Supervision in uncertain times: vigilance, governance and the case for effective supervision

Speech by Patrick Montagner, Member of the Supervisory Board of the ECB, at the 12th Annual IIF Colloquium on European Banking Regulation and Supervision

Frankfurt am Main, 28 November 2025

Thank you for inviting me to speak to you today.

I would like to address a question that has often come up in recent debates: is supervision too strict given this period of apparent calm, the good health of the banking system and the efforts made by banks and supervisors over the past 15 years?

My answer for today is that we must remain vigilant, while continuously improving our supervisory methods.

The challenges facing the banking system

We should all acknowledge the efforts banks have made over the past 15 years to restructure their balance sheets, improve their solvency and liquidity and strengthen their risk governance. This has resulted in improved profitability, although this was helped by the period of higher interest rates and by the unprecedented fiscal measures taken in response to the pandemic shock in 2020-21 and the economic shock following Russia’s invasion of Ukraine in 2022. Accommodative monetary policy has also played a role in this recovery.

However, uncertainty about the state of the economy has increased significantly. And while banks’ profitability has improved significantly in the past two years, “no tree ever grows to the sky”, as the saying goes.

Financial stability is constantly at risk

Theory and practice teach us that the causes of financial instability are exuberant asset bubbles, excessive leverage, asset-liability management tensions resulting in liquidity drying up, and interconnectedness among financial actors. These elements are often interlinked and tend to appear together.

If we consider the situation today, financial stability is threatened by several factors that could trigger future shocks. First off, the valuation of many assets seems to be excessive, pushed to irrational heights of exuberance. In addition to this overvaluation, credit has also increased significantly. This has led to higher leverage in many parts of the economy, including for households, companies, governments and project financing.

Many analysts have been happy to attribute this excessive leverage to unregulated players, conveniently grouped under the term “non-banks” – a name that suggests a decoupling from the banking sector and limited relevance for banking supervision. This is misleading.^[1] These players have deep connections with the banking sector through funding, services and shared exposure, as evidenced by recent corporate failures significantly affecting some financial actors. In fact, banks and other financing providers largely share the same situation, and banks have financed a large part of this growth in private credit.

Finally, liquidity and asset/liability balances are based on assumptions that could well reverse. We must avoid the complacency that preceded the global financial crisis, where market liquidity was taken for granted and structural vulnerabilities were overlooked. In this regard, the turmoil that affected some banks in 2023 demonstrated that focusing solely on prudential ratios is not a sufficiently prudent liquidity policy. The failure of Credit Suisse showed that no solvency or liquidity ratio can make up for a flawed business model, a weak “tone from the top” or a poor risk culture.

Structural challenges lie ahead

In addition to these risks to financial stability, we are also facing a number of structural challenges. First are the still significant imbalances between economies, both within the EU and beyond. The tariffs imposed by the United States – the world’s leading economy – have shown that the reabsorption of these imbalances can be abrupt and uncoordinated and can trigger shocks in many countries and economic sectors. These imbalances greatly increase the likelihood of a geopolitical event occurring that could bring about a series of significant economic shocks.

Second, scientific data clearly show that climate change is taking us into unknown territory as regards the functioning of our economies. To claim that this issue does not exist, or that it will be solved by technical solutions that do not require any changes to current energy production methods, is denying the obvious. And even if we achieve a not-too-disorderly energy transition, its effects are uncertain and the impact on some economic sectors could be severe. Supervisors need to prepare for scenarios involving both heightened physical risks and transition risks stemming from changes in energy production and consumption patterns.

Third, demographic shifts have been taking place before our eyes. The reproductive balance of populations has been disrupted for several decades in some places, with two important consequences: an ageing population and projected population decline. These will have profound effects that cannot yet be fully gauged. Here again, our production systems and our consumption of goods and services will be structurally altered.

Fourth is artificial intelligence, which also ties in with the question of a possible speculative bubble. AI promises productivity gains but also raises questions about labour displacement, market concentration, and whether AI-driven investment is building on sound fundamentals or speculative optimism. And, more importantly, how can this technical progress benefit our economies and give a new impetus to productivity without further fracturing our societies or weakening their acceptance of change?

Fifth, and closely related to both geopolitical tensions and technological transformation, is the growing threat of cyberattacks. The threat landscape has evolved dramatically. Cyberattacks are no longer just isolated incidents. They can also take the form of systematic campaigns – sometimes state-sponsored – targeting critical infrastructure, including financial institutions. Just this week, we learned that a hacking group had successfully breached the systems of an AI provider in order to use its tool to carry out cyberattacks, showing that even cutting-edge technology companies with sophisticated security can be compromised.^[2] As I discussed in my speech on ICT resilience in July,^[3] banks must continuously invest in both defensive capabilities and recovery planning, because the question is not if attacks will occur, but when.

These structural challenges – geopolitical fragmentation, the climate transition, demographic shifts, technological transformation and cyber threats – will shape the risk landscape throughout my mandate and beyond. Today, I will talk about how we can avoid a stop-go cycle in prudential supervision and how we can uphold the values that guide us in this delicate, nuanced and non-scientific art.

The case for effective supervision

ECB Banking Supervision has listened carefully to the remarks made by the banking industry, but we need to move away from a simplistic debate about an excess of supervision. On the one hand, supervisory practices are said to limit banks’ competitiveness, but on the other, there is always a fear that banks’ practices could erode prudential requirements by undermining the calculation of capital and liquidity. That is a false dichotomy and, in my view, an unnecessary distraction.

Allow me to outline some of the key aspects of effective supervision, which is an essential public good to maintain Europeans’ confidence in the banking system.

Governance is key

First of all, I strongly maintain that both banks and supervisors are responsible for ensuring that the supervisory framework functions as it should. This is assuming that legislators have produced sound rules on governance and risk management and given supervisors adequate tools to make sure these rules are being followed. Banks and supervisors have important, but different, responsibilities in keeping banks resilient.

Risk management is a responsibility that falls entirely on banks. The global financial crisis demonstrated that any bank can fail, regardless of business model: market and investment banks, retail banks, specialised financing banks, savings banks or public banks. While all banks may have suffered during the crisis, what set the sound banks apart was the strength of their risk governance frameworks.

Here I would like to highlight the important work of one of my predecessors on the ECB’s Supervisory Board, Julie Dickson. Julie chaired a Financial Stability Board working group that, between 2011 and 2014, issued a series of reports on improving supervisory practices and on the interactions between supervisors and financial institutions regarding risk culture. A lot has been done since then to refine these recommendations and provide supervisors with comprehensive tools, but the core message is as relevant as ever. Let me repeat it now: “Weaknesses in risk culture are often considered a root cause of the global financial crisis, headline risk and compliance events. A financial institution’s risk culture plays an important role in influencing the actions and decisions taken by individuals within the institution and in shaping the institution’s attitude toward its stakeholders, including its supervisors”.^[4]

That is why the ECB considers governance to be a key element of our Supervisory Review and Evaluation Process (SREP). Financial soundness alone is not sufficient for a positive supervisory assessment. A solid financial position is typically a reflection of, not a substitute for, a sound governance and risk culture. Preventive and proactive supervision must investigate the underlying causes of the headline financial ratios.

Light-touch supervision is not supervision

This brings me to the state of supervision itself. We have already seen moves towards lighter-touch supervision via reduced resources, less intensive assessments and a greater reliance on banks’ internal controls. History shows that this is a recipe for a future crisis. We need strong supervisors with sufficient human and financial resources, appropriate expertise and IT capabilities. Prudential supervision has a cost, and we are accountable for the use of these resources.

The former US Acting Comptroller of the Currency, Michael Hsu, has said that banking supervision is one of the most “under-appreciated” jobs in finance.^[5] I couldn’t agree more: supervisors are criticised as overly burdensome when things are calm and too lenient when failures occur. This reflects the countercyclical nature of supervision, which dictates that we must be most vigilant precisely when the risks seem low.

I would like to remind everyone that the banking union has become a reality, even if incomplete and imperfect in some areas. It benefits not just banks, but the euro area economy. Before 2014, EU legislation was largely implemented at national level, with significant differences. And supervision was much more fragmented and inconsistent across Member States. The banking union is an invaluable asset that has helped to harmonise supervisory rules and practices. We must preserve it, complete it, and build on its gains.

This does not mean sticking with the same tools and practices. In September 2022 the ECB appointed a group of external high-level experts to assess European banking supervision. Since receiving their findings, we have been working hard – although some would say not quickly enough – to revise our processes while retaining the core of our methodology. When I think of the regulation and supervision of 33 years ago, when I started out as a supervisor, I cannot deny that they are now considerably more extensive and complex. But it is futile to compare the current complexity with a “simpler” rose‑tinted past. The permanent increase of regulation and supervision reflects continuing innovation in the design of financial products and the rise of mega-banks. We have come too far to return to the “good old days” of this supposed simplicity. We never bathe in the same river twice for very good reason: both the swimmer and the river have changed and evolved.

In short, effective supervision will continue to be a key objective of the ECB. It allows us to identify both best practices and outliers, and to address risks before they become a serious problem for banks. Based on our experience of individual crises, we know that there is still room to improve supervisory practices, despite the good progress made.

Conclusion

Let me be clear about our path. We are working to become a more efficient and more risk-focused supervisor and we are continuing to modernise our tools. This has been a continuous process since the start of European banking supervision in 2014, and we have stepped up our efforts over the past two years through our SREP reform and broader simplification initiatives.

We remain committed to maintaining a strong dialogue with the banking industry. The euro area economy needs sound and resilient banks that are capable of financing investment and the modernisation of the economy. Meeting this need requires collaboration: banks being responsible for risk management, supervisors focusing on systemic resilience and regulators providing clear, coherent frameworks. We all need to deliver on our respective tasks but, on some aspects, like the supervision of non-financial risks, the ECB will follow its own path regardless of what is done in other jurisdictions.

The banking landscape will continue to change through technological innovation, shifting business models, new competitive pressures and structural economic changes. Our supervision will evolve accordingly. But it will evolve to become more effective and efficient, not less intensive or demanding.