Priorities
The ECB aims for more holistic supervision in the face of geopolitical risk
The ECB published its SSM Supervisory Priorities for 2025-2027 this week - for the first time under Claudia Buch’s leadership. The new Priorities (which came alongside the 2024 SREP Results) depart significantly from those issued in previous years. Here are some initial thoughts on the latest priorities and what they might mean for banks.
SSM Supervisory Priorities for 2025-2027: Summary
(source: ECB)
Geopolitical Primacy
The most striking feature of the new priorities is the central position given to geopolitical risk. The ECB identifies geopolitical tensions as the most important threat to the macroeconomy and to European banks. In her statement introducing the Priorities (and following the framework she set out in September), Buch explained that the ECB does not see geopolitical risk as a separate, new risk category. Rather it is a driver for different types of financial and non-financial risk. A geopolitical shock could lead to increased borrower defaults, or a sudden shift in financial market prices. Meanwhile banks’ operational infrastructure (and that of outsourced service providers) could face heightened physical and cyber threats in the event of a conflict.
The cross-cutting nature of geopolitical risk means that building resilience to geopolitical shocks - the ECB’s first Supervisory Priority - is a multifaceted exercise. For supervisors the priority areas are credit and operational risk. Within credit risk, the ECB will press banks to better incorporate geopolitical risks into their loan valuation models (under the IFRS 9 accounting standard), and will conduct a targeted review of loans to small and medium enterprises, which it considers most exposed to geopolitical shocks. On the operational risk side supervisors will focus on weaknesses in banks’ cyber resilience and outsourcing of critical IT services.
Geopolitical risk also has an important governance component. The ECB will assess how geopolitical risk is factored into banks’ risk management and risk appetite framework, and will expect banks to conduct scenario analyses to simulate the impact of a geopolitical shock. Senior management, Buch said, will need to be involved in these exercises to ensure proper coordination across functions. And the ECB will use the upcoming 2025 EU-wide stress test to evaluate banks’ ability to conduct such scenario analysis. This could be where supervisory interest in geopolitical risk proves most controversial. The ECB can certainly assess whether banks have good processes for analysing a given scenario, with the right stakeholders involved, all risks considered and assumptions well documented. But as I have written before (here and here), it is less clear whether supervisors have the expertise to judge whether the scenarios chosen (and the assumptions used) are reasonable. This could lead to more tension with banks, if management feel that supervisors are pressing them to make contingencies for unrealistically bad scenarios.
Holistic Supervision
In the latest Prioriies the ECB acknowledges that the “cross-cutting nature of geopolitical shocks calls for a holistic supervisory strategy.” This is reflected in the new priorities’ more thematic structure - which is a departure from previous years (when they were primarily organised around the main risks types, i.e. credit risk, liquidity risk, operational risk, business model risk and governance - for example, see last year’s priorities).
The desire for more holistic supervision may well be a product of Buch’s own strategic ‘big picture’ mindset. It is a little curious, though, that the priority themes do not quite map onto the three big shifts in the risk environment for European banks that Buch described in her 4 November Eurogroup statement: geopolitical risk, climate change and challenges from digitalisation. Perhaps more importantly, the emphasis on holistic supervision also suggests that Buch sees a need to do more to improve collaboration between different ECB teams and break down internal silos. How far this is possible within a large and inevitably bureaucratic organisation like the ECB remains to be seen.
From Finding to Fixing
After resilience to geopolitical shocks, the ECB's second priority is getting banks to remedy persistent shortcomings. ECB officials have long complained that in some more ‘qualitative’ areas - in particular governance - problems identified by supervisors have been left unaddressed (or even ignored) by banks. Hence the increasing emphasis over the past 18 months or so on escalation and using supervisory enforcement powers to force banks to fix faults that the ECB has found. The latest Supervisory Priorities continue that trend, and once again highlight climate and environmental risk and risk data aggregation as areas where banks are at risk of financial penalties if they do not comply with ECB expectations.
I was particularly struck by the first sentence of this section of the priorities document: “The progressive shift in focus from risk identification to risk remediation is an essential feature of the SSM-wide supervisory strategy.” To me this formulation suggests that the ECB believes it has now uncovered all (or virtually all) of the legacy problems at European banks. So there are no more ‘buried bombs’ to be unearthed: instead the focus should be on addressing (or defusing) the now known deficiencies. That view would be in line with the ECB’s narrative at the 10th anniversary of the Single Supervisory Mechanism: that European banking supervision had successfully strengthened the European banking sector, but must remain vigilant against emerging risks. That suggests a more forward-looking mindset. And it could be a sign that in future inspections supervisors will focus less on searching for new problems and more on checking whether known problems have been solved.
Future-proofing
As it looks to the future, the ECB remains concerned that not enough banks think strategically about the impact of digitalisation and how they will use digital technology across their businesses. So it is no surprise that the ECB's third priority focuses on digitalisation. Yet I saw little new in this section (the shortest of three main priorities): the ECB will just continue pushing banks to invest in IT modernisation and assess their management of the risks from new technologies. In particular, there is still no more detail on the ECB’s expectations on banks’ use of AI beyond a general statement that the risks involve must be managed.
Silent Dogs
Finally, I noted a few issues that did not feature (or hardly featured) among the ECB’s priorities. Perhaps the biggest was liquidity risk - which last year was a key component of the ECB’s resilience priority. In this year's priorities, liquidity risk is barely mentioned: presumably a sign that the ECB (which has celebrated European banks' current high liquidity ratios) does not see this as a significant risk at present. Similarly, there is only one brief mention of interest rate risk in the banking book (IRRBB), in the final section of the priorities document discussing work undertaken in 2024. Although ECB supervisors avoid commenting on future monetary policy, this suggests they share the general expectation that interest rates are set to fall over the coming year.
One other ‘past priority’ caught my eye: governance. I had to feel a little sorry for the ECB officials working to finalise the new Governance and Risk Culture Guide, published in draft this summer. A year ago, finalising the Guide was a supervisory priority (and due to be done this year): now it too has been relegated to the status of ‘following up on past priorities’ and delayed until ‘early 2025’. As I mentioned above there will be an important governance component to the ECB’s work on geopolitical risk: nonetheless the new Guide has apparently faded in prominence. Meanwhile banks who had been bracing themselves for more intrusive scrutiny of the general workings of their management boards may be breathing a sigh of relief.
Strategic Priorities
The point of Priorities, though, is to prioritise. The latest SSM Supervisory Priorities do just that, highlighting the key challenges the ECB sees to European banks (above all geopolitical risk) and focusing supervisory attention on those challenges. More theatic, holistic and strategic supervision seems to match with Buch's own way of thinking - and aligns with the thrust of the SREP reforms she unveiled in May. A big question for the coming year is how far the shift in priorities is reflected in the practice of supervision from day to day.
Holiday break
This is my last ECB Supervision Watch post of 2024. I will be back in the new year with reflections on Claudia Buch’s first 12 months as SSM Chair and a review of the latest SREP results - as well as some thoughts on the ECB’s new Frankfurt neighbour, the EU Anti-Money Laundering Authority (AMLA), whose first Chair Bruna Szego was confirmed by the European Parliament this week.
Until then, I wish all readers a happy holiday season and a good start to 2025.