Resilience, risk and regulation: anchoring stability in a rules-based international order

Keynote speech by Sharon Donnery, Member of the Supervisory Board of the ECB, at the Delphi Economic Forum X

Delphi, 10 April 2025

Introduction

Two timeless pieces of wisdom were inscribed on the ancient walls of Apollo’s temple at Delphi: "Know yourself" and "Nothing in excess."^[1][2]

These words were meant as philosophical guidance, but they evoke what a banking supervisor might advise today: “know your risks and don’t engage in excessive risk-taking!”

Risk-taking is intrinsic to banking – it’s what allows capital to be allocated and innovation to flourish. Yet, history has repeatedly shown us the dire consequences of losing sight of those Delphic maxims. Risk is a constant in finance, but the nature of that risk – and the task of managing it – has grown ever more complex in the 2,500 years since those words were carved in stone.

Technological progress has accelerated not only the pace at which we operate, but also the speed at which risks spread through the financial system. Artificial intelligence has the potential to rapidly and profoundly transform not just finance, but the broader economy and society as a whole too. Cyber risk is now easily a top priority for modern risk managers. Crypto-assets, stablecoins and central bank digital currencies may all transform the payments and banking landscape, reshaping how value is exchanged, how financial services are delivered, and even how monetary policy is transmitted.

Climate and nature-related risks are on the rise and a declining global commitment to mitigate and adapt to these climate risks could lead to more physical and transition risks in the future.^[3]

Globalisation has made the world more interconnected, contributing to economic prosperity, but it has also made it easier for risks to spread throughout the system. Because globalisation thrives on predictability and trust, it inherently relies on internationally agreed rules to provide stability, fairness and a level playing field. Yet, in recent years, rising geopolitical fragmentation has been putting pressure on these very rules and the institutions that uphold them.

In my remarks today, I will provide an overview of the current risk landscape and outline how we, as supervisors, are addressing these challenges.^[4] I will argue that a consistent level playing field in international banking is crucial, not only for financial stability but also to enable banks to effectively operate and compete across borders. However, this playing field must be more than just level: it must be fundamentally sound.

As calls for simpler rules grow louder, I will argue that the solution is to harmonise rules, not weaken or reduce them. The complexity of the European regulatory framework is largely driven by national fragmentation. Therefore, any meaningful debate on simplification must begin and end with a clear commitment to completing the Single Market. Rather than lowering regulatory requirements, we can reduce complexity by harmonising European rules.

Foundation of resilience – success without complacency

In recent years the European banking sector has shown remarkable resilience in the face of an uncertain external environment. Supervised banks have maintained strong capital and liquidity positions, even as they navigated a challenging macro-financial landscape. This fundamental resilience allowed banks to act as shock absorbers rather than shock propagators when confronted with significant disruptions such as the pandemic, Russia’s unjustified war against Ukraine or the rapid shift in interest rates. At the same time, we should acknowledge that policymakers mitigated some of these shocks effectively. In response to the sharp decline in economic activity during the pandemic, fiscal measures helped stabilise the financial position of households and businesses while monetary policy accommodation protected credit supply. This in turn limited corporate insolvencies and credit losses.

Let me give you some numbers to illustrate banks’ resilience.

At the end of 2024, banks under our direct supervision reported an aggregate Common Equity Tier 1 ratio of 15.86%, compared with 12.72% in the second quarter of 2015. Similarly, liquidity positions have considerably improved and the aggregate liquidity coverage ratio now stands at 158.01% while the net stable funding ratio is 126.85%.

In recent years bank profitability continued to benefit from the increase in interest rates observed since mid-2022, with the annualised return on equity of 9.54% in the fourth quarter of 2024. The profitability outlook remains positive despite the gradual decline in interest rates, thanks to increasing non-interest income. The market sentiment towards banks has improved since the onset of the rate hike cycle, gaining further momentum in 2025.

Banks' asset quality remains solid, with the ratio of non-performing loans (NPLs) to total loans standing at 2.28%, well below the levels observed a decade ago when the ratio was close to 8%.

Still, there is some heterogeneity across countries and sectors. Notably, countries with originally higher levels of NPLs such as Greece have continued to reduce their NPL ratios, while some significant increases have been recorded in countries with historically better asset quality.

So, let me spend a couple of minutes on the rebound of the Greek banking sector.

The turnaround of the Greek banking sector is a success story, thanks to the actions taken by the Greek government, institutions, supervisory authorities and the banks themselves.

In 2016 the Greek NPL ratio peaked at close to 50%. Since then, legacy loans have been reduced by 90%, or €97 billion. A key driver of this reduction was the set-up of the Hellenic Asset Protection Scheme. Today, all significant banks in Greece have a single-digit NPL ratio.

Looking at the banking union more broadly, the outlook for asset quality remains stable overall, but pockets of vulnerabilities persist in some sectors. For example, the automotive and chemical sectors are vulnerable due to reduced sales in China and planned US tariffs.

While the commercial real estate market in the banking union shows signs of stabilisation with a 20% increase in transaction volumes in 2024, structural challenges in non-prime office spaces continue to present risks for exposed banks.

In this era of heightened geopolitical tensions and economic uncertainty, it is crucial that banks strengthen their ability to withstand macro-financial threats. One of our supervisory priorities is to ensure that banks address deficiencies in their credit risk management frameworks, enabling them to promptly identify deteriorating asset quality and maintain prudent provisioning levels. This includes a focus on exposures to non-financial corporations, particularly small and medium-sized enterprises, and non-bank financial institutions.

Good credit risk management requires good underwriting standards. In the past, inadequate loan origination practices have contributed to an accumulation of NPLs on banks’ balance sheets. To prevent this from happening in the future, banks should be able to properly assess the risks they take when granting new loans.

Broader risk landscape – geopolitical, cyber and market risk

While credit risk remains central to bank risk management and supervision, modern risk management demands a far broader and more integrated perspective.

The global system is becoming increasingly multipolar with many competing power centres; multidimensional with diverse, interconnected risks; and multilayered in terms of time horizons requiring simultaneous short-, medium-, and long-term planning. Banks today must manage multiple challenges at the same time: short-term volatility, medium-term strategic repositioning and long-term structural transitions such as climate adaptation and digital transformation.

In this context, we now understand that it’s important to not only look at specific risk categories but at underlying risk drivers too.

Let's clarify the concept of risk first. A risk is a potential adverse outcome that could harm a bank or the banking system – essentially, it’s something that could go wrong. Common examples include credit risk, market risk, liquidity risk and cyber risk.

Fundamentally, risks materialise when two distinct factors combine: an external threat (like economic downturn, climate change or geopolitical tension) and an internal vulnerability (such as weak governance, inadequate internal controls or outsized exposures). These two elements can be seen as risk drivers, explaining why or how things might go wrong.

In short: risks describe the "what" (the potential adverse outcome), while risk drivers – the relevant threats and vulnerabilities – explain the "why" or "how".

Let me now focus on geopolitical risk, which has emerged as the defining external risk driver of our times.

I will then concentrate on cyber risk and market risk – two critical areas where geopolitical risks can readily materialise and amplify vulnerabilities.

Geopolitical risk

Geopolitical risks, by their very nature, have the potential to disrupt the broader operating environment for banks.

As geopolitical risks have risen in recent years, we have created a dedicated framework to assess their impact on banks, focusing on three transmission channels: financial markets, real economy, and the safety and security risk channel.

We closely monitor euro area financial markets, which remain sensitive to prevailing policy uncertainty, with investors reacting to changes in tariffs, energy prices and geopolitical tensions, as we have seen in recent days.

On the real economy side, heightened trade tensions might negatively affect banks’ credit exposures to certain countries, for example those with additional tariffs, or certain economic sectors, like the automotive sector. We are carefully monitoring banks’ exposures in this context.

Geopolitical risks can also challenge banks’ operational resilience via the safety and security channel, stemming from heightened cyber risks, or, in the case of unrest, physical security risks.

The current environment of heightened geopolitical risks increases the likelihood of tail events, which are difficult to predict or quantify. As geopolitical risks can have bank-specific idiosyncratic effects, it is important for banks to engage in adequate scenario planning that considers the bank’s business model, geographical coverage and sectoral exposures. Moreover, geopolitical tensions are a key risk driver of the adverse scenario in the European Banking Authority’s 2025 EU-wide stress test. So it is essential that banks have in place adequate governance arrangements and risk management frameworks to ensure resilience to such risks. Banks should reduce vulnerabilities to geopolitical risks through provisioning practices, capital planning, cyber resilience and well-managed third-party arrangements. This is reflected in our supervisory priorities for 2025-27, which ask banks to strengthen their ability to withstand immediate macro-financial threats and severe geopolitical shocks.

Cyber risk

The nexus between geopolitical risk and cyber risk has been widely understood.

A recent survey on global bank risk management^[5] shows that banks’ chief risk officers (CROs) see cybersecurity as the single most pressing concern.

Three out of four CROs rank cybersecurity as their top risk area for the coming year, while 69% think that geopolitical risk is most likely to take the form of increasing cyberattacks. Faced with ever more complex cyber threats, which are fuelled by geopolitical tensions and rapid digitalisation, banks must be continuously vigilant.

Indeed, banks reported a higher number of cyber incidents in 2024.

Chart 1

Number of significant cyber incidents reported to the ECB by significant banks

Worryingly, we see a significant rise in cyberattacks targeting third-party service providers used by banks. To be clear, banks have compelling reasons for outsourcing certain activities – for instance, to achieve cost efficiencies, increase agility or optimise internal resources and expertise. However, as the increase in cyber incidents clearly demonstrates, outsourcing introduces distinct risks to business continuity which banks must carefully assess. Given their high dependency on third-party providers, European banks must be more vigilant, particularly amid rapid geopolitical shifts. Banks should therefore revisit their earlier risk management decisions when reviewing or reassessing outsourcing arrangements.

Against this background, we are looking at banks’ resilience as part of the ongoing targeted reviews on cyber resilience and outsourcing arrangements. And the 2024 cyber stress test gauged how banks would respond to and recover from a severe but plausible cybersecurity incident.

Furthermore, the Digital Operational Resilience Act (DORA), which came into effect in the EU earlier this year, is a significant step towards enhancing operational resilience. By providing a comprehensive framework, DORA requires banks to embed a culture of continuous IT and cyber risk management across their operations.^[6]

By enhancing their digital capabilities, banks can not only improve their competitiveness but also ensure that their business models remain sustainable in an increasingly digital world. As supervisors, we will continue to focus on key technologies such as cloud services and artificial intelligence and their impact on banks' operations and risk profiles.

Market risk and non-bank financial institutions

Geopolitical events such as conflicts, sanctions or political instability generate great uncertainty in financial markets. This uncertainty can lead to increased volatility, as investors reassess the potential risks and rewards associated with their investments. Markets typically react swiftly to unexpected geopolitical developments, often resulting in sharp price corrections.^[7] As the developments of the past week have clearly illustrated, it’s imperative for us to be vigilant to these risks. We will continue closely monitoring the evolving situation and its impact on the banking sector.

As we saw in the past few days, the potential for abrupt asset price corrections remains significant due to geopolitical uncertainties. High equity market valuations compared with fundamentals, narrowing corporate bond spreads and low risk premiums made financial markets susceptible to policy changes, geopolitical tensions and shifts in growth and inflation expectations.

As non-banks may be among those to feel geopolitical stress, their interlinkage with banks is a particular concern.^[8]

​The non-bank sector has grown significantly since the global financial crisis, raising its share of global financial assets to 49.1%.^[9] Non-banks play a crucial role in funding the economy, serving as an important complement to traditional bank lending. Increased financial intermediation by non-banks and the accompanying greater reliance on capital markets can offer significant benefits for the economy as a whole. This is also at the heart of the European Commission’s savings and investment union proposal^[10] which aims to further diversify the EU financial system and lessen over-reliance on banks, thus reducing the related risks.

Nonetheless, this expansion of the non-bank sector has deepened the interconnection between non-banks and banks, introducing potential risks to financial stability.^[11] Banks often have direct exposures to non-banks through lending and investment activities, making them susceptible to shocks originating within the non-bank sector. For instance, during periods of market stress, non-banks may face liquidity constraints, leading to asset fire sales that depress market prices and so affect banks that hold similar assets. Additionally, banks providing credit lines or engaging in derivative transactions with non-banks could encounter counterparty risks if non-banks default. The complexity and opacity of some activities in the non-bank sector can further obscure risk concentrations, complicating banks' risk management efforts. Given these dynamics, banks and supervisors crucially need to enhance their monitoring and develop robust frameworks to address the systemic risks arising from the non-bank/bank nexus.

In this context, we strongly support the European Commission’s consultation on non-banks, in which the Eurosystem has actively participated.^[12] We now encourage both the Commission and EU legislators to seize this pivotal opportunity to reinforce Europe’s policy approach towards non-banks.

Concretely, Europe should swiftly and fully implement the policy recommendations recently issued by the Financial Stability Board. These recommendations target liquidity mismatches in money market and open-ended funds and strengthen the liquidity preparedness of non-banks for margin and collateral calls.

It's essential we expand our macroprudential toolkit, for example with measures to proactively address structural liquidity mismatches within open-ended funds. This will equip authorities to anticipate and mitigate systemic risks.

We also need clearer EU governance. Granting greater responsibilities to the European Securities and Markets Authority will ensure a cohesive European vision, driving effective coordination and consistent policy standards across non-bank financial markets.

In parallel, we should give priority to developing a unified global framework for managing leverage risks, including synthetic leverage, in the non-bank sector. A harmonised global stance is essential to effectively monitor these complex and often hidden vulnerabilities.

Ultimately, reinforcing the policy framework for non-banks from a macroprudential perspective complements the capital markets union agenda. These initiatives will not only bolster the resilience of non-banks but also safeguard stable funding flows vital to the real economy and growth across Europe.

Rules-based order as anchor

Before I conclude, allow me to share another piece of Greek wisdom, often attributed to Thucydides: “History is philosophy teaching by examples”. What is the philosophy that history teaches us?

We know that financial regulation tends to move in cycles.^[13] Financial crises often follow periods of deregulation or regulatory forbearance, prompting a subsequent tightening of regulatory frameworks. Yet, as time passes, memories fade once more and the push for deregulation resurfaces. 

History is clear on one thing: a regulatory race to the bottom is always a race that nobody wins.

In 1974 the collapse of Herstatt Bank sent shockwaves through international financial markets. The supervisory community responded by creating the Basel Committee, based on the understanding that internationally active banks require cooperative supervision and a regulatory level playing field.

Since then, the financial system has grown ever more global, yet the fundamental insight remains unchanged: resilience demands robust rules. In other words, internationally agreed rules are essential for maintaining stability in an interconnected world.^[14]​

Decades of practical experience and academic research have proven that insufficient regulation and weak supervision can lead to financial crises with enormous costs and devastating social and political consequences.^[15]

Systemic financial crises of the past have caused average output losses of 8.5% of GDP in EU countries.^[16] The global financial crisis significantly harmed the real economy, causing Europe’s gross domestic product to drop by 4.3% in 2009 alone. Between 2008 and 2017, the European Commission approved aid to the financial sector totalling almost €1.5 trillion (capital-like aid) plus €3.7 trillion (liquidity aid).^[17] These significant state interventions were essential to stabilise the financial system and prevent even greater losses. Research shows that a more stable banking sector reduces the negative effect of a banking crisis on GDP growth, hence providing economic resilience during crisis periods.^[18]

However, the economic and societal costs of a crisis are just one side of the coin.

There is another, perhaps less discussed, reason for robust regulations. An uneven playing field does not enhance the competitiveness of internationally active banks. Conversations with bank CEOs clearly reveal that many of them deem the faithful implementation of the Basel III reforms to be in their own interest.

While much is said about the cost of regulation, we must also consider the cost of non-regulation. This includes not only the societal costs associated with financial crises but also the compliance costs of navigating different rules across countries where a bank operates. What is simpler: adhering to one European regulation or 27 national ones?

ECB research shows that the Single Market added between 12% and 22% to long-run EU GDP in its first 30 years.^[19] A few years ago, the European Parliament – looking at various policy fields – estimated that further EU integration could generate over €2.8 trillion annually by 2032.^[20] For example, a further harmonisation of corporate insolvency rules, accounting frameworks and securities law would benefit a deeper capital market and thereby contribute to economic growth.^[21]

As I said, rather than lowering regulatory requirements, we can reduce complexity by harmonising European rules.

Conclusion

Let me conclude.

While the European banking sector is resilient overall, we must remain vigilant amid an uncertain and evolving risk outlook. Complacency invites catastrophe.

Geopolitical tensions, cyber threats and market volatility underscore the need for a robust foundation. That foundation is our multilateral rules-based framework, anchoring resilience and ensuring stability. Only by preserving and strengthening this rules-based international order and harmonising rules where possible can we confidently navigate uncertainty and safeguard the resilience essential to our financial system.

Thank you very much for your attention.