Current financial regulation allows banks to use proprietary models for determining their risk-based capital requirement. We study the moral hazard problem that arises when banks decide to use biased models for determining their risk weights. In our theory banks would use downward-biased models if the risk of getting caught by the regulator is low. We use a publicly available dataset to estimate the magnitude of this effect for European banks. We find evidence that banks do indeed report downward-biased risk weights if the risk of getting caught by a regulator is low. We find a significant increase in internal risk weights at banks that have recently been subjected to external scrutiny by the International Monetary Fund. We argue that proposed regulations to harmonize risk weights should explicitly address the moral hazard problem to avoid unintended consequences.