RHB Bank Group [KLSE: RHBBANK]

Zernil Lurthanathan, a seasoned professional in financial services, has built her career across central banking, the stock exchange and banking. A scholarship recipient and LSE master’s graduate, she progressed through risk management, regulatory strategy and analytics, and is now integrating these strengths in strategy, transformation and data-driven insight to drive a stronger risk culture.

In an interview with Enterprise Security Magazine APAC, Lurthanathan shared insights on the evolving role of analytics, governance and culture in modern risk management.

Driving Innovation and Impact Across Risk Functions

I began my career in risk management within Insurance before pursuing a master’s degree at LSE. My master’s was sponsored by the central bank, which provided me a good foundation for my future career growth.

There, I worked in both financial and non-financial risk, and later in prudential policy to understand the banking ecosystem, liquidity frameworks, culture and key regulations.

After about five years in central banking, I moved to the Malaysian Bourse to apply my skills in the equity and derivatives markets. I headed the regulatory strategy function under the chief regulatory officer for about five and a half years. The role covered the entire regulatory chain viewed through a strategic lens, with a good exposure to Board and senior management.

During this time, I also built data analytics capabilities. That experience propelled me to apply regulatory, risk and analytics expertise within banking.

That led me to setup and head a new function under the Group Chief Risk Officer’s office in a leading ASEAN bank for the next few years. Here, I drove strategic projects and built the risk strategy and business management office function from the ground up. I collaborated with fintechs and key stakeholders to successfully pilot and implement Risk Based ML models that shaped risk strategy and the way we worked across the regional risk footprint. This experience catapulted my career in banking as I later joined RHB, where I now work closely with the Group Chief Risk Officer. With my transferable and specialised skills, I established a new setup to drive risk strategy, transformation and risk analytics to scale the existing practices, navigate regulatory environments and drive meaningful change.

Today, I lead the risk strategy team, assessing emerging threats and innovating risk practices that would set us apart in the next three to five years. I also oversee risk transformation, including structural shifts and apply agile approaches. In this capacity, I drive key risk change programmes and amongst others, project directed the group-wide climate action programme. When stronger detection was needed, my team built risk analytics  and machine learning models to provide overlays and insights for both the business and the second line.

“I have never viewed risk culture as a slogan or compliance task. It must be measurable, actionable and tied to desired behavioural change.”

My role goes beyond regulatory work, anticipating future risks and pushing the organisation beyond a rulebook mindset. I oversee analytics, drawing on incident trends, behavioural patterns and cultural signals, shaping behaviours and elevating risk maturity across the group.

Ideas flow through risk forums, task forces and collaborative platforms. We experiment, measure impact within two to three months and adapt quickly. I apply behavioural analytics, strategic foresight and close engagement, focusing on areas most critical to the bank.

Defining Risk Culture with Data-Driven Decision-Making

My approach to strengthening risk culture is shaped by my analytics background and cross-functional experience in capital markets and banking. I have never viewed risk culture as a slogan or compliance task. It must be measurable, actionable and tied to real behavioural change.

What started as a survey review quickly shifted to benchmarked practices coupled with behavioural analytics. Using available data, in collaboration with relevant risk pillars, we defined the risk culture metrics and identified areas needing attention. Rising indicators prompted engagement with the 1.5 line officers to understand root causes.

This led to an ‘action on demand’ process. When metrics deteriorated, or when regional teams raised issues, we assessed the intervention required, whether it be targeted training, ML overlays or predictive models. Solutions were always customised.

As analytics became part of daily workflows, measurable improvements emerged. High-performing teams were recognised, encouraging wider adoption and several segments began driving the culture shift themselves. Training effectiveness was tracked and accountability was reinforced through visibility, early detection and behavioural insight.

What distinguishes my approach is its grounding in analytics and real-world engagement rather than abstract frameworks. Data informs where to act, insight shapes how to intervene, and refinement continues as conditions evolve. Most importantly, the focus remains on consistency. When an approach delivers results, it is allowed to mature and expand, ensuring culture improves through evidence, discipline and sustained effort rather than short-term initiatives.

The Role of AI

Banks have strict obligations and cannot compromise customer data or disclosures. Within these limits, AI can improve internal efficiency. Instead of manual research, it can quickly analyse external information without accessing customer data, making it valuable for research and risk strategy. It can also synthesise trends, scan news and detect signals that might otherwise be missed.

That said, AI use in a bank must sit within a clear framework that defines where, how and on what infrastructure it can be deployed. Those decisions fall under technology governance, while my role is to assess AI through a risk lens, ensuring it enhances efficiency safely.

We must also recognise risks such as fabricated or inaccurate outputs (hallucination), bias and ethical concerns. Flawed outputs cannot guide decisions, so controls and awareness are essential.

Within the risk function, adoption is still early, but we are exploring AI to boost efficiency and automate routine tasks.

Words of Wisdom

Every day and every role is different. It is vital to stay aware, learn continuously and acquire new skills quickly.

For me, three qualities define a strong risk professional: agility, nimbleness and humility.

I build teams with diverse backgrounds. Different perspectives challenge thinking and help solve complex problems, demonstrating true agility. Nimbleness means recognising when something isn’t working and changing direction instead of following sunk-cost logic. Humility is equally important. One must admit what they don’t know, stay curious and improve daily.

Risk is not a career for just specialisation. The role exists because organisations require broad experience, strategic thinking and a deep understanding of the discipline. A strong risk leader must master the industry, maintain a helicopter view and stay nimble enough to operate at a strategic level.

As the banking landscape evolves with AI, new technologies and business models, risk management must adapt just as quickly. Leaders must anticipate change, guide teams effectively and protect both customers and institutions. This combination of agility, nimbleness and humility defines the future of the profession.