Supervising with a learning mindset

5 May 2026

By Sharon Donnery, Member of the Supervisory Board of the ECB, and Mario Quagliariello, Director of Supervisory Strategy and Risk at the ECB

Good governance begins at home

Well-run banks don’t fail. Financial crises have taught us – and sometimes the lesson has been painful – that safety and soundness cannot be assured by meeting capital or liquidity requirements alone. Often, failures reveal weaknesses in banks’ governance, such as insufficiently independent control functions, a lack of challenge and blurred lines of responsibility. That is because in banking, as in supervision, important decisions must be taken in a context of uncertainty.

As supervisors, we must make choices about where to focus our attention, which risks to prioritise and where intervention is most needed. If we spread our limited resources across too many risk areas and supervisory activities, we risk failing to deliver on our mandate. We also need collective supervisory judgement to ensure a level playing field for the banks we supervise. Sound internal governance and clear checks and balances are therefore necessary for supervisors as well as for banks.

Trends across the globe

A few weeks ago, we gathered in Frankfurt with representatives of the internal control functions of a dozen financial authorities from across the world to compare notes, share experiences and identify good practices. We learned that there is a strong trend towards reinforcing the role of these functions globally. Their activities are diverse and typically combine recurring quality checks and ad hoc reviews of specific projects.

While these financial authorities differ in scope, size and mandate, their control functions face remarkably similar challenges. A key takeaway was that effective checks and balances are not about frameworks on paper, but about how they operate in practice.

How do we strike the right balance between collaboration and challenge? A good practice for control functions is to be evidence-based, constructive and transparent with the teams whose work they are challenging.

To act effectively as a constructive or friendly contrarian, these functions need the right skills, stature and independence. Participants also noted that it can take time for internal challenge to have an impact, and that staff rotation helps to spread the right risk culture throughout an organisation.

Overall, there was broad agreement that the objective of internal control functions is to support sound supervisory judgement, to acknowledge the possibility that, with hindsight, some decisions could lead to suboptimal outcomes, and to collectively maintain a constructive learning mindset.

Our framework for internal checks and balances

At the ECB we created a “second line of defence” for supervision in 2020. It supports the Supervisory Board in defining supervisory priorities and challenging line supervisors to make sure that decisions are well thought through, that supervision is effective and that banks are treated consistently.

While the second line of defence is fully integrated within ECB Banking Supervision and works closely with the first line, its direct reporting line to the Chair of the Supervisory Board ensures independence from other functions.

The second line of defence provides a structured set-up to ensure rigorous internal challenge, consistency of supervisory judgement and adherence to a well-defined supervisory risk tolerance framework, where supervisors are empowered to make forward-looking, judgement-based decisions. The presence of the second line ensures there is always room for judgement in day-to-day supervision and helps achieve consistency through independent internal checks.

These internal checks and balances have an impact not only on our internal processes but also on the supervised banks themselves. This work contributes to our reform agenda to streamline banking supervision while safeguarding resilience. And it supports agility in the system by helping supervision adjust course as risks and priorities evolve. Let’s look at some concrete examples of how this works in practice.

Identifying risks and making sure they are addressed

We are working in a challenging risk landscape – think of cyber threats, geopolitical uncertainty and climate and nature-related challenges. The evolving nature of risks requires well thought-out, coordinated and flexible responses. With limited resources available to supervisors and increasing complexity in the risk outlook, it is important to identify areas that merit special supervisory attention.

Strategic priorities are set annually by the Supervisory Board based on initial input from the second line of defence on the main risks and vulnerabilities in the euro area banking sector. The priorities guide our strategic direction over the three-year period that follows. Given the ever-changing economic and financial environment, this strategy is forward-looking and adaptable, allowing us to use resources flexibly and adjust swiftly when necessary.

The publication of the priorities also makes supervisory action more transparent and predictable. It supports banks’ own planning and strengthens the accountability of ECB Banking Supervision to the European Parliament and European citizens. The aim is to foster a shared understanding of the key areas supervisors will focus on.

Over the past few years, for example, we have emphasised the importance of prompt remediation of long-standing shortcomings, for instance in climate risk management and risk data aggregation and reporting.

But it is not only about identifying risks; it is also about making sure those risks are addressed by supervisors. Supervisory priorities cascade down to the institution-specific level, which are shared with the banks. The second line of defence supports the efficient allocation of limited supervisory resources and helps align supervisory activities through integrated planning. Ultimately, this approach boosts efficiency and benefits banks by providing a clearer view of supervisory focus areas.

Ensuring consistent, effective and risk-based supervision

Risk-based, efficient supervision implies the application of expert judgement and, in line with the Basel Core Principles for effective banking supervision, that judgement is applied throughout the whole supervisory cycle. Common methodologies and clear internal guidance are the first line of defence. They aim to mitigate the risk of inconsistent outcomes in the supervision of the more than 100 banks which are supervised directly by the ECB.

On top of this, the second line of defence supports further consistency by reviewing supervisory outcomes and suggesting adjustments if the same vulnerabilities are being dealt with differently across supervised banks. It does this ahead of supervisory decisions, and both during and after the supervisory cycle.

Let’s look at some examples.

The second line of defence helps ensure that the requirements imposed on banks are consistent by reviewing supervisory outcomes. One of its main roles is benchmarking the results of the Supervisory Review and Evaluation Process (SREP) and engaging with Joint Supervisory Teams (JSTs) before the final SREP decisions are submitted to the Supervisory Board for approval.

While the supervisory outcomes may be refined based on these discussions, it is the JSTs that ultimately decide on and implement the strategy chosen for a given bank. Internal, independent checks and balances are critical for promoting a level playing field and preserving the flexibility needed for bank-specific supervisory judgements.

Further, ex post reviews can trigger changes to approaches and processes or provide input into ongoing reforms. For instance, there has been agreement on the gradual move to more risk-based, timely and focused on-site inspections and internal model investigations, with findings limited to critical aspects. In the area of risk data aggregation and reporting, the second line of defence has helped to instil a greater sense of urgency about the need for timely remediation of long-standing shortcomings. At the same time, it has helped set clear expectations and milestones.

One concrete example is the ECB’s review of internal ratings-based (IRB) model supervision, a key and resource-intensive activity. The assessment focused on possible ways to increase the efficiency of the process and the consistency of the outcomes from different perspectives, from the planning and decision-drafting stages to the ongoing model monitoring performed by JSTs and the identification and investigation of suspected breaches related to IRB models.^[1]

Another more recent example is leveraged finance. In 2023 ECB Banking Supervision launched a series of on-site inspections to check leveraged loan portfolios at 12 banks. The project was completed at the end of 2025, when the ECB sent final follow-up letters to banks. Given its scale and complexity, the exercise was then reviewed by the second line of defence, which helped identify where internal governance and resource planning could be strengthened. These insights help us learn from past experience and improve the way on-site projects are designed and executed.

Also recently, the second line of defence has started work on assessing ECB Banking Supervision’s ability to deliver on its priorities and ensure that banks remediate existing shortcomings. The approach taken emphasises measurable outcomes, ensuring that supervision is impactful and aligned with our goals and, ultimately, making ECB Banking Supervision more accountable.

Looking ahead

Adequate internal controls and a culture of constructive internal challenge are indicators of a mature organisation. ECB Banking Supervision has made significant strides over recent years with the introduction of the second line of defence. Not only is this a concrete way of improving the quality of our actions, it also reflects a tangible commitment to aligning with the good governance standards we expect.

From an organisational perspective, the second line of defence sits very close to the first line, remaining independent but not isolated. This ensures a good understanding of supervisory matters and allows close collaboration and regular engagement with supervisory teams, while preserving the “four eyes” principle. The ability to provide a different angle as a friendly contrarian continues to play a pivotal role in an increasingly complex and uncertain risk environment.

This supports effective day-to-day supervision and is in line with the SSM-wide “Next-level supervision” reform agenda. It also increases confidence among stakeholders that supervisors’ actions are proportionate and targeted to risks.

Supervising with a learning mindset ultimately means learning continuously – from our own experience, from our peers and from the changing environment around us.

Check out The Supervision Blog and subscribe for future posts.

For topics relating to central banking, why not have a look at The ECB Blog?

References

• Basel Committee on Banking Supervision (2024), Core principles for effective banking supervision, Bank for International Settlements, April.
• Buch, C. (2025), “Incentives matter: what is different in banking and what role does supervision play?”, speech at the Frankfurt School of Finance & Management, 22 October.
• Enria, A. (2025), “Moving the Dial: Fostering a Culture of Supervisory Effectiveness”, Forum on Financial Supervision, Systemic Risk Centre, 9 October.