Supervisory priorities 2026-28: charting a course through turbulent waters

22 January 2026

By Sharon Donnery, Member of the Supervisory Board of the ECB, and Mario Quagliariello, Director of Supervisory Strategy and Risk at the ECB

The European banking sector is navigating a challenging external environment. The risk outlook is being reshaped by heightened geopolitical risks, elevated uncertainty and structural shifts driven by technological innovation and climate and nature-related crises. The ECB Banking Supervision must rise to these challenges by allocating our supervisory resources efficiently in support of our risk-based and forward-looking strategy. To achieve this, the ECB will continue to focus on the issues of greatest relevance to the banks we supervise, and our Joint Supervisory Teams will follow up on individual banks’ vulnerabilities.

For the 2026-28 period, the Supervisory Board has set two key priorities to guide our supervisory efforts. The first is to improve banks’ resilience to geopolitical risks and macro-financial uncertainties. The second is to ensure that banks strengthen their operational resilience and ICT capabilities to avoid disruptions to critical operations and services. This covers banks’ digital strategies, governance and risk management practices – including those linked to artificial intelligence.

Geopolitical risks: understanding persistent challenges

Geopolitical uncertainty continues to surge, driven by protectionism, geoeconomic fragmentation and increasing global tensions. For example, rising tariffs related to US trade policies show how geopolitical challenges can disrupt the real economy and financial markets. Combined with climate and nature-related crises, demographic shifts and technological disruptions, these risks exacerbate existing structural vulnerabilities and boost the likelihood of extreme events. In the past, governments used fiscal measures to mitigate the impact of economic shocks. However, high public spending and fiscal constraints may reduce their ability to do so in the future. While the European banking sector has proved to be broadly resilient and the overall impact of some of these structural shifts may appear contained so far, their full consequences are yet to be seen. We need to remain vigilant.

Our supervisory priorities and workplan for 2026-28 address evolving risks while maintaining continuity with last year. We aim to foster consistent and effective risk-based supervision by considering both system-wide and bank-specific risks. Ensuring banks have adequate risk controls and governance in place to address geopolitical uncertainties remains a core focus of our work. For example, in the 2026 thematic reverse stress test, each bank will define its own geopolitical scenario, tailored to its bank-specific vulnerabilities.^[1] And in our regular supervisory dialogue with banks, we will look at how this cross-cutting risk driver is incorporated into their capital planning and stress testing, risk management frameworks and governance structures.^[2]

Financial and operational resilience: standing firm despite headwinds

Strengthening the financial and operational resilience of European banks remains our priority. Strong capital and liquidity positions, in combination with sustainable profitability, should ensure banks are well-positioned to navigate the current risk landscape. At the same time, they need to be ready for the challenges ahead and maintain sound risk profiles.

To achieve this, it is crucial that banks ensure they are prudent when taking risks and that they maintain sound credit underwriting standards to preserve asset quality even during a downturn.

We will assess how banks plan to mitigate potential credit losses by conducting a thematic review of credit underwriting standards with a focus on new lending. We will also pay close attention to how banks adapt their frameworks to align with new requirements under the Capital Requirements Regulation. Ensuring new standardised approaches to credit and operational risk are implemented adequately is a must for quantifying the capital that banks need.

At the same time, climate and nature-related disasters are becoming more frequent, and transition risks are rising as momentum towards net-zero goals slows. As we approach the end of our multi-year programme launched in 2020, with banks having reached a mature level of risk management, and we will increasingly move towards supervising with a more business-as-usual approach in this area.^[3] Our efforts will thus progressively shift from remediation and expectational alignment towards supporting banks in planning their transitions.

It is imperative that banks avoid disruptions to critical operations and services by maintaining operational resilience. With this in mind, we will continue to assess their ICT risk management practices, with particular attention given to cybersecurity and third-party risk management. The introduction of the Digital Operational Resilience Act at the beginning of 2025 brought in new requirements on this front and we expect banks to implement them swiftly. Supervisors will also closely monitor follow-up actions to address deficiencies in risk data aggregation and risk reporting – ensuring banks meet relevant deadlines – given the slow pace of progress so far.

Looking ahead: preparing the supervision of tomorrow

The banking sector operates in a rapidly shifting landscape shaped by technological change – banks and their supervisors must adapt and stay ahead of emerging risks.

Accelerated digital innovation, particularly in AI, is transforming the banking industry. Banks must act strategically to harness the long-term value of AI, while addressing associated risks. We will expand our focus from prudentially relevant applications to generative AI more broadly, we will assess its impact on banks’ risk profiles and governance frameworks and we will engage with banks on how they are using these new tools. This will help us develop a stance on the materiality and risks of these applications and it will inform our supervisory approach in the future.

The evolving risk landscape, characterised by heightened uncertainty and increasing non-traditional risks, requires banks to strengthen their financial and operational resilience. It also necessitates a more agile, risk-focused approach from supervisors. So the ECB will continue to implement its reform agenda in 2026 in order to increase the efficiency, effectiveness and risk focus of European banking supervision.^[4] These initiatives aim at further streamlining supervisory processes and procedures in key areas beyond the standard annual health check we provide for banks, known as the Supervisory Review and Evaluation Process. This will create more capacity to react quickly to changes in the external environment and concentrate on areas of higher complexity and risk.

By making our processes more efficient, we expect to reduce the compliance workload and costs for banks, while always ensuring this does not come at the expense of the resilience that is so vital for keeping the European banking system safe and sound.

Check out The Supervision Blog and subscribe for future posts.

For topics relating to central banking, why not have a look at The ECB Blog?