Addressing the impact of geopolitical risk
Geopolitical risk is not a new risk. It is a cross-cutting risk driver that can have an impact on banks’ traditional risk categories. But geopolitical risks are heightened, affecting businesses, the economy and Europe’s banking sector. This calls for increased supervisory focus.
Banks need to remain resilient and ensure they are well prepared to manage the impact of geopolitical risk on their activities. To safeguard the financial system, European banking supervision is working with banks to develop good practices on how to manage these risks. If necessary, supervisory tools are used to ensure that banks improve risk management.
What is geopolitical risk?
Geopolitical risk refers to the threat, realisation and escalation of adverse events associated with wars, terrorism and any tensions among states and political actors that affect the peaceful course of international relations.
“Measuring Geopolitical Risk”, American Economic Review, 2022Economic policy uncertainty
Geopolitical risks have intensified in recent years, contributing to a significant increase in economic policy uncertainty in Europe and globally.
Source: policyuncertainty.com.
Notes: The index is a news-based index and captures economic policy uncertainty by counting the number of newspaper articles containing the terms uncertain or uncertainty, economic or economy, and one or more policy-relevant terms. The data are for the period from January 1997 to August 2025 for the index of economic policy uncertainty in Europe and for the period from January 1997 to July 2025 for the index of global economic policy uncertainty. The European index is based on newspapers in France, Germany, Italy, Spain and the United Kingdom. The global index is a GDP-weighted (at current prices) average of national Economic Policy Uncertainty indices for: Australia, Brazil, Canada, Chile, China, France, Germany, Greece, India, Ireland, Italy, Japan, Russia, South Korea, Spain, Sweden, the United Kingdom and the United States.
How do geopolitical risks affect banks?
Geopolitical risks can materialise as credit, market, operational and funding risks. Geopolitical shocks can be transmitted to banks and their operating environment through different channels.
A geopolitical shock can affect banks via the:
Financial market channel
Heightened uncertainty and risk aversion among investors and financial market fragmentation can trigger fluctuations in asset prices, leading to disruptions to global capital flows and increased market volatility. This can erode the value of banks’ asset portfolios or lead to direct losses on trading portfolios, increasing market and funding risks.
Real economy channel
Tariffs, sanctions and disrupted trade flows and supply chains can lead to inflationary pressures, change corporate and consumer behaviour and weaken the general economic conditions underpinning banks’ credit portfolios. This can raise credit risk and lead to higher default rates, increased provisioning for loan losses and pressure on banks’ capital positions.
Safety and security channel
Conflict and unrest can affect banks’ operational resilience, as can successful cyberattacks. Banks could face operational risks from cyberattacks and service interruptions. Their physical infrastructure or the infrastructure of critical third-party service providers may also be damaged.
Transmission of geopolitical tensions to banks
Transmission of geopolitical tensions to banks
Note: The transmission channels are shown in more detail in this diagram.
How are we incorporating geopolitical risk into our supervision?
Supervisory priorities
Geopolitical risk can affect traditional banking risks and was therefore already part of the ECB's supervisory priorities for 2024-26. We have strengthened the focus on this risk in the supervisory priorities for 2025-27.
Cyber resilience stress test
In 2024 we conducted a cyber resilience stress test to assess banks’ resilience to potential risks, since geopolitical upheaval may be associated with operational risks and cyberattacks. Geopolitical risk was also a key component of the 2025 EU-wide stress test and will be the focus of the 2026 thematic stress test.
Supervisory guidance
Given the cross-cutting nature of geopolitical risks, existing supervisory guidance can play an important role in helping banks to manage them. We are scrutinising banks’ overall planning processes. This includes examining their internal capital and liquidity adequacy assessment processes, recovery plans and internal stress-testing frameworks to assess their readiness to confront geopolitical shocks.
Market intelligence activities
In addition, ECB Banking Supervision is performing regular market intelligence activities and deep dives to better understand, identify and assess risks stemming from emerging geopolitical shocks and raise supervisors’ awareness of the related challenges. Increased awareness is useful for the dialogue with banks on managing geopolitical risks.
What do we expect from banks?
Banks must identify and manage all risks they are or might be exposed to in a prudent and conservative way, commensurate with the size and complexity of their business models and operations.
Geopolitical risks can be transmitted to banks via credit risk, liquidity and funding risk, market risk, business model risk, operational risk and governance. Banks are therefore expected to also consider geopolitical risks when identifying and managing their risks. Importantly, exposure to geopolitical risk is not confined to banks with a direct international footprint. Smaller banks, too, can be affected indirectly – through their corporate clients, reliance on international capital markets or outsourcing arrangements, particularly for ICT and cloud services that are concentrated among a handful of global providers.
At the same time, geopolitical shocks can manifest in highly idiosyncratic ways: depending on each bank’s counterparties, sectoral focus or operational dependencies, the same geopolitical event can have very different impacts across banks.
- A strong governance and risk management framework
-
Banks should consider the impact of geopolitical risk in strategic decision-making. They need strong governance arrangements, internal controls and risk management to effectively monitor and address risks, including geopolitical risks. Banks’ management bodies must align business objectives and risk appetite frameworks to balance risk-taking and risk control.
Clear and reliable risk data aggregation and reporting capabilities play a key role in supporting risk monitoring and decision-making in banks. The internal governance and risk management SREP methodology, the draft guide on governance and risk culture and the guide on effective risk data aggregation and risk reporting outline good practices that banks can draw on.
- Sound financial risk management
-
If needed, banks must take appropriate action to mitigate risks and prevent excessive risk-taking. They should adjust capital levels or make loan loss provisions as appropriate. Banks should continuously monitor the impact of geopolitical risk and have early warning systems in place.
To ensure adequate capital in relation to banks’ risk profiles, we have published a guide to the internal capital adequacy assessment process (ICAAP) and a guide to the internal liquidity adequacy assessment process (ILAAP). We have also shared best practices for capturing novel risks in loan loss provisions.
- Prudent capital planning and stress testing
-
Banks need tools to simulate the potential impact of geopolitical events on their financial stability and operational resilience. When a bank understands its exposure, it should take follow-up action to prevent or recover from the impact.
The report on banks’ ICAAP practices encourages banks to incorporate a broad range of adverse scenarios, including geopolitical risks, into their capital planning. The guide to the ICAAP also provides best practices for internal stress testing.
- Operational resilience
-
Geopolitical upheaval can generate cyber threats and disrupt services that have been outsourced to third parties. It can cause data leaks, pose physical security and safety risks and lead to international sanctions. Banks should therefore have robust compliance and monitoring frameworks in place.
To safeguard against these risks, banks should implement preventive measures and carry out contingency planning and staff training. The EU’s Digital Operational Resilience Act harmonises the rules relating to digital operational resilience that apply to different types of financial entities and their third-party service providers, and the guide on outsourcing cloud services to cloud service providers shares good practices for the implementation of cloud resilience measures.