Digital innovation: hindrance or booster for banks’ business models?

Keynote speech by Claudia Buch, Chair of the Supervisory Board of the ECB, annual Foreign Bankers’ Association of the Netherlands conference

Amsterdam, 22 September 2026

Banking is, in essence, about processing information and making predictions^[1] – about the future liquidity needs of depositors, the ability of borrowers to repay loans, the quality of collateral.^[2] Some of the necessary information is measurable, while some is rather “soft” and comes from repeated interaction with customers.

Traditionally, banks have had a key competitive advantage over other financial institutions: by providing different financial services under one roof, they obtain valuable information to make predictions.^[3]

Digital innovation may thus change banks’ competitive advantages – it can hinder or boost their business models.

New technologies, in particular artificial intelligence (AI), improve the processing of information. Banks use AI to upgrade their services, better manage risks and operate more efficiently. More than 80% of banks supervised by the ECB identify process automation as an important way of reducing costs.^[4]

But digital innovation also accelerates structural change in the financial sector as new competitors enter the scene and provide services along the banking value chain.^[5] Banks under ECB supervision indeed see the potential loss of customers as one of the risks associated with the digital transformation.^[6]

Moreover, digital innovation introduces new sources of risk. Increased competition may lead to excessive risk taking. Cyber risk and outsourcing dependencies increase operational and financial stability risks. AI increases the risk of fraud or of built-in biases in decision-making. It has the potential to shake the very foundations on which banks are built – trust and dependable information systems.

Banks, supervisors and regulators must all act to ensure that digital innovation adds to, not undermines, welfare.^[7]

Banks need long-term digitalisation strategies, built around good governance and risk management. This includes safeguards against operational vulnerabilities and the potential misuse of AI. Digital innovation cannot be left to the technical experts, it requires board-level attention and alignment with core corporate values. And it requires sufficient budget to build resilient and reliable IT infrastructures.

As supervisors, we are technology-neutral – not risk-neutral. It is not our role to determine which technologies banks should use. But in a more digital environment, risks can emerge faster, propagate through common infrastructures and service providers, and escape detection when viewed only on a bank-by-bank basis. That makes overarching sectoral analysis, interaction with the relevant stakeholders, and clear supervisory expectations even more important in strengthening resilience across the banking industry.

Public policy needs to set guardrails beyond prudential regulation. The public sector shapes the digital infrastructure, in particular payments and securities settlement, around which banks develop their digital business models. The safe use of digital technologies requires frameworks that address cyber and AI-related risks. Effective competition policy can counter concentration risks. Policy responses need to have an international dimension – just as digital finance is international in scope.

The current debate about the competitiveness of banks can make a significant contribution to strengthening the sector. Increasing their ability to embrace digital innovation and to safely provide financial services in an integrated market should be at the centre of that debate.

Today, my focus is on the impact of digital innovation on the resilience of banks’ business models.^[8] This resilience is crucial because, in a wider economic context, the future evolution of AI, uncertainty about the sustainability of productivity gains, and the increasing proportion of debt finance mean that safeguards are needed against increasing risks to financial stability.

How digital innovation is changing banks’ competitive advantage

Digital innovation has several dimensions.

AI makes it easier to make predictions from large sets of data. More than 90% of banks supervised directly by the ECB already integrate AI into their operations, and 85% use generative AI, according to supervisory data. Risk mitigation is the most important use case, with 64% of banks using AI for fraud and cybercrime prevention. Customer support and credit scoring are other important areas.

Distributed ledger technology can improve record-keeping and enable tokenisation. Around one-third of banks under ECB supervision report engaging in digital-asset activities, including tokenisation and crypto-asset custody.

Quantum computing could eventually enable attackers to break some of the cryptographic methods that banks currently rely on to protect data and transactions. Banks therefore need to prepare for a transition to quantum-resistant cryptography. For most banks, though, quantum computing remains at an exploratory stage.^[9]

Cloud services can give banks access to computing capacity and advanced technologies that would be costly to reproduce internally. Around two-thirds of euro area banks have cooperation agreements with external providers, often residing outside the European Union.^[10] This reliance on external providers also creates dependencies – often in highly concentrated markets with limited substitutability.^[11]

These technological innovations affect the way banks collect deposits, provide payment services and lend to their customers. Advances in computing power and the use of mobile phones accelerate these effects.

Digital innovation and the stability of deposit funding

Traditionally, deposits have been a relatively stable source of funding and of franchise value for banks.^[12]

Digital innovation can reduce the stability of deposit funding. Depositors can compare deposit rates more easily, open accounts remotely and move funds faster. Deposits may become more sensitive to differences in pricing and risk.

Online deposit platforms are one channel through which competition increases. They allow savers to compare deposit offers and to place deposits with the bank of their choice. The market for online platforms is currently small, though, accounting for 1% of the deposits of households and non-financial corporates.^[13] But for some smaller banks the share of deposits sourced through this channel can be quite significant.

Digitalisation may change how depositors behave in periods of stress.^[14] Social media channels allow information and rumours to spread almost instantaneously. Online banking lets depositors respond just as quickly.^[15]

We monitor these developments and potential vulnerabilities carefully. Recent ECB research finds that greater use of online banking can indeed amplify extreme deposit outflows to some degree. But there is no evidence that online banking or mobile apps have made deposits more volatile in normal times.^[16] Nor do we see a broader structural shift towards more volatile deposit flows in the euro area.^[17] Evidence on the impact of social media is similarly nuanced: it may be important during periods of stress, but there is so far no evidence of systematic effects on euro area deposit flows.

Digital innovation and tokenised deposits

Tokenisation is a channel through which financial innovation can affect the stability of deposits. Tokenisation makes it possible to represent financial assets, including claims on banks, on distributed ledgers, which means that it is much faster to create and manage assets.

A digital token has two features: it provides information about the asset, such as its type and ownership structure, and it contains information about the rules, about what can and what cannot be done with the asset.

Stablecoins are one form of tokenised asset. So far, the demand for stablecoins has been driven mostly by the trading of unbacked crypto-assets like bitcoin and ether.^[18] It largely comes from emerging markets with weak domestic currencies and high inflation, making it akin to a form of dollarisation. Most stablecoins are indeed denominated in US dollars.^[19]

In principle, increased holdings of stablecoins could make banks’ funding sources less stable. For this to happen, funds would not even have to leave the banking system. Under current EU rules, stablecoin issuers must generally hold at least 30% of the relevant backing funds or reserves as deposits with credit institutions.^[20] Greater use of stablecoins could thus shift deposits from relatively stable retail deposits to – potentially less stable – wholesale deposits.

Yet stablecoins are unlikely to crowd out deposits as money created by banks. Savers hold deposits because banks are protected by a public sector safety net with deposit insurance at its core. For this reason, banks are comprehensively regulated and supervised, and they have access to central bank money. Giving the same features to stablecoins would imply stricter regulation, supervision and requirements for crisis management and resolution – as in the rules applying to banks. But this would make stablecoins commercially less attractive for the issuers.^[21]

Still, banks need to develop strategic responses to financial innovation. Tokenisation of deposits is one response – an evolutionary, not a revolutionary one.^[22] Around 30% of banks under ECB supervision are planning the tokenisation of deposits, and around 20% plan to issue e-money tokens. Some banks plan both. Current activities remain limited, however.

In essence, tokenisation means recording a claim against a bank – the deposit – on a distributed ledger, i.e. a shared digital record, not only the bank’s internal record. The legal relationship between the customer and the bank does not change.

Banks mostly use permissioned networks. In these networks, only identified and authorised participants can join and validate transactions. Permissionless networks, in contrast, are in principle open to anyone; most stablecoins circulate on such public permissionless networks.

Yet with permissioned networks tokenised deposits may have limited reach across banks.^[23] Some banks have thus formed consortia to broaden the use of tokenised deposits. Whether these initiatives have the potential to scale up depends to a large extent on how the public sector organises the payments system infrastructure.

Digital innovation and payments systems

Deposit-taking and the provision of payment services are indeed two sides of the same coin. Digitalisation is opening up this part of the banking value chain to greater competition.

Payment services account for around 28% of the total fee and commission income of banks.^[24] Competition for this revenue and for the customer interface is increasing. In the first half of 2025, there were more than 700 payment institutions and just below 300 electronic money institutions active in the euro area.^[25] Mobile means of payment are increasingly important. In 2024, payment wallets and other mobile apps accounted for 29% of consumers’ online payments, while by 2026 68% of euro area companies reported accepting mobile payments.^[26] Often, banks still hold customer accounts, but must share part of the revenue with payment service providers.

This illustrates a broader point. Digital innovation does not necessarily move financial activity away from banks. But it can redistribute value within the financial services chain. Banks need to develop digital strategies, with tokenisation of deposits as one element.

Public infrastructure can build bridges between banks. The ECB is thus working on two projects to connect different private networks and preserve access to settlement in central bank money.

The Eurosystem’s “Pontes” initiative went live just yesterday.^[27] It allows transactions in tokenised financial assets to be settled in central bank money. In addition to tokenised deposits, use cases include markets for bonds, commercial paper and investment funds, repo transactions or collateral management.^[28] Banks can thus develop tokenised services without giving up the safety and liquidity advantages of central bank settlement.^[29]

“Appia” is a longer-term project.^[30] By 2028 it will have developed a blueprint for an integrated European ecosystem for tokenised finance. Appia goes beyond settlement in that it will develop common standards and interoperability – thus reducing fragmentation and allowing banks to build scale.

Beyond building such bridges, greater harmonisation of digital laws and a common definition of deposits are needed. Currently, for example, tokenised deposits cannot be clearly delineated from e-money tokens.^[31] This makes it difficult for banks to scale tokenised deposit models, especially when providing services across borders.

Moreover, tokenisation may affect banks’ risk profiles. Deposits may move faster, operational dependencies may increase. From a supervisory perspective, these risks can largely be addressed within the existing prudential framework.^[32] We interact closely with the industry and other authorities to follow the rapid evolution of the market for payments services – and the associated risks.

Digital innovation and lending

Digital innovation can fundamentally change the lending process – the collection, processing and analysis of information.

Traditionally, providing deposit services and monitoring payment flows give banks an information advantage over other providers of credit, especially where repeated interaction allows the collection of soft information about customers over time.^[33]

Digitalisation may shift competitive advantage. New providers of payment services and less deposit funding may weaken banks’ information sources. This could have effects on the quantity and quality of lending.

So far, though, negative effects of digitalisation on banks’ loan market share have been fairly contained.

The market share of purely digital banks in the euro area has increased slightly but remains low – below 4% in 2024.^[34] Around 80% of their funding comes from retail deposits; lending activities remain limited.

The growth of markets for private credit is another recent phenomenon that has moved lending activity away from banks.^[35] It is driven mainly by differences in regulation and business models rather than by digital innovation, though, and it remains to be seen how these markets will evolve once tested across a full credit cycle.

Perhaps the biggest impact of digital innovation could come from improvements in banks’ own lending policies. AI-enabled credit scoring could improve the screening of loan portfolios, reduce default rates and improve monitoring.^[36]

While AI can improve predictions, it cannot substitute for human judgement. Many decisions taken within banks involve choices that cannot be reduced to statistical optimisation. How much risk to take, how to use qualitative and soft information, how to treat unusual cases – all of this requires human judgement. And AI can introduce new biases, requiring human intervention to align lending practices with the values of the organisation.

The value of relationship-based information will remain high, especially in periods of stress.^[37] AI models predict the future on the basis of information from the past. But if the recent past does not contain relevant information about stress episodes, the information generated by AI can be of limited value.

Managing the digital transformation of finance: the need for action from banks, supervisors and regulators

The digital transformation of finance promises better financial services, but it also entails new risks. Managing these trade-offs well requires action – from banks, supervisors and regulators.

Banks’ strategic responses to digital innovation

Like other industries undergoing structural change, banks are facing a fundamental shift in their costs, technologies and competitive environment. Whether this ultimately strengthens or weakens their business models will depend critically on their long-term strategic response.

Key elements of banks’ strategies are the quality of the information systems they rely on, the resources invested, and the guardrails put in place.

First, new technologies cannot compensate for poor underlying data or fragmented legacy systems. Strong risk data aggregation and reporting capabilities determine how effectively banks can exploit AI and advanced analytics.^[38] Yet risk data aggregation remains an area where progress is often too slow. We thus closely monitor the action banks are taking to remediate open supervisory findings, and employ a supervisory escalation strategy if material deficiencies are not addressed in a timely manner.^[39]

Second, digital transformation requires significant investment. Banks under ECB supervision invest on average 2.8% of their operating income in digital transformation projects, which is around one-fifth of total IT spending. Around 5% of their staff are allocated to digital transformation projects – and banks have reported difficulties in attracting and retaining digital and IT specialists.^[40] From a supervisory perspective, we expect banks to have multi-year budgets aligned with their strategic objectives and indicators to monitor delivery.^[41]

Third, digitalisation cannot be managed as a collection of individual technology projects – good governance and risk management remain essential. The use of AI agents brings urgency to the question of how to establish guardrails and ensure that decisions taken are in line with core corporate values.

There is no simple definition of good ethical behaviour – cultures, legal norms and the practical context all play a role. What we do know, though, is what promotes ethical behaviour – good governance. Banks remain accountable for ensuring that decisions are consistent with legal requirements, sound risk management and the fair treatment of customers. They need to align their policies with the values of the society to which they provide services. This cannot be outsourced to a model or to a third-party provider.

In sum, technological capability depends on investment, data and IT architecture, just as much as on governance and control functions. These elements reinforce each other: a bank with reliable data, modern infrastructure and effective governance will be better placed to identify valuable applications of new technology and to deploy them safely at scale.

Adapting supervision

As supervisors in a world of digital finance, we continue to assess whether banks are financially and operationally resilient, and whether they have sound risk management and governance systems in place.^[42]

But we also need to adapt. Risks can emerge faster, propagate through common infrastructures and service providers, and become visible only when developments are viewed across banks.

This has several implications for our supervision.

First, we take a perspective beyond the individual bank. Depositors cannot assess how new technologies create vulnerabilities and how risks can be amplified within the system. They need to rely on supervisors monitoring and analysing vulnerabilities and addressing weaknesses.

Our system-wide view of outsourcing dependencies that the DORA framework provides is an example.^[43] Our Guide on outsourcing and supervisory follow-up addresses risks related to the disruption of a major cloud provider.^[44]

Second, we share information about good practices across the sector.^[45] Advances in frontier AI models have, for example, increased the speed and scale at which cyber vulnerabilities can be identified and exploited. This summer, we therefore asked banks to reassess their defences and submit concrete action plans.^[46] These plans will be assessed horizontally to identify and share good practices.

Banks also need to prepare for the transition to quantum-resistant cryptography well before the risks fully materialise.^[47] Our role is to raise awareness, promote industry dialogue and ensure that this longer-term risk is incorporated into banks’ strategic planning.

Third, supervision needs to ensure that banks take a sufficiently long-term perspective. In particular, listed banks and banks depending on short-term market funding need to resist pressure to realise short-term payouts at the expense of sound, long-term digital strategies. By analysing the soundness of business models and medium-term capital planning, supervision can tilt the balance towards longer-term strategic planning.

Fourth, open supervisory findings need to be remediated in a timely manner. In 2024 we conducted a cyber resilience stress test, which confirmed that banks have response and recovery frameworks in place. But it also identified weaknesses which need to be remediated.^[48] Moreover, cyber risk has implications beyond supervision. Effective resolution depends critically on timely and reliable data, but a severe cyber incident could compromise information needed to apply resolution tools.^[49]

These examples illustrate our broader approach: supervision needs to look across institutions, identify emerging common vulnerabilities, communicate good practices and ensure that material weaknesses are remedied before they become embedded throughout the system.

Setting regulatory guardrails

Public authorities and regulators shape the environment in which innovation can develop safely. In payments and securities settlement, common standards, interoperability and public infrastructure shape how competition evolves and how services are provided.

Some of the regulatory responses needed to address the risks and structural changes created by digital innovation lie outside the prudential remit, but they will provide the basis for a healthy ecosystem of financial service providers.

Digital innovation can significantly alter the competitive structure of banking markets. It can lead to increased power for customers and suppliers, and it can lower barriers to entry. It can lead to market concentration, which may require responses from competition authorities.

Structural change means that financial institutions need to be able to enter and leave the market without creating disruptions. This requires a further strengthening of the framework for dealing with failing financial institutions, ensuring that those with access to the public sector safety net are properly supervised and regulated.

Systemic risks can increase, which calls for a system-wide perspective to be taken on evolving risks. Self-regulation is not enough. This applies not only to banks, but also to other providers and technologies that are becoming increasingly important in the financial system. Governance, sound risk management and safeguards against systemic risk are needed wherever new financial products and applications can have negative welfare implications. As in medicine, products that can have harmful effects have to undergo pre-testing before being launched on the market.

Summing up

For digital innovation to boost rather than hinder banks’ business models, investment and good governance are needed. Digital innovation requires significant upfront investment and sufficient scale. The more fragmented markets are, the less likely are such investments to pay off. Policy measures that contribute to more integrated banking markets in Europe – completing the banking union and harmonising national rules that, de facto, segment markets – can thus support banks’ long-term digitalisation strategies.^[50]

Proposals tabled by the European Commission on ways to reduce market fragmentation in Europe^[51] can thus be a facilitator for banks’ development of sound digitalisation strategies.

Weakening prudential standards, on the other hand, would undermine precisely the operational and financial resilience that banks need to successfully compete with new providers of financial services.

Prudential supervision has a key role to play in ensuring that banks’ governance and risk management remain commensurate with the opportunities but also the risks that financial innovation entails.

But prudential supervision does not operate in isolation. Cyber security, AI governance, financial integrity and market conduct interact to provide a comprehensive public policy framework.