Regulations leading up to the financial crisis of 2007-2009 provided incentives for banks shift their risk profiles toward less regulated areas. We focus on the case of operational risk which went from being a relatively benign and largely unregulated risk type to a major risk that now accounts for about 25% of large banks' risk profile. We show that capital-constrained banks aggressively took on operational risk as a mean of regulatory arbitrage. Indeed, this contributed to operational risk's rise to prominence as a leading risk type in the financial sector and worsened the effects of the crisis.