Agile supervision amid uncertainty

Introductory remarks by Sharon Donnery, Member of the Supervisory Board of the ECB, at the Institute of International Finance

Washington DC, 24 April 2025

Introduction

Thank you very much for inviting me to this roundtable discussion.^[1]

Many of you may be familiar with the fable about the oak and the willow: while the oak stands firm, solid and unyielding – yet risks breaking under extreme pressure – the willow bends gracefully, adapting easily to changing winds.

Good supervision needs to combine the stability, predictability and structural integrity of the oak with the agility, adaptability and responsiveness of the willow.

In the current era of rapid change and relentless uncertainty, supervisors need to continue to anchor their decisions in sound principles and transparent objectives, but they also need to be agile to pivot quickly and respond to emerging risks.

Today, I will argue that our supervisory priorities for 2025-27^[2] offer a roadmap to do exactly that: they provide a clear and predictable framework while enabling us to remain flexible to respond to changing circumstances.

The current risk picture

Uncertainty may very well be the word of the year, if not the decade. News-based indices of uncertainty have increased significantly in recent years. Most notably, global trade policy uncertainty is at an all-time high.^[3]

Chart 1

Trade policy uncertainty

So, if there’s one thing we can be certain of, it’s uncertainty. But where do we go from here?

Our actions as banking supervisors need to be grounded in rigorous analysis and data-driven insights. Let’s start by looking at the hard data.

Despite all the uncertainty, the European banking sector has shown considerable resilience in recent years, maintaining strong capital and liquidity positions amid an unpredictable external environment. While banks have generally weathered recent shocks effectively, we should also acknowledge the important role that policymakers have played. In response to the sharp economic downturn during the pandemic, fiscal measures supported the financial position of households and firms, while accommodative monetary policy safeguarded the supply of credit. This, in turn, helped contain corporate insolvencies and credit losses.

At the end of 2024, banks under our direct supervision reported a Common Equity Tier 1 ratio of 15.9%, compared with 12.7% in the second quarter of 2015.

Asset quality remains generally solid across the sector, with the ratio of non-performing loans to total loans standing at 2.3%.^[4] This is a substantial improvement compared with a decade ago, when the ratio was close to 8%.

However, some vulnerable sectors, such as the commercial real estate and automotive sectors, warrant particular attention. In this context, banks’ provisions do not appear to sufficiently reflect downside risks, confirming some persistent shortcomings in their International Financial Reporting Standard 9 (IFRS 9) provisioning frameworks.

Bank profitability has increased in recent years, with an annualised return on equity of 9.54% in the fourth quarter of 2024. The outlook for profitability remains stable, despite the gradual decline in interest rates, and is being supported by rising non-interest income.

An agile supervisory approach

Now that we’ve looked at some hard data, let’s turn to the broader environment and how our supervisory priorities aim to respond to it. At the end of last year, we outlined three key priorities.

First, enhancing resilience to macro-financial and geopolitical risks.

Second, remediating persistent material shortcomings in a timely manner.

Third, managing risks from digital transformation and emerging technologies.

Let me walk you through each of them in light of recent developments.

The recent volatility has been a clear reminder that we must remain vigilant and continue to strengthen banks’ resilience to macroeconomic shocks and geopolitical tensions.

Rising protectionism, growing uncertainty and weakening international cooperation have created a more volatile and unpredictable environment. It is becoming harder to foresee where crises might come from, how they might spread across different sectors and what their overall impact on banks and economies might be.

Let us be clear: geopolitical risk is not new. In fact, history books could easily be mistaken for catalogues of geopolitical turmoil. And banks have had to deal with this type of risk since banking began. However, the world has become more interconnected, and the potential impact of geopolitical risks on the financial system and the broader economy is therefore greater.

Chart 4

Geopolitical risk index

(index: 1985-2019 average = 100)

To understand how geopolitical risks can affect banks, we have created a dedicated framework, focusing on three transmission channels: financial markets, the real economy and the safety and security risk channel.

Table 1

Transmission channels of geopolitical tensions to the macro-financial environment and banks

Geopolitical shocks could lead to unstable financial markets, disruptions to trade and supply chains, or threats to operations and security - in short, they have the potential to affect every part of a bank’s business. Banks should analyse their own business models, geographical coverage and sectoral exposures to better understand how geopolitical risk could affect traditional risk categories such as credit, market, operational, liquidity and funding risks. One key element of this is adequate scenario planning and consideration of actions that banks could take now or later in more severe scenarios. In this context, we are examining how banks are integrating geopolitical risks into their overall risk management, capital and liquidity planning and internal stress testing. This work will help us identify best practices and clarify our expectations for banks.

Geopolitical risks also play a key role in this year’s ongoing EU-wide stress test, the results of which are due to be published in August. The stress test scenario features substantial disruptions to international supply chains and international trade, causing a considerable slowdown in economic growth and an increase in energy and commodity prices.

Stress tests and forward-looking scenario analyses are key tools used by supervisors and banks alike to address emerging risks and to deal with uncertainty. That is why we are continuously updating our capabilities to run faster-paced forward-looking scenario analyses, sensitivity analyses and reverse stress tests. Enhancing our capabilities won’t make uncertainty disappear, but it will help us turn the unknown into something we can prepare for. At the same time, banks should also bolster their internal stress testing capabilities.

Let me now look at our second priority, which is the timely and effective remediation of persistent material shortcomings.

One key lesson learned from the events of March 2023 was how important it is to introduce timely, qualitative measures to ensure the safety and soundness of banks. A recent paper by the Financial Stability Institute summarised this nicely: act early or pay later.^[5] That’s why we decided to focus on remediating existing shortcomings using the right supervisory tools through an escalation ladder.

One key area of concern in this respect is risk data aggregation and reporting.

Uncertainty often stems from a simple but critical gap caused by a lack of reliable data. While data can’t eliminate all the unknowns, strengthening risk data management may be one of the best antidotes we have available. High-quality, timely and well-structured data allows banks to better understand potential vulnerabilities, spot emerging risks at an earlier stage and make more informed decisions. It is hard to imagine any bank being able to adequately manage and cover its risk exposures without having strong risk data reporting capabilities. In an unpredictable world, making full use of the existing data available is one of the most effective tools banks have at their disposal to help bring clarity to complex situations.

The governance and quality of risk data has been a priority area for European banking supervision for many years, also due to the fact that many banks have been formed through mergers, often without fully integrating or streamlining their underlying IT architecture. Despite this focus, banks have not paid enough attention to this topic and many structural shortcomings have yet to be tackled. Too many banks still need to make substantial improvements to their risk data aggregation and risk reporting capabilities, especially in light of the growing importance of data for banks’ digitalisation strategies.

This brings me to our third priority, which is banks’ digitalisation strategies and the challenges stemming from the use of related new technologies.

The accelerating pace of the digital transformation can also be seen as a source of uncertainty. The financial landscape is undergoing rapid change and new entrants are reshaping the market. While this fosters competition, it also poses a risk for those banks that fail to effectively embrace digitalisation, leaving them in danger of falling behind. The digital transformation is already reshaping banks’ business models, as those with a more advanced digital profile are evolving into banking-as-a-service providers.

Banks are investing in numerous initiatives aimed at achieving cost efficiency and modernising their back-end operations. At the same time, they are working to meet changing customer needs and remain relevant in a highly competitive environment through new sales initiatives, new digital brands or subsidiaries, and by bringing their digital payment capabilities into line with market standards.

As part of their digitalisation strategies, banks are adopting new methods of cooperation, including equity investment and strategic collaborations with fintech companies. Moreover, banks are becoming increasingly reliant on concentrated cloud service providers and innovative technologies, such as artificial intelligence.

The digital transformation therefore presents huge opportunities but also significant risks. From a business model perspective, the successful implementation of their digitalisation strategy represents a risk for many banks owing to their need for better project management capabilities. For example, they would benefit from having access to more granular key performance indicators to assess the impact these strategies might have on their profit and loss account. Against this backdrop, it is essential that management bodies take clear ownership of digital strategies, with boards ensuring robust oversight and regular challenge of their implementation and associated risk management.

From a broader risk management perspective, reliance on third-party providers and the use of technologies entails substantial third-party, IT, operational and cybersecurity risks. Our latest annual horizontal analysis of outsourcing arrangements shows that the dependence on ITC services performed in non-EU countries is growing. In addition, half of the cloud budget is spent on the top 30 external providers, showing increasing concentration risk.^[6] While this digital transformation is essential if banks want to maintain a competitive advantage and keep their customers satisfied, they should ensure that their risk management frameworks fully cover these transformation risks. For example, some technology solutions, such as generative artificial intelligence, are at the early adoption stage. Ensuring comprehensive risk management from this early stage onwards can help support efficiency gains as and when the technology is rolled out further.

Banks must strengthen their internal controls, enhance their governance around technological innovation and rigorously manage their third-party and outsourcing risks. A recent ECB cyber resilience stress test highlighted the need for business and technology processes to be aligned in terms of risk management, and banks were expected to promptly address any gaps identified to protect critical functions from cyber threats.

It is widely acknowledged that there is a connection between geopolitical risk and cyber risk. The increase in cyberattacks, particularly on third-party service providers, underscores the need for banks to reassess their outsourcing arrangements and improve their cyber resilience. In practice, banks need to involve their service providers in their incident response and recovery processes. The introduction of the Digital Operational Resilience Act (DORA) is a key step in enhancing operational resilience across the banking sector.

Conclusion

Let me conclude.

Uncertainty is a fact of life and a constant in both banking and supervision. As supervisors, we navigate our way through uncertainty every day, just as bankers do. Our role is not to add to that uncertainty but to reduce it where we can, by being transparent in our expectations and predictable in our actions.

The priorities I have outlined today are intended to help us do just that: provide a clear and predictable framework that reflects how we view the current landscape and how we intend to respond to the risks we see, by being agile but predictable.

Thank you very much for your attention.