Foreword by Christine Lagarde, President of the ECB

European banks continued to navigate a challenging environment in 2023. They faced a weak euro area economy and rising geopolitical risks, especially from Russia’s unjustified war against Ukraine and the tragic conflict in the Middle East. Financial tensions in other jurisdictions affected funding markets in the spring. And, with inflation set to remain too high for too long, the ECB continued to tighten its monetary policy.

But the hard work done in previous years to make euro area banks more resilient has paid off. Banks maintained solid capital and liquidity positions, with the aggregate Common Equity Tier 1 capital ratio of supervised banks standing at 15.6%, close to its record-high level. This helped to shield the sector from external shocks and allowed banks to smoothly transmit the ECB’s policy tightening to the economy.

But several challenges remain. While higher interest rates affected euro area banks’ net interest margins, leading to an average return on equity of 10% in the third quarter of 2023, deposit rates are rising and non-performing loans are increasing. Supervisors will continue to closely monitor risks. In particular, they will keep a close eye on banks’ exposures to vulnerable sectors, such as commercial real estate, and address concerns about banks’ governance and internal risk control frameworks.

Resilience and adaptability will be crucial to confront the structural challenges posed by climate change and digitalisation. In 2024 banks are expected to meet the ECB’s supervisory expectations on climate-related and environmental risks and embed these risks in their strategies and risk management processes. And as the use of artificial intelligence becomes more widespread, supervisors will continue to scrutinise banks’ digitalisation strategies and their resilience to cyberattacks. These efforts will help to ensure that banks remain strong and continue to play their part in supporting the euro area economy on its path towards a greener and more digital future.

Introductory interview with Claudia Buch, Chair of the Supervisory Board

You took over as Chair of the ECB’s Supervisory Board in January 2024. What will be your guiding principle in carrying out this important task?

We must always remember that, as supervisors, we act on behalf of the public. Banks play a huge role in everyday life: they safeguard deposits, they facilitate payments and they lend money to households and firms. Our job is to ensure that banks are safe and do not take too many risks.

This has very practical implications: we need to be forward-looking and have a critical mindset, as set out in the Basel Committee’s Core Principles for Effective Banking Supervision. The forward-looking element is particularly important now that many economies and societies have reached a turning point. And we need to be critical, to think outside of the box. Well-functioning banks are clearly good for society. But banks are private entities and, ultimately, they act in the interest of their shareholders. It is our role as supervisors to ensure that they also act in the interest of society.

In 2024 European banking supervision celebrates its tenth anniversary. How mature is it, and what can still be improved?

With the Single Supervisory Mechanism (SSM), Europe has made significant progress as regards institution-building and delegating powers to the European level. A decade ago, the supervisory landscape in Europe was fragmented, in terms of both institutions and practices. Cross-border risks were often ignored, and it was impossible to benchmark banks against their peers. Supervisory standards differed across countries.

We now have strong supervisory powers at European level, while cooperating closely with national authorities. I think that the way in which European banking supervision is organised today can serve as a model for other policy areas where more integration may be needed.

But, of course, we can always improve. One of my goals is to make European supervision even more integrated. We have named 2024, our tenth anniversary year, our “year of integration”. It will include a number of initiatives to further promote knowledge sharing, invest in common supervisory technologies and leverage the expertise of national supervisors. This will foster our “one team” culture.

How do you think supervised banks fared in 2023?

European banks have proven resilient to the shocks that have hit our economies in recent years. The COVID-19 pandemic, rising energy prices and inflation, the Russian invasion of Ukraine and, more recently, the conflict in the Middle East have all put our economies under stress. The effects of these shocks are reflected in higher inflation and interest rates and weaker economic growth. We saw the sharpest increase in interest rates in the history of the ECB.

These higher interest rates are certainly an important driver of the strong increase in banks’ profitability, also because banks have been slow to pass on the increases to deposit rates. Banks’ capital positions have remained robust and well above regulatory requirements. European banks’ unrealised losses from the devaluation of securities have also been relatively contained. And their liquidity positions have remained strong, even after the gradual withdrawal of the ECB’s extraordinary liquidity support. This can be attributed to the regulatory and supervisory changes implemented after the global financial crisis. But we must also acknowledge that banks have benefited from the strong monetary and fiscal responses to past shocks.

So, there is no room for complacency. Macro-financial and geopolitical risks are heightened and, in many countries, the real economy needs to adjust to structural changes. This can affect banks through increased credit and liquidity risk. In fact, some emerging risks have already started to materialise. We are seeing increases in underperforming loans, in corporate bankruptcies and in default rates. We will continue our efforts to strengthen the resilience of the banks we supervise. And we will address identified shortcomings in their governance and risk management.

What lessons do you think European banking supervision can learn from the market turmoil of March 2023?

For me, the main lesson is that crises often happen when banks’ poor risk management is exposed by negative external shocks. This has two concrete implications for us.

First, as supervisors we have to be proactive and address findings early on. The events of March 2023 showed that even stress in smaller locally active banks can have global repercussions if not tackled proactively. Therefore, at international level, we are reviewing shortcomings in the regulatory framework, for example in the areas of liquidity risk and interest rate risk, and we are discussing the implications for supervisory effectiveness.

Second, we need a good understanding of how changes in the macro environment affect banks. The US and Swiss authorities have acknowledged that there had been risk management and governance deficiencies before the turmoil. In a benign macroeconomic environment, these fault lines do not do much harm. But when the tide turns, they become exposed and can damage the whole financial system.

Of course, having a sufficient level of capital in the system is the first line of defence against unforeseen events and external shocks. It also mitigates the negative impact of poor governance and deficiencies in risk management.

Supervisory effectiveness is a topical issue and was also the focus of a recommendation in the external assessment of the Supervisory Review and Evaluation Process (SREP). How do you intend to make European banking supervision more effective?

For a supervisor, being effective means ensuring that relevant findings translate into concrete improvements in banks’ risk profiles and resilience. This is a major lesson from the events of last spring. But being effective also means focusing on relevant risks.

In fact, we have been paying attention to the effectiveness of European banking supervision for a while now. I am very grateful to Andrea Enria for having appointed an expert advisory group to review the SREP. The group’s report contains clear recommendations for us: we should become more adaptable, intrusive and risk-focused; enhance our efficiency and effectiveness; and make full use of all supervisory tools.

We have discussed these recommendations extensively within the Supervisory Board. Some were implemented in the 2023 SREP cycle. We have a new risk tolerance framework and a multi-year SREP assessment, which gives supervisors more flexibility to focus on individual banks’ vulnerabilities. Other recommendations will be considered for the 2025 SREP cycle. We are also strengthening our supervision by using more intrusive measures, as Frank Elderson explained in a recent speech.

What do you think will be the biggest challenges for European banks in the near future?

I would say that the biggest challenges facing banks are the changes in the macro-financial and geopolitical environment and the evolving competitive landscape.

We are coming out of a period of ultra-low interest rates. That environment may have prompted banks to take on more risk to support profits. Despite recent shocks to GDP, insolvencies and defaults have remained at very low levels, as have banks’ loan loss provisions. This disconnect is in large part due to the unprecedented fiscal and monetary support that shielded banks’ balance sheets from those shocks.

This has implications for future risk assessments, as past data on loan defaults do not truly reflect the risks to asset quality that lay ahead. And many of the risks to which banks are exposed, such as cyber risk, climate-related and environmental risks and geopolitical risks, have only emerged more recently.

It is therefore crucial that banks adjust their risk management practices to the new environment.

The second challenge facing banks is the changing competitive environment. Non-bank financial institutions have increased their market share, and while innovations such as distributed ledger technology and artificial intelligence provide opportunities for banks to boost their productivity, they also enable new market entrants to challenge existing business models. Innovation and increased competition may improve economic welfare, but they also create new risks. If banks see their margins being squeezed, they may turn to potentially riskier activities. They might, for example, relax their underwriting standards. We are therefore keeping a close eye on banks’ exposures to non-banks and the digital ecosystem and we are monitoring how their business models are affected by increased competition.

How do you see the future of the banking union?

We have made very good progress on the first two pillars of the banking union – supervision and resolution – but the third pillar, deposit protection, is moving much more slowly. I think that further delays in completing the banking union could prove harmful. We need to prepare for a potentially more adverse environment, and this requires closing the remaining gaps in the European crisis management and deposit insurance frameworks.

The three pillars of the banking union are in fact closely connected. Supervision ensures that bank failures are unlikely and, if they do occur, are not severe. But even the highest quality supervision cannot, and should not, prevent all failures. When failures occur, disruptions to banking services should be minimised and taxpayers’ money should be protected. That’s where the second pillar comes in – a credible and efficient resolution regime under the auspices of the Single Resolution Board.

More work is clearly needed on the third pillar – a common deposit insurance scheme. Deposit insurance is essential to protect depositors. But, as with any insurance, it can foster moral hazard and risk-taking. That’s why European banking supervision ensures high supervisory standards are applied consistently across all participating countries.

At present, deposit insurance is largely organised at the national level, which is not compatible with European-level supervision and resolution. We need a European deposit insurance scheme to ensure a uniform level of depositor protection across the euro area. This could also promote better integration of banking markets and cross-border risk sharing.

I would also like to stress that legacy assets are no longer a reason to delay the next steps. When the banking union project started, it made sense to first focus on removing legacy assets from banks’ balance sheets. This has now been achieved – the non-performing loans ratio of significant banks has fallen from 7.5% in 2015 to 1.9% in the third quarter of 2023, close to its record low.

1 Banking Supervision in 2023

1.1 Resilience of banks under European banking supervision

1.1.1 Introduction

The 2023 Supervisory Review and Evaluation Process (SREP) confirmed that euro area banks continued to exhibit resilience, with robust capital and liquidity positions, in spite of the uncertain economic environment. Banks are overall well capitalised. The aggregate Common Equity Tier 1 (CET1) capital ratio of significant institutions (SIs) returned to the historical highs seen in 2021, standing at 15.6% in the third quarter of 2023, while it reached 17.7% for less significant institutions (LSIs). The aggregate leverage ratios also improved, reaching 5.6% (+0.5 percentage points) for SIs and 9.3% (+0.7 percentage points) for LSIs.

On aggregate, SIs also have ample liquidity buffers in terms of the regulatory requirements, in spite of the decline in these liquidity buffers since the start of the current monetary policy tightening cycle. In the third quarter of 2023, the aggregate liquidity coverage ratio of SIs was 159%, up from around 140% before the pandemic. For LSIs, this ratio stood higher, at 205%.

However, subdued economic growth in the first nine months of 2023, the weak economic outlook in the face of tighter financing conditions, and elevated geopolitical tensions all contributed to a high level of uncertainty surrounding the macro-financial environment.

In the third quarter of 2023, SIs’ aggregate annualised year-to-date return on equity stood at 10%, unchanged compared with the previous quarter and up from 7.6% one year earlier. LSIs generated a lower annualised year-to-date return on equity, standing at 8.0% in the third quarter of 2023, down from 8.3% in the previous quarter but up significantly from 1.3% one year earlier.

Net interest margins were the main profitability driver in 2022 and the first nine months of 2023. This more than offsets the stagnant or slightly declining lending volumes. Revenues from trading and investment banking decreased by 5% compared with 2022, with subdued fees from equity, fixed income and commodities in the second quarter partially compensated by a buoyant third quarter and, for some banks, by credit trading.

In 2023 supervisors continued to keep a close eye on issues such as the sustainability of surging profitability and credit risk stemming from exposures to vulnerable sectors, such as residential and commercial real estate. Internal governance and risk management also remained an area of focus for supervisors. Higher funding costs were the main downside risk to euro area banks’ profits. The cost of deposits, which has adjusted slowly thus far, is expected to increase further as competitive pressure increases and depositors shift their funds from overnight deposits to time deposits that yield higher remuneration.

Data from the first nine months of 2023 show a gradual, albeit modest, increase in the volume of non-performing loans (NPLs). Inflationary and market pressure on vulnerable credit risk portfolios such as consumer credit, residential and commercial real estate, as well as on small and medium-sized enterprises, continued. Consequently, increased provisions owing to higher credit risk may weigh on future profits.

1.1.2 Stress testing and ad hoc data collection of unrealised losses

1.1.2.1 Stress testing of euro area banks

In 2023 the ECB performed two stress-testing exercises for euro area SIs. 57 large euro area banks took part in the EU-wide stress test coordinated by the European Banking Authority (EBA). Another 41 medium-sized SIs took part in the parallel stress test coordinated by the ECB. These two exercises constituted the annual supervisory stress test that the ECB is required to carry out under EU law.^[1]

The EBA published detailed results of its 2023 EU-wide stress test for the 57 largest euro area banks. The ECB published individual results for the additional 41 medium-sized banks, as well as a report on the aggregate final results of its stress test of euro area banks for the full sample of 98 supervised entities.

The ECB’s 2023 stress test results showed that the euro area banking sector could withstand a severe economic downturn. Under the adverse scenario, the CET1 ratio would, on average, fall by 4.8 percentage points, to 10.4%, at the end of 2025.^[2] The marked improvement in banks’ asset quality and profitability compared with the previous exercises, along with the significant capital accumulation over the last decade (Chart 1), helped banks weather the high severity of the adverse scenario. That said, the stress test also identified potential vulnerabilities, calling for the continued monitoring of risks.

The ECB uses the stress test results as input for the annual SREP. The quantitative results play a key role in defining the Pillar 2 guidance, which for the first time also includes a leverage ratio Pillar 2 guidance, where appropriate. The qualitative results of the stress test are included in the risk governance part of the SREP, thereby potentially influencing the Pillar 2 requirements.

Chart 1

Developments in CET1 ratio starting point and projections

(percentage points)

1.1.2.2 Data collection to assess unrealised losses in euro area banks’ bond portfolios measured at amortised cost

The EBA and ECB also carried out an ad hoc data collection to comprehensively assess the risks related to unrealised losses in banks’ bond portfolios measured at amortised cost and the related hedges. The amount of net unrealised losses in euro area banks’ bond portfolios is overall contained, standing at €73 billion as at February 2023, after taking into account the effect of fair value hedges. The additional losses, net of fair value hedges, projected under the adverse scenario of the EU-wide stress test would amount to €155 billion. However, the materialisation of these unrealised losses should be regarded as an unlikely, hypothetical outcome, since banks’ amortised cost portfolios are designed to be held to maturity and banks would typically turn to repo transactions and other mitigating measures before liquidating their bond positions. The ECB published the individual results of banks’ carrying and fair value amounts for these bond portfolios as at February 2023.

1.2 Supervisory priorities for 2023-25

1.2.1 Introduction

In 2022 Russia’s invasion of Ukraine and its macro-financial consequences increased uncertainty about developments in the economy and the financial markets, while heightening the risks to the banking sector. Against this background, supervised entities were asked to strengthen their resilience to the immediate macro-financial and geopolitical shocks (Priority 1). In particular, the ECB demanded that banks focus on their credit risk management frameworks and target those sectors prone to deteriorating credit risk. The ECB also further scrutinised the adequacy of banks’ funding plans and the diversity of their funding sources. In addition, banks were asked to address digitalisation challenges, strengthen their management bodies’ steering capabilities (Priority 2) and step up their efforts to address climate change (Priority 3).

The ECB continuously assesses and monitors the changing nature of the risks and vulnerabilities faced by supervised entities. This agile approach allows the ECB to flexibly adjust its focus to changes in the risk landscape. In 2023, the continuous monetary policy tightening employed by several central banks highlighted the importance for banks to prudently manage their exposures to interest rate risk and credit spread risk in the banking book (IRRBB/CSRBB). Furthermore, following the market turmoil in spring 2023, which was marked by the failure of some medium-sized banks in the United States, the ECB adjusted its supervisory priorities and extended its targeted review of IRRBB/CSRBB to a wider scope of institutions. At the same time, the ECB carried out ad hoc analyses to identify banks’ potential vulnerabilities stemming from unrealised losses on their balance sheets. Moreover, the heightened risk posed by the commercial real estate business made supervisors reprioritise certain on-site inspections to assess banks’ management and mitigation measures for some of the riskier counterparties operating in this sector.

1.2.2 Priority 1: Strengthening resilience to immediate macro-financial and geopolitical shocks

1.2.2.1 Shortcomings in credit risk management, including exposures to vulnerable portfolios and asset classes

Throughout 2023 supervisors continued to implement a credit risk work programme focused on addressing structural deficiencies in banks’ credit risk management frameworks, including the area of real estate and vulnerable portfolios. Amid rising interest rates and macroeconomic uncertainty, it is especially important for supervisors to ensure that banks proactively address emerging credit risk in vulnerable portfolios and asset classes. Loan origination is also a key component of the credit risk management cycle of a bank and is increasingly becoming the focus of supervisors, because originating good quality loans can help prevent future NPLs. In 2023, the ECB continued its focus on NPL management^[3] and related activities, ensuring that if NPLs begin to rise, banks are equipped to react proactively with recourse to the appropriate processes and procedures.

Despite a relatively stable NPL ratio at the aggregate level in the 2023 cycle, the ECB observed a deterioration in specific portfolios more vulnerable to inflationary pressure, including loans to households^[4]. It also observed a downturn in commercial real estate markets,^[5] together with increased pressure on borrowers’ ability to refinance maturing commercial real estate loans. Moreover, corporate bankruptcies and default rates increased from the low levels seen during the pandemic.^[6] Euro area firms, particularly small and medium-sized enterprises, also continued to face challenges from higher funding costs but also higher costs in general owing to inflation^[7]. Highly indebted firms, or those firms operating in vulnerable sectors, were more affected by higher costs and lower demand, which in turn put pressure on profit margins.

Supervisory activities and outcomes

The off-site and on-site activities performed in 2023 revealed that banks have made progress in mitigating the risks related to vulnerable portfolios and asset classes. However, several shortcomings remained unaddressed.

Recent in-depth assessments in areas such as forbearance^[8] revealed significant gaps in some banks’ preparedness for dealing with an increase in distressed debtors and refinancing risks, including identifying and monitoring clients in financial difficulty. The assessments also showed that banks need to pursue more proactive remedial actions. On-site inspections and targeted reviews of IFRS 9 provisioning practices (including overlays) revealed that while many banks have adequate practices in place, a considerable number need to better capture emerging risks and better reflect these in their staging approach. For all these supervisory activities, a set of supervisory measures have been communicated to banks to ensure that remediation occurs in a timely manner. The ECB closely monitors the planned remedial actions and their implementation.

Specifically focusing on the portfolios of loans to households, a targeted review of residential real estate lending found that banks have limited capabilities to anticipate risks and differentiate them both at origination and in pricing. This targeted review involved a sample of 34 SIs with material portfolios including residential real estate exposures. Several cases of non-compliance with the EBA Guidelines on loan origination and monitoring came to light, also in the area of collateral valuation processes.

In-depth assessments of banks’ commercial real estate unveiled exposures with bullet or balloon and floating rate loans, as well as potential collateral overvaluation (see Box 1).

Detailed findings from the off-site and on-site supervisory activities were communicated to banks. Where appropriate, these fed into the 2023 SREP outcomes and the related supervisory measures discussed with the supervised entities as part of the regular supervisory dialogue.

Box 1
Commercial real estate: emerging risk

Commercial real estate (CRE) is a material asset class which accounted for €1.4 trillion of SIs’ loan books in the second quarter of 2023. €52 billion (3.67%) of CRE loans were classified as non-performing loans (NPLs) in that quarter. This corresponds to 15% of total overall NPLs, of which the majority stems from legacy NPLs from the 2008 financial crisis. Banks’ material exposures to CRE loans are particularly concentrated in German, French and Dutch banks (around 52% of total commercial real estate).

Chart A

Materiality of commercial real estate loans in significant institutions

(EUR trillions)

Following years of rising property prices, CRE markets are currently in a downturn,^[9] as signs of deterioration are becoming apparent across several euro area countries.^[10] Commercial real estate is facing tighter financing conditions and an uncertain economic outlook, as well as weaker demand following the pandemic.^[11]

The main factor negatively weighing on CRE markets was the increase in interest rates and the higher cost of debt financing. Together with higher construction costs and changing demand dynamics (i.e. remote working and more energy efficient retail space and offices), this was associated with a repricing in CRE property valuations (particularly office and retail), which is still ongoing. Furthermore, there was also a sharp fall in investment and transaction volumes and a halt on new constructions, as well as compressed returns on CRE properties, leading to negative margins.

Loans with a large balance falling due at maturity^[12] are often called “bullet” or “balloon” loans and are currently a particular focal point for the ECB owing to the current market conditions. A material share of these CRE loans are structured as bullet or balloon loans and as non-recourse loans. These types of financing structures pose higher refinancing risk, meaning that at maturity, borrowers may need to refinance their loans at much higher financing costs than originally foreseen. Other repayment options have also become challenging, as the deteriorating market conditions and higher financing costs also negatively affect the ability of the borrower to sell the asset and/or refinance the CRE loan at another bank.

Of the exposures captured in AnaCredit as at the second quarter of 2023, bullet/balloon type structures maturing in the next two years accounted for 8% of CRE loans. It is crucial for banks to actively engage with their CRE borrowers and assess the refinancing risk of CRE loans in a meaningful manner. They need to focus on the key considerations of this assessment, such as updated and realistic collateral valuations, the cashflow generation capability to cover financing costs, and where relevant, also sponsorship cash injection options.

Chart B

Breakdown of commercial real estate loans on varying repayment type structures by maturity end date

(share of total CRE loans)

The ECB continues to conduct a range of on-site and off-site supervisory activities^[13] to ensure active supervisory focus on commercial real estate risk. This active focus will continue into 2024,^[14] with supervisors keeping a close eye on banking and market developments in this material portfolio.

Counterparty credit risk and non-bank financial institutions

In 2023, the ECB followed up on the outcome of the work carried out on governance and management of counterparty credit risk by way of off-site and on-site activities. To this end, it published a report entitled Sound practices in counterparty credit risk governance and management summarising the outcome of the review performed in 2022 and outlining sound practices observed in the industry.

The ECB also organised a conference on counterparty credit risk for senior risk managers of SIs and other banking supervisors to discuss developments in the counterparty credit risk landscape and industry practices, as well as the current challenges and opportunities from both a practitioner’s and a supervisory perspective.

1.2.2.2 Lack of diversification in funding sources and deficiencies in funding plans

Over the past ten years, targeted longer-term refinancing operations (TLTROs) have supported banks in ensuring the supply of credit to the economy during crisis periods. That said, recourse to TLTRO III during the pandemic increased the concentration of liabilities considerably.^[15] Owing to the maturity of the loans under TLTRO III, SIs now need to develop and implement sound and credible multi-year funding plans that address the challenges stemming from changing funding conditions and ensure the appropriate diversification of funding sources.

In line with the supervisory priorities for 2023-25, and as part of a broader analysis of the feasibility of liquidity and funding plans, the ECB assessed the planned repayments of the loans under TLTRO III for those SIs more exposed to increases in funding costs. Most of the scrutinised supervised entities proved to have credible TLTRO III exit strategies in place and to continue to meet both the minimum liquidity coverage ratio and the net stable funding ratio. However, some proved to have a relatively high proportion of low-quality liquid assets in the Eurosystem’s collateral pool which, once released, could not be used as collateral for private secured funding transactions. Other SIs had made rather optimistic assumptions about their deposit increases, making their strategies less viable.

The failure of Silicon Valley Bank, as well as other regional banks in the United States, in March 2023 illustrated that depositors’ behaviour can change abruptly and without warning. Social media and digitalisation, combined with the attractiveness of alternative investment opportunities, can affect the speed with which depositors react to price signals and market rumours. Therefore, in 2023 the ECB initiated additional analyses of contingency plans and collateral mobilisation capabilities in order to understand the extent to which banks can withstand short-term liquidity shocks and unexpected crisis events, including high deposit outflows. This also involved evaluating asset and liability management strategies, as well as the modelling of behavioural assumptions in the current interest rate environment.

Continued supervisory scrutiny of exposure to interest rate risk and credit spread risk

In 2023 the ECB followed up on the outcome of its targeted review of exposure to interest rate risk and credit spread risk, conducted on 29 SIs in 2022^[16]. In the second quarter of 2023, the review was extended to include a new set of ten SIs. This initiative was complemented by on-site inspections. Furthermore, in the second half of 2023, the ECB initiated a horizontal review of the governance of assets and liabilities management involving 24 SIs and covering aspects related to both interest rate risk and liquidity risk management, such as the modelling of non-maturity deposits.

1.2.2.3 Leveraged finance

Since introducing reporting templates for leveraged finance in 2018, the ECB has observed a continued increase in holdings of leveraged loans by SIs. This increase was driven by sustained low interest rates and abundant liquidity, which encouraged higher leverage levels for borrowers and lenders, combined with a loosening of lending standards. Over the course of 2022 and in the first half of 2023, this trend was reversed. New leveraged loan issuances fell considerably on account of the energy crisis, inflation and interest rate volatility. This decrease is gradually being reflected in declining exposure levels across SIs (Chart 2). The combination of declining exposure levels and increasing CET1 ratio levels has led to a significant reduction in the leveraged finance/CET1 ratio over the past few quarters.

Chart 2

SI exposures to leveraged finance

(left-hand scale: EUR billions; right-hand scale: percentage of CET1 capital)

The ECB has, on numerous occasions, called for more restraint by SIs in this particular market segment because of the continued growth in highly leveraged transactions. As expected, increasing borrower weakness is being reflected through higher default rates for leveraged loans both in Europe and the United States. However, overall, these default levels remain low compared with previous periods of stress, which may be explained by the weakening of covenants observed in the market. Given the high debt refinancing risk facing leveraged finance borrowers in a higher interest rate environment, there is a risk of potentially much higher non-performing exposures and defaults materialising over the next few years.

In 2022 the ECB issued a “Dear CEO” letter with detailed expectations of the internal risk appetite frameworks to be implemented and it reported on high levels of risk-taking in leveraged transactions. A gap assessment revealed numerous deficiencies for which specific follow-up measures were imposed on SIs. Throughout 2023, the ECB continued to scrutinise banks’ progress in implementing these measures. While some progress could be observed in certain banks, significant risk control deficiencies persist. Therefore, the number of banks that were subject to specific capital charges for the risks associated with leveraged finance activities increased significantly compared with 2022.

Furthermore, to support the ongoing supervisory monitoring of banks’ leveraged finance exposures, the ECB included an in-depth quality assurance analysis of leveraged finance in its 2023 EU-wide stress test. The findings of this analysis were published in a dedicated section of the ECB report on the 2023 stress test of euro area banks.

1.2.3 Priority 2: Addressing digitalisation challenges and strengthening management bodies’ steering capabilities

1.2.3.1 Digital transformation strategies and operational resilience frameworks

Banks are becoming increasingly digital. This means that further supervisory attention needs to be paid to digital transformation strategies and the necessary risk management capabilities. This involves examining risks relating to the use of innovative technologies, as well as risks relating to operational resilience frameworks, such as dependencies on third parties and cyber risks.

With regard to digitalisation more generally, in February 2023 the ECB published an overview of the main takeaways from a survey on digital transformation and the use of fintech conducted in 2022. The overview confirmed that most SIs’ have a digital transformation strategy in place, which is focused on enhancing the customer experience. This overview also demonstrated the importance of having the right tone from executive management, as well as an effective internal control framework.

Further to this, targeted reviews on digitalisation were conducted for 21 SIs in 2023, building on the above survey results to better understand how banks define their digitalisation strategy objectives, monitor their implementation and ensure that their risk appetite frameworks and governance are fit for purpose. The results of these reviews are due to be published in the first half of 2024 and will be instrumental in providing supervised entities with the supervisors’ views and their benchmarks.

Regarding operational resilience, the number of significant cyber incidents reported to the ECB increased significantly in 2023 on a year-on-year basis. This increase was mainly driven by threat actors running distributed denial-of-service campaigns against several banks. This was accompanied by a notable surge of incidents at third-party service providers related to ransomware, a type of attack with a high potential for disruption. Furthermore, cyberattacks by state-sponsored actors also increased in the financial sector. The ECB therefore carried out a number of off-site and on-site supervisory activities relating to IT and cyber risk in 2023 and published the key results and observations in its November 2023 Supervision Newsletter.

In addition to the cyber resilience stress test planned for 2024, the ECB conducted an internal cyber resilience dry run to test the ECB’s and several NCAs’ internal communication, coordination and escalation processes in the event of a cyberattack on multiple supervised entities. This exercise was internal with no industry involvement.

With regard to outsourcing, the registers of all SIs’ outsourcing arrangements were again collected in 2023. Compared with the first submission in 2022, considerable progress was made in terms of data quality and consistency of the information collected. The results of this exercise confirmed that outsourcing is a highly relevant topic for SIs, particularly in the area of information and communication technologies. A well-established notification process informing supervisors about the intentions of supervised entities to conclude new outsourcing agreements lent additional support in assessing outsourcing risk. Additionally, the ECB initiated a targeted review of outsourcing risk, involving several SIs, which will continue until 2025. Each year, the outsourcing management framework of these SIs, together with a selected number of their outsourcing arrangements, will be reviewed. The exercise will provide a horizontal view of the risk management processes for outsourcing arrangements within SIs.

Furthermore, in line with international standards^[17], operational resilience and digitalisation were the focus of the supervisory activities conducted in working groups with other European supervisory authorities in 2023. These activities included the implementation of the Markets in Crypto-Assets Regulation and the Distributed ledger technology pilot regime, discussions surrounding the Artificial Intelligence Act and the implementation of the Digital Operational Resilience Act. The ECB also incorporated the Basel Committee on Banking Supervision’s Principles for Operational Resilience in its SREP framework.

1.2.3.2 Management bodies’ functioning and steering capabilities

To foster adequate decision-making and mitigate excessive risk-taking, it is crucial for banks to have effective management bodies, sound governance arrangements,^[18] robust internal controls and reliable data. The importance of having sound arrangements in place in these different areas was also illustrated by the bank failures which took place in the United States and Switzerland in the spring of 2023. These failures had governance and risk management deficiencies at their root. Despite some progress in recent years, the ECB continues to see a high number of structural deficiencies in internal control functions, management bodies’ functioning, as well as risk data aggregation and reporting capabilities.^[19]

Therefore, supervisors have continued to engage with supervised entities to achieve further progress in this regard. Since 2022 the ECB has performed targeted reviews of banks with deficiencies in the composition and functioning of their management bodies, on-site inspections and targeted risk-based fit and proper (re)assessments. The ECB has further developed an approach to reflect diversity in its fit and proper assessments and has refined its data collections to enhance peer analysis^[20], with targeted reviews and supervisory action continuing throughout 2024.

Follow-up action to address deficiencies also took place as part of the 2023 SREP (see Section 1.3.1.5).

Sound governance arrangements are essential for all banks regardless of their size. For this reason, the ECB continued to follow up on the results of its 2021-22 thematic review of the governance arrangements for LSIs.^[21] In this vein, the ECB and national supervisors have been continuing to promote greater alignment of European supervisory expectations and standards for internal governance.

Moreover, in an effort both to encourage dialogue about what constitutes effective governance and to communicate its supervisory approach and expectations in this regard, in April 2023, the ECB reached out to industry representatives in a seminar jointly organised with the EUI Florence School of Banking^[22].

1.2.3.3 Risk data aggregation and risk reporting

The ECB identified several deficiencies in risk data aggregation and risk reporting and included it as a key vulnerability in its planning of the supervisory priorities for the 2023-25 cycle. A comprehensive, targeted supervisory strategy covering both on-site and off-site activities was therefore developed with the aim of ensuring that banks have effective steering and risk management procedures in place based on reliable data.

With regard to the on-site activities, a dedicated on-site inspection campaign on risk data aggregation and risk reporting continued, covering 23 SIs over the course of 2022 and 2023. This campaign revealed shortcomings in terms of the involvement of management bodies, the unclear and incomplete definition of the scope of the data governance framework, as well as the lack of independent validation. Furthermore, weaknesses in data architecture and IT infrastructure, the extensive usage of manual workarounds and long reporting timelines, as well as a lack of data quality controls, were a major source of concern.

As for the off-site activities, a key pillar was the draft Guide on effective risk data aggregation and risk reporting, which includes a set of minimum requirements for effective risk data aggregation and risk reporting and is meant to assist banks in strengthening their capabilities in this regard.^[23] This draft Guide does not impose new requirements but rather consolidates and clarifies important supervisory priority topics. It is therefore important that banks do not see the latest publication of the Guide as an opportunity to reset the clock for their implementation deadlines but rather as further guidance for identifying gaps and achieving observable progress in closing them. Further supervisory activities included the pilot of the Management report on data governance and data quality^[24], the contribution to the progress report on global systemically important banks’ compliance with the Basel Committee on Banking Supervision’s Principles for effective risk data aggregation and risk reporting, the further strengthening of the measurement of data quality in supervisory reporting and the more effective use of supervisory tools to escalate severe, persistent deficiencies in risk data aggregation and risk reporting, including the related quantitative and qualitative measures.

1.2.4 Priority 3: Stepping up efforts in addressing climate change

Since the publication of the ECB Guide on climate-related and environmental risks in 2020, the ECB has consistently highlighted the need for banks to properly manage these risks. One of the ECB’s main supervisory priorities for 2023-25 is for banks to adequately integrate these risks into their business strategy and governance and risk management frameworks in order to mitigate and disclose such risks.

1.2.4.1 Follow-up on deficiencies identified in the thematic review

Following the 2022 thematic review on climate-related and environmental risks, the ECB set deadlines in order to smooth banks’ transition towards full alignment with the expectations outlined in the aforementioned ECB Guide by the end of 2024. The ECB communicated at that point that these deadlines would be closely monitored and, if necessary, enforcement action would be taken.

The first deadline fell due in March 2023, when banks were expected to have in place a sound and comprehensive materiality assessment and business environment scan. Since a number of banks did not deliver within this deadline, in 2023 the ECB issued binding supervisory decisions for 23 supervised entities, which envisage the accrual of periodic penalty payments for the 18 most relevant cases should the supervised entities fail to comply with the requirements within the deadlines set out in these decisions. Proceedings concerning additional draft decisions, including some with periodic penalty payments, were still ongoing at the end of 2023 (see Section 2.3.1).

The ECB will continue to closely monitor banks’ progress in 2024 and 2025 and, if needed, take enforcement action.

1.2.4.2 One-off fit-for-55 climate risk scenario analysis

In March 2023, as part of the “sustainable finance package”, the European Commission issued a mandate to the three European Supervisory Authorities^[25] to conduct, together with the European Systemic Risk Board and the ECB, a one-off fit-for-55 climate risk scenario analysis to assess how agreed transition policies would affect the financial sector. The ECB is involved in the banking sector module, which includes a data collection exercise launched on 1 December 2023. The related data collection templates cover credit risk, market risk, real estate risk and income data as well as climate-relevant data on transition risk and physical risk at the counterparty and sectoral levels. The ECB intends to share its individual feedback, including the main findings, with those banks that participated in the data collection. The results of the overall climate scenario analysis for the banking sector module are due to be published in early 2025. This data collection will allow supervisors to monitor progress in line with the ECB’s 2022 climate risk stress test and to assess banks’ climate risk data capabilities and alignment with good practices in accordance with the ECB report on good practices for climate stress testing.

1.3 Direct supervision of significant institutions

1.3.1 Off-site supervision

The ECB strives to supervise SIs in a proportionate and risk-based manner. To this end, it plans and conducts various off-site supervisory activities, including horizontal and institution-specific activities each year. These supervisory activities draw on the existing regulatory requirements, the Supervisory Manual and the supervisory priorities, and form part of the annual Supervisory Examination Programme (SEP) conducted for each SI. These activities are meant to address institution-specific risks, while ensuring compliance with the supervisory priorities set by the ECB.

1.3.1.1 Principle of proportionality

The SEP follows the principle of proportionality, i.e. the intensity of the supervision depends on the size, systemic importance, risk and complexity of each SI. Therefore, Joint Supervisory Teams (JSTs) supervising bigger and riskier SIs, on average, plan a higher number of SEP activities (Chart 3).

Chart 3

Average number of planned tasks per significant institution in 2023

The number of activities carried out in 2023 was marginally lower than what was originally planned at the beginning of the year (Chart 4). This is mostly due to a small number of administrative tasks being cancelled throughout the year, which is in line with previous years.

Chart 4

Average number of tasks per significant institution in 2023

1.3.1.2 Risk-based approach

The SEP follows a risk-based approach, focusing on the most relevant systemic and institution-specific risks for each SI. For example, for high-NPL banks, the JSTs conducted (relatively) more activities related to credit risk than for the average SI (Chart 5).

Chart 5

SEP activities in 2022 and 2023: credit and market risk activities as a share of all activities

Credit risk

(percentages)

Market risk

In 2023 the ECB introduced a new risk tolerance framework to better focus its work on strategic priorities and key vulnerabilities. This new framework is crucial for a more risk-focused supervisory culture that allows supervisors to tailor their activities to the individual situation of the institution they supervise, rather than taking a one-size-fits-all approach.

The risk tolerance framework is designed to facilitate the translation of the supervisory priorities into strategic planning and day-to-day supervision. For this purpose, it combines top-down guidance from the Supervisory Board on prioritised risks and vulnerabilities with bottom-up relevance assessments for each individual supervised entity. The bottom-up assessments effectively complement the top-down guidance, as some supervised entities deal with institution-specific issues that affect the risk tolerance levels set across various risks and, consequently, also affect the supervisory focus. Within the risk tolerance framework, supervisors have the authority to make full use of the flexibility embedded in the supervisory toolkit to focus on the most relevant tasks. This means that, depending on an institution’s specific circumstances, supervisors may intensify their efforts in those areas which warrant greater engagement and assign a lower priority to those areas considered less pressing.

Drawing on the positive experience gained over the course of the year, the ECB intends to complete the implementation of the risk tolerance framework by embedding it in all its supervisory processes.^[26] This should further enhance the JSTs’ ability to focus on what matters the most for their individual supervised entity, including the necessary flexibility to address new and emerging risks in a changing macro-financial environment.

1.3.1.3 Supervisory planning process

The supervisory planning process, which was revamped in 2022, follows a consistent and integrated approach by which the supervisory priorities steer the planning of horizontal activities, on-site inspections and internal model investigations, among tasks.

To ensure effective supervision, the various business areas of the ECB collaborate closely when planning their activities and with due regard for the supervisory priorities, SIs’ institution-specific risks and the risk tolerance framework. This planning involves selecting samples of supervised entities that are to participate in these horizontal activities and on-site inspections. As in past years, a campaign approach was taken to on-site inspections (see Section 1.3.3 on on-site supervision). The outcome of that process is reflected in the SEP conducted by each JST for its supervised entity. Given that the SEP is an important part of the JSTs’ communication with the SI, a simplified SEP is also shared with the SIs which forms the work programme for the forthcoming year.

Based on the principle of proportionality, the off-site SEP activities include (i) risk-related activities (e.g. the SREP); (ii) other activities related to organisational, administrative or legal requirements (e.g. the annual assessment of significance); and (iii) additional activities planned by JSTs to further tailor the SEP to the specific characteristics of the supervised group or entity (e.g. analyses of the bank’s business model or governance structure).

1.3.1.4 Overview of supervisory activities

The ECB ensures that its resources are adequate for addressing its strategic and supervisory needs. Senior management is provided with regular reports on how its supervisory priorities have been incorporated into the planning and whether all activities and projects have been accomplished as planned.

In 2023 the ECB conducted an organisational readiness assessment, which evaluated its preparedness in ensuring that its proposed supervisory priorities could be successfully put into action based on the available set of skills and resources (see Section 5.3.3).

Monitoring and regular reporting of supervisory activities is crucial for the strategic steering of supervisory initiatives. This way, senior management can assess developments in supervisory priorities, as well as other initiatives, and stay informed about the progress being achieved in terms of the related supervisory activities. This assessment forms the basis for the update of the supervisory priorities and fosters efficient decision-making by senior management.

1.3.1.5 Supervisory measures

Supervisory measures are one of the key outcomes of regular on-site and off-site activities. They set out detailed actions to be taken by supervised entities to remediate shortcomings. The JSTs are responsible for monitoring the timely and effective implementation of these measures. In 2023, the total number of recorded measures was similar to that in 2022. The most important driver of supervisory measures in 2023 was off-site supervisory activities (39%). As in 2022, the highest number of new supervisory measures (45%) related to credit risk (Chart 6).

Chart 6

Supervisory measures

a) Number of measures recorded each year

(number of measures)

b) Measures by activity	c) Measures by risk category
(number of measures)	(number of measures)

1.3.1.6 SREP horizontal analysis

The ECB published the outcome of the 2023 Supervisory Review and Evaluation process on 19 December 2023. This included further developments in SREP scores and Pillar 2 capital requirements and guidance as well as a deeper analysis of selected risk areas. With the consent of the relevant SIs, the ECB made available bank-specific Pillar 2 requirements, including those that are used for addressing the risk of excessive leverage applicable in 2024.

The 2023 SREP demonstrated banks’ overall resilience, as they maintained solid capital and liquidity positions amid various macroeconomic challenges (see Section 1.1.1).

Downside risks remained resulting from reduced economic growth, continued restrictive monetary policy, credit supply tightening and the withdrawal of fiscal support. The banking turmoil seen in the United States and Switzerland last spring did not significantly affect supervised entities but called attention to the potential for rapid interest rate adjustments to cause market instability.

In 2023 the ECB observed improvements in the banking sector. Benefiting from boosted interest income, the aggregate return on equity of supervised entities was 10.0% in the first nine months of 2023. Asset quality improved, with the NPL ratio decreasing from 2.6% in 2021 to 2.3% in the third quarter of 2023.

The overall SREP score remained stable at 2.6, with 30% of supervised entities seeing a change in their score. The overall capital requirements and guidance increased slightly to 15.5% of risk-weighted assets (15.1% in 2022), while the median of Pillar 2 requirements stood at 2.25% (2.15% in 2022). Banks should continue to address the structural challenges outlined in the supervisory priorities for 2024-26 (see Section 1.6).

1.3.1.7 SREP review by external experts

On 17 April 2023 the ECB published the results and recommendations of an expert group’s assessment of European banking supervision, and in particular of the SREP.

While acknowledging good progress in ensuring that SIs maintain sufficient capital levels, the Assessment of the European Central Bank’s Supervisory Review and Evaluation Process invites the ECB to revise its risk scores, as well as the process for determining Pillar 2 capital requirements. Given that capital alone cannot address all types of risk, the report recommends that the ECB make full use of all instruments in its toolbox, including effective qualitative measures, to encourage banks to tackle weak business models and governance practices.

The report complements the conclusions drawn by the European Court of Auditors’ report to further enhance the efficiency and effectiveness of ECB Banking Supervision (see Section 5.1.1).

The ECB began implementing some of the expert group’s recommendations during the 2023 SREP cycle. For example, as part of completing the implementation of its risk tolerance framework for all supervisory processes, the ECB introduced a new multi-year assessment for the SREP. This enables supervisors to better calibrate the intensity and frequency of their analyses, in line with the individual banks’ vulnerabilities and broader supervisory priorities. The ECB also continues to strive to improve its risk-based supervision and foster the influence of supervisory judgement. Therefore, initiatives such as the multi-year assessment and the risk tolerance framework will be further refined to help nourish a well-defined supervisory culture.

Furthermore, in 2023 the ECB improved its communication surrounding the disclosure of SREP methodologies for Pillar 2 requirements. This included enhanced disclosure on methodologies for assessing the leverage ratio, internal governance and risk management, and business model, credit and market risks.

1.3.2 Supervision of entities with subsidiaries in Russia

Since the start of Russia’s invasion of Ukraine in February 2022, the ECB has been closely monitoring the situation and has engaged in dialogue with the few supervised entities that have subsidiaries in Russia. While most of these entities have held on to their Russian subsidiaries, they have made some progress in scaling down their activities in this market. Overall, SIs reduced their exposures to Russia by 21.4% between the end of 2022 and the third quarter of 2023^[27], thus progressively shrinking their exposure levels since the onset of the war. Most banks also decided not to accept any new business in Russia, where legally permissible, and are now exploring exit strategies, such as the sale of business or the winding down of their operations in the Russian market. As explained in a letter dated 27 June 2023 to MEPs de Lange and Juknevičienė on banks’ activities in Russia, the ECB asked these banks to push ahead with their downscaling and exit strategies by creating clear roadmaps and regularly reporting to their management bodies and to the ECB on the progress being made, as well as explaining any delays and/or execution impediments. Where relevant, specific measures were taken by the ECB to address the particular situation of individual SIs.

1.3.3 On-site supervision

178 on-site inspections (OSIs) and 83 internal model investigations (IMIs) were launched for SIs in 2023. Similar to the previous year’s trend, in 2023 most OSIs and IMIs were performed based on hybrid working arrangements. The ECB also continued to work on the implementation of the risk tolerance framework^[28].

Implementing the risk tolerance framework meant increasing efficiency by optimising resource allocation in line with the scope, size and complexity of the inspected institution. It also involved strengthening the risk-based approach as well as combining missions and, where possible, examining blind spots and top-down priorities, while also better integrating off-site, horizontal and on-site activities. This streamlining has allowed the number of OSIs to be increased over the last three years. The number of IMIs to be conducted has, by contrast, decreased over the last two years (Chart 7) owing to a lack of resources, together with an increased number of extensive IMIs to address banks’ requests for material model changes following the latest regulatory requirements.

The OSI campaign approach used in previous years continued to be applied to a number of risk areas, thereby transforming the supervisory priorities into strategic initiatives and complementing other more institution-specific OSIs. These campaigns focused on (i) credit risk, (ii) interest rate risk and credit spread risk in the banking book (IRRBB/CSRBB), (iii) risk data aggregation and reporting, (iv) internal capital adequacy assessment process (ICAAP), and (v) business model and profitability. Dedicated OSIs were also conducted in connection with the supervisory priorities on topics such as digital transformation, IT and cybersecurity, management body functioning and effectiveness. Climate-related and environmental risks were assessed either by way of institution-specific or risk-specific OSIs.

The IMIs conducted in 2023 covered areas such as the implementation of the latest EBA standards and guidelines, the fundamental review of the trading book, and follow-ups to the targeted review of internal models.

Chart 7

On-site inspections and internal model investigations launched in 2021, 2022 and 2023

(number of investigations)

1.3.3.1 Key findings from on-site inspections

In terms of credit risk, severe weaknesses were found in identifying credit deterioration, including evaluating and identifying significant increases in credit risk, classifying both Stage 2 and unlikely-to-pay exposures, and classifying forborne exposures and the related forbearance processes. There were also some major issues in the risk monitoring processes, with deficiencies in the areas of the early warning system and the role of the risk management body in managing to properly monitor and control credit risk. Furthermore, there were shortcomings in the areas of expected credit losses, including the calculation and calibration of parameters such as the loss given default, the probability of default and the cure rates, as well as in the provisioning process for Stage 2 and Stage 3 exposures, both at the individual and collective levels.

In terms of market risk, the main weaknesses concerned governance, fair value measurements and additional value adjustments. These were particularly apparent as regards the insufficient reliability of market data sources or the coverage of independent price verifications, inadequate methodologies for the fair value hierarchy and additional value adjustments, or in the shortcomings in the day-one profit deferral calculations. Severe shortcomings were also evident in counterparty credit risk, where stress-testing frameworks, risk identification, limit setting and collateral management were seen to be areas for concern.

In terms of liquidity risk, the severe findings related to weaknesses in the measurement and monitoring of risk, including shortcomings in quantification methodologies, the accuracy and completeness of data and in scenario design for stress testing. Further severe findings were identified with regard to regulatory reporting and the calculation of the liquidity coverage ratio and the net stable funding ratio.

In terms of IRRBB, the vast majority of critical findings concerned weaknesses in the measurement and monitoring of IRRBB. In particular, they related to the inadequacy of quantification methods, the lack of robustness of key modelling assumptions, outdated data and weak model risk frameworks. Other severe findings revealed an insufficient formalisation of the IRRBB management profile and strategy, as well as the low involvement of the risk management body in defining and monitoring IRRBB risk management processes.

In terms of business model and profitability, the most severe findings related to strategic planning, the monitoring of strategy implementation, income and cost allocation frameworks and financial projections, with inadequately justified and outdated assumptions being a source of concern.^[29]

The initial OSIs on the review of banks’ digital transformation^[30] showed challenges related to monitoring and steering projects and change management. Additionally, the misalignment of IT strategies and business strategies raised concerns with respect to governance.

In terms of climate risk, which is a risk driver of other existing risk categories, such as the business model, credit risk, internal governance and operational risk, the initial dedicated OSIs on climate risk revealed further weaknesses in terms of integrating climate risk in credit risk management and climate and environmental data governance, in quality controls and in data strategies. This was also corroborated by a supervisory horizontal review, which ultimately led to enforceable transition plans for all SIs.

In terms of internal governance, the most critical findings were related to (i) independence, scope of activity and resources for all internal control functions; (ii) insufficiently comprehensive frameworks, inadequate data architecture and IT infrastructures, and weaknesses in data quality management in the area of risk data aggregation and reporting; and (iii) the management body’s steering capabilities, including insufficient interaction between members of the management body, weak institution-wide risk culture, insufficient oversight over the implementation of banks’ business and risk strategies. These findings also confirm that governance remains a high supervisory priority.

In terms of the ICAAP, the most severe findings concerned (i) weak internal quantification methodologies for credit risk, market risk or interest rate risk; (ii) inadequate methodologies to identify material risks as part of the risk identification process, with an incoherent overall ICAAP architecture; and (iii) discrepancies between the internal capital and economic capital adequacy concepts.

In terms of the regulatory capital (Pillar 1), the main findings revealed (i) insufficient control frameworks for the capital requirements and own funds calculation process, and (ii) incorrect allocation of exposures to exposure class or inadequate assignment of risk weights to exposures.

In terms of IT and cybersecurity management, these risks constituted around half of the most severe findings identified in the overall area of IT risk. Previously, the findings had related to preventing a cyberattack, identifying cybersecurity risks and safeguarding IT assets. However, in 2023 the ECB identified an increasing trend in findings surrounding cyber incident response and recovery capabilities.^[31]

A substantial number (around 16%) of the remaining IT severe findings concerned the IT outsourcing arrangements that banks have with third parties. Therefore, in addition to assessing this risk during the usual IT risk OSIs conducted at the SIs, in 2023 the ECB performed a dedicated OSI at a large cloud service provider.

1.3.3.2 Key findings from internal model investigations

In 2023 most IMIs were triggered by requests from banks to assess model changes^[32], model extensions or model approvals, rather than having been initiated by the ECB. The ECB also received and assessed numerous applications to revert to less sophisticated approaches, usually as part of the broader initiatives taken to simplify internal model landscapes.

Banks’ internal models generally improved following the 200 model investigations conducted as part of the targeted review of internal models between 2017 and 2021. Their modelling approaches now better meet (or are being changed to meet) the specifications defined in the EBA’s new regulatory framework. However, the investigations still exposed several weaknesses, some of which were severe, indicating institutions’ lack of preparedness in terms of model change requests. The internal control functions of banks should play a more active and independent role in this respect.

Approximately one-third of the findings resulting from IMIs were of high severity. Regardless of the risk type being investigated, the categories “model description”, “processes” and “validation” contained the highest number of findings. Looking purely at the procedural aspects related to IRB models, approximately one-third of the findings were of high severity, of which roughly half concerned shortcomings in the IT infrastructure and the definition of default. For probability of default modelling and for loss given default modelling, approximately one-third of the findings were of high severity and mostly concerned risk quantification and the structure of the rating system.^[33] In areas where severe findings were numerous, the ECB provided additional clarification in its revised Guide to internal models.

Only very few market risk investigations took place during the reporting period owing to the forthcoming fundamental review of the trading book. As a result of those market risk IMIs, findings mostly concerned validation, x-value adjustment and incremental risk charge modelling. As a result of the very limited number of counterparty credit risk IMIs, there was no clustering of findings.

1.4 ECB oversight and indirect supervision of less significant institutions

1.4.1 Structure of the less significant institution sector

The LSI sector remains rather fragmented. 83% of all European LSIs are located in Germany, Austria and Italy. These countries have therefore been the drivers of consolidation in the LSI sector. The number of LSIs declined to 1,956 entities in the third quarter of 2023 compared with 2,014 at the end of 2022. Most of these structural changes were related to the mergers of 53 entities, with four banking licences being withdrawn. At the same time, six new licences were granted, most of which were for technology-enabled companies (fintech entities).

While the LSI sector is composed of quite diverse and sometimes very specialised business models, retail lenders remain the predominant component. They are often regional savings and/or cooperative banks, many of which are members of institutional protection schemes and mostly located in Germany and Austria. Generally, LSI activities are still more concentrated in certain regions than those of SIs.

Despite the overall declining number of LSIs, this sector continues to constitute a relevant share of the European banking sector, accounting for roughly 15.4% of total banking assets excluding financial market infrastructures. The share of LSI assets in the respective country’s total banking assets deviates considerably, however, pointing to structural differences across Member States. While in Luxembourg, Germany, Malta and Austria, LSIs accounted for more than one-third of the total assets held in the domestic banking sector, the LSI sector in most other countries is relatively small. For instance, in France, Greece and Belgium, this sector represents only 2.4%, 4.1% and 5.5%, respectively, of total banking assets.

Chart 8

Business model classification of less significant institutions

(percentages)

1.4.1.1 Selected oversight activities

Owing to geopolitical events, financial markets were subject to significant volatility in 2023. Moreover, the rapid increases in interest rates, affected existing interest-bearing assets and liabilities. The increased risk aversion of investors led banking supervisors to place liquidity and funding risks at the top of their agenda. ECB Banking Supervision and the national competent authorities focused increasingly on interest rate risk, as well as the suitability and sustainability of LSI funding.

Despite the continued decrease in the NPL ratio in 2023, credit risk remained a key area of supervisory focus for LSIs. Besides multiple quantitative benchmarking exercises, the ECB also conducted a review of credit risk assessment practices within European banking supervision, as well as updating the harmonised SREP methodology for credit risk in LSIs.

At the same time, supervisors strengthened their crisis management cooperation frameworks (see Section 3.3).

1.4.2 Horizontal work on stress testing of less significant institutions

Building on the 2022 review of national practices for the supervisory stress testing of LSIs, the ECB and the national competent authorities have been working on collecting and exchanging information on the stress-testing practices used for LSIs, including the methodologies and tools. This ongoing work aims to promote both good practices and synergies, and where appropriate, also draw on the supervisory stress test approaches used for SIs.

1.5 The ECB’s macroprudential tasks

The ECB continued to engage actively with the national authorities in 2023 in accordance with the macroprudential tasks conferred on it under Article 5 of the SSM Regulation^[34]. In this context, as in past years, the ECB received and assessed macroprudential policy notifications from the relevant national authorities. These notifications concerned decisions on setting countercyclical capital buffers, decisions on the identification and capital treatment of global systemically important institutions or other systemically important institutions (O-SIIs), as well as decisions on other macroprudential measures, for example on the setting of systemic risk buffers and measures under Article 458 of the Capital Requirements Regulation^[35].

In 2021 and 2022, several national authorities imposed or increased cyclical or structural capital buffers amid rising macro-financial vulnerabilities. This trend continued into 2023, with some national authorities imposing new systemic risk buffers aimed at addressing systemic risks in specific sectors. National authorities also identified 127 O-SIIs and set capital buffer rates for those banks. These buffer rates were in line with the floor methodology for setting O-SII buffers, which the ECB has followed since 2016. As mentioned in the ECB 2022 Annual Report on supervisory activities, from 1 January 2024 the ECB will be using a revised floor methodology to assess O-SII buffers.^[36] The revised floor methodology is designed to strengthen the capacity of O-SIIs to absorb losses, further reduce the risk of heterogeneity in O-SII buffers and lead to a more consistent treatment of O-SIIs across those countries that fall under European banking supervision.

ECB Banking Supervision also participated actively in several areas of the work of the European Systemic Risk Board. This included its regular assessments of the risks and vulnerabilities in the EU financial system, its work on the implications of higher interest rates for financial stability, analysis of systemic illiquidity, macroprudential tools for cyber resilience^[37], and its work on crypto-assets and decentralised finance^[38], as well as work on climate risk^[39]. It also included the adverse scenarios for the EBA’s 2023 EU-wide stress test exercise and the one-off fit-for-55 climate risk analysis.

1.6 Risks and supervisory priorities for 2024-26

The main purpose of the risk-identification and priority-setting exercise is to develop a sound strategy for ECB Banking Supervision to follow for the next three years. This strategy consists first of identifying the main vulnerabilities which banks and supervisors alike need to focus on in the light of the risk outlook, and second, of developing the strategic objectives and the related supervisory work programmes aimed at tackling the identified risks. In 2023 higher and more persistent inflation than previously expected resulted in both a faster tightening of financing conditions and a weaker economic outlook than previously foreseen. At the same time, however, the marked turn in the interest rate cycle also helped to boost banks’ overall profitability through higher net interest margins, thus adding a layer of resilience to the banking sector as a whole.

These developments led ECB Banking Supervision to slightly adjust its supervisory priorities for the 2024-26 period, while reiterating its call for banks to maintain prudent and sound risk management practices to better withstand the likely headwinds expected both in the near and medium term. For the 2024-26 period, supervised entities will therefore be asked to strengthen their resilience to immediate macro-financial and geopolitical shocks (Priority 1); accelerate the effective remediation of shortcomings in governance and the management of climate-related and environmental risks (Priority 2); and make further progress in their digital transformation, while building robust operational resilience frameworks (Priority 3). Further details about the updated supervisory priorities, the underlying risk assessments and the related supervisory activities can be found in the SSM supervisory priorities for 2024-2026.

2 Authorisations, enforcement and sanctioning procedures

2.1 Authorisations

2.1.1 Significance assessments, comprehensive assessments and identification of high-impact less significant institutions

2.1.1.1 Significance assessments

In line with the SSM Framework Regulation^[40], the annual assessment of whether a bank or banking group fulfils any of the significance criteria^[41] was concluded in November 2023. It was supplemented by ad hoc significance assessments (leading to 61 significance decisions) which were carried out following changes to group structures.

As a result, 113 institutions^[42] were classified as significant as of 1 January 2024, the same as in the previous annual assessment of significance.

The 2023 annual assessment resulted in the following changes.

• Wüstenrot Bausparkasse Aktiengesellschaft was classified as significant because its assets exceeded €30 billion.
• Following a request from Lietuvos bankas, the ECB decided to take over the direct supervision of Revolut Holdings Europe UAB in line with Article 6(5)(b) of the SSM Regulation and Article 67 of the SSM Framework Regulation, in view of factors such as the institution’s large cross-border presence in European markets, its rapidly growing balance sheet and the substantial increase in its client numbers in different Member States.
• Euroclear Holding SA/NV met the size criterion but was classified as less significant owing to particular circumstances, as provided for under Article 6(4) of the SSM Regulation and Article 70 of the SSM Framework Regulation.

Furthermore, as a result of three Class 1 investment firms being licensed as significant credit institutions, four significant credit institutions were added to existing significant groups in 2023: ProCapital to Confédération Nationale du Crédit Mutuel, with effect from 11 April; GENO Broker GmbH to DZ BANK AG Deutsche Zentral-Genossenschaftsbank, with effect from 12 August; KBC Securities NV to KBC Group NV, with effect from 5 October; and BNP Paribas Financial Markets to BNP Paribas S.A., with effect from 9 December.

In addition, the following changes to group structures took place, affecting the number of significant supervised entities.

• HSBC Bank Malta p.l.c., HSBC Trinkaus & Burkhardt GmbH and HSBC Private Bank (Luxembourg) S.A. were acquired by HSBC Continental Europe, becoming part of the significant supervised group headed by HSBC Continental Europe, with effect from 30 November 2022, 1 February 2023 and 2 November 2023 respectively. HSBC Trinkaus & Burkhardt GmbH’s licence was subsequently withdrawn with effect from 30 June 2023.
• LP Group B.V. and its subsidiary LeasePlan Corporation N.V. were acquired by a subsidiary of Société Générale S.A., becoming part of the supervised group headed by Société Générale S.A., with effect from 22 May 2023.
• CACEIS Investor Services Bank S.A. (formerly RBC Investor Services Bank S.A.) and its subsidiary were acquired by Crédit Agricole S.A. with effect from 3 July 2023, becoming part of the significant supervised group headed by Crédit Agricole S.A.
• The euro area-based entities belonging to NatWest Group plc (established in the United Kingdom) – NatWest Bank Europe GmbH, the group headed by RBS Holdings N.V. and RBS International Depositary Services S.A. – were classified as significant, with effect from 13 November 2023, in view of the establishment of two intermediate EU parent undertakings headed by NatWest Bank Europe GmbH and RBS Holdings N.V. respectively.

Finally, the following changes to group structures took place, without affecting the number of significant supervised entities.

• OTP Luxembourg S.à.r.l. (formerly Biser Bidco S.à.r.l.) was classified as significant, as one of the three largest supervised groups in Slovenia, following the sale of Biser Topco S.à.r.l.’s shares in OTP Luxembourg S.à.r.l. (formerly Biser Bidco S.à.r.l.) and Nova Kreditna Banka Maribor d.d. as of 6 February 2023.
• Atlantic Lux HoldCo S.à r.l. became the top entity of the significant supervised group which also comprises Aareal Bank AG and Atlantic BidCo GmbH following its acquisition of more than 50% of the capital and voting rights of Aareal Bank AG, with effect from 7 June 2023.
• Citibank Europe plc became a stand-alone significant supervised entity following the distribution by Citibank Holdings Ireland Limited of the totality of the capital and voting rights of Citibank Europe plc, with effect from 17 October 2023.

The list of supervised entities is frequently updated and can be found on the ECB’s banking supervision website.

2.1.1.2 Comprehensive assessments and asset quality reviews

In the first half of 2023, the ECB concluded four asset quality review (AQR) exercises that had been launched in 2022. Each of the four banks assessed fulfilled a criterion to be directly supervised by the ECB: AS Citadele banka in Latvia was among the three largest credit institutions in the Member State and Crelan SA in Belgium, Goldman Sachs Bank Europe SE in Germany and Morgan Stanley Europe SE in Germany all met the size criterion.

In 2023 the ECB launched AQR exercises for three banks. The AQRs of AS LHV Group in Estonia (among the three most significant credit institutions in the Member State) and FinecoBank S.p.A. in Italy (size) were launched in April 2023 and the AQR of J.P. Morgan SE in Germany (size) was launched in November 2023. The first two exercises are expected to be completed in the first quarter of 2024 and the AQR of J.P. Morgan SE is expected to be completed by the end of the second quarter of 2024.

2.1.1.3 High-impact less significant institutions

Owing to the large number of less significant institutions (LSIs), as well as their differences in terms of size, complexity and risk profile, European banking supervision classifies these institutions based on their impact on the financial system and their risk profile. Since 2022 impact criteria and risk criteria have been assessed separately. High-impact LSIs are determined once a year for each of the countries participating in European banking supervision. The criteria for determining high-impact LSIs can be found in Box 1 of the LSI supervision report 2022.

An LSI that is considered a small and non-complex institution within the meaning of the Capital Requirements Regulation cannot be designated as a high-impact LSI unless it is the largest LSI in a jurisdiction where all LSIs are small and non-complex institutions.

2.1.1.4 Implications of high-impact LSI designation

The designation of an LSI as high impact is an important factor that national competent authorities (NCAs) take into account when determining the frequency and level of detail of their supervisory activities, such as the Supervisory Review and Evaluation Process and on-site inspections. In addition, NCAs are obliged to notify the ECB of any material supervisory procedures or decisions they intend to implement in respect of these institutions, in line with Articles 97 and 98 of the SSM Framework Regulation.

The list of supervised entities, as adopted by the Supervisory Board of the ECB, identifies the 100 LSIs designated as high impact for 2024.

2.1.2 Authorisation procedures

In 2023 the ECB was notified of a total of 777 authorisation procedures (Table 2). These notifications comprised 25 licence applications, 10 licence withdrawals, 61 lapsings of authorisations, 112 acquisitions of or increases in qualifying holdings, 558 passporting procedures and 11 authorisations of financial holding companies. They also included the authorisation of three Class 1 investment firms licensed as significant credit institutions, in line with the broader definition of “credit institution” applicable since June 2021.

In 2023 206 authorisation procedure decisions^[43] were finalised. Of these, the Supervisory Board submitted 106 draft decisions which were then approved by the Governing Council. The remaining 100 were approved by senior management within the framework for delegation.^[44] These numbers include 79 operations (such as lapsing of authorisation and passporting procedures) that were implicitly approved by the ECB^[45] by not objecting within the legal deadlines.

The 206 authorisation procedure decisions accounted for 8.57% of all ECB individual supervisory decisions in 2023.

Three authorisation procedures led to negative decisions. Furthermore, seven licence applications and five notifications of acquisitions of or increases in qualifying holdings were withdrawn prior to a decision being finalised owing to a negative assessment.

2.1.2.1 Developments in common procedures

Overall, in 2023 the number of notifications of common procedures for licensing, qualifying holdings and withdrawals submitted to the ECB remained stable compared to the previous year.

The ECB assessed a high number of qualifying holdings. In a few procedures, following concerns raised by supervisors during the initial assessment or the issuance of a negative decision by the ECB, applicants decided to withdraw their notifications. In other cases, applicants decided to withdraw their applications owing to the prolonged uncertain macroeconomic environment or for case-specific reasons. Several qualifying holding procedures stemmed from internal reorganisations that were subject to the simplified qualifying holding assessment approach. As in previous years and despite emerging transformation and active consolidation dynamics, only limited cross-border consolidation was observed.

In 2023 most licensing procedures were associated with the establishment of new LSIs. The few licensing procedures concerning significant institutions resulted primarily from the need to extend licences for additional regulated activities planned by banks, which is required in certain Member States. In addition, several authorisations were granted under the EU regulatory framework for investment firms, introduced with the application of the Investment Firms Regulation and Directive as of 26 June 2021.

As in previous years, one important driver of new licence applications was the increased use of digital innovations to provide services to EU clients (e.g. fintech business models). Most of the applications concerning business models concentrated in crypto-asset related activities and services were submitted by credit institutions based in Germany, owing to the specific licensing requirement imposed under German law. While some of these licensing applications were withdrawn during the initial assessment, the ECB issued one licence extension, in accordance with German law, to a German credit institution in relation to its crypto custody business model. When assessing licensing requests concerning crypto-asset related activities, the ECB and the relevant NCAs apply the criteria set out in the Capital Requirements Directive. National frameworks governing crypto-assets and related activities currently vary, so the ECB is taking steps to harmonise the assessment of licensing requests involving crypto-assets.

With the entry into force of the Markets in Crypto-Assets Regulation (MiCAR) in June 2023 and its application from 2024, credit institutions across the EU are considering whether to engage in crypto-asset related activities and services as set out in MiCAR. Credit institutions as defined in the Capital Requirements Regulation do not require additional licensing under MiCAR for crypto-asset related services and activities, but they are subject to notification requirements. The ECB will continue to ensure that credit institutions engaging in crypto-asset-related activities do so safely and soundly.

In 2023 the ECB continued to receive a high number of licensing applications for banks with a fintech business model. The assessments showed that fintech firms tend to rely heavily on outsourced critical services owing to their limited staffing levels. Outsourcing critical services to external service providers increases operational risk, particularly in the area of IT services and cloud data storage but also in authentication and know-your-customer procedures. Fintech firms often made use of the passporting regime which allows EU credit institutions to provide services or establish branches in any other EU country under the initial licence granted.

The authorisations of three LSIs (in Germany, Greece and Latvia) were withdrawn because of capital failures and serious anti-money laundering breaches. Two ECB decisions were challenged before the ECB’s Administrative Board of Review and the Court of Justice of the European Union. The Court of Justice upheld the ECB’s withdrawal decision in one of the cases challenged and the court proceedings were closed, while the proceedings for the second case are still ongoing.

2.1.2.2 Developments in passporting procedures and (mixed) financial holding companies

The ECB and the NCAs handled 558 passporting procedures in 2023.

Approvals and exemptions of parent (mixed) financial holding companies were introduced under Article 21a of CRD V. In 2023 the ECB approved two and exempted five (mixed) financial holding companies that were already part of or due to be added to significant banking groups. Of all approvals and exemptions, three concerned (mixed) financial holding companies that were newly established in the significant supervised group. Other approvals and exemptions were related to delays in the transposition of Article 21a of CRD V into national law (i.e. after 29 December 2020), which in turn delayed notifications by already existing (mixed) financial holding companies. After a vast influx of procedures in 2021 and 2022 following the transposition of CRD V, the number of procedures stabilised in 2023. Finally, a number of reorganisations took place in supervised groups which eliminated (mixed) financial holding companies from the group structure.

2.2 Fit and proper procedures

In 2023 the ECB was notified of a total of 2,573 individual fit and proper procedures^[46] concerning significant institutions (Table 3).

In 2023 62% of all individual fit and proper procedures concerned members of the management body in its supervisory function and 28% concerned members of the management body in its executive function. The remaining individual procedures involved key function holders (8%), third-country branch managers (1.5%) and additional non-executive directorships (0.5%).

The average time taken to carry out fit and proper assessments and for the ECB to adopt a decision was 109 days, which is within the maximum period of four months set out in paragraph 179 of the Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders.

2.2.1 Developments in fit and proper procedures

The ECB has taken fit and proper decisions more effectively by simplifying processes and developing and updating guides and templates, as noted in the European Commission’s second report on the Single Supervisory Mechanism.^[47] The Commission also found that significant progress has been made in enhancing cooperation with NCAs in the area of fit and proper assessments. The ECB also communicated with the industry in a joint seminar with the European University Institute in Florence on diverse and effective boards and committees in a changing and competitive landscape.

As regards ensuring diverse boards, in 2023 the ECB leveraged the fit and proper criterion of collective suitability to promote diversity of skills and experience, gender, age and geographical provenance in bank boards. It also decided to raise its expectations about collective suitability for 2024, with a particular focus on expertise in information and communications technology and security risks within the management body in its supervisory function.

A suitability assessment may result in the imposition of ancillary provisions when, based on the five fit and proper criteria, certain concerns about an appointee need to be mitigated. The policy on ancillary provisions was revised in 2022, resulting in more specific requirements and deadlines. Since then, ancillary provisions in decisions have become more precise, and decisions containing an ancillary provision decreased from 32% of all decisions in 2022 to 9.5% in 2023. The most common concerns raised in the fit and proper assessments in 2023 were about time commitment, experience and conflicts of interest. This led to 47 conditions, 179 obligations and 21 recommendations, down from 58, 225 and 95 respectively in 2022.

If there are material concerns about an appointee’s suitability, the ECB may deem it necessary to carry out a more in-depth assessment and may ultimately communicate its intention to adopt a negative decision. Banks then tend to withdraw the application during the supervisory dialogue. This occurred in ten cases in 2023.

The ECB carried out 19 reassessments of members of the management bodies of banks, mainly owing to concerns about reputation (14 cases).

In 2023 the ECB continued to develop and promote IT tools for processing fit and proper procedures (see Section 5.9.2).

2.3 Whistleblowing, enforcement and sanctioning

2.3.1 Enforcement and sanctioning measures

Under the SSM Regulation and the SSM Framework Regulation, the allocation of enforcement and sanctioning powers between the ECB and the NCAs depends on the nature of the alleged breach, the person responsible and the measure to be adopted. The penalties imposed by the ECB within the remit of its supervisory tasks and the penalties imposed by the NCAs at the request of the ECB are published on the ECB’s webpage on supervisory sanctions.

Sanctions are intended to punish misconduct and act as a deterrent not only to the supervised entity concerned but also to the banking sector as a whole. Enforcement measures, such as periodic penalty payments, are designed to compel supervised entities to comply with prudential requirements set out in supervisory decisions or regulations.

In 2023 the ECB handled 14 enforcement and sanctioning proceedings. Of these, 13 were sanctioning proceedings, which led to nine ECB decisions^[48], and one was an enforcement proceeding, which led to one ECB decision (Table 4).

In addition, in 2023 the ECB issued 18 binding supervisory decisions envisaging the accrual of periodic penalty payments per day of infringement should the banks concerned fail to comply with prudential requirements on strengthening the process for identifying climate-related and environmental risks within the deadlines set out in those decisions, which range from the end of 2023 to the end of 2024 (see Section 1.2.4). Proceedings concerning additional draft decisions envisaging the accrual of periodic penalty payments were still ongoing at the end of 2023.

Of the 13 sanctioning proceedings handled in 2023, five were related to suspected breaches of directly applicable EU law (ECB decisions and regulations included) committed by five significant institutions. Three of these proceedings were finalised in 2023 with three ECB decisions imposing penalties amounting to €17,925,000 on three supervised entities for breaches of capital requirements and the misreporting of own funds requirements for market risk and credit risk respectively. Two proceedings were still ongoing at the end of 2023.

The eight remaining sanctioning proceedings handled in 2023 related to suspected breaches of fit and proper, remuneration, governance and qualifying holding requirements laid down in national law implementing the Capital Requirements Directive. These proceedings concerned five significant institutions and one less significant institution and were finalised with six ECB requests addressed to the relevant NCAs to open proceedings.

The enforcement proceeding handled in 2023 concerned the potential imposition of periodic penalty payments on a significant institution with a view to compelling it to comply with the prudential requirements on interest rate risk in the banking book imposed in an ECB decision. In view of the actions taken and the documentation submitted by the institution during the hearing phase of the enforcement proceeding, the ECB decided that periodic penalty payments were not necessary, as initiating the proceeding had already helped to achieve the desired outcome.

A complete breakdown by area of infringement of the suspected breaches subject to the enforcement and sanctioning proceedings handled by the ECB in 2023 is shown in Chart 9.

Chart 9

Suspected breaches subject to enforcement and sanctioning proceedings in 2023

Following previous requests from the ECB to open proceedings and having assessed the cases in accordance with their national law, two NCAs imposed two pecuniary penalties amounting to €60,000 in 2023.

Detailed information, including comprehensive statistics on the sanctioning activities that the ECB and the NCAs carried out in 2023 in relation to breaches of prudential requirements, will be presented in the Annual Report on Sanctioning Activities in the SSM in 2023. The report will be published on the ECB’s banking supervision website in the second quarter of 2024.

2.3.2 Whistleblowing

Under Article 23 of the SSM Regulation, the ECB is required to ensure that effective mechanisms are put in place to enable any person to report breaches of relevant EU law, a process commonly referred to as whistleblowing. Accordingly, the ECB operates an online whistleblowing platform.

The ECB ensures full confidentiality of the whistleblowing reports received through the web platform or other channels (e.g. email or post) and takes into account all available information when carrying out its supervisory tasks.

The ECB received 355 whistleblowing reports in 2023, an increase of 74% compared with the previous year. Of these reports, 117 referred to alleged breaches of relevant EU law, 106 of which were considered to be within the ECB’s supervisory remit and 11 within that of the NCAs. The remainder referred mainly to alleged breaches of non-prudential requirements (e.g. consumer protection) and therefore fell outside the scope of the whistleblowing mechanism.

Within the ECB’s supervisory remit, the most common alleged breaches reported related to governance issues (87%) and the calculation of own funds and capital requirements (9%). Governance-related issues mainly concerned risk management and internal controls, fit and proper requirements, organisational structure and management body functions. The complete breakdown is shown in Chart 10.

Chart 10

Alleged breaches reported via the whistleblowing mechanism

(percentages)

The relevant Joint Supervisory Teams were made aware of the information reported via the whistleblowing mechanism and decided on the appropriate follow-up action.

The main investigatory actions taken in 2023 in relation to whistleblowing reports on breaches of relevant EU law received in the course of the year, or previously, included:

• internal assessment based on existing documentation (48%);
• request for documents or explanations from the supervised entity (42%);
• request for an internal audit or on-site inspection (10%).

3 Contributing to crisis management

3.1 Crisis cases in 2023

The banking turmoil in spring 2023, which started in the US banking sector and culminated in the takeover of Credit Suisse, was the most significant system-wide banking stress since the great financial crisis. However, the banking sector in the European banking union proved to be resilient, with robust levels of capital and liquidity. As a result, in 2023 no significant institutions were assessed as failing or likely to fail in accordance with Article 18(1)(a) and Article 18(4) of the Single Resolution Mechanism Regulation^[49].

3.2 Interaction with the Single Resolution Board

The ECB and the Single Resolution Board (SRB) continued to cooperate closely at all levels in 2023. There were regular exchanges between the Chairs of the organisations and between senior and middle management. Moreover, the Chair of the ECB’s Supervisory Board and the Chair of the SRB made joint visits to several national competent authorities (NCAs).

The ECB and the SRB intensified their cooperation following the banking turmoil of spring 2023.^[50] The ECB and the SRB continued to discuss the lessons learnt and conducted follow-up work.

The ECB and the SRB continued to cooperate closely on policy topics of common interest. In October 2023 the ECB and SRB jointly organised a high-level seminar on the proposed changes to the crisis management and deposit insurance framework from a supervisory and resolution perspective.

The ECB also updated its internal operational guidance to support the full implementation of the bilateral Memorandum of Understanding, which was reviewed in 2022. As in previous years, the ECB participated in the SRB dry-run crisis simulation exercise and the Trilateral Principal Level Exercise, involving resolution authorities, supervisory authorities, central banks and finance ministries of the United States, the United Kingdom and the banking union.

The ECB and the SRB continued their joint efforts on liquidity measurement and reporting. In this regard, a joint working group was mandated to run annual joint liquidity exercises aimed at testing banks’ crisis preparedness. The working group successfully completed its first exercise, which covered 204 banks, in October 2023.

Moreover, regular interaction between the ECB’s Joint Supervisory Teams and the SRB’s Internal Resolution Teams continued to be a key part of the cooperation between the two organisations. Cooperation was particularly close for banks under the ECB crisis management framework.

In line with the regulatory framework, the SRB was consulted on the recovery plans submitted to the ECB by significant institutions.

Finally, the SRB consulted the ECB on draft resolution plans and on the calculation of the proposed ex ante contributions to be paid to the Single Resolution Fund by significant institutions, in accordance with the Single Resolution Mechanism Regulation.

3.3 Crisis management involving less significant institutions

Crisis management involving less significant institutions (LSIs) requires close cooperation between the relevant NCA and the ECB. Although supervisory responsibility for LSI crisis management lies with the NCAs, the need for intensified cooperation and information sharing arises when an LSI approaches the point of non-viability, as the ECB is responsible for licence withdrawals.

In the early stages of a crisis triggered by a deterioration of an LSI’s financial situation, the relevant NCA informs the ECB through an official notification. The ECB received 13 such notifications from NCAs in 2023.

After a notification of financial deterioration is submitted, crisis management contact groups are generally set up. In 2023, as in previous years, these groups – which comprise representatives from the ECB and the relevant NCAs – ensured that crises were closely monitored and supervisory actions and decisions were taken in a timely and coordinated manner. 17 crisis management contact groups were in place over the course of the year. There were also ten withdrawals of banking licences and three cases of licences lapsing, i.e. the LSIs concerned proactively surrendered their banking licence. The grounds for licence withdrawals can include unsustainable business models, weak or negative profitability, or deficiencies in governance and risk controls.

In 2023 the ECB and the NCAs jointly revised the LSI Crisis Management Cooperation Framework, drawing on their experience of managing LSI crisis cases since the start of European banking supervision. The project, which sought to enhance the framework and make it more effective, is part of broader efforts by several European institutions to review crisis management practices for financial institutions in distress.

4 Interinstitutional cooperation

4.1 European and international cooperation

4.1.1 Cooperation with other EU supervisory authorities and authorities from non-EU countries

Memoranda of Understanding agreed between the ECB and other supervisory authorities are published on the ECB’s banking supervision website.

4.1.1.1 The ECB and colleges of supervisors

For significant banking groups with operations outside of the banking union, the ECB participates in colleges of supervisors. This enables the ECB to develop coordinated supervisory approaches and decisions and to ensure common work programmes with other supervisory authorities involved in the supervision of the same cross-border banking group. The ECB organises colleges in cases where, as home supervisor, it is the authority responsible for supervising a banking group on a consolidated basis. If the ECB is host supervisor and oversees specific entities within a banking group, it participates in colleges of supervisors where invited. In 2023 a college of supervisors was in place for 47 banks directly supervised by the ECB.

4.1.1.2 Strengthening cooperation with national market conduct authorities and non-SSM EU authorities

Significant banking groups conduct operations in markets in financial instruments, so the ECB cooperates with national market authorities in the EU in line with Union law.

The ECB continued to strengthen information sharing and cooperation with national supervisory authorities in non-SSM EU Member States regarding the operations of significant banking groups in those countries.

4.1.1.3 Cooperation with other sectoral supervisors in the EU and non-EU prudential supervisors

Under the Financial Conglomerates Directive^[51], the ECB is required to cooperate with the relevant competent authorities for the supplementary supervision of financial conglomerates. For groups headed by institutions for which the ECB is the consolidating supervisor, the ECB is responsible for establishing the respective coordination arrangements. In 2023 the ECB was the coordinator for 29 financial conglomerates^[52].

A cross-functional team comprising experts from the ECB and the national competent authorities ensures a consistent approach to the supervision of financial conglomerates across the SSM.

In 2023 the ECB also strengthened its exchanges with non-EU prudential supervisors on the use of supervisory technology. This included collaborating with the Federal Reserve System, the Bank of England and the United Kingdom’s Financial Conduct Authority to develop a machine learning application to support supervisors in identifying specific IT and cyber risks with the help of natural language processing. Experts from the four institutions are currently working together in an interdisciplinary, cross-functional “tiger team” to deliver a proof of concept in September 2024.

4.1.1.4 IMF Financial Sector Assessment Programs

The Financial Sector Assessment Programs (FSAPs) of the International Monetary Fund (IMF) are comprehensive in-depth assessments of a country’s financial sector.

The 2018 FSAP for the euro area examined the banking supervision and resolution architecture in the euro area. The ECB has implemented most of the IMF’s recommendations in its supervisory practices. In parallel, EU co-legislators have been addressing the recommendations that require modifications to EU law. The next FSAP for the euro area is planned for 2024 and is expected to include an in-depth assessment of the supervision of significant institutions.

In 2023 the IMF concluded the national FSAP for Belgium, continued work on the exercise for the Netherlands and launched the FSAPs for Luxembourg, Slovakia and Spain. National FSAPs assess non-banking topics, such as domestic insurance and macroprudential frameworks, and entail a holistic assessment of banking issues, especially those that fall within the remit of national authorities supervising less significant institutions or aspects related to anti-money laundering and combating the financing of terrorism, while taking into account that further work is needed to complete the banking union.

The ECB’s involvement in national IMF Article IV consultations for countries participating in European banking supervision relates to microprudential and macroprudential issues, in line with the ECB’s responsibilities in these areas.

4.2 Contribution to developing the European and international regulatory framework

4.2.1 Contributing to the work of the Financial Stability Board

In 2023, in the context of persistent inflation, higher interest rates and a tightening of financial conditions, the Financial Stability Board (FSB) focused on addressing existing vulnerabilities in the financial system and enhancing the resilience of the financial system through structural changes. These activities supported the G20 Presidency’s financial sector priorities.

As a member of the FSB, ECB Banking Supervision participated in various workstreams. These included (i) finalisation of the recommendations on crypto-asset activities and markets; (ii) work related to the climate roadmap, such as achieving consistent climate-related financial disclosures; (iii) finalisation of the third-party risk management toolkit; (iv) the final report on recommendations to achieve greater convergence in cyber incident reporting; (v) resolution planning and crisis preparedness, including addressing obstacles to cross-border funding in resolution and discussing the operationalisation of resolution tools; and vi) the review of the lessons learnt (including for the international resolution framework) from the banking turmoil of spring 2023.

ECB Banking Supervision participated in the meetings of the FSB Plenary, the Standing Committee on Standards Implementation and the Standing Committee on Supervisory and Regulatory Cooperation. In June and July 2023, the ECB hosted on-site meetings of the Standing Committee on Supervisory and Regulatory Cooperation and the FSB Plenary respectively. It also contributed to the work of the Resolution Steering Group, the Regional Consultative Group for Europe and the Roundtable on External Audit.

In addition to the topics mentioned above, in 2024 ECB Banking Supervision will cooperate with the FSB on transition planning policy work, the follow-up to the spring 2023 banking turmoil, margin preparedness issues, and the implementation of sound compensation practices.

4.2.2 Contributing to the Basel process and the revised Basel core principles for effective banking supervision

In 2023 the ECB continued to contribute significantly to the work of the Basel Committee on Banking Supervision (BCBS). It actively participated in several workstreams, providing expertise in BCBS groups and cooperating with Basel Committee members within the EU and across the globe.

One key milestone was the Report on the 2023 banking turmoil, which was a stocktake of the regulatory and supervisory lessons learnt from the banking turbulence of spring 2023. It underlined the importance of banks’ risk management practices and governance arrangements, the need for strong and effective supervision to ensure the safety and soundness of banks and the critical importance of prudent and robust regulatory standards in safeguarding financial stability.

Another key milestone was the launch of a public consultation on revisions to the Core principles for effective banking supervision. The changes proposed in the consultative document include the explicit recognition of supranational supervisory frameworks such as the Single Supervisory Mechanism, the impact of climate-related financial risks and the digitalisation of finance and the importance of assessing banks’ business model sustainability and operational resilience.

Other key achievements included the launch of public consultations on (i) a Pillar 3 disclosure framework for climate-related financial risk (see Box 7); (ii) the disclosure of banks’ crypto-asset exposures, which proposes a standardised disclosure table and set of templates for banks’ crypto-asset exposures and operations; (iii) amendments to the standard on banks’ exposures to crypto-assets published in December 2022; and (iv) proposed adjustments to the standard on interest rate risk in the banking book.

The ECB continued to co-chair the BCBS Task Force on Climate-related Financial Risks and the BCBS Policy and Standards Group. In June 2023 the ECB hosted the meeting of the Supervisory Cooperation Group in Frankfurt am Main.

4.2.3 Contributing to the work of the European Banking Authority

In 2023 ECB Banking Supervision continued to work closely with the European Banking Authority (EBA) to promote consistent supervision across the European banking sector and to foster the safety and soundness of credit institutions and the stability of the financial system.

Joint projects included the 2023 EU-wide stress test, which enabled supervisors to assess the resilience of the European banking sector. The ECB also worked with the EBA to launch the one-off fit-for-55 climate risk scenario analysis, which aimed to assess the resilience of the financial sector in line with the EU’s Fit-for-55 package. Together with the Single Resolution Board, the ECB and EBA issued a joint statement following the write-down of Credit Suisse’s Additional Tier 1 bonds. This helped to clarify the EU resolution framework and calm European markets for Additional Tier 1 instruments.

The ECB was also involved in the EBA’s regulatory work, providing input and support to a number of projects, including the EBA’s policy development plan for the Markets in Crypto-assets Regulation and the finalisation of the EBA Guidelines on the overall recovery capacity in recovery planning, which aim to improve the usability of recovery plans and make crisis preparedness more effective. Moreover, the ECB contributed to drafting work for the Digital Operational Resilience Act policy mandates as a member of the European Supervisory Authorities’ Joint Committee Sub-Committee on Digital Operational Resilience. The ECB also contributed to the EBA’s Basel III Monitoring Report analysing the impact of EU-specific adjustments, which is a crucial part of the Basel III finalisation process.

Regarding the EBA’s comply-or-explain procedure, in 2023 ECB Banking Supervision notified the EBA of its compliance status with respect to one guideline, as documented on the ECB’s banking supervision website. ECB Banking Supervision is committed to complying with all applicable guidelines issued by the EBA or the Joint Committee of the European Supervisory Authorities.

The ECB is working with the EBA and other stakeholders to set up the Joint Bank Reporting Committee, which will be made up of representatives from European and national authorities, and the Reporting Contact Group, which will comprise banking industry experts. The first meeting of the Joint Bank Reporting Committee is expected to take place in 2024. Work to develop a sectoral data dictionary in line with the European Commission’s supervisory data strategy, enhance granularity in supervisory reporting and further integrate statistical and supervisory reporting is already under way.

5 Organisational set-up of ECB Banking Supervision

5.1 Discharging of accountability requirements

This Annual Report constitutes one of the main accountability channels for ECB Banking Supervision vis-à-vis the European Parliament and the Council of the European Union (EU Council), as stipulated by the SSM Regulation. The Regulation provides that the ECB’s supervisory tasks are subject to appropriate transparency and accountability requirements. The ECB attaches great importance to maintaining and fully applying the accountability framework that is set out in further detail in the Interinstitutional Agreement between the European Parliament and the ECB and in the Memorandum of Understanding between the EU Council and the ECB.

In 2023 the Chair of the Supervisory Board appeared before the European Parliament’s Committee on Economic and Monetary Affairs on four occasions – in three regular public hearings and one ad hoc exchange of views. In his public hearing on 21 March 2023, the Chair presented the ECB Annual Report on supervisory activities 2022. On the same day, he participated with the Chair of the European Banking Authority in an ad hoc exchange of views on the failure of Silicon Valley Bank and its implications for financial stability in Europe. The other two regular public hearings took place on 28 June and 7 November 2023. The discussions focused on the risks stemming from the macroeconomic outlook, particularly the impact of interest rate increases on the banking sector and depositors, the lessons learnt from the spring market turmoil and developments in non-performing loans. Other issues discussed were emerging risks from the crypto sector and non-financial banking institutions and the legislative files to strengthen the banking union, such as the banking package and the review of the bank crisis management and deposit insurance framework.

In 2023 the Chair of the Supervisory Board responded to two written questions from Members of the European Parliament (MEPs) on banking supervision-related matters and, in line with the ECB’s reporting requirements with respect to national parliaments, to one written question from a member of a national parliament. All the reply letters to Members of Parliament were published on its website. The letters covered supervised institutions’ activities in Russia, supervisory work on banks’ exposures to vulnerable sectors and legislative initiatives to promote the secondary market for non-performing loans.

In line with the Interinstitutional Agreement, the ECB also made the records of proceedings of its Supervisory Board meetings and the summaries of Supervisory Board seminars available to the European Parliament.

In addition, to further foster the dialogue between the ECB and the European Parliament, ECB Banking Supervision reacted to the comments and suggestions provided by the European Parliament in its Resolution on banking union – annual report 2022. In its feedback^[55], the ECB commented on developments in the banking sector, climate-related and environmental risks and legislative files relevant to banking supervision.

Regarding interactions with the EU Council in 2023, the Chair of the Supervisory Board participated in two exchanges of views with the Eurogroup, on 15 May and 8 November. Ahead of each of these discussions, the ECB published an overview of its relevant supervisory activities^[56]. The main topics discussed were the state of the European banking system in the current macroeconomic and geopolitical environment, supervisory priorities and regulatory and institutional issues.

5.1.1 European Commission’s review of the SSM and European Court of Auditors’ special report on EU supervision of banks’ credit risk

On 18 April 2023 the European Commission published a report on its second review of the SSM. The review concluded that the SSM is functioning well overall and has become a mature, established supervisory authority that delivers on the objectives set out when it was created. It helps ensure that banks are well prepared and capitalised for economic and financial crises. It also provides good quality and proactive banking supervision, rapidly adapting to supervisory challenges, as shown during the coronavirus (COVID-19) crisis.

On 12 May 2023 the European Court of Auditors (ECA) published its Special report on EU supervision of banks’ credit risk. The report concluded that the ECB’s supervisory assessments of banks’ credit risk have some shortcomings but are generally of good quality. The ECB’s comments on the findings are included in an annex to the report. The ECB welcomes the outcome of the ECA’s audit and its recommendations, which will contribute to further improving processes. The ECB remains committed to applying the highest standards in banking supervision and enhancing its supervisory practices.

The ECA also completed the follow-up to its 2016 audit – Special Report 29/2016 Single Supervisory Mechanism – Good start but further improvements needed. The results were published as an annex to the special report on EU supervision of banks’ credit risk.

5.2 Transparency and communication

In 2023 the Chair and Vice-Chair of the Supervisory Board gave 26 speeches and the ECB representatives to the Supervisory Board gave 12 speeches. Together, they gave 32 media interviews and posted nine blog posts and opinion pieces. The Chair also held two press conferences on the results of the Supervisory Review and Evaluation Process (SREP) for 2022 and 2023. ECB Banking Supervision released four podcast episodes and published 28 press releases, as well as other items such as letters to MEPs, guidance to banks and supervisory statistics. The quarterly Supervision Newsletter, a digital publication with 10,000 subscribers, provided information and updates on ongoing supervisory projects and findings.

In 2023 ECB Banking Supervision published stress test results and launched four public consultations. These consultations covered sound practices in counterparty credit risk governance and management, the revised ECB Guide to internal models, the Guide on effective risk data aggregation and risk reporting and the draft Guide on financial conglomerate reporting of significant risk concentrations and intragroup transactions. In response to the Swiss banking turmoil, ECB Banking Supervision swiftly clarified the bank resolution rules applied in the EU. It also shared information on several sanctions cases and published the results of an external review of the SREP (see Section 1.3.1.7). Moreover, the ECB hosted the fifth ECB Forum on Banking Supervision. To foster dialogue between ECB Banking Supervision and market professionals, the ECB held two meetings of the Banking Supervision Market Contact Group, with discussions focusing on the risk outlook for the European banking sector.

In 2023 the ECB responded to 1,355 public enquiries on banking supervision topics. In particular, it addressed one petition in which citizens expressed concerns about the effects of climate change on the European financial sector and responded to enquiries about the climate risk stress test. Through the Visitor Centre, the ECB held lectures on banking supervision for 401 attendees and introduced 9,096 visitors (8,903 on-site and 193 virtually) to the key tasks of the ECB and the basics of European banking supervision.

5.3 ECB Banking Supervision staffing

5.3.1 Hiring

ECB Banking Supervision generally advertises vacant positions internally first, except for entry-level positions, which are advertised on the external market. In 2023 ECB Banking Supervision hired 40 candidates from external campaigns for longer-term positions.

Chart 11

Number of appointments per staff group in 2023

As part of the annual rotation exercise, 48 staff members moved to a new Joint Supervisory Team to avoid supervisory capture and to aid their personal and professional development.

5.3.2 Swap programmes

In addition to the SSM staff swap programme (see Section 5.4), ECB Banking Supervision joined the Schuman Programme, which enables staff from across the European System of Central Banks and European banking supervision to work in different institutions on common projects.

In addition to the exchange between the European Insurance and Occupational Pensions Authority and the ECB that began on 1 February 2023, there was a call for applications to take part in swaps between the ECB and the European Investment Bank, the European Securities and Markets Authority and the Single Resolution Board.

5.3.3 Capability building

In 2023 ECB Banking Supervision carried out an organisational readiness assessment and identified three areas for development: IT and cyber risk, climate risk and digital transformation.

This gap analysis provided the basis for the SSM capability building plan for 2024. The plan will include measures to better identify and match talent with organisational needs, training and other learning opportunities and improve the recruitment of new talent. Against this background, 35 positions were allocated to the SSM flexibility pool for 2024 to support initiatives within the three areas for development.

5.3.4 Diversity and inclusion

ECB Banking Supervision is committed to embracing diversity and inclusion in all their forms. Gender balance remains a key strategic priority. Women make up 43% of its employees. The share of female employees varies slightly across the levels of hierarchy. At analyst level, the share of female staff increased by 2 percentage points to 52%. At expert level, it fell by 4 percentage points to 39%. And at team lead and management levels, it increased by 2 and 1 percentage points to 34% and 35% respectively. The ECB will continue to strengthen its efforts to achieve gender balance.

Figure 1

ECB Banking Supervision workforce in figures

5.4 SSM integration

In 2023 the ECB, together with the national supervisory authorities, developed a multidisciplinary SSM foundation training programme, which was launched in early 2024. The programme is open to all staff working for European banking supervision and was created in cooperation with the European University Institute. It aims to build up a common level of technical skills and knowledge of core and emerging supervisory topics.

New content and functionalities adapted to the needs of users helped to make SSMnet – the joint information and knowledge-sharing platform – a more effective channel for direct communication across European banking supervision. Contributors from all of the national supervisory authorities and the ECB produced engaging content, informing readers about internal activities, important meetings and the results of their regular SSM-wide survey on collaboration, among other topics.

To strengthen this common supervisory culture, a major integration initiative was developed in 2023 and launched in early 2024. This initiative aims to make the tenth anniversary year of the SSM a “year of integration” in which all of the national supervisory authorities and the ECB offer greater opportunities for staff to connect with one another.

As part of the SSM swap programme, in 2023 staff swaps were organised with established partner institutions (Autorité de contrôle prudentiel et de résolution and the Banco de España), as well as with new ones (Banca d’Italia and De Nederlandsche Bank). These professional exchanges between staff from the ECB and the national supervisory authorities are key to facilitating integrated career paths within European banking supervision. 15 pairs of staff members took part in swaps.

There was also closer cooperation on key supervisory topics. More than 50 supervisory staff from national supervisory authorities were successfully onboarded to expert groups for hybrid collaboration. In a pilot scheme, the on-site community launched two centres of competence for dedicated risk areas to further enhance collaboration and expertise sharing among inspectors. In addition, to further strengthen collaboration, best practices were identified for knowledge sharing and the operation of SSM networks.

As closer collaboration is linked to integrated planning, the risk tolerance framework was rolled out to support supervisory assessments and facilitate the translation of the strategic priorities into supervisory planning (see Section 1.3.1).

5.5 SSM digital agenda

With the banking sector becoming more complex and supervisory resources more limited, European banking supervision has turned to digitalisation to keep pace with changes in the banking landscape and to address emerging supervisory risks. To that end, since 2020 European banking supervision has made the digital agenda a priority and invested in a portfolio of supervisory technologies (suptech).

Some 14 suptech tools are now live and catering effectively to the diverse needs of supervisors. As an example, Navi – a platform for network analytics and advanced visualisations – draws key insights from connected data, such as the ownership structures of significant institutions. Meanwhile, Agora provides centralised access to all prudential data used in European banking supervision.

While 2022 marked the roll-out of several tools, 2023 saw major efforts to better connect and integrate these tools in the IT landscape, upscale suptech platforms, foster their adoption by supervisors and explore emerging technologies. The initial investment in technology also aided the development of cutting-edge infrastructure to scale the application of artificial intelligence (AI). A notable example is the Virtual Lab, which is a state-of-the-art cloud-based platform. It not only enhanced collaboration and digital exchanges but also enabled users to explore pioneering technologies, such as generative AI applications. This included querying supervisory data using natural language and testing chatbot functionalities for supervisory regulations and methodologies.

Furthermore, the first strategy cycle of the SSM digital agenda was concluded in 2023 with the full implementation of the SSM Digitalisation Blueprint. A new SSM digital strategy is being developed for the period 2024-28. One core objective of the new strategy is to build a unified supervision cockpit that bundles together the most requested data, news, IT applications and systems.

Lastly, European banking supervision has started to implement an operating model for its digital agenda in the steady state, which involves strengthening internal teams and reducing reliance on external consultants for developing and maintaining suptech applications and platforms. In this context, it has launched the suptech centre initiative in which certain NCAs will develop and share suptech solutions for use across the SSM.

5.6 Decision-making

5.6.1 Meetings and decisions of the Supervisory Board and Steering Committee

The ECB’s Supervisory Board met 20 times in 2023. Following a further loosening of pandemic restrictions, five meetings were held in Frankfurt am Main and one in Dubrovnik. All other meetings were held via videoconference.

In addition, the Supervisory Board held two touch points to exchange information on topical financial developments and organised a seminar to discuss topics of supervisory relevance. Upon invitation by the Banca d’Italia, the Supervisory Board also held a strategic retreat in Rome in October 2023, where members talked about the way forward for SSM integration, the follow-up to the report of the expert group on SREP, ways to enhance supervisory effectiveness and the EBA priorities for 2024.

The Steering Committee^[57] of the Supervisory Board held four meetings in 2023, all of which were held via videoconference.

The Steering Committee held 13 additional meetings with a focus on digitalisation, simplification of SSM processes and SSM integration. All of these meetings were held via videoconference and participation was open to all Supervisory Board members who expressed an interest.

Following the publication of a vacancy notice in May, on 13 September 2023 the Governing Council of the ECB nominated Claudia Buch to succeed Andrea Enria as Chair of the Supervisory Board as of 1 January 2024 from a shortlist of candidates previously shared with the European Parliament and the EU Council. The European Parliament’s Committee on Economic and Monetary Affairs held a public hearing with Ms Buch on 20 September and voted in her favour. The ECB’s proposed appointment was subsequently approved by the European Parliament in a plenary session on 3 October and confirmed by an implementing decision of the EU Council on 19 October 2023 with an application date of 1 January 2024.

In 2023 the ECB took 2,403 supervisory decisions^[58] concerning specific supervised entities (Figure 2). Of these, 1,286 decisions were adopted by the ECB heads of work units in line with the general framework for delegating decision-making powers for legal instruments related to supervisory tasks. 1,117 decisions were adopted by the Governing Council under the non-objection procedure on the basis of a draft proposal of the Supervisory Board. These numbers include 189 operations^[59] (such as the establishment of branches) that the ECB implicitly approved by not objecting within the legal deadlines.

The bulk of the supervisory decisions were related to fit and proper assessments (48.4%), own funds (9.6%), national powers (7.9%), internal models (7.7%), the SREP (4.7%), and ad hoc reporting (4.7%).

In addition to the bank-specific final draft decisions submitted to the Governing Council for adoption, the Supervisory Board decided on several horizontal issues. Most notably, these decisions related to the 2024 SSM cyber resilience stress test exercise, the final results of the EBA’s 2023 EU-wide stress test, the modalities and operational aspects of the publication of periodic penalty payments imposed by the ECB, the supervisory priorities for 2024-26, and the fit and proper policy for assessing information and communications technology and security risk expertise on the boards of banks. Some of these decisions were prepared by temporary structures mandated by the Supervisory Board. These structures comprised representatives from the ECB and the NCAs who carried out preparatory work on topics such as revisions to the methodology for assessing operational resilience, operational risk and IT risk to be implemented in the 2024 SREP cycle and the calibration of the methodologies for setting Pillar 2 guidance and Pillar 2 guidance for the risk of excessive leverage.

Moreover, some decisions by the Supervisory Board resulted in public guides, reports and reviews, such as the ECB Guide on qualifying holding procedures.

The Supervisory Board took most of its decisions by written procedure.^[60]

Of the 113 banking groups directly supervised by the ECB in 2023, 32 asked to receive formal ECB decisions in an EU official language other than English.

Figure 2

Decisions by the Supervisory Board in 2023

5.6.2 Activities of the Administrative Board of Review

The Administrative Board of Review (ABoR) is an ECB body comprising members who are individually and collectively independent from the ECB and are entrusted with the task of reviewing decisions adopted by the Governing Council on supervisory matters upon an admissible request for review.

In 2023 the ABoR received four requests for an administrative review of ECB supervisory decisions (Table 5). One of these requests was withdrawn by the applicant after the ECB clarified the matter with the applicant outside the ABoR proceedings.

Of the three remaining requests, two related to the withdrawal of banking licences by the ECB. In both cases, after hearing the applicant, the ABoR proposed to the Supervisory Board that the decision should be replaced by a decision of identical content. In the third case, also after hearing the applicant, the ABoR adopted an opinion in which it proposed that the Supervisory Board should replace the decision with a decision which establishes the same supervisory measures. In addition, the ABoR referred the Supervisory Board to new information provided by the applicant and included it in the opinion.

In May 2023 an interview with the Chair of the ABoR, Pentti Hakkarainen, was published in the Supervision Newsletter. In the interview, he explains how the ABoR operates and its workplan for the coming years.

In 2023 the ABoR was chaired by Pentti Hakkarainen. Its other members were André Camilleri (Vice-Chair since May 2023), F. Javier Aríztegui Yáñez, René Smits and Christiane Campill (a member since March 2023, having previously been an alternate). Damir Odak was an alternate member. The current composition of the ABoR is available on the ECB’s ABoR webpage.

5.6.3 Areas of interest of the ECB representatives to the Supervisory Board

Pursuant to the SSM Regulation and ECB Decision 2014/4^[61], the Governing Council appoints four representatives of the ECB to the Supervisory Board.

The current ECB representatives to the Supervisory Board are Kerstin af Jochnick, Edouard Fernandez-Bollo, Elizabeth McCaul and Anneli Tuominen.

In their daily work, the representatives support the Chair and Vice-Chair of the Supervisory Board and represent ECB Banking Supervision internally and externally.

As the terms of Kerstin af Jochnick, Edouard Fernandez-Bollo and Elizabeth McCaul will come to an end in 2024, the areas of interest of the ECB representatives to the Supervisory Board will be redistributed upon the appointment of their successors.

5.7 Implementing the Code of Conduct

In accordance with Article 19(3) of the SSM Regulation, the ECB has established an ethics framework for high-level ECB officials, management and staff. It comprises the single Code of Conduct for high-level ECB officials, a dedicated chapter in the ECB Staff Rules and the Guideline laying down the principles of the Ethics Framework for the Single Supervisory Mechanism. The implementation and further development of the framework is supported by the ECB Ethics Committee, the Compliance and Governance Office (CGO) and the Ethics and Compliance Committee.

Since 1 January 2023 all high-level ECB officials have been subject to the enhanced rules and transparency obligations for private financial transactions. Under the new rules, officials must now also obtain prior authorisation for the sale of, or the exercise of any rights attached to, legacy assets and provide lists of private financial transactions carried out during the calendar year.

In accordance with its mandate, the Ethics Committee carried out its yearly assessment of the Supervisory Board members’ declarations of interests prior to their publication on the ECB’s banking supervision website. The Committee also responded to requests for advice submitted by high-level ECB officials involved in banking supervision and, in this context, issued 13 opinions, most of which concerned private and post-employment activities. Ethics Committee opinions are published on the ECB’s website six months after the date they are issued.

In 2023 the CGO continued its digitalisation efforts with to a view to providing staff with ethical advice in a faster, safer and more user-friendly way. In addition to an Ethics Chatbot which provides answers to straightforward queries, ECB staff can now make use of an internal platform to access templates for submitting information and to track any follow-up. The new tool is accessible from multiple devices. There were 2,767 requests requiring CGO staff input in 2023, compared with 1,690 in 2022. Approximately 44% of the requests for advice were submitted by ECB Banking Supervision staff.

Chart 12

Overview of requests received from ECB Banking Supervision staff in 2023

(number of requests)

In addition to specialised training courses and e-learning programmes, the CGO organised information campaigns on the ethics framework, such as the Open Ethics Days for newcomers and an Ethics Awareness Season during October, which included contributions to cybersecurity awareness month. The 2023 Global Ethics Day for all staff members focused, among other things, on rules on private financial transactions, post-employment, meetings with external parties and the importance of speaking up.

To avoid actual or perceived “revolving door” situations, the CGO assessed possible conflicts of interest arising from staff members considering job offers from the private sector and advised on the applicable rules and mitigating measures. Of those members of staff involved in banking supervision who resigned from their posts in 2023, two cases triggered a temporary prohibition on taking up another occupational activity in line with the ethics framework. In seven cases, additional safeguarding measures, such as reassigning tasks, transferring staff to other positions and/or cutting access rights were imposed to avoid a revolving door situation, in effect internalising the cooling-off period.

The CGO organised its regular compliance monitoring exercise on staff members’ and high-level ECB officials’ private financial transactions. As in previous years, this exercise only identified a limited number of instances of non-compliance, of which less than 40% were related to ECB Banking Supervision staff. None of these instances involved intentional misconduct or other serious cases of non-compliance.

The Ethics and Compliance Committee is a forum for exchange and collaboration within the Eurosystem and the SSM on matters related to ethics and integrity. In 2023 its activities included establishing a conduct risk task force to compare, improve and harmonise existing frameworks for assessing conduct risk and the monitoring and reporting processes in place at NCAs. The ECB presented its conduct risk framework for contractors and its implications for SSM contractors at a meeting of the Ethics and Compliance Committee.

5.8 Applying the principle of separation between monetary policy and supervisory tasks

In 2023 the principle of separation between monetary policy and supervisory tasks was mainly applied to the exchange of information between different policy areas.

In line with Decision ECB/2014/39 on the implementation of separation between the monetary policy and supervision functions of the ECB^[63], this exchange of information was subject to a need-to-know requirement: each policy function had to demonstrate that the information it was requesting from the other policy function was necessary to achieve its policy goals.

Under Decision ECB/2014/39, Executive Board approval is required for the exchange of non-anonymised common reporting (COREP) and financial reporting (FINREP) data, other raw data, and information containing assessments or policy recommendations. The business areas of the ECB’s two policy functions exchanged such data under the framework approved and periodically reviewed by the Executive Board.

Where the requested information pertained to anonymised data or non-policy sensitive information, access to confidential information was granted directly by the ECB policy function that owned the information, in line with Decision ECB/2014/39.

In May 2023 the Executive Board decided to authorise the exchange of confidential information between the two functions on the basis of Article 8 of Decision ECB/2014/39 in view of adverse market developments that could potentially jeopardise market liquidity and financial stability. The authorisation, granted on a strict need-to-know basis, was reviewed and extended each month until the end of June 2023. The sharing of data related to the impact of the Russian invasion of Ukraine on the banking sector – which was activated under the emergency provision in Article 8 of Decision ECB/2014/39 in February 2022 – continues, subject to a strict need-to-know requirement. The exemption applied to exchanges of bank data collected in the context of the COVID-19 pandemic was discontinued in October 2023.

Separation at the decision-making level did not raise concerns and no intervention by the Mediation Panel was required.

5.9 Data reporting framework and information management

5.9.1 Developments in the data reporting framework

In 2023 the ECB and the NCAs continued to make significant progress in implementing measures to further harmonise common practices for the collection of supervisory data using the “sequential approach”. The requirement for NCAs to immediately forward supervisory data submissions to the ECB was put into practice, and the associated updates to the ECB legal framework were made (see Chapter 7).

The ECB’s Centralised Submission Platform (CASPER), which had over 3,400 internal and external users in 2023, is being upgraded to enable incoming data to be validated against other ECB datasets upon reception.

In response to a recommendation from Internal Audit, the ECB, in collaboration with the NCAs, began work on a clear set of rules to determine the significance of resubmitted supervisory data within the scope of the EBA’s implementing technical standards on supervisory reporting. A pilot exercise was launched to define the criteria for identifying significant resubmissions and to collect detailed explanations for resubmissions when these breach the relevant regulatory or significance thresholds.

The ECB also launched the Management report on data governance and data quality.^[64] The report, which comprises a set of quantitative indicators and a questionnaire to banks, aims to foster management body accountability and identify and potentially reduce banks’ structural deficiencies in risk data aggregation and reporting.

In 2023 the ECB expanded the content of its quarterly supervisory banking statistics with new indicators on the net interest margin, an additional breakdown of the net stable funding ratio and a breakdown of debt securities by counterparty. In addition, in May 2023 the ECB released a new set of aggregated banking statistics for less significant institutions, covering key indicators on capital, profitability, liquidity and asset quality.

At the end of 2023 the ECB published Pillar 3 information for individual banks, supplementing the selected capital and liquidity ratios and credit quality templates with information on banks’ exposures to environmental risks. The ECB carried out a reconciliation exercise between selected Pillar 3 disclosures and regulatory reporting which resulted in substantial improvements in data consistency.

5.9.2 Information management

The SSM Information Management System (IMAS) comprises the suite of systems for supervisory processes. IMAS hosts the applications for SREP procedures, all the primary workflows for supervision, a data service to retrieve and analyse supervisory reporting (IDRA) and an application for supervised entities to connect digitally with supervisors and submit applications and notifications via online forms (IMAS Portal).

In 2023 the underlying technical infrastructure of IMAS was overhauled completely. The system now benefits from state-of-the-art technology and is more efficient, scalable and maintainable. It was also adapted to changes in the financial system and its regulatory framework and to the SSM methodology and strategy. The new features in 2023 included (i) changes to reflect the SREP methodology updates and calibrations, including specific tools for benchmarking and horizontal analysis; (ii) a revamp of the Supervisory Examination Programme planning module; (iii) adjustments to the reporting generated for the SSM decision-making bodies; (iv) upgrades to the module for the significance assessment and the register of supervised institutions; and (v) improved traceability and internal controls across all the supervisory processes supported in IMAS.

In 2023 the IMAS Portal was also upgraded with a renovated user interface that simplifies navigation. New supervisory processes were added, specifically for (i) the submission of loan tapes as part of credit quality reviews in on-site inspections; (ii) the new procedure for banks and supervisors to monitor the remediation of findings and related measures; and (iii) the extension of the unified entry form for fit and proper applications for Bulgarian and Croatian institutions.

The use of the IMAS Portal increased significantly in 2023 and more than 3,900 new processes were submitted, including applications for fit and proper assessments, passporting notifications, proposed acquisitions of qualifying holdings, new licences, approvals and exemptions of financial holding companies, notifications of non-material model changes and notifications of outsourcing arrangements. Notably, the use of the IMAS Portal for submitting fit and proper applications and monitoring their progress increased from 89% in 2022 to 96% in 2023.

Finally, the machine-reading tool, Heimdall, was implemented for fit and proper notifications as of 1 September 2023. Heimdall retrieves information submitted by the banks via the IMAS Portal, such as questionnaires, and analyses its content before case handlers verify and complete the assessment using a risk-based assessment tool. Using Heimdall and the risk-based assessment tool strengthens the efficiency of the fit and proper assessment process and ensures consistency across assessments.

6 Reporting on budgetary consumption

6.1 Expenditure for 2023

The SSM Regulation requires the ECB to dedicate adequate resources to carrying out its supervisory tasks effectively. These resources are financed via a supervisory fee borne by the entities subject to direct and indirect supervision by the ECB. The ECB makes every effort to reprioritise and optimise its resources in order to ensure that banking supervision can perform its tasks adequately in an ever-changing context, thus improving its effectiveness and containing its costs in line with the cost stabilisation commitment of the whole organisation.

The expenditure incurred for supervisory tasks is separately identifiable within the ECB’s budget. The expenditure incurred consists of the direct expenses of the ECB Banking Supervision function. The supervisory function also relies on shared services provided by the ECB’s support business areas^[65].

The budgetary authority of the ECB is vested in its Governing Council. The Governing Council adopts the ECB’s annual budget, following a proposal by the Executive Board in consultation with the Chair and the Vice-Chair of the Supervisory Board for matters related to banking supervision. The Governing Council is assisted by the Budget Committee, which consists of members from all of the national central banks of the Eurosystem and the ECB. The Budget Committee assists the Governing Council by providing it with evaluations of the ECB’s reports on budget planning and monitoring.

In 2023 the actual annual expenditure on ECB supervisory tasks was €653.5 million, in line with the estimate of €649.0 million communicated in March 2023 and 7.4% below the ECB’s budget ceiling for supervisory tasks in 2023 of €705.6 million.

The classifications provided in Table 6 are used to identify the split of the annual costs to be recovered through annual supervisory fees from supervised entities based on their supervisory status as significant or less significant according to Article 8 of the Fees Regulation^[66].^[67] Table 7 provides more granular information on the expenditure based on the activities performed.

Spending on supervisory tasks in 2023 (€653.5 million) increased by 10.1% compared with 2022, when it stood at €593.8 million. This increase is observed for all of the main supervisory tasks and reflects the rise in staff-related costs, as well as the first full year of the return to normal levels of activity in banking supervision following the pandemic. Moreover, it reflects the introduction of new IT services related to supervisory technology (suptech) projects and ongoing developments in other IT systems for banking supervision. More information on these activities can be found in Section 5.9. Finally, this increase reflects the effects of inflation and high energy prices. The 20.4% rise in expenditure on macroprudential tasks reflects the biennial European Banking Authority stress test that was conducted in 2023.

To supplement its internal resources, the ECB uses external consultancy support services to provide either specialised expertise or integrated consultancy under qualified internal guidance to complement internal resources during workload peaks. In 2023 the ECB spent €33.9 million on consultancy services for core supervisory tasks, a decrease of €6.9 million compared with 2022, mainly resulting from the internalisation of resources for on-site missions. This expenditure included €9.4 million on developments in IT systems, €8.3 million on asset quality reviews and €16.2 million for on-site supervision tasks, including cross-border missions. More information on these activities can be found in Chapter 1. In addition, consultancy costs of €11.2 million were incurred. These costs derived from areas that support the ECB Banking Supervision function and were primarily related to the running and evolutionary maintenance of IT systems.

In 2023 there was a significant increase in expenditure on business travel related to banking supervision activities, with expenditure amounting to €11.3 million, up from €6.8 million in 2022. This reflects the fact that 2023 was the first full year in which business travel was unrestricted following the pandemic.

The split of costs between expenditure directly attributable to ECB supervisory tasks and expenditure on shared services was broadly similar to the previous year (Chart 13).

Chart 13

Cost of ECB supervisory tasks by cost category

(EUR millions)

The directly attributable expenditure is composed of core supervisory staff costs, supervisory initiatives (including costs related to comprehensive assessments), other operating expenditure such as business travel and training, dedicated information technology such as IMAS and the Stress Test Account Reporting platform (STAR) and related projects, as well as advanced suptech developments.

The shared services category encompasses services that are used by both the central banking function and the banking supervision function.^[68] The cost of the shared services is split between each function using a cost allocation mechanism applying industry standard metrics such as full-time equivalents, office space and number of translation requests. As the ECB is committed to rigorously pursuing efficiency improvements, it routinely refines the cost allocation metrics.

In 2023 total actual expenditure was €653.5 million. Directly attributable expenditure amounted to €403.0 million, and shared services amounted to €250.5 million, respectively 61.7% and 38.3% of the actual expenditure incurred (which is broadly similar to 2022, when they were 59.2% and 40.8% respectively). The amortisation of IMAS and STAR contributed to the expenditure on directly attributable information technology and related projects, amounting to €22.9 million in 2023.

70.7% of the €59.7 million overall increase in actual expenditure for 2023 stems from staff-related costs (€42.2 million). In 2022 staff costs decreased following an adjustment in the valuation of long-term benefits owing to the significantly higher discount rate applied in the actuarial valuation. In 2023 the higher average number of staff working for ECB Banking Supervision, including the staff needed for the biennial European Banking Authority stress tests and for the partial internalisation of consultancy costs associated with on-site inspections and internal model investigations, as well as salary adjustments, led to a rise in staff costs.

In addition, the return to full levels of activity following the pandemic not only led to a higher staff occupancy rate but also had an impact on most cost types, for example business travel, which also contributed to the overall cost increase.

The remaining increase can be seen across most of the other cost categories, both in the directly attributable expenses and in the shared services expenses, again mainly reflecting a return to full levels of activity and the impact of inflation.

6.2 Outlook for ECB supervisory fees in 2024

Following the easing of the effects of the pandemic on expected consumption of the planned expenditure, the ECB adjusted its approach when estimating expenditure for 2024. The expected increase in the consumption of planned expenditure resulted in an estimated expenditure for 2024 of €661.0 million. The ECB’s budget ceiling for supervisory tasks in 2024 is €698.9 million. This planned expenditure, in line with the ECB’s commitment to cost stabilisation, takes into consideration efforts to reprioritise and optimise resources, the fact that the European Banking Authority’s stress test will not take place in 2024 and the internalisation of consultancy costs associated with suptech projects and on-site missions, both of which are offset by a reduction in consultancy expenses.

In line with its commitment to cost stabilisation for the whole organisation by 2023, the ECB envisages stabilisation in planned expenditure for its current mandates.

The annual supervisory fee for 2024, to be levied in 2025, will only be known at the end of the 2024 fee period and will comprise the actual expenditure for the whole of 2024, adjusted for amounts reimbursed to or collected from individual banks for previous fee periods, late payment interest and non-collectable fees.

The ratio of the total amount to be levied on each category in 2024 is estimated to be 95.8% for significant institutions and 4.2% for less significant institutions.

6.3 Fee framework for 2023

Together with the SSM Regulation, the Fees Regulation and associated Decision^[69] provide the legal framework within which the ECB levies an annual supervisory fee for the expenditure it incurs conducting its supervisory tasks.

6.3.1 Total amount to be levied for the fee period 2023

The annual supervisory fee to be levied for the fee period 2023 amounts to €653.7 million. This is almost completely composed of the actual annual cost for 2023, amounting to €653.5 million, with adjustments of €402,266 for (net) reimbursements to individual banks for previous fee periods and €182,137 for late payment interest received, amounting to an overall adjustment of €220,129.

The annual supervisory fee can also be adjusted for amounts written off that were not collectable. Such an adjustment was not necessary in 2023.

The amount to be recovered via annual supervisory fees is split into two parts. This split is related to the status of supervised entities as either significant or less significant, reflecting the varying degrees of supervisory scrutiny they are subject to by the ECB. Expenditure is allocated to the institution categories based on a methodology that allows for ongoing enhancements and timely adjustments, ensuring that the allocation continuously improves over time.

For 2023 the total amount levied for significant institutions is €626.5 million; for less significant institutions it is €27.2 million, representing 95.8% and 4.2% respectively of the total cost of ECB supervisory tasks.

6.3.2 Individual supervisory fees

At entity or group level, the fees are calculated according to a bank’s importance and risk profile using annual fee factors for the supervised banks.

More information on supervisory fees is available on the ECB’s banking supervision website.

6.4 Other income related to ECB supervisory tasks

The ECB is entitled to impose administrative penalties on supervised entities for failure to comply with applicable EU banking law on prudential requirements (including ECB supervisory decisions). The related income is not taken into account in the calculation of the annual supervisory fees, nor are reimbursements of such penalties in the event that previous sanction decisions are amended or annulled, the related amounts are recorded in the ECB’s profit and loss account. In 2023 the income arising from penalties imposed on supervised entities amounted to €17.9 million.

7 Legal instruments adopted by the ECB

The legal instruments adopted by the ECB include regulations, decisions, guidelines, recommendations and instructions to national competent authorities (mentioned in Article 9(1), third subparagraph, of the SSM Regulation and Article 22 of the SSM Framework Regulation). This section lists the legal instruments concerning banking supervision that were adopted in 2023 by the ECB and published in the Official Journal of the European Union and on EUR-Lex. It covers legal instruments adopted pursuant to Article 4(3) of the SSM Regulation and other relevant legal instruments.

7.1 ECB regulations

ECB/2023/20
Regulation (EU) 2023/1678 of the European Central Bank of 17 August 2023 amending Regulation (EU) 2015/534 on reporting of supervisory financial information (ECB/2015/13) (ECB/2023/20) (OJ L 216, 1.9.2023, p. 93)

7.2 ECB legal instruments other than regulations

ECB/2023/2
Decision (EU) 2023/656 of the European Central Bank of 28 February 2023 on the total amount of annual supervisory fees for 2022 (ECB/2023/2) (OJ L 81, 21.3.2023, p. 42)

ECB/2023/5
Decision (EU) 2023/672 of the European Central Bank of 10 March 2023 on delegation of the power to adopt decisions relating to on-site inspections and internal model investigations (ECB/2023/5) (OJ L 84, 23.3.2023, p. 18)

ECB/2023/6
Decision (EU) 2023/673 of the European Central Bank of 14 March 2023 nominating heads of work units to adopt delegated decisions relating to on-site inspections and internal model investigations (ECB/2023/6) (OJ L 84, 23.3.2023, p. 24)

ECB/2023/11
Decision (EU) 2023/864 of the European Central Bank of 13 April 2023 amending Decision ECB/2014/16 concerning the establishment of an Administrative Board of Review and its Operating Rules (ECB/2023/11) (OJ L 112, 27.4.2023, p. 46)

ECB/2023/18
Decision (EU) 2023/1681 of the European Central Bank of 17 August 2023 on the provision to the European Central Bank of supervisory data reported to the national competent authorities by the supervised entities (ECB/2023/18) (OJ L 216, 1.9.2023, p. 105)

ECB/2023/19
Decision (EU) 2023/1680 of the European Central Bank of 17 August 2023 on the reporting of funding plans of supervised entities by national competent authorities to the European Central Bank (ECB/2023/19) (OJ L 216, 1.9.2023, p. 98)

ECB/2023/24
Decision (EU) 2023/2530 of the European Central Bank of 28 September 2023 on the delegation of the power to adopt decisions not to object to intended macroprudential measures of national competent authorities or national designated authorities (ECB/2023/24) (OJ L, 2023/2530, 24.11.2023)

ECB/2023/26
Decision (EU) 2023/2531 of the European Central Bank of 24 October 2023 nominating heads of work units to adopt delegated decisions not to object to intended macroprudential measures of national competent authorities or national designated authorities (ECB/2023/26) (OJ L, 2023/2531, 24.11.2023)