SSM supervisory priorities for 2024-2026

The SSM supervisory priorities reflect ECB Banking Supervision’s medium-term strategy for the next three years. They are set by the Supervisory Board, reviewed annually, and rest on a comprehensive assessment of the main risks and vulnerabilities for supervised institutions. The priorities also take into account the outcome of the Supervisory Review and Evaluation Process (SREP)^[1] and progress made on the priorities from previous years. They support an efficient allocation of the available supervisory resources and can be adjusted flexibly if warranted by changes in the risk landscape.

Supervised institutions have navigated the adverse macro-financial and geopolitical shocks of recent years well. Robust fundamentals – such as sound capital positions and liquidity buffers or lower levels of non-performing loans (NPLs) – have helped banks cope with the challenges stemming from the coronavirus (COVID-19) pandemic and related supply chain disruptions, Russia’s war in Ukraine and the subsequent energy supply shock, as well as the recent failures of US and Swiss banks. The ability of the banking sector to withstand a severe economic downturn has also been confirmed by the outcome of this year’s EU-wide stress test.^[2]

Looking ahead, the European banking sector is facing several challenges that require enhanced vigilance by supervisors and banks alike. While the fast-paced rise in interest rates has so far benefited banks’ profitability, the higher interest rate environment is expected to increase both the volatility of some funding sources and banks’ funding costs in the medium term, just when substantial amounts of central bank funding are to be replaced. In addition, the quality of banks’ assets may start to deteriorate again if geopolitical risks materialise or high inflation coupled with tighter financing conditions challenges the debt servicing capacity of households and non-financial corporations. Higher risk premia may lead to a further repricing of financial assets and new episodes of high financial market volatility. Against this background, it is essential that banks maintain and keep enhancing their credit risk and asset and liability management (ALM) frameworks, ensuring, for the latter, both liquidity and funding risks and also interest rate risk in the banking book (IRRBB) are covered.

The failure of a number of medium-sized US banks and the takeover of a Swiss bank once again highlighted that banks need strong internal governance and effective risk controls to cope with a dynamically evolving risk landscape. The bank failures also stressed the importance of a timely and effective supervisory response and, if needed, escalation, whenever banks’ practices appear inadequate and remediation slow. Against this background, ECB Banking Supervision will progressively apply the appropriate escalation mechanisms and tools to ensure that banks promptly and successfully address the shortcomings identified in the supervisory priorities. This is especially the case in governance, where major shortcomings have not been adequately addressed by some banks despite long-standing engagement with supervisors, for instance those related to the functioning and steering capabilities of management bodies or risk data aggregation and reporting (RDAR) capabilities. Banks also need to ensure that their practices are fully aligned with the sound management of climate related and environmental (C&E) risks. They must do so by the deadline of the end of 2024 at the latest, and ECB Banking Supervision has also set interim deadlines by which banks need to satisfy certain requirements.

While the risk landscape has evolved further since last year, the supervisory priorities and corresponding activities set out in 2022 remain valid overall and still address the main vulnerabilities in the banking sector. Notwithstanding the stability necessary for planning over a three-year horizon, a few selected adjustments are warranted in order to address the risks highlighted above.

In the context of the SSM supervisory priorities for 2024-2026, supervised institutions will primarily be asked to strengthen their resilience to immediate macro-financial and geopolitical shocks (Priority 1), as well as accelerate the effective remediation of shortcomings in governance and the management of C&E risks (Priority 2) and make further progress in their digital transformation and building robust operational resilience frameworks (Priority 3). Figure 1 lists seven key vulnerabilities in banks that can be assigned to three overarching priorities.

Figure 1

Supervisory priorities for 2024-2026, addressing identified vulnerabilities in banks

The main purpose of ECB Banking Supervision’s strategic planning is to develop a sound strategy for the next three years. The priorities promote effectiveness and consistency in the supervisory planning of the Joint Supervisory Teams (JSTs) and support a more efficient allocation of resources, in line with the setting of the corresponding risk tolerance levels. They also help national supervisors set their own priorities for the supervision of less significant institutions in a proportionate way. Transparent communication of the priorities clarifies supervisory expectations to banks, enhances the impact that supervision has on further increasing the resilience of the banking sector and helps to ensure a level playing field.

The following sections provide more detail on the outcome of the 2023 risk identification and assessment exercise and set out the supervisory priorities and underlying work programmes for 2024-2026. Other regular and ad hoc activities are also carried out by supervisors as part of their ongoing engagement with banks and complement the work on the priorities.

2.1 Operating environment for supervised institutions

The growth outlook for the euro area remains subject to high uncertainty in the context of tighter financing conditions and heightened geopolitical tensions, while future energy and food price paths are subject to upside risks.^[3] Inflationary pressures are further shaping the challenging environment, and weak euro area growth is expected to persist over the near term. While weaknesses in the manufacturing sector remain, activity in the services sector – the main driver of economic growth so far – is also set to soften given that the effects from the post-pandemic reopening of the economy are fading and the drag from tighter financing conditions and elevated consumer uncertainty remain significant. The euro area labour market has been resilient so far, but labour demand may slow down should economic activity stagnate for longer.^[4] Credit supply conditions have tightened significantly since December 2022 and lending dynamics have slowed as the fast-paced tightening of monetary policy feeds increasingly into the real economy.^[5]

Headline inflation in the euro area is projected to continue on a downward path over the medium term, while core inflation is expected to fall more gradually.^[6] If monetary policy requires further tightening, or if interest rates stay at higher levels for longer in a scenario of persistently high inflation, the economic growth outlook may deteriorate, impairing banks’ asset quality. While households and corporate balance sheets appear financially sound overall, concerns about borrowers’ debt servicing capacity are rising, especially in real estate lending. Besides an erosion of banks’ asset quality in the event of an economic downturn, one-off factors like the bank levy constitute a separate downside risk to banks’ earnings in some countries.

A mixture of heightened geopolitical tensions, “higher-for-longer” interest rates and a potential economic slowdown in the euro area may result in renewed turbulences in financial markets. The banking sector turmoil in the United States and Switzerland in early March, which triggered a steep risk-off sentiment among US banks, only spread partially and temporarily to the European banking sector. Spillover to the euro area remained contained and short-lived, market volatility receded, and euro area stock prices recovered shortly after the shock, especially in the banking sector, while corporate bond spreads narrowed again. A sudden deterioration in the economic outlook could nonetheless trigger renewed episodes of heightened volatility and abrupt asset price corrections, resulting in a further tightening of financing conditions.

2.2 Supervisory priorities for 2024-2026

Priority 1: Strengthen resilience to immediate macro-financial and geopolitical shocks

Prioritised vulnerability: Shortcomings in credit risk and counterparty credit risk management frameworks

Supervisors have been working towards addressing structural deficiencies in banks’ credit risk management frameworks for several years.^[7] While the supervisory activities reveal that banks have made some progress in this area, they also highlight several persistent shortcomings. These range, for example, from banks’ limited capabilities to anticipate emerging risks (including C&E risks) and adequately reflect them in their credit risk provisions, to gaps in their preparedness for dealing with a potential surge in distressed debtors and refinancing risks, and evidence of collateral overvaluation in CRE portfolios. While the findings of those reviews have fed into the 2023 SREP outcome, dedicated supervisory measures have been communicated to banks, and supervisors are monitoring the implementation of the planned remedial actions closely.

Regarding CCR management, the targeted review conducted in 2022 and the subsequent on-site inspections (OSIs) have highlighted material shortcomings in banks’ customer due diligence, risk appetite definition, default management processes and stress-testing frameworks. While supervised institutions have made progress in addressing the identified issues, further effort is still expected to achieve close alignment with the “Sound practices in counterparty credit risk governance and management” report published in October 2023.

Looking ahead, the supervisory activities from last year’s work programme that are aimed at achieving the strategic objective in credit and CCR management will largely continue. Nevertheless, some re-focusing is necessary to allow for the changing economic environment and the progress achieved thus far. The remaining gaps identified in the 2020 “Dear CEO” initiative will continue to be followed up on as part of the reviews of forbearance, unlikeliness-to-pay (UTP) and provisioning practices. Regarding the latter, the targeted review focused on IFRS 9 and overlays will be repeated to monitor banks’ progress and remediation of past findings. Moreover, targeted reviews and, where relevant, OSIs and internal model investigations will be conducted on more sensitive portfolios such as real estate (both residential and commercial) and small and medium-sized enterprises (SMEs). Regarding CCR, JSTs will continue to closely monitor banks’ exposures and scrutinise the adequacy of their risk management practices, performing a targeted follow-up on the progress made in remediating the shortcomings identified in 2022.

Main activities as part of the supervisory priorities work programme

Prioritised vulnerability: Shortcomings in asset and liability management frameworks

Financial market volatility and price corrections in fixed income markets in the light of the current interest rate dynamics have increased the risk of unrealised losses building up in banks’ amortised cost portfolios. Although the effects can be severe, as evidenced by the turmoil surrounding some US medium-sized banks in March, the combination of factors that led to that particular episode has so far not been observed in banks under European banking supervision. Indeed, as evidenced by data^[8] published in July 2023, the overall amount of such unrealised losses was relatively contained, at €73 billion as of February 2023, compared with USD 620 billion for US banks at year-end 2022^[9]. Supervisors have been scrutinising banks’ assessment and management of interest rate and credit spread risks from as early as the second half of 2021, when the first signs of inflationary pressure emerged. In 2022 ECB Banking Supervision included those risks in its supervisory priorities and performed a dedicated targeted review to proactively assess banks’ preparedness for potential rate hikes. Findings identified at that time pointed to the need for banks to review the calibration of their ALM models more frequently to respond to changes in customer behaviour stemming from the new interest rate regime and to weaknesses in some hedging strategies.

On the liquidity and funding side, supervised institutions have, on the whole, shown strong resilience to the changes in the financial environment so far. While shrinking central bank reserves and weak monetary dynamics have led to a decline in banks’ liquidity buffers, their liquidity coverage ratios and net stable funding ratios remain, on average, well above the regulatory minimum. In addition, supervised institutions are not displaying funding concentrations similar to those of some of the US medium-sized banks that failed earlier this year, as their main sources of funding primarily stem from deposits. These mostly come from retail customers, with the bulk covered by deposit insurance. In order to ensure the smooth phasing-out of the targeted longer-term refinancing operations (TLTRO) programmes and to assess banks’ preparedness for it, a targeted review focusing on banks’ TLTRO exit strategies was conducted in 2023. Against this background, some banks have been asked to further diversify their funding sources. A targeted review is also assessing the reliability and soundness of banks’ funding plans, the results of which will feed into the 2024 SREP outcome.

Going forward, ECB Banking Supervision will continue to strongly emphasise the need for banks to have robust ALM arrangements in place. Targeted activities will review banks’ ALM governance and strategies and assess the adequacy of the assumptions underpinning some of their behavioural models. Supervisors will also evaluate banks’ resilience to short-term liquidity shocks and the credibility and soundness of their liquidity contingency plans. Finally, supervisors will continue the efforts initiated in previous years by further reviewing how banks are managing IRRBB, as well as the soundness and reliability of their funding plans.

Main activities as part of the supervisory priorities work programme

Priority 2: Accelerate the effective remediation of shortcomings in governance and the management of climate-related and environmental risks

Prioritised vulnerability: Deficiencies in management bodies’ functioning and steering capabilities

Tackling deficiencies in management bodies has been one of ECB Banking Supervision’s top priorities for several years, and while there have been improvements in some areas, more progress is needed in terms of the composition, collective suitability and oversight role of banks’ boards. Following direct supervisory engagement in 2022, banks have made improvements in their diversity policies, which now include the criteria of education, experience, geographical provenance, and age in addition to gender. Currently, almost all supervised institutions have targets to address gender imbalances in their management bodies. However, the progress in meeting those targets is still insufficient.^[10] Banks also need to further improve the collective suitability of their boards, as well as their challenging capacity. The latter is related to weaknesses in board composition (e.g. an insufficient number of formal independent directors and a lack of knowledge in specific areas like IT) and functioning (e.g. insufficient time set aside for debate and concerns in the nomination processes of management bodies). The oversight role of board committees also needs further improvement, as revealed in the 2023 targeted review of management bodies.^[11]

ECB Banking Supervision will continue its engagement with banks to address these long-standing deficiencies through targeted reviews and OSIs. In addition, supervisors will update and publish supervisory expectations on governance and risk management.

Main activities as part of the supervisory priorities work programme

• Targeted review of the effectiveness of banks’ management bodies and targeted OSIs.
• Update and external publication of supervisory expectations and best practices regarding banks’ governance and risk culture.^[12]

Prioritised vulnerability: Deficiencies in risk data aggregation and reporting

Timely and accurate risk-related data aggregation and reporting are essential for sound decision-making and effective strategic steering by banks, especially in the current environment, as well as for the purpose of risk, financial and supervisory reporting. The outcomes of supervisory exercises performed to date – including the 2023 SREP exercise and the ongoing OSIs campaign – all point towards insufficient progress in closing gaps with respect to supervisory expectations and compliance with the Basel Committee on Banking Supervision principles for effective risk data aggregation and risk reporting. The key deficiencies relate to insufficient attention and oversight of management bodies, weaknesses in data architecture and fragmented and non-harmonised IT landscapes, low capacity for aggregating, and ineffective governance frameworks. Strong prioritisation by management bodies is key, as tackling RDAR-related deficiencies often requires significant resources.

As already communicated in last year’s supervisory priorities, ECB Banking Supervision is strengthening its efforts to ensure that supervised institutions deliver substantial progress in remedying the long-standing shortcomings identified in RDAR. A structured escalation mechanism, possibly including enforcements and sanctions, will be increasingly applied from 2024 onwards.^[13] The Guide on effective risk data aggregation and risk reporting further reinforces and specifies the supervisory expectations. A public consultation^[14] on the Guide took place between July and October 2023, and the Guide is planned to be published in 2024. Supervisors will also perform targeted reviews and OSIs and will engage with banks when persistent shortcomings are identified. Moreover, the Management Report on Data Governance and Data Quality^[15], piloted in early 2023, will be continued as an annual questionnaire to banks. It aims to ensure adequate accountability of banks’ management bodies in matters related to internal, financial and supervisory reporting.

Main activities as part of the supervisory priorities work programme

Prioritised vulnerability: Material exposures to physical and transition risk drivers of climate change

Global greenhouse gas emissions have continued to rise^[16], leading to further future global warming and, in turn, the intensification of multiple and concurrent hazards, as repeatedly shown by record-breaking heatwaves and the wildfires and floods in Europe and other regions of the world. The policies in place fall short of achieving the global warming targets set under the 2015 Paris Agreement.^[17] Delayed climate action is expected to further increase physical and transition risks and, potentially, the related losses to banks, raising the risk of greater damages, locked-in high-emission infrastructures, stranded assets and cost escalation.^[18] Geopolitical tensions, as well as increasingly higher upfront investments and disruptive changes needed for mitigation and adaptation, are likely to further fuel transition risks amid the tighter financing conditions.

While for some banks, the SREP 2023 revealed some improvement in defining their strategy with respect to C&E risks, for others it also showed the pressing need to address these deficiencies. SREP qualitative measures focused mainly on banks’ weaknesses in strategic and operational planning and in management bodies’ knowledge of environmental, social and governance (ESG) topics. C&E risks affected Pilar 2 requirement levels for an increasing number of banks when compared with last year’s SREP exercise.^[19]

In order to effectively address the deficiencies highlighted by the ECB’s 2022 climate risk stress test^[20] and thematic review^[21], ECB Banking Supervision set institution-specific deadlines for banks to fully align their practices with the supervisory expectations laid out in the 2020 ECB Guide on climate-related and environmental risks by the end of 2024. March 2023 marked one of the intermediate milestones in this process, as this was the month by which banks were expected to adequately categorise C&E risks and conduct a full assessment of the related impact on their activities. Some banks have still shown severe weaknesses in this respect, and supervisors have engaged with them through operational acts, SREP qualitative requirements and ad-hoc Supervisory Board decisions. By the end of 2023, banks are expected to incorporate C&E risks in their governance, strategy and risk management, and finally, by the end of 2024, meet all remaining supervisory expectations outlined in 2020, including full integration in the Internal Capital Adequacy Assessment Process (ICAAP) and stress testing. Going forward, ECB Banking Supervision will continue to use its full toolkit to ensure banks comply with these expectations including, when needed, supervisory escalation, such as periodic penalty payments or bank-specific capital add-ons.^[22]

Moreover, supervisors will continue reviewing and assessing the adequacy of banks’ disclosure practices. While banks have made some headway in this area, as revealed by the outcome of the third assessment of the progress European banks have made in disclosing climate and environmental risks, the quality of the disclosed information remains low. Other areas of focus in the coming years will include addressing C&E-related reputational and litigation risks arising from the publication of transition objectives and/or net zero commitments. Supervisors will also pursue their preparatory work to develop a framework for reviewing banks’ transition planning and readiness to meet ESG-related mandates in the Capital Requirements Directive (CRD VI). Finally, climate-related risks will continue to be assessed in certain risk-specific OSIs, while targeted stand-alone C&E risk missions are planned to start in 2024.

Main activities as part of the supervisory priorities work programme

Priority 3: Further progress in digital transformation and building robust operational resilience frameworks

Prioritised vulnerability: Deficiencies in digital transformation strategies

In 2023 ECB Banking Supervision conducted a horizontal assessment and a benchmarking analysis based on the SSM-wide data collection on digital transformation and the use of financial technology (fintech). The outcome of this analysis was shared with banks and helped qualify a number of risks related to digital transformation, including strategic and execution risks, cyber risk, third-party dependency risk and money laundering and fraud risks. Targeted OSIs, which complemented the horizontal assessment, raised concerns about effective strategic steering and execution and underlined the importance of upskilling staff and management bodies. Deficiencies in budgeting and financial planning were also revealed, as banks struggle to monitor the financial impact of their digital transformation initiatives. The outcome of these activities informed the supervisory assessment of banks’ business models during the 2023 SREP cycle. Going forward, ECB Banking Supervision will continue to focus on digital transformation, combining targeted reviews with dedicated OSIs. ECB Banking Supervision will publish its supervisory expectations on banks’ digital transformation.^[23] The revised expectations will help strengthen the supervisory assessment methodology.

Main activities as part of the supervisory priorities work programme

• Targeted reviews focusing on the impact of banks’ digital transformation on their business model/strategy, governance and risk identification/management, complemented by JSTs’ follow-up with banks where material deficiencies are identified.
• Targeted OSIs on digital transformation, combining the business model dimension with the IT aspect of banks’ digital transformation strategies.
• Publication of supervisory expectations and sharing of best practices on digital transformation strategies.

Prioritised vulnerability: Deficiencies in operational resilience frameworks, namely IT outsourcing and IT security/cyber risks

Cyber risk and data security remain key drivers of banks’ operational risk. The number of cyber incidents that supervised institutions reported to ECB Banking Supervision surged in the first half of 2023, reflecting the banking sector’s significant exposure to evolving cyber threats, which was due, among other things, to Russia’s war in Ukraine and heightened geopolitical tensions. Destructive attacks have become a prominent component of the operations of state actors, with financial institutions also being a likely target given their role in critical infrastructure.^[24] Ransomware attacks in particular have been on the rise, with cybercriminals becoming more sophisticated and banks increasingly being affected by evolving extortion techniques.

Weaknesses in IT outsourcing arrangements present another key vulnerability, given banks’ increasing reliance on third-party service providers. The lengthening and increasing complexity of supply chains require banks to gain a better understanding and control of their supplier relationships and (inter-)dependencies to proactively address potential concentration risks. Sound asset and vendor management are thus key for banks to be able to meet the demands of customers and increase their efficiency in an increasingly competitive landscape, all while ensuring proper risk management of their outsourcing arrangements and adoption of cloud solutions. The outcome of the 2023 SREP assessment has further confirmed the prominence of banks’ deficiencies related to the management of IT outsourcing and IT security/cyber risks, as operational risk continues to be the element with the worst SREP scores.^[25]

Against this background, ECB Banking Supervision has established an annual collection of supervised institutions’ outsourcing registers. The analyses run so far have identified various vulnerabilities, including a high dependency on some non-European external providers and a significant number of outsourcing contracts. Proper third-party risk management, including cloud outsourcing, remains high on the supervisory agenda and will be assessed further as part of ongoing activities.

Besides the horizontal assessment of banks’ outsourcing arrangements and the analysis of concentration risk, ECB Banking Supervision will continue to carry out targeted reviews of outsourcing arrangements and cyber resilience, to gain a better insight into the nature and magnitude of the risks as well as banks’ related mitigation measures. The targeted reviews will also be complemented by OSIs in order to identify and assess deficiencies on a bank-by-bank basis. Given the surge in cyberattacks and the importance of the topic in the current geopolitical environment, ECB Banking Supervision will additionally conduct a thematic stress test on cyber resilience next year, to assess banks’ ability to respond to and recover from a successful cyberattack.^[26]

Main activities as part of the supervisory priorities work programme