Trust is the infrastructure: banking supervision in a changing risk landscape

Keynote speech by Sharon Donnery, Member of the Supervisory Board of the ECB, at the Central Banking Meetings

London, 11 June 2026

Introduction

Thank you very much for inviting me to today’s conference on “Strategic turning points”.^[1]

Strategic turning points are moments when we need to distinguish carefully between what must change and what must not. In banking supervision, the distinction is clear. The way we supervise must continue to modernise. It must become more efficient, more effective and more risk-focused. But the objective must not change: banks must remain safe, sound and resilient, so that the public can continue to trust the essential services they provide.

That is why I would like to bring together two debates that are often held separately: the debate about simplification, competitiveness and modernisation; and the debate about a risk environment that is becoming more complex, more interconnected and less predictable.

To do so, I would like to start by taking a step back.

Modern societies depend on infrastructures we rarely think about: electricity, water, the internet. And trust in banks. We notice electricity when the lights go out. Trust in banks is similar. We notice it most when it is missing.

Banks are not ordinary companies. They are private institutions, but they perform functions of public importance. Households and firms use bank deposits as money. Banks provide payment services, extend credit to the real economy and transform short-term funding into longer-term lending. These functions are performed privately but relied on collectively. They support confidence, economic activity and financial stability.

That is why banking supervision matters. Financial distress in an individual bank can have consequences well beyond its own shareholders and creditors. It can affect depositors, disrupt payments, reduce credit to households and firms, weaken market confidence and, in some cases, threaten financial stability.^[2]

This is the protective rationale for supervision but there is also a more positive dimension: supervision helps sustain the confidence on which economic activity depends. Reliable electricity allows people and businesses to plan their day without thinking about the grid. Reliable banking plays a similar role in the economy: salaries are paid, savings are held, payments are settled, credit is granted and investment is financed. Supervision helps make that reliability possible by aiming to ensure that banks are safe, sound and resilient through the cycle.

This matters in the competitiveness debate. Europe needs banks that can lend, innovate and compete. To do that, banks need to be resilient, even when conditions deteriorate. A banking system that only supports the economy in calm conditions is not truly competitive from society’s perspective.

An electricity grid supports growth because it provides a resilient and efficient infrastructure. No one would try to boost growth by not sufficiently maintaining the grid and thereby unsustainably lowering energy costs. A reliable electricity grid can power a factory; it cannot make the factory more productive.

Let me extend this analogy to banks. Finance can support productivity, but it cannot substitute for productivity.^[3] Sound banks can finance productive investment, but changes to prudential standards cannot solve deeper challenges in the real economy. I will come back to this topic later.

Let me first consider the current risk landscape before turning to the changes needed to make the regulatory and supervisory framework fit for the future.

An increasingly complex risk landscape

The euro area banking sector entered the current period of heightened uncertainty from a position of strength. This resilience reflects reforms adopted after the global financial crisis, improvements in banks’ own risk management and more than a decade of European banking supervision.

European banks are well capitalised, liquid and profitable, with stable and healthy asset quality. The average Common Equity Tier 1 ratio of the banks we supervise is close to 16%, return on equity was close to 10% in 2025 and the aggregate non-performing loan ratio remains at a historical low of 2.2%.

But this strong starting point should not lead to complacency. Part of the recent resilience also reflects the fact that monetary and fiscal support measures cushioned some of the shocks Europe has faced. And, more fundamentally, today’s balance sheet indicators do not necessarily show tomorrow’s risks.

Shocks can be transmitted with a lag, often in ways that are non-linear and difficult to model. The risk environment has become more complex and more interconnected. The main concern is not one single shock, but how several shocks may interact and amplify one another: geopolitical tensions and trade fragmentation, renewed energy price and supply chain pressures, sudden market repricing, tighter funding conditions, vulnerabilities in non-bank finance and private credit, and rising cyber threats, including those amplified by artificial intelligence. In such an environment, resilience depends not only on the health of individual banks, but also on the strength of the wider system around them.

One of the key risks is geopolitical risk. Geopolitical risk is best understood not as a separate risk category, but as a cross-cutting driver of many traditional banking risks. It can affect the real economy, financial markets and the safety and security of banks’ operations, showing up as credit risk, market risk, liquidity risk, operational risk, business model risk or governance risk. That is why it requires forward-looking risk management that looks beyond immediate exposures and also considers second and third-round effects. This is also the focus of our reverse stress test, which will be finalised this summer.

Credit risk is one of the key risk areas that could be affected if current geopolitical tensions persist or intensify. Higher energy costs, trade disruption and higher interest rates can weaken firms’ margins, reduce households’ purchasing power, affect export-oriented sectors and weigh on investment. Recent bank lending survey evidence already points to tighter credit standards for firms, with banks explicitly referring to geopolitical and energy developments as tightening factors.^[4] If shocks persist, provisioning needs could increase, loan demand could fall and credit losses could materialise with a lag. This could also weigh on profitability.

Market, liquidity and funding conditions have remained orderly so far. But stretched valuations, compressed risk premia and a possible reassessment of geopolitical, inflation, growth, sovereign or AI-related risks could shift sentiment abruptly and tighten funding conditions.

Non-bank financial intermediation is another key area of risk. Non-banks provide important financing and risk sharing, but liquidity mismatches, leverage, opaque exposures and concentrated positions can amplify market stress. Because euro area banks rely, in aggregate terms, on funding from the non-bank financial sector, stress in non-banks can become a funding and liquidity issue for banks. A shock in non-bank finance could travel back to banks through liquidity withdrawals, collateral values, market prices and confidence.

Private credit deserves particular attention within this broader landscape. Exposures remain relatively contained compared with other assets on banks’ books, but they are growing strongly. The key issue is not only the size of these exposures, but also banks’ ability to aggregate them properly: to identify when they lend alongside private credit funds, and when they have overlapping exposures across funds, investors and portfolio companies. Weaknesses in this area can make it harder for banks to identify concentrations, correlations and transmission channels under stress.

Cyber and operational resilience are also becoming more central. The financial sector is operating in an environment of escalating geopolitical tensions and increasingly hostile cyber threats. And it is increasingly reliant on third-party service providers. Recent developments show that AI is changing the cyber risk environment by enabling vulnerabilities to be discovered and exploited more quickly, shortening the window between flaws being identified and used to launch an attack, and making weak ICT change management processes more material. Banks therefore need strong ICT asset inventories, robust controls over software development and emergency changes, and a clear prioritisation of known vulnerabilities across ICT security, cyber resilience and ICT outsourcing.

The message is clear: banks are resilient today, but the environment is testing the system’s weakest links. Those links may not lie within banks alone. They may be in energy-sensitive borrower sectors, stretched markets, non-bank finance, private credit, cyber vulnerabilities or operational dependencies. Our task as supervisors is to identify those links early, ensure that banks take action to remain resilient under stress, and preserve the trust that allows the banking system to serve households, firms and the wider economy.

Simplification and modernisation: a framework fit for the risks ahead

Let me now turn to what this means for regulatory and supervisory modernisation.

If the risk environment is becoming more complex, the answer cannot be to make supervision more mechanical. Nor can it be to make the framework weaker. The answer is to make supervision simpler to operate, but stronger in effect: more focused, more forward-looking and more effective.

This also matters for Europe’s growth agenda. Europe needs stronger growth. But we should be precise about the source of growth. Europe’s growth challenge is, first and foremost, a productivity challenge. Finance can fund productivity, but it cannot substitute for it.

Productivity comes from better technology, better skills, better organisation, greater scale, innovation and investment. A resilient banking system helps ensure that credit can support households and firms through the cycle. But weaker prudential standards cannot solve Europe’s productivity challenge. They cannot compensate for the structural measures needed: completing the Single Market, deepening capital markets and fostering innovation to create investment projects that can attract financing from banks.

The right growth agenda is therefore to strengthen the real economy and the financial architecture together. Europe needs to become better at turning savings into investment, investment into innovation, and innovation into productivity.^[5] That requires deeper capital markets, a completed banking union, a more integrated Single Market, faster diffusion of digital and AI technologies, and the scale for firms to grow across borders. Sound banks have an important role to play in financing this transformation, but productivity is ultimately created in the real economy: through technology, skills, investment, organisation and scale.

So what, then, is the role of supervision? Risk-based supervision contributes in a more specific way: it helps keep the financial infrastructure reliable, so that sound banks can finance productive investment through the cycle.

That is why effective supervision must be forward-looking.^[6] It must look beyond today’s ratios and ask where vulnerabilities could emerge next. In an interconnected financial system, resilience cannot be assessed only on a bank-by-bank basis. Stress can arise in private credit, a cloud provider, a payment system or a common software vulnerability and then spread quickly through funding channels, collateral values, asset sales or operational disruptions.

This is also the thinking behind the ECB’s reform agenda. For us, modernisation means making supervision more risk-based, more forward-looking and more effective, while preserving the resilience on which trust depends.

That means asking practical questions. Are we focusing on the most material risks, whether financial or non-financial? Are we using data and technology effectively? Are we communicating our concerns clearly and escalating where needed? And, most importantly, are weaknesses actually being addressed?

This is what lies behind our work to streamline supervision.^[7] The reform of our Supervisory Review and Evaluation Process (SREP) is making the annual health check of banks more focused and better tailored to their risk profiles. Beyond the annual SREP cycle, we are making supervisory work more targeted and more flexible, so that attention is better directed to the risks and activities that matter most. For example, it used to take banks up to three months to receive ECB approval for their capital management transactions. We have now introduced fast-track processes, so that standardised, lower-risk transactions can be approved in less than two weeks.

In addition, we set our priorities in a targeted and risk-based manner and have improved coordination across supervisory activities, including on-site inspections. This enhances efficiency for both banks and supervisors and focuses supervisory reviews and findings on the most material risks.

Finally, we are assessing supervisory effectiveness, because completing a process is not the same as achieving an outcome. And we are strengthening a common supervisory culture across European banking supervision, because good supervision depends on sound judgement, consistency and a willingness to act.

In infrastructure terms, we are improving our sensors, clarifying the signals and making repairs faster. A modern supervisory framework should reduce unnecessary complexity, make better use of data, communicate more clearly, focus on material vulnerabilities and ensure more effective follow-up.

Let me also say a word about capital, because it sits at the heart of banking supervision and features prominently in the simplification debate.

In the public debate, simplification is sometimes used as shorthand for something quite different: lower capital requirements or less stringent bank rules. We should keep these questions separate. Simplification is not a mechanism for raising – or lowering – capital requirements. The objective is not more capital, but more effective supervision and a clearer, more coherent framework.

In this context, we often hear comparisons suggesting that capital requirements in the European Union are higher than in the United States. Recent counterfactual analysis does not support this as a general claim and does not point to a competitive disadvantage for large internationally active European banks.^[8]

More generally, the evidence does not suggest that capital requirements are holding back lending. Corporate lending in the euro area is growing^[9], banks remain well capitalised and recent shareholder distributions have been sizeable. All of this suggests that capital is not, in itself, the binding constraint.

Some banks are also concerned that Pillar 2 captures risks already reflected in Pillar 1. Pillar 1 sets minimum capital requirements for credit, market and operational risks, while Pillar 2 addresses risks that are not covered, or not sufficiently covered, under Pillar 1, in particular bank‑specific vulnerabilities. To ensure that no such overlaps exist, we have a revised Pillar 2 methodology that supports case‑by‑case assessments and consistent application across the system.^[10]

Looking ahead, modernisation also means greater clarity. For instance, we are currently discussing a targeted clarification in the ECB Guide to the internal capital adequacy assessment process (ICAAP), which will clarify the role of the management buffer to avoid it being misunderstood as an additional capital requirement. The management buffer reflects banks’ own forward‑looking capital planning above the minimum requirement. It is not a supervisory add‑on.

At the same time, we recognise that banks experience capital requirements as a whole. Overall capital demand reflects Pillar 1, Pillar 2 and the macroprudential buffers set by national authorities. Differences in national buffer frameworks can therefore contribute to variations across the banking union. In this context, we have proposed^[11] that the Macroprudential Forum – which brings together the members of the Governing Council and the Supervisory Board – take a more holistic view of the overall level of capital demand across the system, combining prudential, macro-financial and real economy considerations at system level. This is also consistent with the spirit of simplification. Where an existing forum can provide the necessary system-wide perspective, we should use it rather than create new institutional layers. The aim is not to centralise decisions, but to improve coherence, transparency and accountability in how these interactions between the various capital requirements are assessed, while fully respecting the separation of responsibilities.

Ultimately, capital remains a cornerstone of resilience. But forward‑looking supervision cannot rely on capital alone. It also requires a strong focus on findings, timely remediation and credible escalation.^[12]

In this context, it is true that the stock of outstanding supervisory measures remains high – an average of around 100 measures per significant bank, ranging from very high to very low severity. In part, this reflects the transition to a single European supervisor, which brought greater consistency and transparency to the way supervisory concerns are identified and tracked across the system, and which followed a comprehensive approach. In this respect, we will launch a cleaning-up exercise by the end of the year to look critically at the oldest delayed accumulated measures.

But the key issue for us today is not the headline number. It is whether supervisory action is focused on the most material risks and whether the weaknesses identified are actually being remedied.

Effective supervision is about identifying the most material prudential vulnerabilities – those that could undermine a bank’s resilience under stress – and ensuring that they are addressed in a timely and sustainable way.^[13]

That is why we are sharpening our approach on two fronts. First, by being more risk‑based in the origination of findings and measures, reducing low‑value actions and concentrating supervisory attention on issues with the most material prudential impact. Second, by strengthening the follow‑through process for supervisory measures: ensuring a risk-based approach in our follow-up and remediation actions, while ensuring accountability and a more consistent readiness to escalate where progress is insufficient.

As an example, and as part of our broader SREP reform, we have recently implemented a new “tiered approach” to the follow-up of findings. It allows banks to close less severe findings directly and autonomously, while retaining evidence for future supervisory review, reducing administrative costs for both banks and supervisors. This approach can be used for around 35-40% of the issues regularly identified.

Delivering this kind of effective, outcome‑focused supervision is easier in an integrated system than in a fragmented one. And that brings me to the European dimension.

Electricity grids are more reliable when they are well connected across regions and borders. The same can be said of Europe’s banking system. We have a single currency and a common supervisor for significant banks. But the banking market remains too fragmented. National differences still add complexity. Capital and liquidity do not always move freely within cross-border banking groups. And the banking union remains incomplete.

This is both an efficiency issue and a resilience issue. Fragmentation makes the system harder to operate, harder to supervise and less able to benefit from scale and diversification. A more integrated European banking system can support resilience by allowing risks to be diversified across a wider area, resources to be moved more efficiently and shocks to be absorbed by a broader system.

In Europe, harmonisation is one of the most powerful tools of simplification. A coherent European framework is simpler, more transparent and more resilient than a patchwork of national rules. That is why deeper integration, completion of the banking union and progress towards credible European deposit protection all belong to the modernisation debate. If trust is infrastructure, Europe needs that infrastructure to be connected, resilient and credible across borders.

Conclusion

Let me conclude.

I have tried to connect two debates that belong together: the debate about a more complex risk landscape and the debate about the need to modernise regulation and supervision.

The link between them is resilience.

Trust in banking is part of the infrastructure on which modern economies depend. We notice it most when it is missing, but we depend on it every day. Like any critical infrastructure, it has to be maintained, tested and modernised as and when the environment changes.

Modernisation should therefore make the framework clearer, more effective and more risk-focused. Because in a crisis, the public will not judge us by the simplicity of the framework. They will judge us by the resilience of the system.

They will ask whether deposits remained safe, whether payments cleared, whether credit kept flowing and whether confidence held.

They will ask, very simply, whether the lights stayed on.

The success of supervision often goes unnoticed. But its value is felt every day the system continues to work.