the same deposit book. Each version is defensible in isolation. Together they produce three different numbers and an argument.
• Unclear ownership of a metric. When the LCR or a survival horizon moves, someone has to own the explanation from source data to final number. If ownership is fuzzy, the diagnosis is slow.
• Slow escalation. A position can move faster than the committee calendar. If escalation depends on the next scheduled ALCO, the bank is already behind. Escalation triggers have to be defined in advance and independent of the meeting cycle.

None of these are exotic. They are the everyday friction of a risk that sits across teams. The control that actually works is coordination: shared assumptions, agreed ownership, and escalation that moves at the speed of the risk.

The practical takeaway

When you join a liquidity team, learn the org chart before you learn the model. Find out who owns each number, where the second line challenge actually happens, and how fast escalation can move when a position turns. The bank that survives a funding shock is rarely the one with the cleverest stress model. It is the one where everyone already knows their job and does not have to work out who is in charge while the clock runs.