If time stood still: regulatory modernisation and financial stability

Keynote speech by Sharon Donnery, Member of the Supervisory Board of the ECB, at the 2026 IIF European Banking Regulation and Supervision Colloquium

Frankfurt am Main, 6 November 2026

Introduction

Suppose we suddenly decided to leave all banking rules and supervisory practices unchanged for the next ten years.^[1] Could we justify that decision?

The financial system would continue to evolve. Banks would adopt new technologies and business models. Some safeguards might remain effective. Others might leave us exposed to risks they were never designed to address.

Meanwhile, banks and supervisors would need to continue spending time and money on requirements that had lost their usefulness, or on work that technology could do faster and cheaper.

Doing nothing would therefore leave us with unnecessary costs and less protection. But that conclusion alone does not tell us what we need to change.

To make the right choices, we need to start with the purpose of our work: ensuring the safety and soundness of banks and the stability of the financial system. People depend on banks every day. Households entrust banks with their savings; they rely on them to make payments and to finance their homes. Businesses need banks to manage cashflows such as wages and to finance investment. All in all, banks provide services that are fundamental to the economy, and any disruption can lead to lost jobs, failed businesses and lasting economic damage.

And this is where regulatory and supervisory modernisation must also start. It must help preserve banks’ ability to provide these services, including when conditions deteriorate. We welcome the Financial Stability Board’s (FSB) recently published draft principles^[2] and support their overall direction. They are closely aligned with the reforms we are already pursuing at the ECB: simplifying processes, adopting new technologies and tools responsibly, sharpening our focus on the most important risks and preserving resilience.

The FSB consultation gives us all an opportunity to share our experiences, learn from one another and examine together where our approaches can be improved. I encourage all stakeholders, including financial institutions, researchers and civil society organisations, to contribute their evidence and experience to this public consultation.

The question I want to explore today is therefore: how can we keep a changing financial system safe while reducing unnecessary complexity and costs?

I will address this question in three parts.

First, what does it mean to keep the financial system safe?

Second, how can we keep our safeguards effective as risks evolve?

Third, how do we know if a change is actually an improvement?

What does it mean to keep the financial system safe?

Keeping the financial system safe does not mean eliminating risk. Banking involves taking risks. A business can make a sound investment and still fail. A bank can lend responsibly and still incur losses. An economy in which no one can take such risks will struggle to grow.^[3]

But when investments fail and losses arise, the wider economy still needs a functioning banking system. To quote the FSB’s draft report: “financial stability provides the foundation for sustainable economic growth, which in turn supports financial stability”.

Safety therefore requires banks to manage the risks they take and have the resources to withstand losses and episodes of funding stress, all while maintaining essential operations.

This is where capital and liquidity requirements come into play. Capital absorbs losses, helping banks remain solvent and continue lending under stress. It helps protect depositors and reduces the risk that taxpayers will have to support a failing bank. Similarly, liquidity requirements help ensure that banks can meet payments as they fall due, including under stress. Together, these safeguards support confidence in the financial system.

In addition, banks must understand and manage the risks they take. Banks’ boards and management are responsible for putting in place appropriate internal governance and risk management arrangements. Strong governance is central to banks’ ability to recognise and respond to changing risks – a point I will return to later.

Even with these safeguards, banks can still fail. We therefore also need arrangements to manage failures in an orderly way, protecting depositors and essential services.^[4]

What, then, is the role of supervision?

Supervision contributes to economic growth by helping banks remain safe and sound. Resilient banks are better placed to finance productive investment through good times and bad, including when losses rise or funding becomes harder to obtain.

But we should be clear about what that contribution entails. Finance can help fund the investment needed to boost productivity; it cannot replace the structural reforms needed to make that investment profitable and productive. Europe needs a more integrated Single Market, conditions that support innovation and the adoption of new technologies, and fewer barriers to firms expanding across borders.^[5] The evidence shows that capital is not currently a major constraint on euro area lending. In the ECB’s latest bank lending survey,^[6] banks attributed tighter corporate credit standards mainly to heightened risk perceptions and lower risk tolerance.^[7] Supervisors cannot resolve Europe’s structural growth challenges simply by adjusting prudential requirements.

How can we keep our safeguards effective as risks evolve?

Sustaining banks’ ability to finance the economy means keeping our safeguards effective as the risks they face change. That requires us to look at banks within the wider financial system.

Geopolitical tensions and trade barriers can result in lower economic growth and higher inflation, weakening borrowers and disrupting markets. Their effects may take time to show up on banks’ balance sheets. High public debt, weak growth and rising spending needs can limit governments’ capacity to cushion such shocks. Climate change continues to challenge the banks and the wider economy, as illustrated by the increasing frequency of extreme weather events. Rapid technological developments and rising cyber threats are also reshaping the risks banks need to manage.

I want to highlight three features of this risk environment that matter most for modernisation: the way risks interact, the way exposures cross sectoral boundaries, and the way some risks can materialise very rapidly.

First, the way risks interact. A sharp rise in government bond yields could trigger losses across portfolios and increase borrowers’ financing costs. Concentrated positions, excess leverage and liquidity mismatches can amplify such market shocks by forcing investors to sell into falling markets.^[8]

Our recent reverse stress test on geopolitical risk shows why banks need to capture risk interactions in their assessments. We asked banks to identify plausible geopolitical scenarios that would lead to a substantial decline in their capital ratios. Some banks projected only limited liquidity stress. Yet losses can also undermine confidence and make funding harder to obtain. Assessing risks separately can therefore underestimate their combined impact.^[9]

Second, the way exposures cross sectoral boundaries. Consider the growing use of debt to finance investment in artificial intelligence (AI), which is broadening the range of lenders and investors exposed if expected returns disappoint. Private credit is one such source of financing. But limited transparency can make it difficult to establish where leverage sits and who would ultimately bear losses. Banks may be exposed through lending both to funds and to the companies financed by those funds.^[10] More broadly, AI may reshape firms’ competitiveness and employment, affecting borrowers’ repayment capacity well beyond the technology sector. However, the timing and scale of these effects remain uncertain.^[11]

Third, the way some risks can materialise very rapidly. A cyberattack on a technology or critical service provider serving multiple financial institutions could disrupt services across the system. Frontier AI models can also shorten the gap between the discovery of a software vulnerability and its exploitation, leaving less time to respond.^[12]

Whatever the risk, protection starts with a well-run bank. Sound governance, risk management and risk culture shape how banks deal with every kind of risk. They help ensure that assumptions are challenged, warnings are heard and follow-up is undertaken. They matter more when conditions change: banks need to recognise when familiar approaches no longer provide adequate protection and must be ready and willing to adapt. Reflecting on the banking turmoil of 2023, Andrea Enria concluded: “Governance was at the root of the problem”.^[13]

Supervisors, in turn, must assess how banks’ governance and risk management work in practice, including whether warning signs lead to action. Weaknesses can warrant intervention before they produce measurable losses.

We must also recognise when our own assessments and priorities need to change.

In Building Better Regulators, Lyndon Nelson and Gavin Stewart call for greater honesty about what regulators can realistically deliver and the trade-offs they face.^[14] For supervision, this includes explaining where we focus our attention, what uncertainty we accept and why.

We cannot examine every activity at every bank in equal depth, every year. Trying to do so could leave us with too little time to investigate weaknesses that warrant urgent attention. Prioritisation means deciding both whom and what to investigate more closely and where less intensive scrutiny is justified.

Our priorities guide supervisory focus at the system level. At bank level, the ECB’s supervisory risk tolerance framework makes those choices explicit. Reviewing a lower-priority area less intensively means consciously accepting some uncertainty about what a fuller review might reveal.^[15] That decision needs a rationale, an appropriate level of challenge and a willingness to reconsider when circumstances change. Less intensive supervisory scrutiny does not reduce banks’ responsibility to manage those risks.

But an area that warrants less attention today may require closer scrutiny tomorrow. This is where “peripheral vision” becomes important.^[16] We need to remain attentive to developments beyond our immediate line of sight. We must remain able to recognise when a bank or area needs closer attention, and retain the discretion to act.

That requires reliable information on banks’ exposures and dependencies, cooperation with authorities overseeing other parts of the financial system, and time to investigate emerging concerns. Making better use of the information already available – and sharing it more effectively – can help us identify connections that separate reviews might overlook.^[17]

Difficulty in quantifying a risk calls for careful judgement about its significance. It does not, by itself, make the risk irrelevant. Supervisors need room to use information that a mechanical score may miss.

Identifying weaknesses must lead to timely corrective action.^[18] Banks need clear expectations and deadlines. Supervisors need to establish whether the underlying problem has been remedied and act when progress is insufficient. Repairing weak controls can also help manage risks that neither a bank nor its supervisor has yet anticipated.

Securing these improvements depends on both regulation and supervisory practice. Regulation establishes common prudential safeguards and gives supervisors powers to act. Supervision uses judgement to identify vulnerabilities, assess banks’ resilience and secure timely action on weaknesses. Modernisation must therefore encompass both.

Clear, enforceable rules are essential. But detailed legal prescriptions for supervisory procedures and review frequencies can tie up resources that would be better directed towards more material risks. For example, we have proposed revisiting the requirement to review internal models at least once every three years.^[19] Some improvements therefore require legislative change. Others depend on how supervisors organise their work and use their existing powers.

Our report Streamlining supervision, safeguarding resilience sets out practical ways to improve supervision within the existing legal framework.^[20] Better coordination of inspections and other supervisory activities will help avoid duplicate work and requests. Simpler follow-up on less severe findings will allow supervisors to concentrate more on serious weaknesses. As Erik Thedéen recently put it: “Modernisation should free supervisors to think, not simply enable them to process more”.^[21]

Keeping our safeguards effective therefore requires us to reconsider both what we examine and how we secure improvements. Changes in the risk environment give us reason to review existing approaches. They do not tell us which particular reform will work. That brings me to the third question: how do we know if a change is actually an improvement?

How do we know if a change is actually an improvement?

A reform should help us meet our prudential objectives more effectively or at lower cost, while preserving resilience.

The ECB’s High-Level Task Force on Simplification translated this goal into principles for reform.^[22] Its recommendations, endorsed by the Governing Council in December 2025, seek to preserve resilience and the ability of prudential and resolution authorities to fulfil their responsibilities, covering all relevant risks. These principles also seek to advance European harmonisation and financial integration, and uphold international standards and cooperation. They establish what we expect from reform. The harder task is determining whether a particular change will deliver.

We should begin by identifying specific shortcomings: be it the duplication of information collection, delays in addressing serious weaknesses, or risks that an existing requirement no longer captures well.

We then need to compare the available approaches. We should explain how a change would address the problem, what evidence supports that expectation and which assumptions matter most.^[23] That includes explaining what protection the existing approach provides and what might be lost by changing it or by retaining it as the financial system changes.

We should acknowledge the limits of our knowledge. We cannot predict precisely how the financial system might develop under different regulatory approaches. Outcomes depend on banks’ decisions, market conditions and the interaction of numerous safeguards.^[24]

The depth of analysis should reflect what is at stake. Removing a genuinely duplicated request may require a straightforward check that the information remains available. A change affecting a bank’s capacity to absorb losses warrants much closer examination, including how it could perform under adverse conditions.

Our recent proposals for small and non-complex banks illustrate how requirements and supervisory engagement can be matched to an institution’s risks and significance.^[25] These proposals envisage less frequent supervisory assessments where risks permit, alongside greater reliance on top-down stress tests conducted by supervisors to ease the workload of banks. Supervisors need enough information to recognise when risks have changed, and discretion to intensify scrutiny.

Size cannot be the only factor in determining how much risk a bank poses. A bank with little trading activity may warrant simpler market risk requirements, yet still need close scrutiny of concentrated lending or funding.^[26] Simpler arrangements also need credible crisis management. The conditions justifying simpler treatment must therefore remain subject to review.

Some changes involve difficult trade-offs. A simpler method may be less sensitive to differences in risk. For capital requirements, a more conservative calibration can help compensate for that loss of sensitivity. These choices should be explicit. Costs visible in a bank’s budget must not dominate merely because the benefits of preventing financial distress are harder to measure. Our judgement must remain anchored in safety and soundness.

We also need to consider how changes interact. Individual reforms that may appear modest could have a substantial effect when combined. The leverage ratio and output floor illustrate why apparent overlap need not mean duplication. The former limits leverage regardless of measured risk, while the latter limits how far internal models can reduce risk-weighted assets compared with the standardised approach. Which constraint matters most can change as a bank’s balance sheet changes.^[27] Regulatory backstops, including the output floor, should be maintained to guard against risks being underestimated. Assessment should therefore examine the framework as a whole, including whether risks would move to other institutions or sectors.

That assessment must also extend across borders. Differences in the implementation of common standards, including the output floor, can affect capital requirements for banks undertaking comparable trading activities. The floor applies to aggregate risk-weighted assets, but its effects depend on banks’ wider balance sheets and the rest of the capital framework. We should examine such differences through our international institutions, with the aim of securing consistent protection and fair competitive conditions.

Through the Basel Committee on Banking Supervision (BCBS) and the FSB, we can compare evidence and experience across jurisdictions. The 2023 banking turmoil exposed weaknesses in interest rate and liquidity risk management, inadequate preparedness for stress and failures to ensure timely corrective action. The BCBS’s follow-up was designed to address precisely these weaknesses.^[28] Examining these challenges together helps each authority fulfil its responsibilities more effectively. As members, we have a shared responsibility to contribute our evidence and expertise, engage constructively when our assessments differ and follow through on what we agree. Focus and prioritisation are essential to this shared international work, but they must sharpen our responsiveness rather than raise the bar for action. The BCBS and FSB have proven their value precisely by modernising frameworks as risks evolve – enabling us to act decisively together.

Finally, before implementing a reform, we should identify how we will assess its effects. Once a reform is in place, we need to check whether it delivers the intended benefits. If we review some areas less often, does that free up time to address more serious risks? And does the information available between reviews still allow us to detect emerging problems and act in time?

The review process should itself be proportionate. We should use existing information where possible, seek feedback from banks where relevant and direct deeper analysis towards consequential changes or credible signs of problems. Banks need time to adapt, and reforms need time to bear fruit. Repeatedly changing requirements before learning from them can create costs of its own.

Authorities also need independent internal challenge of their supervisory judgements and working methods. Reviews should examine both the consistency of assessments and whether supervisory work achieves its intended outcomes.^[29] At the ECB, our second line of defence reviews supervisory work independently of the teams carrying it out and reports directly to the Chair of the Supervisory Board. Reviews of internal model supervision and our leveraged finance inspection programme have identified ways to improve processes and resource planning. This helps us question our methods and draw practical lessons from experience.

Internal review sits alongside our public accountability. ECB Banking Supervision is accountable to European citizens via the European Parliament and EU Council. Individual supervisory decisions can be challenged through administrative and judicial review. These arrangements give practical meaning to our responsibility to explain and justify our choices.

Conclusion

I began by asking whether we could justify leaving all banking rules and supervisory practices unchanged for ten years.

We could not. But change is not, in and of itself, progress. We must be able to explain why we changed one requirement, why we retained another, and how those decisions help banks remain resilient.

Modernisation must keep our safeguards effective as risks change, while removing undue complexity and improving how we regulate and supervise. This is the approach we are already pursuing at the ECB and the basis for our support for the FSB’s work on modernisation. That is how we protect the people and businesses who depend on the financial system.