Last quarter I reviewed the credit file for a mid-sized Indonesian manufacturer applying for a working capital facility. The numbers were healthy. The covenants were standard. The collateral was sufficient. What stopped me was the customer concentration disclosure: more than 60 per cent of the manufacturer’s annual revenue came from a single buyer in a sector currently subject to US export controls, with components sourced from a Chinese supplier whose parent company appeared on a US entity list earlier this year.
The credit risk, in conventional terms, was manageable. The geopolitical risk inside the credit risk was not, and the bank’s credit policy framework had no formal way of pricing it.
That kind of file is now arriving across ASEAN banking, multifinance, and trade finance functions in volumes the supervisory infrastructure designed for the older version of geopolitical risk has not caught up to.
The shift that happened
For most of the past two decades, geopolitical risk in ASEAN was a macro problem. It showed up as currency stress when capital flowed out, trade volume drops when major partners imposed tariffs, and cross-border funding stress during episodes of dollar tightness. The supervisory toolkit was correspondingly macro, capital adequacy buffers, reserve requirements, foreign exchange limits.
The decisions made in Washington, Beijing, and Moscow since 2024 have pushed risk down two layers, out of the macro statistics and into individual loan files, individual compliance reviews, and individual technology stacks. The macro toolkit has not stopped being useful. It has stopped being sufficient.
Where the imported risk now sits
Four transmission mechanisms deserve to be named.
Supply chain credit risk. ASEAN exporters are increasingly caught between US export controls and Chinese counter-measures. A borrower whose primary customer is now on a sanctions list, or whose primary supplier was added to an entity restriction, has experienced a material change in credit risk that conventional financial statements may not yet reflect.
Also Read: Code, power, and chaos: The geopolitics of cybersecurity
Sanctions compliance burden. The Russia sanctions architecture established since 2022 has been more durable and secondary-effect-heavy than ASEAN compliance teams initially modelled. Banks operating across multiple jurisdictions now face overlapping US, EU, and UK secondary sanctions regimes, with documentation requirements that exceed what regional supervisors require domestically.
USD funding fragmentation. The architecture for dollar funding in Asia has not broken, but it has become more conditional. Episodes of US monetary tightening now carry geopolitical signals attached, counter-China policy, sanctions enforcement, election-cycle volatility, that make dollar funding more expensive and more uncertain than the pre-2024 baseline.
Technology stack geopolitical risk. US export controls on semiconductors, cloud services, and AI infrastructure now reach into the technology stack of ASEAN financial institutions. The vendor a bank depends on for fraud detection, AI scoring, or core banking may itself be subject to restrictions on what it can sell or deploy in specific markets.
Why ASEAN risk teams are behind
Outsourced thinking. For most of the post-1997 period, ASEAN institutions could reasonably outsource geopolitical risk analysis to global research houses, ratings agencies, and the IMF. Since 2024, the gap between global frameworks and ASEAN-specific exposure has widened. The outsourced analysis is no longer applicable in the way it used to be.
Capacity gap. Few ASEAN financial institutions have an in-house geopolitical risk function with depth comparable to their credit, market, or operational risk teams. The volume of files now requiring that kind of analysis exceeds the capacity that exists.
Supervisory silence. ASEAN supervisors have updated frameworks for cyber risk, climate risk, and operational resilience over the past five years. Geopolitical risk frameworks remain conspicuously underdeveloped. The supervisory expectation is unclear, which produces uneven institutional responses.
What is starting to work
Geopolitical exposure mapping. Large ASEAN banks are mapping the geopolitical exposure inside their major credit relationships, which clients are sanctions-exposed, which supply chains run through controlled jurisdictions, which technology dependencies sit inside sanctions architecture.
Also Read: The shifting geopolitics of sustainability, energy, and climate
Geopolitical scenarios in stress testing. Some institutions have added explicit geopolitical scenarios to internal stress tests, a sustained US-China trade dislocation, a Taiwan escalation, a sanctions tightening event, and tested portfolio impact.
Cross-functional geopolitical desks. The institutions making the most progress have created small cross-functional teams including treasury, compliance, credit, and government relations, meeting frequently enough to translate breaking developments into specific portfolio decisions.
What needs to happen
Build in-house geopolitical capability. Outsourcing to global houses is no longer sufficient. ASEAN institutions need staff who can read the same primary sources as their compliance counterparts in New York or London, in real time, and translate them into local decisions.
Update credit policy to include geopolitical exposure. Credit committees should require explicit geopolitical exposure disclosure for material relationships, alongside traditional credit metrics.
Develop supervisory expectations. ASEAN regulators should publish frameworks for geopolitical risk in financial institutions, institution-level frameworks that match what cyber and climate already have.
The macro stakes
For most of my career, geopolitical risk was something ASEAN’s central banks worried about during crises and the rest of the financial sector worried about as background context. That arrangement worked because the geopolitical risks of the post-1997 era were episodic. The current era is not.
The decisions being made in Washington, Beijing, Moscow, and Brussels are now landing inside ASEAN balance sheets month after month, across loan files, vendor contracts, technology stacks, and compliance frameworks. The institutions that adapt their risk infrastructure to that reality will be the ones still functioning when the next material geopolitical shock arrives.
The imported risk is no longer arriving once a decade. It is arriving once a quarter. The risk function that absorbs it has to absorb it that often too.
—
Editor’s note: e27 aims to foster thought leadership by publishing views from the community. You can also share your perspective by submitting an article, video, podcast, or infographic.
The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of e27.
Join us on WhatsApp, Instagram, Facebook, X, and LinkedIn to stay connected.
The post The imported risk: How geopolitics moved from ASEAN’s macro problem to ASEAN’s balance sheet appeared first on e27.