Keynote speech by Claudia Buch, Chair of the Supervisory Board of the ECB, ECB Forum on Banking Supervision

Frankfurt am Main, 13 November 2025

“Resilience in times of disruption” is the theme of this year’s ECB Forum on Banking Supervision.^[1] Disruption has different aspects: heightened geopolitical risks; digital innovation re-drawing the competitive landscape in which banks operate; weaker growth making competitiveness take centre stage – sometimes leading to calls for loosening the rules that were put into place after the global financial crisis.

Strong global guardrails are needed to avoid a race to the bottom in this complex and risky landscape. Yet, it is precisely the stability of the world order and the willingness and ability to cooperate that many are currently questioning: nearly two-thirds of experts surveyed by the World Economic Forum expect a more fragmented international order within the next decade.^[2]

In an adverse scenario, international cooperation may collapse, with the provision of global public goods such as financial stability suffering.^[3] In a “world of blocs”, global markets would be fractured, raising operational complexity for banks. Only in a more optimistic scenario of “multilateralism reinvented”, collective frameworks would provide global public goods – from climate policies to financial stability.

How can banks and supervisors navigate this increasingly complex environment? Resilience is the key. It is not just about banks’ ability to withstand shocks, but also about how supervisors, policymakers and societies adapt to a rapidly changing world.

The next two days will bring useful ideas to the table, and I very much look forward to these discussions. We particularly welcome the many international participants attending this conference as cross-border cooperation remains essential to maintaining financial stability.

Let me use this opportunity to provide input into the debate and explain how ECB Banking Supervision is responding to the new challenges.

First of all, we have a dedicated agenda on banks’ risk management and governance arrangements to address geopolitical risks.

Geopolitical risk is not new – globally active banks often operate under challenging conditions. Currently, however, geopolitical risk is heightened and exposure to this risk is quite broad-based. Large banks are affected, but so are smaller ones that are not very active internationally. Out of the 113 banks we supervise directly, nearly all have outsourced critical functions.^[4] Cyberattacks have become more frequent and severe.

Chart 1

Significant cyber incident reporting

Resilience against geopolitical risk needs to be equally broad-based. Being resilient to a range of possible scenarios does not require predicting the exact nature of the next crisis. But banks need to maintain strong capital and liquidity buffers, robust governance and operational flexibility to buffer a range of shocks. In short, they need to have robust business models.

Therefore, broad-based resilience does not come at the expense of long-term profitability.

Our second response to the new environment is to adapt our own work. While ECB Banking Supervision has progressed well over the past decade, we certainly cannot afford to stand still.^[5] We are adapting our supervision to become more effective, more efficient and more risk-based. Our reforms reduce undue complexities and compliance costs, enabling banks – and us – to better address evolving risks.

I am convinced that strong supervision helps banks to navigate a risky and uncertain environment safely. It plays a key role in identifying good practices regarding risk management and ensuring that banks are financially and operationally resilient. In contrast, weakening supervision or regulation would weaken banks and their competitiveness.

Geopolitical risks and exposures of European banks

Virtually all European banks are vulnerable to geopolitical risks:

• 40 banks directly supervised by the ECB – in particular the larger ones – have subsidiaries outside of the European Union.
• Assets vis-à-vis third countries make up one-quarter of banks’ total assets, with the United States being the largest destination, accounting for around 30% of these assets.^[6]
• Even though European banks intermediate a smaller share of cross-border financial flows than in the past,^[7] they remain closely intertwined with non-bank financial intermediaries, with around 9% of their total assets and 15% of liabilities.^[8]
• Many banks use cloud services that are provided by a small number of non-EU third-party providers. Thanks to the Digital Operational Resilience Act (DORA), which has been in effect since the beginning of this year, information on these outsourcing arrangements and potential risks has significantly improved.^[9]
• Significant cyber incidents reported by European banks have doubled in recent years.^[10]

Addressing geopolitical risk has thus been a supervisory priority for ECB Banking Supervision for several years now. In the current 2025–27 cycle, our focus is on ensuring that institutions can withstand immediate macro-financial threats and severe geopolitical shocks. Last year we set out an analytical framework to better understand how geopolitical shocks are transmitted to the financial system and to banks.^[11]

Key to this framework is that geopolitical risk needs to be managed as a cross-cutting driver. Geopolitics can affect banks through multiple channels – financial markets, the real economy, and the safety and security of operations. The impact of geopolitical events cuts across credit, market, liquidity, business model, governance and operational risks.

So, one year after setting out this framework, where do we stand?

Measures of global economic policy uncertainty certainly remain elevated, and so risk sentiment can change abruptly. Take the events of March 2025: the announcements of new tariffs led to a rapid increase in market volatility across asset classes. Credit spreads widened temporarily while still appearing compressed relative to underlying risks. Prices for traditional safe-haven assets increased significantly, reflecting increased demand for protection against adverse shocks.^[12]

Trade policy is particularly heightened, and the ECB’s May 2025 Financial Stability Review shows that this can have negative implications for banks and financial stability.^[13] A potential repricing of equity market could have effects beyond the firms immediately affected through regional and sectoral linkages. For banks, this could lead to higher provisioning, lower profitability and reduced lending, and the effects would build up gradually over time. Higher capitalisation mitigates these effects.

Chart 2

Economic and trade policy uncertainty

Risks have certainly become more difficult to model. During the past decade, shocks have often been buffered by fiscal or monetary policy. Loan losses hardly increased even in times of recession such as during the COVID-19 pandemic. Traditional correlations linking macroeconomic shocks and credit risk may no longer hold.

All of this indicates that markets are underpricing geopolitical risks. The International Monetary Fund’s (IMF) most recent Global Financial Stability Report observes that valuations of risk assets remain stretched, and that credit spreads and volatility appear compressed.^[14] While short-term market reactions to tariff announcements have been contained, the IMF warns that longer-term effects on investment and growth could be more severe, especially if shocks are amplified through high leverage and interconnections in the global financial system. The report stresses that sufficient capital and liquidity remain essential to preserve resilience amid heightened uncertainty.

Building broad-based resilience against geopolitical risks

European banks are closely interconnected with international flows of funds. They operate across borders, outsource key services and are strongly exposed to common global factors.^[15] Disturbances originating in other parts of the world can propagate through the financial system and affect euro area banks.^[16]

Chart 3

International exposure of banks under European supervision

(y-axis: USD millions)a) Volume of exposures (1999-2024)

b) Regional structure of exposures (1999, 2024)

Geopolitical risk cannot be avoided, but it needs to be managed well.

Geopolitical risk certainly differs from traditional risk drivers. Adverse geopolitical events are uncertain, less predictable, highly interdependent and difficult to model.^[17] This may make them hard to assess for any individual bank.

Still, geopolitical events can have very concrete impacts on banks. Many geopolitical risks are “known unknowns”. The disruption of an established trade route, a cyberattack or an energy outage are all concrete scenarios. We do not know when they may occur, but we can describe the scenarios quite well. These uncertainties must be managed at the level of the individual institution.

But, clearly, there is a systematic component to geopolitical risk. The global economy can be hit by large events that are difficult to anticipate. The COVID-19 pandemic is an example: although a global pandemic could have been anticipated as a potential tail risk, its specific impact was difficult to forecast.

In such cases, ex ante private insurance can be limited and fiscal and monetary policy often ends up providing insurance ex post. During the COVID-19 crisis, fiscal support in the euro area amounted to around 4% of GDP, approximately two-thirds of which consisted of direct support to firms and employees.^[18] In the following years, fiscal measures to shield against the energy price shock were in a similar range.^[19] This also protected the financial sector from significant losses. During the turmoil on banking markets in March 2023, public sector safety nets were expanded.^[20]

Yet, given increased levels of fiscal debt and high budgetary pressure, whether similar policy support will be forthcoming in a future crisis is a legitimate question to raise.

While the exact nature of future crises cannot be anticipated, institutions and authorities can still prepare – by building broad-based resilience, which protects banks and the services they provide against a range of scenarios.

For banks, broad-based resilience means maintaining strong capital and liquidity positions, robust governance, operational flexibility, and robust IT systems.

Broad-based resilience is not about predicting the next crisis. But it ensures that banks and the financial system can continue functioning and adapt, even when facing events that fall outside conventional stress testing assumptions or historical experience.

Broad-based resilience does not come at the expense of banks’ competitiveness. Resilience and competitiveness are, in fact, two sides of the same coin. Sufficient capital, diversification, redundancies in operational systems and strong governance are good for broad-based resilience. These are also key features of long-term, sustainable business models.

Banks need such long-term strategies. They need to respond to the growth of non-bank suppliers of financial services.^[21] They need good risk management and information systems to monitor and address risks linked to private markets. And they need sound strategies to respond to the emergence of crypto assets and stablecoins. Sufficient investment in resilient IT systems is a key component of these long-term strategies.^[22] Banks should therefore avoid prioritising short-term decisions that undermine their ability to invest adequately in their future competitiveness.

But bank-specific responses are not sufficient to capture the systemic nature of geopolitical risk events. Macroprudential policy must prepare the system for a potential deterioration of macro-financial conditions. In Europe, there are currently no signs of widespread losses or credit supply constraints arising from banks being capital-constrained.^[23] Hence, maintaining sufficient capital buffer requirements remains important to preserve resilience.

Supervisory frameworks for banks’ management of geopolitical risks

Strong supervision helps banks to manage risks and to follow good practices. To play our role, we do not need new regulatory frameworks, but we do need a commitment from legislators not to weaken the frameworks we have.

Under the Capital Requirements Directive (CRD) and relevant national legislation, banks must have robust internal governance arrangements and effective risk management processes in place that are proportionate to the nature, scale and complexity of their activities.^[24] And prudential supervisors, including the ECB, must carry out reviews to determine whether banks properly manage and cover risks.^[25] This includes the sound management of geopolitical risks.

On this basis, we include geopolitical considerations in our ongoing dialogue with banks on how they manage such risks as a cross-cutting driver within their established risk management frameworks.

Ongoing supervision pays particular attention to the following aspects.

First, banks’ management bodies should have a comprehensive view of how geopolitical risks affect their institutions. Regular, timely information on these risks allows them to prepare for adverse scenarios and take decisions swiftly when shocks materialise. This requires robust internal reporting and data aggregation capabilities.^[26]

Second, banks need a set of “what if” scenarios related to relevant geopolitical events. Managers and boards should regularly assess the impact of such scenarios on risks and take proactive measures where needed.

Third, stress testing and scenario analyses are powerful tools for assessing exposure to geopolitical risks. This year’s stress test conducted by the European Banking Authority was based on an adverse common geopolitical risk scenario showing higher losses, but also a better ability on the part of European banks to absorb these losses, compared with the stress test two years ago. Next year, we will ask the banks to conduct a “reverse” stress test to assess which firm-specific geopolitical risk scenarios could severely affect their solvency.

Fourth, cyber and operational resilience should become a key priority in banks’ risk management frameworks. Last year’s cyber resilience stress test confirmed that banks are generally well prepared for the recovery phase after a successful cyberattack. However, it also revealed areas where more work needs to be done. Exposure to external providers can become a vulnerability in an adverse geopolitical risk scenario. In July this year, we published a guide outlining good practices related to the management of outsourcing risks,^[27] such as a comprehensive risk assessment before using cloud services and taking business continuity measures.

Creating space to address evolving risks

Both banks and supervisors need space to analyse and address evolving risks. They need the time to explore different scenarios, discuss preventive measures and act accordingly.

This is one of the reasons why, after creating a solid European architecture over the past decade, we are now significantly reforming our supervision, with three main objectives:^[28]

• enhancing efficiency by streamlining supervisory and decision-making processes and by removing undue complexities in interactions with banks;
• improving effectiveness by communicating clearly to banks any major deficiencies that we have identified and by escalating supervisory action as needed;
• strengthening the focus on relevant risks by continuously tailoring supervisory activities to bank-specific vulnerabilities in a proportionate manner.

We are carrying out four initiatives to achieve these objectives:

• In 2024, we decided on a reform of the Supervisory Review and Evaluation Process (SREP), which will be fully implemented by 2026.
• With our “next-level supervision” project, launched in 2025, we are streamlining key supervisory activities and decision-making procedures, including on-site inspections.
• A dedicated supervisory culture initiative ensures that the reforms are rolled out across European banking supervision in an integrated manner.
• Finally, we are assessing the effectiveness of our supervision.

You can find details about each of these initiatives on a dedicated web page.^[29]

Let me give concrete examples of how this creates the necessary space to address geopolitical risks.

We are using a risk tolerance framework to target bank-specific vulnerabilities. While all banks are exposed to geopolitical risks, their specific vulnerabilities can be very different. This is why we have had a risk tolerance framework in place for several years now. Rather than assessing every risk for every bank with the same intensity each year, we redirect our supervisory resources to where they are most needed.

We are improving our approach to internal model approvals. Informative internal models are essential for sound risk management, but their reliability can be impaired in a period of rapid structural change and external shocks. In the past, we have spent most of our resources on model approvals requested by banks. What is more, approving models can be a lengthy process. This has given us little time to focus on model investigations that can, for example, assess the fitness of models in a changing risk landscape. By speeding up the process for internal model approvals, we are creating the necessary space. But our efforts need to be complemented by a streamlining of the model landscape within the banks themselves.

We are making stress tests more efficient and effective. Stress tests are a key forward-looking tool for addressing the evolving nature of geopolitical risks. We have already reduced the number of submission cycles in the EU-wide stress test, and we see scope for further improvement ahead of the 2027 exercise. In parallel, we are increasing our use of agile, top-down stress testing to detect vulnerabilities arising from emerging risks while limiting costs for banks. Next year’s reverse stress test on geopolitical risks deliberately builds on banks’ internal capabilities and is therefore much less intense than the regular EU-wide stress tests.^[30]

We are streamlining reporting requirements. Reliable data are the foundation of effective risk management and supervision, yet the current reporting landscape is highly fragmented. National and European frameworks coexist, and the information collected often overlaps. This can hinder the effective management of geopolitical risks, as relevant information may not be available in a consistent and timely manner. Within banks, inadequate risk data aggregation systems can lead to decisions being based on poor information. Streamlining reporting is therefore a key objective of our reforms.

Across all of these initiatives, we are using suptech tools to automate routine processes and data handling. This allows supervisors to spend more time on forward-looking analysis and supervisory engagement with banks that is both critical and constructive, addressing complex areas such as geopolitical and structural risks.

Conclusion

Geopolitical risks are heightened, and virtually all European banks are exposed – whether through direct financial ties, market spillovers or reliance on cross-border services. Banks’ risk management and strategic planning need to respond, just as banks need to respond to the digitalisation of financial services.

As supervisors, we focus on banks’ need for broad-based resilience. Resilience is about strong financials, but equally so about operational resilience, sound governance and good risk management. Resilience does not impair competitiveness. Strong capital and liquidity positions, sound governance and operational flexibility enable banks to continue providing essential services even under stress. These are key ingredients of successful, long-term business models.

At the same time, we are adapting our supervision to the new environment. Supervision is about promoting good practices and identifying vulnerabilities early on. It is about ensuring that banks address any vulnerabilities decisively, and escalating supervisory measures if necessary. By making supervision more efficient, effective and risk-based, we are creating space to focus our attention on evolving risks.

To be successful, we need strong international cooperation and coordination. I look forward to discussing with you how, together, we can manage the current complex environment. A stable global financial system is crucial for growth. It depends on shared regulatory standards and coordination among supervisors. These guardrails must hold as geopolitical tensions rise. Fragmentation or a watering down of standards would leave banks more vulnerable just when they need broad-based resilience the most.