1. Sector Overview
The Financial Services sector encompasses commercial banking, investment banking, insurance, securities and commodity trading, asset management, and the regulatory infrastructure that governs them. The Department of the Treasury serves as the Sector Risk Management Agency under CISA’s critical infrastructure framework because disruption to financial services propagates immediately across every other sector of the economy.
The conventional assessment of this sector focuses on capital ratios, liquidity coverage, stress test results, and market performance. Those metrics describe financial condition. They do not describe the structural conditions that determine whether the sector can absorb the next surprise without transmitting it across the economy. The next interest rate dislocation. The next concentrated deposit run. The next governance failure at a systemically important institution.
The Four Frequencies framework examines a different layer. Where has the number of independent institutions declined below the threshold where failure of one creates systemic contagion? Where has governance authority concentrated in ways that prevent risk signals from reaching decision-makers? Where has the information flowing through risk management channels diverged from the actual risk position? And where has the institutional knowledge that once distributed risk awareness across the sector departed or concentrated in too few people?
Financial Services is a Tier 1 data coverage sector in this assessment: 17 structural metrics across five federal data sources (FDIC, SEC, BLS, OSHA, and Treasury). The sector is also the site of one of the most structurally revealing failures in recent history—the collapse of Silicon Valley Bank in March 2023—which provides forensic evidence for the structural patterns the data describes.
2. Structural Thesis
3. Four Frequency Severity Assessment
Where structural slack has eroded below recoverable thresholds. The U.S. banking system has undergone one of the most sustained consolidation trends of any sector in the economy. The number of FDIC-insured institutions has declined from approximately 18,000 in the mid-1980s to 4,379 as of the third quarter of 2025. That is a 76% reduction in independent banking institutions over four decades.
The consolidation is not merely a count reduction. It is a concentration of assets and systemic consequence. The four largest U.S. banks—JPMorgan Chase, Bank of America, Wells Fargo, and Citigroup—held a combined $11.5 trillion in assets at year-end 2024, representing over 40% of total U.S. commercial banking assets. In 1994, the largest banks held 16% of total commercial bank assets. By 2020, that share had reached 69%. The structural implication: failure or severe stress at any one of these institutions transmits consequences across the entire financial system because no combination of smaller institutions can absorb the load.
Consolidation has a legitimate structural rationale. Larger institutions hold more capital, absorb losses more effectively, and demonstrated superior stability during the 2008 financial crisis relative to many smaller banks. The framework does not dispute this rationale. It measures the structural outcome: when four institutions hold 40% of the sector’s assets and the pipeline for new institutions has effectively closed, the system trades resilience against correlated failure for resilience against individual institutional failure. That trade-off is not wrong. It is structural, and it carries consequences that capital ratios do not capture.
The pipeline of new institutions has effectively closed. Since 2010, the total number of new bank charters issued over fifteen years is 86—an average of fewer than six per year. For context, from 1995 to 2007, the lowest annual count of new bank formations was 93. The sector is not merely consolidating. It has lost the capacity to regenerate structural diversity. Each merger reduces the number of independent risk-assessment frameworks, independent governance structures, and independent balance sheets in the system. That diversity is the sector’s structural buffer against correlated failure.
Branch closures provide a geographic signal. In 2024, approximately 2,200 branches closed while 1,100 opened, a net decline of nearly 1,100. That was actually the smallest net decline since 2012, but it continues a structural pattern: the physical infrastructure through which financial services reaches communities is thinning, concentrating access in digital channels controlled by the largest institutions.
The architecture of authority and constraint governing how risk decisions are made. The Permission frequency in financial services operates at a level the framework classifies as Strained: formal governance structures exist, but the gap between those structures and actual decision-making authority is measurable across several indicators.
The governance concentration signal is direct. In Bank Director’s 2024 Governance Best Practices Survey, almost one-fifth of responding directors and CEOs reported that a single individual directly or indirectly dominates their board’s deliberations. The framework reads this as a Permission condition: when one person controls the information flow and decision architecture of a governing body, the board cannot exercise the independent oversight that regulatory frameworks assume it provides. The formal structure says “independent board.” The operational reality says “one person decides.”
CEO-to-median-worker pay ratios provide a structural proxy for authority concentration. Across the S&P 500, the average CEO-to-worker pay ratio reached 285:1 in 2024. The median ratio across larger companies stood at approximately 213:1, up from 206:1 the prior year. In financial services specifically, where compensation structures are more complex and variable, these ratios measure the distance between the people who carry operational risk knowledge and the people who make strategic decisions about that risk. Large pay ratios do not cause structural failure. They measure the structural distance between the operational layer and the authority layer—the same distance that determines whether risk signals reach decision-makers before the position becomes terminal.
Regulatory permission dynamics compound the picture. The Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 raised the asset threshold for enhanced prudential standards from $50 billion to $250 billion, effectively de-supervising a category of banks that included SVB. The framework does not evaluate whether this policy was correct. It observes the structural outcome: a set of institutions gained permission to operate with reduced oversight at the precise scale where their failure would carry systemic consequences. SVB held $209 billion in assets when it collapsed. It sat just below the threshold that would have required the enhanced supervision it demonstrably needed.
The integrity of information the sector uses to price and manage risk. Financial services’ Management frequency operates at Vulnerable because the sector’s core function—pricing risk accurately—depends on information systems that are demonstrably diverging from the risk positions they are supposed to describe.
The material weakness rate across public companies dropped to just over 15% in 2024, representing a downward trend. That sounds like improvement. The framework reads it differently. A material weakness in internal controls means the company’s own auditing determined that its financial reporting could contain material misstatements. Fifteen percent of public companies carrying this designation means that roughly one in seven publicly traded firms has acknowledged that its information architecture cannot reliably produce accurate financial statements. For a sector whose fundamental purpose is accurate risk pricing, that rate is a Management frequency signal.
The specific pattern of deficiencies reveals more. Material weaknesses related to lack of segregation of duties have been trending upward since 2021. Weaknesses related to IT systems, software security, and access controls have also increased steadily. These are not accounting errors. They are structural conditions in the information architecture: the controls that separate who can initiate transactions from who can approve them are weakening, and the technology systems that carry financial information are less secure than they were four years ago.
SVB provides the forensic demonstration. The bank’s held-to-maturity securities portfolio carried $15.9 billion in unrealized losses by late 2022. That information existed in the bank’s own systems. Risk management frameworks flagged the concentration. Internal risk metrics were breached. The management information was present. It did not reach the decision architecture with sufficient force to change the position before it became terminal. The Management frequency does not ask whether the information existed. It asks whether the information changed behavior. At SVB, the answer was no.
Where critical knowledge and capability have departed or concentrated in too few people. The Absence frequency in financial services operates at Strained, driven by elevated executive turnover that carries institutional risk knowledge out of organizations at rates that exceed historical norms.
S&P 500 CEO succession announcements increased significantly in 2025, driving the projected annual rate to 13%—well above the 10% recorded in 2024. External hires nearly doubled from 18% of CEO appointments in 2024 to 33% in 2025, the highest level in eight years. External succession has a structural rationale: new leaders break entrenched patterns, introduce perspectives unconstrained by institutional blind spots, and can redirect strategy faster than insiders who have adapted to the existing architecture. The framework does not dispute this. It observes the structural cost. When one in three new CEOs comes from outside the organization, the institutional knowledge those departing leaders carried—the relationships, the risk intuitions, the understanding of where the real exposures sit versus where the models say they sit—leaves with them. The new leader gains strategic freedom but loses structural context. Both conditions are real. The question is which matters more at the moment of departure, and that answer depends on where the organization sits across the other three frequencies.
CFO turnover is more acute. Global CFO departures reached 262 in 2025, up from 256 in 2024 and 5% above the seven-year average. For S&P 500 companies specifically, CFO turnover hit a seven-year high of 12% in the first half of 2025, with companies hiring a record 106 CFOs during the year—19% above the prior year and well above the seven-year average of 86. The CFO carries the organization’s financial risk architecture in operational memory. When CFO turnover reaches record levels, the continuity of that risk architecture is interrupted at the precise position in the organization where financial information is translated into strategic decisions.
The structural interaction matters: CEO turnover drives CFO turnover (new CEOs frequently replace the CFO as they reshape their leadership team), and both drive downstream departures of risk officers, controllers, and compliance leaders who carry the detailed knowledge of where the institution’s actual exposures sit. The departure cascades. Each level that turns over loses institutional knowledge that the replacement must rebuild, typically under time pressure and without access to the tacit knowledge the predecessor carried.
4. The 12 Public Dimensions
Twelve of the twenty Four Frequencies dimensions are measurable from publicly available federal data. In financial services, the combination of FDIC banking data, SEC disclosure filings, and BLS labor statistics provides structural visibility across all four frequencies.
5. The 8 Diagnostic-Only Dimensions
The following eight dimensions can only be scored through the Four Frequencies diagnostic engagement using behavioral intelligence data from inside the organization. Federal data reveals the sector-level structural conditions above. These dimensions reveal the organization-specific structural dynamics that determine whether your institution is absorbing compensatory load for the sector-level weaknesses, or compounding them.
The gap between what federal data reveals (12 dimensions) and what the diagnostic measures (all 20) is not a marketing device. It is the structural reality of organizational intelligence. Public data shows the sector-level weather. The diagnostic shows whether your roof leaks.
6. Forensic Evidence
The Financial Services sector has one published forensic case study in the Evidence Library. The Silicon Valley Bank analysis demonstrates the Four Frequencies framework’s explanatory power in a financial services context: where concentration in a single depositor type and asset class (Thinness), the regulatory de-supervision of mid-size banks (Permission), the divergence between internal risk metrics and management action (Management), and the departure of risk management continuity (Absence) interact to produce a failure that conventional financial analysis treated as a surprise but structural analysis identifies as a predictable outcome.
The counterargument is straightforward: SVB was a management failure, not a structural inevitability. Its leadership made specific decisions—removing interest rate hedges, accumulating long-dated securities in a rising rate environment, failing to act on internal risk metrics—that a competent management team would not have made. The framework does not dispute this. It asks a different question: what structural conditions made it possible for those decisions to persist uncorrected until the position became terminal? The answer involves all four frequencies. SVB is not an outlier. It is the most visible instance of structural conditions that remain present across the sector. The same Thinness pattern that concentrates banking assets concentrates depositor risk. The same Permission dynamics that weakened SVB’s internal risk governance operate in institutions that have not yet experienced the triggering event. The structural architecture is consistent. The triggering conditions vary.
7. Cross-Cutting Theme Connections
Three cross-cutting structural themes operate at elevated intensity in the Financial Services sector.
Cybersecurity
Financial institutions are among the most targeted organizations for cyberattack globally. The framework reads cybersecurity exposure in financial services as a compound structural condition. The sector’s consolidation (Thinness) means a successful attack on one large institution can disrupt services for millions of customers with no structural alternative. The management information complexity (Management) means that IT security weaknesses—which have been trending upward in material weakness disclosures since 2021—create attack surfaces that the institution’s own internal controls cannot reliably detect. And the executive turnover pattern (Absence) means that the institutional knowledge of where the actual security vulnerabilities sit, versus where the compliance reports say they sit, is interrupted each time a CISO or CTO departs.
Regulatory Dynamics
The 2018 regulatory rollback that raised the enhanced prudential standards threshold from $50 billion to $250 billion is a structural Permission condition with direct consequences. Institutions between those thresholds gained permission to operate with reduced oversight. SVB sat in that gap. The framework does not advocate for a specific regulatory threshold. It observes that the structural consequence of the threshold change is measurable: a category of institutions with systemic relevance operated with less structural constraint, and one of them failed in a way that required emergency federal intervention to prevent contagion. The regulatory architecture is itself a Permission structure, and changes to it create or remove structural constraints that either contain or amplify the sector’s other vulnerabilities.
Governance
Board independence, insider ownership patterns, and CEO pay ratios are not merely governance metrics. They are structural Permission indicators. When 19% of bank boards report domination by a single individual, the formal governance structure and the actual decision-making architecture are misaligned. That misalignment is the structural condition that determines whether risk signals reach the governing body with sufficient independence to change course. SVB’s board received risk information. The governance structure did not produce a response commensurate with the risk. The information was present. The permission to act on it was not.
8. Federal Data Sources
This assessment draws on structural data from five primary federal sources. Financial services is a Tier 1 data coverage sector: 17 metrics across multiple agencies, supplemented by SEC disclosure data that provides governance and risk management visibility unavailable in other sectors.
Additional data from: Federal Reserve Material Loss Review of Silicon Valley Bank (September 2023); FDIC Memorandum on SVB Officer and Director Litigation (2024); KPMG 2024 Material Weakness Study; Russell Reynolds Global CFO Turnover Index (2025); Conference Board CEO Succession Practices Report (2025); Bank Director 2024 Governance Best Practices Survey; Equilar CEO Pay Ratio data (2024).
9. What This Means for Organizations in This Sector
The structural conditions identified in this assessment are familiar to anyone operating inside a financial institution. The consolidation pressure, the regulatory complexity, the compliance reporting burden, the competition for experienced risk professionals. These are the conditions financial services leaders navigate daily. What this assessment adds is the structural architecture: how these conditions interact, where they compound, and which structural conditions are within organizational control versus which are sector-level forces.
Three structural observations emerge from this analysis. But first, the interaction mechanism. These four frequencies do not merely coexist. They connect through specific structural pathways. Consolidation (Thinness) increases the systemic consequence of any single institution’s failure, which increases regulatory scrutiny, which increases compliance burden, which consumes management attention (Management) that might otherwise monitor actual risk positions. The compliance burden drives demand for experienced risk and compliance professionals, whose departure rates are elevated (Absence), which concentrates remaining institutional risk knowledge in fewer people, which increases the vulnerability of the governance structure (Permission) to information gaps. Each frequency’s degradation connects to the others. This interaction pattern would be interrupted if any of several conditions changed: if new bank formation recovered to levels that restore structural diversity, if governance structures demonstrated independence under pressure rather than in proxy filings, if risk information systems measured structural position rather than regulatory compliance, or if executive retention stabilized enough to maintain institutional risk knowledge continuity. None of these corrections is currently observable in the federal data.
The gap between compliance reporting and structural risk position is the condition with the most immediate consequence. SVB passed its most recent regulatory examinations. Its capital ratios met requirements. Its compliance reporting was current. None of those metrics detected a $15.9 billion unrealized loss in its securities portfolio that was visible in its own internal systems. The Management frequency measures this gap: the distance between what the information system reports and what the structural position actually is. For any financial institution, the diagnostic question is not “are we compliant?” It is “does our compliance reporting describe our actual risk position, or has the reporting become a parallel reality?”
Executive turnover carries risk architecture knowledge that no onboarding process replaces. When a CFO departs—and they are departing at record rates—the organization does not lose a position. It loses the person who understood where the actual risk concentrations sit versus where the models say they sit. The experienced chief risk officer who has seen the specific conditions that precede a liquidity event. The controller who knows which reconciliation processes actually work versus which ones produce clean reports from unclean data. Record CFO turnover in a sector whose structural integrity depends on risk knowledge continuity is an Absence condition with direct Management consequences.
Sector-level consolidation and organizational-level resilience are not the same. The decline from 18,000 to 4,400 banking institutions and the concentration of 40%+ of assets in four banks are sector-level forces that individual institutions cannot reverse. But where risk knowledge resides within the organization, how management information flows between the trading floor and the board room, and whether governance structures exercise genuine independence versus procedural independence—these are organizational-level conditions. Some financial institutions carry structural strength that compensates for sector-level vulnerabilities. Others compound them. The difference is visible in the structural architecture: how the four frequencies interact within a specific institution, against the sector-level conditions documented here.