A financial system built on layered promises and dense interconnection (the last two lessons) is only as safe as its guardrails. This lesson is about the rules and mechanisms — often invisible, occasionally the difference between a bad day and a depression — that keep the whole thing standing.
Capital: a buffer of the bank's own money
The first and most important rule: banks must hold capital — a cushion of their own money (equity) that absorbs losses before depositors and the wider system are hit. If a bank makes bad loans, its capital shrinks first; only if losses exceed capital does it fail. The international framework for this is the Basel Accords (Basel I, II, III), agreed after each crisis exposed the last set of rules as too thin. Basel sets how much capital a bank must hold against its risks — more capital for riskier assets — turning "don't take reckless bets with depositors' money" into enforceable ratios.
Liquidity: solvent isn't enough
A bank can be solvent (assets exceed liabilities) yet still fail if it can't pay withdrawals right now — because its money is tied up in long-term loans while depositors want cash today. That is a liquidity crisis, and it is exactly what a bank run triggers. Post-2008 rules (also under Basel III) require banks to hold enough easily-sellable assets to survive a stress period, and the central bank stands behind them as lender of last resort. Solvency and liquidity are different failures, and the rules guard against both.
Clean money: AML and KYC
Regulation isn't only about stability — it's also about not being a getaway car for crime. Know Your Customer (KYC) rules require institutions to verify who their customers really are; Anti-Money-Laundering (AML) rules require them to monitor transactions and report suspicious activity. Together they aim to stop the financial system laundering the proceeds of crime, terrorism and sanctions evasion. This is why opening an account means showing ID, and why unusual transfers can get flagged — the inconvenience is the system doing its job.
Settlement risk: the lesson written in a bank's collapse
Recall from Foundations that "credited is not settled." The danger in that gap has a name and a famous casualty. In 1974, Herstatt Bank was shut down by regulators mid-day — after it had received payments in one currency but before it had paid out the other side in another time zone. Its counterparties were left having paid and received nothing. This settlement risk (still called "Herstatt risk") was so alarming it drove decades of infrastructure to eliminate it: payment-versus-payment (PvP) systems like CLS that settle both currency legs simultaneously, and the move toward real-time settlement. A single bank's failure rewrote how the world settles foreign exchange.
The pattern across all of this: every major rule is scar tissue from a past disaster. Which is a fitting note to end on — because the system keeps evolving, and the frontier is being written now.