SPEECH

Global rifts and financial shifts: supervising
banks in an era of geopolitical instability

Keynote speech by Claudia Buch, Chair of the Supervisory Board of
the ECB, at the eighth European Systemic Risk Board (ESRB)
annual conference on "New Frontiers in Macroprudential Policy"
Frankfurt am Main, 26 September 2024

When the ESRB first met in 2011, the global financial system was still recovering from the financial

crisis." The dark clouds of the European sovereign debt crisis were on the horizon, but the full force of
the storm had yet to break.

This was a time of institution building in Europe, of designing new microprudential and macroprudential
instruments, in a spirit of confidence that global cooperation works. The G20 Pittsburgh Summit of 2009
was emblematic of this cooperative spirit, as policymakers decided on a comprehensive reform

package to make the global financial system safer./2]
Today, the world looks very different.

On a positive note, the reforms have worked. Banks are better capitalised and have higher liquidity
buffers. We have at least a decade of macroprudential policymaking experience. In Europe, we have
significantly reformed supervision through the Single Supervisory Mechanism (SSM). Banks across
Europe are supervised according to the same standards, their performance can be benchmarked
against that of other banks, and non-performing loans have declined considerably. A new resolution
framework makes us better prepared for potential bank failures - although further progress is needed
here.

Yet the foundations of the post-war international institutional order and global cooperation are
becoming shakier.3! The rise of protectionist policies has eroded the clear commitment to

multilateralism, leading to weakened global trade agreements and cooperation frameworks. 4]
Heightened geopolitical risk is unlikely to dissipate over the nearer-term horizon. We need to prepare
for a prolonged period of sustained geopolitical tensions, marked by high uncertainty and increased
volatility.

All of this is happening at a time when memories of previous financial crises are fading rapidly. The
severe consequences of financial crises for societies and economies alike are still being felt today. But
few recall what happens when crises actually strike. The impact of recent shocks such as the pandemic
or the energy crisis has been buffered by fiscal and monetary policy. Against this backdrop, the benefits
of the existing regulatory framework are being called into question, with strict regulation and
supervision being seen by some as an obstacle to competitiveness. Progress on new regulatory
initiatives, especially in the area of non-bank financial intermediation, is slow.

How do these global rifts and financial shifts affect banks' risk management and what do they mean for
banking supervision? Today, I would like to make three main points.

First, addressing geopolitical risks requires a framework for dealing with not only "known unknowns" but
also "unknown unknowns". Through the channels of financial markets, the real economy and safety and
security, geopolitical events can affect all traditional categories of bank risk. At the same time, there is a
high degree of uncertainty about how geopolitical risk may materialise. Tools that have been developed
to analyse traditional risk drivers are often not very effective here, and various scenarios need to be
assessed. Sufficient resilience - both operational and financial - is needed to withstand unexpected
events.

Second, close cooperation between microprudential and macroprudential supervision is needed to
address geopolitical risks. Geopolitical risks can have very bank-specific, idiosyncratic effects, but they
can also be systemic. Scenario planning and sufficient resilience are needed. The micro- and
macroprudential perspectives are highly complementary, and collaboration can exploit synergies.
Macroprudential oversight can identify vulnerabilities and spillovers across the whole financial system,
while microprudential supervision has much more detailed information about individual banks and can
identify vulnerabilities that have not yet come to the surface at the aggregate level.

Third, as geopolitical risks evolve, international cooperation remains as crucial as ever. Strong, well-
capitalised banks can serve the real economy, including during periods of stress. Dialling back on Basel
Ill would therefore be harmful. It would not only weaken banks' resilience at this critical juncture, but it
would also undermine trust in global regulatory coordination. Close international cooperation is pivotal
to address the global nature of geopolitical risks and the potentially adverse consequences for banks
and non-banks.

A framework for assessing geopolitical risk

Although geopolitical risk is a common term, its precise meaning is often unclear. A broadly cited
definition of geopolitical risk is the "threat, realization, and escalation of adverse events associated with
wars, terrorism, and any tensions among states and political actors that affect the peaceful course of

international relations." This is the definition I will use here.

Characteristics of geopolitical risks

Geopolitical risks can take many forms, including outright wars, regional conflicts, terrorist attacks,
cyberattacks, trade disputes, sanctions and heightened political instability. Each of these events has
the potential to disrupt global financial markets, economic activity and policy coordination. Risks can be
slow-burning, with the related impact materialising only gradually over time, or fast-burning if shocks
occur unexpectedly. They are often difficult to predict and assess ex ante. Geopolitical risk and other
novel risks are interconnected. The materialisation of physical, climate-related risk, for instance, can
trigger disruptions in trade or migration, which in turn can exacerbate geopolitical risk. And rising
geopolitical tensions can affect energy security, which in turn can affect the political roadmap to
address climate and environmental risks.

Geopolitical risks differ from traditional risk drivers, and as such do not lend themselves to traditional
computations of risk (Table 1). They are less predictable. They are highly uncertain, in both their

probability of materialising and their impact. And they originate outside the financial system. Traditional

risk drivers can be analysed using historical data, statistical models and relatively easily available

economic indicators. In contrast, geopolitical risks arise from political events, shifts in international

relations or societal changes, which are not subject to as much quantitative analysis. Policy reversals,

political tensions and outright conflicts are influenced by a multitude of human behaviours and external

circumstances, making them less suited to traditional risk assessment methods. A sudden political

upheaval or an unexpected diplomatic breakdown can have immediate and far-reaching consequences

that are difficult to foresee.

Table 1: Characteristics of geopolitical and traditional risk drivers

Characteristic

Geopolitical risk drivers

Traditional risk drivers

Predictability

Interdependencies

Quantification

Ambiguity

Range of
outcomes

Low. Geopolitical events can emerge
unexpectedly and escalate rapidly.

High. Involves complex, interconnected
relationships between political events,
economic impacts and the financial
system across countries, regions and
institutions.

Difficult. Cannot be easily quantified or
modelled probabilistically due to inherent
uncertainty.

High. Characterised by a lack of clear
information leading to challenges in
defining responses.

High. Potential scenarios are diverse
and can vary significantly.

Higher. Economic cycles and
market trends can be better
modelled with historical data.

Lower. Generally more
contained within financial
systems and less influenced
by non-economic events.

Easier. Can often be
quantified using historical
data and probabilistic models
(e.g. credit scores, value at
risk (VaR)).

Lower. More data-driven with
clearer information available
for decision-making.

Lower. Outcomes are
generally more predictable
within a certain range based
on historical patterns.

Still, geopolitical risks have an impact on banks' operating environment and risk profiles. While

geopolitical risk drivers are external to the financial system, they can affect financial stability, especially

if they interact with pre-existing vulnerabilities. This is why microprudential supervision is required in
order to strengthen individual banks. At the same time, broader risks to financial stability can arise if
shocks are amplified through pre-existing vulnerabilities in the financial system, leading to strong

contagion.!& And this is why macroprudential policy has an important role to play in shielding the
financial system from geopolitical shocks.

In short, geopolitical events are characterised by a high degree of uncertainty - "radical" uncertainty -
and therefore require different analytical tools and preventive measures. If probabilities cannot be
assigned to specific outcomes, traditional models for pricing risks might fail. This, in turn, can lead to an
abrupt re-pricing of risks if adverse events actually materialise. Financial data do not adequately signal
heightened levels of political uncertainty (Chart 1).

Chart 1: Measures of uncertainty in the euro area

Standard deviation from mean; monthly data, July 2007-June 2024

Forecast disagreement

Political uncertainty

-- Macroeconomic uncertainty (right-hand scale)

-2
2007 2009 2011 2013 2015 2017 2019 2021 2023

Sources: Consensus, Eurostat, Haver analytics, Economic Policy Uncertainty and ECB staff calculations.
Notes: Standard deviation from mean; monthly data, July 2007-June 2024. Macroeconomic uncertainty is a
measure of conditional volatility of forecast errors. A value of 2 means that uncertainty is equal to two standard
deviations. Forecast disagreement and political uncertainty are standardised series. A value of 2 means that such
a measure exceeds its historical average level by two standard deviations. The latest observations are for June
2024.

Transmission channels

Geopolitical risk affects traditional risk categories through a variety of transmission channels. Credit,
market, operational, liquidity and funding risks - all of these risks are potentially affected (Table 2).
Within European banking supervision, we have therefore developed a classification of geopolitical risks
and three primary pathways: the financial markets channel, the real economy channel and the safety
and security channel.

Table 2: Transmission channels of geopolitical tensions to macrofinancial environment
and banks

'ial environment and banks

+ >
s Financial market channel Real economy channel Safety and security channel
& + Trade and supply chain disruptions 'cal ri ,
= ; ; 3 J + Physical risk related to conflict/unrest
g Uncertainty and investor risk aversion <- I Commodity market disruptions _ +- I. Cybersecurity and fake-news threats
§ + Economic uncertainty (expectations)
g
3
4 t t
8 v I
a Public policy reactions
E Protectionist measures Fiscal and monetary policies International/other policies
£ - I- Cross-border capital flows and payment restrictions + Monetary policy interventions (divergence) + Shifts in foreign policy
% + Financial sanctions and trade restrictions: tariffs, quotas + Changes in fiscal and distribution policies + Decoupling in international relations
3 'Asset repricing (commodities, stocks, bonds) . + Materialisation of physical (damage to assets,
a 5 5 5
5 Flight to safety; reversal of international capital Dowreee ae & global growth outlook and military actions), operational (e.g. to businesses),
$ g flows ee eee 65 ea cybersecurity and disinformation risks
ge Widening of sovereign spreads ETS TR cS RCT oe + Institutional fragility and socio-economic
3 Disruptions to cross-border payments (systems) Us OCEMCUSETTELS [yy enneanS challenges
RM recit ik Liguidty & funding isk J Mart risk SISTESeOuETER Operational ik
g Direct and indirect
3 credit risk to high isk + Valuation losses: business incudng se
& countries and + Intraday liquidity risk: Ez concentrations 9
a Q, Fl, FX, COM + Physical exposures to incl. management
£3 vulnerable sectors - margin calls, draws on ees CoRR
= concentration, default credit lines Effi + Asset 4 i
ge ° + Efficiency of + Weak IT security/controls high-risk countries
25 and migration risk 5 freezes/seizures
BE + Funding hedging strategies + Outsourcing
ss . - i a l<>I «Bank licence concentrations <> I + Reputational risks
83 Gauri) eect enerclraors + Concentration and Bank tenes + Compliance risks; MLITF
g epee ST UME Es) correlation risk risks + Weaknesses in
5 commodity traders / costs - internal control
- NBFls + Step-in risks + Technological capability
limitations functions

An

Through the financial markets channel, geopolitical shocks can lead to heightened uncertainty and risk
aversion among investors. This can trigger fluctuations in asset prices, disruptions in global capital
flows and increased market volatility. Banks are affected through an erosion of the value of their asset
portfolios, making it more difficult to raise capital or secure funding, thereby increasing market and
funding risks.

Economic history provides ample evidence of how pre-existing vulnerabilities and political shocks can
reinforce each other and lead to disruptive market developments. The end of the Bretton Woods
system in the early 1970s, the emerging market debt crisis of the 1980s and the crises in Asia and
Russia in the late 1990s were all distinct in nature. At the same time, they also bear testament to the
ways in which geopolitical events can disrupt the pricing of risks on financial markets. Such crises are
often driven by the interplay of economic fragility and political shocks, which can exacerbate market

volatility and the mispricing of risk (Chart 2).!8]

Chart 2: Types of crises: world aggregate

mm BCD! index (excl. stock market crashes)
mmm BCDI index + stock market crashes

200

180

Great Depression,
WWILmore defaults

is fale 4 4
- t 4 i Second Great
" Hi rm) Contraction
\ it iN
140 1 1! F
} q
120 ! i
i
i!
q rT]
4 4 q Oil shock-inflation it
100 +
iy y I 4 4 HH
\ ThA ] Noa it
1 Ww Hh AN 4 an ii
80 Panic of 1907 4 "i ' 1 rm 1 i it
4 \ ' D i H \
1! ! 4
+0 1 1 A hy
i 1 ' y OH)
i' i ' ¢ yyity p
r 1! D 7A Me
40 u a1
a y D) VA :
, i 4

-

20

Emerging market crises and
Nordic and Japanese banking crises

0
1900 1905 1910 1915 1920 1925 1930 1935 1940 1945 1950 1955 1960 1965 1970 1975 1980 1985 1990 1995 2000 2005 2010

Source: Reinhart, C. M. and Rogoff, K.S. (2009), This Time Is Different: Eight Centuries of Financial Folly,
Princeton University Press.

Note: This is a composite index of banking, currency, sovereign default and inflation crises and stock market
crashes.

The real economy channel captures how geopolitical events disrupt trade flows and supply chains.
These disruptions can lead to inflationary pressures, alter corporate and consumer behaviour and
weaken the economic conditions that underpin banks' credit portfolios. Credit risks become elevated,
leading to higher default rates, increased provisioning for loan losses and pressure on banks' capital
positions. Corporates take counterbalancing measures to de-risk global activities by shortening and
diversifying supply chains. But such measures have costs in terms of both time and money, and risks

might remain elevated in the meantime.

Geopolitical shocks can have very different implications across sectors, which are not well captured by
aggregate patterns of GDP. Changes in energy costs, which are often triggered by geopolitical
tensions, can have a negative impact on energy-intensive industries. The oil crisis of the early 1970s
and the energy price shock following the Russia's invasion of Ukraine both put significant pressure on
energy-intensive firms and led to significant corporate restructuring. Moreover, looking beyond energy-
intensive sectors, industries that are sensitive to value chain disruptions and reliant on well-functioning

transport networks are vulnerable to geopolitical shocks.

The safety and security channel impairs banks' operations. Conflict and unrest can directly affect
banks' operations, as can successful cyberattacks. Banks could face operational risks from damage to

their physical infrastructure or the infrastructure of critical third-party service providers, service
interruptions and cyberattacks.

Two key trends exacerbate this risk: digitalisation and the growing threat from malicious actors
targeting financial institutions. Many banks are heavily reliant on digital supply chains involving third-
party apps and cloud-based services. This leaves the banks vulnerable to cyber threats. Cyberattacks
might also target critical infrastructure such as power grids or payment systems, resulting in wider
instability and affecting economic activity. Although not linked to a cyberattack, the Crowdstrike global
IT outage in July 2024, which affected air traffic, payments and IT systems worldwide, showed how
interconnected systems can lead to cascading failures, amplifying disruption across multiple sectors.
Incidents of this kind underline the importance of building resilience against cyberattacks and IT
failures.

Geopolitical shocks trigger policy responses, which can in turn affect banks. These responses could
take the form of economic and financial sanctions, trade barriers or shifts in fiscal and monetary
policies. International financial sanctions, for instance, can lead to asset freezes, increased compliance
costs, financial losses and wider reputational damage. Banks then face greater compliance and
operational risks as a result. The failures of banks with connections to Russia in 2022 are prime
examples of how international sanctions and reputational risk can translate into acute liquidity risk,
counterparty risk and operational failure.

Adverse geopolitical events have broad implications across the financial system. Banks with
international exposures or those operating in the region in question are directly affected. But banks
without direct exposures may be equally vulnerable, perhaps without being completely aware.
Networks of counterparty exposures are complex and opaque, and reliance on critical infrastructure
and third-party providers can spread contagion risks to all parts of the financial system. While some
risks may be felt more acutely by individual banks with specific exposures or operational footprints,
other risks can be systemic, affecting the stability of the financial system as a whole.

Banks therefore need to assess how geopolitical risks can affect their business. They need to address
these risks and build resilience, both financially and operationally.

However, individual banks may have neither the incentives nor the means to carefully monitor
geopolitical tail risks. Due to the inherent uncertainty, geopolitical risks are often not priced on financial
markets until they materialise. As a result, banks' standard risk models do not reflect these risks either.
Monitoring geopolitical risks and the channels through which individual banks are affected - in many
cases only through their counterparties - is costly. And geopolitical risks may be building up slowly over
time, with their full impact potentially only materialising beyond the time horizon used in banks' medium-
term capital planning.

This is why supervision has a strong role to play. Good supervision can promote a better understanding
of the channels through which geopolitical risk affects the traditional risk categories. Supervisory
measures can address weaknesses in banks' risk management and stress testing so that banks take
mitigating measures. As we see strategies across different banks, we can identify and share good
practices. Building on the framework for assessing geopolitical risk that I have set out, I will now
explore the complementary roles of microprudential and macroprudential policies in assessing
geopolitical risks and taking preventive measures.

Microprudential and macroprudential policy as complementary
approaches to addressing geopolitical risks

Much like a forest, the financial system is a complex ecosystem. Both the individual components and
the system as a whole need to be resilient to shocks.

Microprudential supervision is about the resilience of individual banks - the trees in the forest. It aims to
protect depositors and other creditors by mitigating bank-specific risks. These risks are intrinsic to the
institutions, and they are shaped by the markets in which the banks operate as well as the broader
macroeconomic environment.

In addressing geopolitical risks, resilience is important to cushion unforeseen shocks. Sufficient capital
and liquidity buffers ensure that shocks can be absorbed without recourse to external sources.
Microprudential capital requirements ensure that banks can absorb unexpected losses not captured by
accounting provisions. In addition, banks need to have capital buffers which they can draw down in
times of stress, without breaching their minimum requirements. Stress tests are the starting point for
bank-specific recommendations - known as Pillar 2 guidance - in which we set our expectations for
how much capital banks should maintain over and above their minimum requirements and their
regulatory buffers. Stress tests ensure that banks would not dip into their minimum requirements even
in severe adverse scenarios and they incentivise banks to bolster their own internal stress testing. But
financial resilience alone is not enough. Banks also need sufficient operational resilience. They need to
have proper risk management systems in place to consider the broader consequences of possible fast-
moving changes in the external environment.

Macroprudential oversight, meanwhile, focuses on the whole system - the forest rather than the trees.
It is a crucial complement to the work of microprudential supervisors. Its ultimate objective is to
safeguard the stability of the financial system by strengthening resilience and preventing the build-up of

systemic risks. This ensures a sustainable contribution of the financial sector to economic growth./2]
Systemic risks are often endogenous to the financial system and can be cyclical or structural.

Addressing radical uncertainty requires close feedback loops from the micro- to the macro-level. In this
sense, microprudential and macroprudential supervision complement each other. Individual banks can
fail if systemic events cause turmoil that impairs financial stability. And weak individual banks can affect
systemic stability through their mere size or through their connectedness to other institutions.

Macroprudential policy can address geopolitical risks by strengthening resilience at the system-wide
level. This includes resilience to unforeseen events - the "known unknowns". One helpful innovation in
this respect is the recent adoption of positive neutral rates for the countercyclical capital buffer (CCyB).

Generally, the CCyB protects the banking sector against endogenous financial risk. Periods of excess
aggregate credit growth can leave banks vulnerable to sharp reversals in asset prices and
macroeconomic conditions. The CCyB ensures that, when the cycle turns, authorities can release
buffers, freeing up capital and alleviating fears that banks may cut back on lending to avoid dipping

below regulatory thresholds or defying market expectations.19 This allows banks to maintain the flow
of credit even in times of stress.

Setting a positive neutral rate for the CCyB makes it possible to take uncertainty into account. It is
important to raise buffers when standard risk metrics see cyclical risks as neither subdued nor

elevated. This hedges against the inherent uncertainty in predicting the financial cycle and guards

against the risk of raising buffers too late] In addition, releasable system-wide buffers will also be in
place in the event of unexpected shocks arising outside the financial system, such as pandemics and
geopolitical shocks, that can severely disrupt macroeconomic and financial conditions. At the beginning
of the pandemic, for example, limited macroprudential buffer space restricted the flexibility of
policymakers to respond. This highlights the importance of proactive measures in buffer-building during
more stable times.

In addition to cyclical risks, strong buffers are needed to address negative externalities related to size
and connectedness. The buffers for "global" and domestic ("other") systemically important institutions
("G-SII and "O-SII" buffers) vary from bank to bank, depending on the bank's individual characteristics.
At the current juncture, where geopolitical risk events can have strong amplification effects across the
financial system, they offer effective protection against risks that may undermine financial stability.

Supervisory responses to geopolitical risks

Strengthening resilience to geopolitical shocks is a key priority for ECB Banking Supervision.12] We
follow a three-pronged approach by identifying transmission channels, mapping risks into supervisory
initiatives, and identifying gaps. Our focus is on governance and risk management, capital and liquidity
planning, credit risk and operational resilience, as well as the assessment of country-specific
vulnerabilities.

Governance and risk management

Geopolitical risks differ from traditional risks and require strong governance structures. Management
bodies cannot rely on traditional, quantifiable risk indicators to "measure" geopolitical risks. Assessing
these risks is not a simple forecasting exercise - it requires judgement, experience and the
combination of qualitative and quantitative information. Structured frameworks need to be developed to
analyse different scenarios and to apply sound judgement. These tasks cannot be delegated. Adequate
risk management requires strong CEOs and boards to minimise the adverse effects of economic and

geopolitical uncertainty on banks. 13]

Hence, governance structures within banks need to address the highly uncertain nature of geopolitical
risk. The ECB is currently reviewing risk management processes and frameworks. In July this year, we

issued a new ECB Guide on banks' governance and risk culture for consultation."4] Banks are
expected to have a robust risk culture, one that adapts to the changing geopolitical landscape and
integrates uncertainties into a holistic risk management strategy. Strategic decision-making can be
influenced by geopolitical events, requiring management bodies to align business objectives and risk
tolerance frameworks.

All banks, not just those that are active globally, need to be vigilant. They need to integrate geopolitical
considerations into their risk management practices, ensuring they are prepared for any challenges that
such risks may pose. Smaller, more locally active banks need to consider their exposure to critical
infrastructures and third-party providers. The framework that has been developed within the SSM can

serve as a useful reference point in this regard, and it will be used in our supervisory process to identify
vulnerabilities and address them through specific supervisory action.

Capital and liquidity planning
Banks' capital and liquidity planning need to account for geopolitical risk events. The ECB is
scrutinising the tools that banks are using for the planning process - the internal capital adequacy

assessment process (ICAAP) and the internal liquidity adequacy assessment processes (ILAAP).!5]
This includes a careful examination of banks' recovery plans and internal stress testing frameworks to
ascertain their readiness to confront shocks that could stem from geopolitical threats. Across these
measures, we will increasingly focus on evaluating to what extent banks are sufficiently incorporating
geopolitical factors into their risk management.

Credit risk

Adverse geopolitical events can increase credit risks through the real economy channel. Strong
underwriting practices are critical in ensuring that lending terms, in particular loan pricing, capture
relevant risks. In addition, we have asked banks how they account for novel risks, including geopolitical
risk, and higher default rates in their loan loss provisioning. Adequate provisioning for novel risks,
including geopolitical risks, is essential for maintaining prudential capital ratios and acting as a
safeguard in case these risks materialise. Yet, banks may lack the necessary historical data needed to
apply classic expected loss provisioning models.

Banks have thus increasingly turned to overlays to provision against potential loan losses. Overlays are
adjustments made outside of traditional credit risk modelling frameworks and they gained prominence
during the COVID-19 pandemic. As supervisors, we encourage the use of overlays, but they should be
based on sound methodologies and governance, such as simulations and scenario analysis, and
should not be used at the expense of improving the regular expected credit loss models.

While most banks now consider novel risks in their provisioning practices, some still ignore them. This
was clear in a thematic review on how banks' IFRS 9 provisioning frameworks capture emerging risks.

[16] Some banks rely primarily on their legacy macro-overlay models to capture novel risks, which
restricts the impact of novel risks to their aggregate impact on future GDP. This approach tends to
underestimate the true impact of novel risks on expected losses across different sectors. As a result,
the ECB will take further supervisory action on both sets of banks: those that ignore the risks altogether
and those that rely on outdated models.

In addition, stress testing remains a cornerstone of European banking supervision's prudential
oversight, with scenarios capturing effects of geopolitical tensions. The adverse scenario of the 2023

stress test assumed a partial deglobalisation of the world economy and increased fragmentation.14
This would lead to higher inflation, lower growth and higher volatility. Banks reacted to this scenario by
projecting higher default rates, riskier credit parameters and, ultimately, higher provisions on exposures
to sectors and regions more vulnerable to geopolitical risk.

The results of last year's stress test shows that if European banks were exposed to three years of

stress under challenging macroeconomic conditions, they would have sufficient capital buffers to
absorb losses. The Common Equity Tier 1 (CET1) capital ratio of the 98 stress-tested banks would fall

by an average of 4.8 percentage points to 10.4%."8] Credit and market risk as well as lower income
generation drove the negative capital impact in the adverse scenario. Loan losses generated 4.5
percentage points of CET1 ratio depletion, with unsecured retail portfolios being the most vulnerable.

However, any stress test has limitations when it comes to capturing the complex effects of geopolitical
risk events. European significant institutions are exposed, for example, to counterparty credit risk
arising via non-bank financial institutions which, in turn, are highly sensitive to geopolitical risks via
hidden leverage or crowded trades. This is an area of growing concern, as instability can quickly affect
the creditworthiness of a bank's counterparties, potentially leading to a cascade of financial distress.
The failure of Archegos in 2021 and the 2022 liability-driven investments turmoil in the United Kingdom
are a testament to this. In addition to the 2025 EU-wide stress test, European banking supervision will
therefore conduct an exploratory counterparty credit risk scenario analysis.

Operational resilience and cyber risks

Operational resilience is another area where we incorporate geopolitical risk factors into supervisory
work since geopolitical upheaval can generate cyber threats and disrupt outsourced services. That's
why European banking supervision is conducting targeted reviews aimed at strengthening the sector's
cyber defences and scrutinising outsourcing arrangements. This is critical as operational disruptions in
one area can quickly spread through the entire network.

This year, the ECB conducted its first cyber resilience stress test."] The exercise assessed how banks
respond to and recover from a cyberattack, as opposed to looking at their ability to prevent it. Under the
stress test scenario, a cyberattack successfully disrupted banks' daily business operat