ECB Banking Supervision – Supervisory priorities for 2022-2024 (2024)

Supervised institutions have remained resilient over the last year, although the risk landscape of the European banking sector continues to be shaped by the impact of the coronavirus (COVID-19) pandemic. Supervised institutions have been able to withstand the adverse economic shock induced by the outbreak of the pandemic. They have remained, overall, well capitalised^[1] and capable of helping households, small and medium-sized enterprises and corporates to cope with the challenges posed by the global health crisis. The improvement in macroeconomic conditions compared with the situation last year^[2] has reduced some of the risks to the banking sector, but the economic outlook remains uncertain, sensitive to the evolution of the pandemic and more recent supply chain bottlenecks. Against this background, and while the extraordinary support measures have helped prevent a surge in bankruptcies and non-performing loans (NPLs), the quality of banks’ assets remains an area of concern as the full impact of the pandemic may only materialise in the medium term, after the bulk of the public emergency support has been withdrawn. Moreover, the combination of historically low real yields and elevated valuations raise concerns about a potential repricing of risk in the financial markets which, if it materialises, may also impair banks’ overall resilience. In addition, a number of structural vulnerabilities, including related to the sustainability of banks’ business models and internal governance, have been exacerbated by the crisis and require effective and timely action by banks and supervisors. Finally, supervisors also need to proactively mitigate emerging and evolving risks, for example in the area of climate-related and environmental risk.

Against this background, ECB Banking Supervision, in cooperation with the national competent authorities, has performed a thorough assessment of the main risks and vulnerabilities faced by the significant institutions under its direct supervision and has set its strategic priorities for the next three years accordingly. The three priorities identified for 2022-2024 aim to ensure that banks (1) emerge from the pandemic healthy, (2) seize the opportunity to address structural weaknesses via effective digitalisation strategies and enhanced governance, and (3) tackle emerging risks, including climate-related and environmental risks, IT and cyber risks (see Figure 1). For each priority, ECB Banking Supervision has developed a set of strategic objectives and underlying work programmes, spanning the next three years, which aim to address the most material vulnerabilities identified during this year’s risks and priorities exercise (see Section 2.2 for further details).

Figure 1

Supervisory priorities for 2022-2024 addressing identified vulnerabilities in banks

The risk-identification and priority-setting process (also referred to as the “risks and priorities exercise”) is a central mechanism for developing and formulating ECB Banking Supervision’s strategy for the next three years. It supports the SSM-wide effort to prioritise and coordinate supervisory activities over a medium-term time horizon. The supervisory priorities provide guidance to the Joint Supervisory Teams (JSTs) in order to promote both effectiveness and consistency in supervisory planning for the significant institutions the ECB directly supervises. They also provide important input for the Supervisory Review and Evaluation Process (SREP), bearing in mind that vulnerabilities and challenges may differ from bank to bank. In addition, the supervisory priorities help national supervisors to set their own priorities for the supervision of less significant institutions in a proportionate way. Transparent communication on the priorities also clarifies the supervisory expectations banks must meet, enhances the supervisory impact on the banking sector, and helps ensure that there is a level playing field. The supervisory priorities cover three years, a time span which makes it possible to achieve good progress in addressing the relevant vulnerabilities. ECB Banking Supervision constantly monitors and assesses both the way the risks and vulnerabilities of the supervised institutions evolve and how much progress is being made in implementing the selected priorities. While the strategic priorities are reviewed on a yearly basis, this ongoing monitoring enables ECB Banking Supervision to flexibly adjust its priorities and corresponding activities at short notice when needed.

The next sections provide more details on the outcome of the 2022-2024 risks and vulnerabilities assessment, the corresponding priorities and the underlying work programmes targeting the significant institutions directly supervised by the ECB. Other regular supervisory activities, not explicitly mentioned in this document, will also be carried out in parallel and complement the work on the priorities.

2.1 Operating environment for supervised institutions

The economic outlook has improved since last year but uncertainties remain, owing to the economy’s dependence on the evolution of the pandemic and the persistence of supply chain bottlenecks. The euro area economy is projected to recover to its pre-pandemic GDP levels as early as end-2021, largely as a result of the robust recovery in domestic and external demand, which has been driven by the relaxation of containment measures, increases in vaccination rates and supportive fiscal and monetary policies.^[3] A potential resurgence of the pandemic due to more infectious virus variants and a reduced efficacy of vaccines, necessitating the re-introduction of containment measures, might lead to more economic scarring and slow down the pace of the recovery. In addition, more persistent than expected supply shortages are also a potential downside risk to the economic outlook.^[4]

The substantial increase in debt levels in various segments of the economy might translate into higher solvency risks, particularly in economic sectors and/or countries that have been more heavily impacted by the pandemic. The euro area public debt-to-GDP ratio has surged further since the last assessment, raising concerns around what would happen if there were a sudden rise in interest rates.^[5] Private debt-to-GDP ratios have also increased significantly during the same period, which in turn might challenge the debt-servicing capacity of highly indebted corporates and households. The broad-based rebound in economic activity has contributed to the improvement of the outlook for the corporate sector, where profits are recovering. However, solvency risk might increase once the support measures are withdrawn, particularly in the sectors of economic activity that were hit hardest by the pandemic. The commercial real estate (CRE) sector has been particularly impacted in this regard, recording a large decline in transaction numbers and prices. On the other hand, the continued rise in residential real estate (RRE) prices and robust mortgage lending have added to the increase in households’ indebtedness and estimated overvaluation of RRE prices, contributing to the build-up of vulnerabilities going forward.^[6]

The improved global economic outlook and supportive financing conditions have further reduced market volatility, although buoyant financial asset price developments and the continued search for yield raise overvaluation concerns. Elevated valuations in some market segments, in combination with remaining underlying vulnerabilities and uncertainty, leave markets exposed to corrections and disorderly deleveraging.^[7] The high-yield bond segment seems particularly vulnerable to a sharp repricing should investors’ expectations about the growth outlook change abruptly or interest rates increase suddenly.

2.2 Risks and Priorities 2022-2024

ECB Banking Supervision has defined its supervisory priorities by drawing on an assessment of the main risks and vulnerabilities to the European banking sector. The three priorities for the 2022-2024 period are all equally important. They aim to ensure that banks (1) emerge from the pandemic healthy, (2) seize this opportunity to address structural weaknesses via effective digitalisation strategies and enhanced governance, and (3) tackle emerging risks. Each priority is associated with a set of strategic objectives and underlying high-level work programmes that aim to address the key vulnerabilities identified as part of this year’s risks and priorities exercise. The next sections provide more details on the outcome of this risk assessment and outline the supervisory activities planned to address these targeted vulnerabilities.

Priority 1: Banks emerge from the pandemic healthy

Addressing the adverse impacts of the COVID-19 pandemic and ensuring that the banking sector stays resilient is a crucial objective for supervisors. Possible asset quality deterioration, linked to the progressive withdrawal of governmental and monetary policy support, and potential corrections in financial market valuations call for supervisory attention to address the short to medium-term challenges for banks.

Key vulnerability: Deficiencies in credit risk management frameworks

Strategic objective: Supervised institutions should improve their credit risk management practices, especially with regards to the timely identification, forward-looking measurement and mitigation of credit risks.

One of the unique features of the COVID-19 crisis is that, amid an enormous drop in economic output, NPLs have continued to fall, thanks to the exceptional policy measures taken to support the real economy. These unprecedented actions have also blurred borrowers’ creditworthiness and challenged banks’ ability to accurately and proactively manage credit risk. Despite the initiatives undertaken over the past few months to assess and challenge banks’ preparedness to cope with increasing asset quality deterioration, it was found in the follow-up to the “Dear CEO letter” initiative^[8] that material deficiencies still persist in the credit risk management frameworks of several banks. The main areas of concern are related to the identification and classification of distressed borrowers, collateral valuation and adequacy of provisioning practices. While such deficiencies might hinder banks’ resilience to potential future downturns, some banks have already started releasing precautionary provisions. Against this background, ECB Banking Supervision will proactively engage with banks that have reported material deficiencies in one or several of the areas covered by this initiative and, where relevant, conduct targeted reviews, on-site inspections and internal model investigations. Supervisors will also review and challenge banks’ implementation of the European Banking Authority’s guidelines on loan origination and monitoring^[9], with a particular focus on real estate portfolios.

Key planned supervisory activities:

• Follow-up by JSTs on credit risk management deficiencies identified during the “Dear CEO letter” exercise, and targeted on-site inspections^[10]
• Targeted reviews in the area of credit risk identification, monitoring and assessment, as well as the relevant dimensions of the IFRS 9 provisioning framework
• Follow-up by JSTs with affected banks, and targeted internal model investigations into model changes related to the implementation of the EBA IRB repair programme or triggered by the impact of the pandemic

Key vulnerability: Exposures to COVID-19 vulnerable sectors, including commercial real estate

Strategic objective: Strengthen supervisory focus on supervised institutions’ exposures towards COVID-19 vulnerable sectors, including commercial real estate.

Highly indebted companies in economic sectors more sensitive to the impact of the pandemic remain particularly vulnerable to the phasing out of support measures. While the progressive economic recovery, positive outlook and longer duration of some support measures, such as guarantees granted by public sector entities, reduce the risk of a spike in corporate defaults, banks’ exposures to vulnerable companies remain susceptible to potential asset quality deterioration and need to be adequately monitored and managed accordingly. This is especially relevant for banks’ exposures to the CRE market, which witnessed a downturn following a demand shift triggered by the pandemic. ECB Banking Supervision will therefore strengthen its scrutiny of banks’ exposures towards COVID-19 vulnerable corporates and will carry out targeted reviews and on-site inspections to benchmark and challenge banks’ management of CRE exposures, including collateral valuation practices.

Key planned supervisory activities:

• Regular monitoring of banks’ exposures towards vulnerable sectors
• Targeted reviews and on-site inspections of banks’ exposures to CRE

Key vulnerability: Exposures to leveraged finance

Strategic objective: Prevent the build-up of unmitigated risks in the area of leveraged finance and foster banks’ adherence to the supervisory expectations laid down in the related ECB Guidance.^[11]

The search for yield in an environment characterised by a sustained low interest rate scenario, abundant liquidity and massive support measures has contributed to the further build-up of risks in the leveraged loans market. Global and European leveraged issuances have continued to increase, and the expansion has been accompanied by a loosening of the corresponding lending standards. Against the background of the increasing risk appetite for riskier leveraged transactions reported by some large supervised banks, ECB Banking Supervision will further reinforce its efforts to prevent the build-up of unmitigated risks in this segment. Supervisors’ activities will include targeted on-site inspections aimed at ensuring that banks strengthen their risk management of leveraged loans. The inspections will take particular account of underwriting standards, management of syndication risk, risk appetite and capital requirements. Banks are also expected to adhere to the supervisory expectations laid down in the ECB Guidance on leveraged transactions.

Key planned supervisory activities:

• JSTs continue to assess leveraged finance risks and follow up on significant institutions’ efforts to implement the supervisory expectations outlined in the related ECB Guidance
• Targeted on-site inspections

Key vulnerability: Sensitivities to shocks in interest rates and credit spreads

Strategic objective: Supervised institutions should have sound arrangements in place to manage the impact of medium-term interest rate and credit spread shocks and adjust their risk assessment, mitigation and monitoring frameworks whenever the need arises.^[12]

The low interest rate environment, extraordinary fiscal and monetary policy support measures and the search for yield have led to stretched valuations in several financial market segments, sometimes disconnected from economic fundamentals. This situation might exacerbate the likelihood of a repricing risk in government and corporate bonds or equity markets. It is a source of concern for supervisors, especially considering banks’ material sensitivities towards some of the corresponding risk factors, especially interest rates and credit spreads. Although it is difficult to predict the events that could trigger a fundamental repricing in the markets, it remains essential from a supervisory standpoint to make sure that supervised institutions are prepared to cope with such corrections and in particular with potential medium-term interest rate and credit spread shocks. Banks should have in place sound risk management frameworks addressing the assessment, mitigation and monitoring of such risks and take timely remedial actions whenever deficiencies are identified. Through regular JST engagement, targeted reviews and on-site inspections, from next year onwards ECB Banking Supervision will strengthen its focus on making sure banks are adequately prepared to withstand such market shocks.

Key planned supervisory activities:

• Targeted review of banks’ interest rate and credit spread assessment, monitoring and management, in both trading and banking books
• Follow-up by JSTs on banks’ remedial action plans whenever material deficiencies are identified, and targeted on-site inspections

Priority 2: Structural weaknesses are addressed via effective digitalisation strategies and enhanced governance

To support the resilience and sustainability of banks’ business models, supervisors will take focused initiatives to encourage banks to address persisting deficiencies both in the area of digital transformation and in the steering capabilities of their management bodies.

Key vulnerability: Deficiencies in banks’ digital transformation strategies

Strategic objective: Supervised institutions should embrace sound digital transformation and have adequate arrangements in place to make their business models sustainable in the long term.

Supervised institutions have accelerated their adoption of technologies to overcome the challenges posed by the pandemic and respond to changes in customer preferences. This also enables them to keep pace with the development of new technologies applied to the financial sector and rising competition stemming from digital natives like FinTech and BigTech. Moreover, low profitability has been a long-lasting feature of significant institutions. Among other factors, it is deeply rooted in structural vulnerabilities related to excess capacity and cost inefficiencies. The digital transformation process could also be a lever to improve efficiency and offer new avenues for revenue growth. Against this backdrop, supervisors will intensify their efforts to benchmark and assess banks’ digitalisation strategies to make sure they have adequate arrangements in place (e.g. governance, resources, skills, risk management etc.) to make them sustainable in the long term. To achieve this objective, JSTs will carry out targeted on-site inspections and specific follow-ups with banks that report material deficiencies in this area.

Key planned supervisory activities:

• Survey on banks’ digitalisation strategies
• Benchmarking analysis and JST follow-up with banks where material deficiencies in their digital transformation strategies are identified
• Targeted on-site inspections in areas where the main deficiencies are identified

Key vulnerability: Deficiencies in management bodies’ steering capabilities

Strategic objective: Supervised institutions should address deficiencies in management bodies’ functioning and composition.

Sound governance arrangements, robust internal controls and reliable data are essential to fostering adequate decision-making and mitigating excessive risk-taking both in normal and crisis times. Despite the progress achieved by banks over the past few years, supervisors keep reporting a high number of findings pointing towards structural deficiencies in internal control functions, management bodies’ functioning or risk data aggregation and reporting capabilities. The difficulties banks have in remedying these shortcomings in a timely way raise legitimate concerns about the effectiveness of their boards and their strategic steering capabilities. In order to address the risks and challenges stemming from a constantly evolving banking landscape, banks need effective and timely remedial action plans to address outstanding supervisory findings and strengthen the effectiveness of their boards. Against this background, ECB Banking Supervision will carry out supervisory activities to achieve progress in this area, tackling in particular the functioning and oversight and challenging capacity of management bodies. In addition, ECB Banking Supervision will focus on management bodies’ collective suitability and diversity, which are key drivers of their effectiveness. The planned supervisory activities will include data collection, targeted reviews of banks with deficiencies in the composition and functioning of their management bodies, on-site inspections, and targeted risk-based fit and proper (re)assessments.

Key planned supervisory activities:

• Targeted reviews of banks’ management bodies’ effectiveness and targeted on-site inspections
• Development and implementation of a policy on diversity and a risk-based approach to fit and proper assessments

Priority 3: Emerging risks are tackled

Banks are being challenged by a number of emerging and evolving risks that can materialise both in the short and longer term, and it is essential for ECB Banking Supervision to monitor the situation and design and calibrate its supervisory response adequately. Banking supervisors will therefore aim to ensure that vulnerabilities related to three emerging themes are tackled: climate-related and environmental risk, increasing counterparty credit risk towards riskier and less transparent non-bank financial institutions, and operational and IT resilience.

Key vulnerability: Exposure to climate-related and environmental risks

Strategic objective: Supervised institutions should proactively incorporate climate-related and environmental risks into their business strategies and their governance and risk management frameworks, in order to mitigate and disclose such risks and comply with the corresponding regulatory requirements.

Addressing risks stemming from climate change and environmental degradation will without a doubt be one of the main challenges for banks and supervisors in the years to come. The transition towards a low-carbon economy poses significant risks to banks via a set of transmission channels, for example through exposures to firms with high carbon emissions. Furthermore, a substantial share of banks’ exposures are towards firms located in areas that are already highly exposed or increasingly exposed to physical hazards.^[13] Recent ECB assessment shows that banks have made some progress in adapting their practices, but at still too slow a pace.^[14] For this reason, it is crucial that banks develop a mitigation strategy to soften the long-term impacts of climate-related and environmental risks and adjust their business strategy, governance and risk management frameworks to adequately incorporate these risks.^[15] Next year ECB Banking Supervision will therefore carry out a climate stress test, considered to be a learning exercise for both banks and supervisors,^[16] and a thematic review to assess banks’ progress towards achieving this objective.^[17] Supervisors will also conduct on-site inspections, engage with institutions with material deficiencies in their management of climate-related and environmental risk to ensure they implement sound remedial action plans in good time, and monitor compliance with upcoming regulatory requirements. As most supervised institutions have achieved only limited progress towards aligning their disclosure practices with supervisory expectations,^[18] ECB Banking Supervision will continue monitoring banks’ remedial actions in this important area.^[19]

Key planned supervisory activities:

• Bottom-up climate risk stress test and development of best practices on climate stress testing
• Thematic review of banks’ strategies and governance and risk management frameworks
• On-site inspections
• Follow-up by JSTs on banks’ disclosure practices and adherence to supervisory expectations laid down in the related ECB Guide^[20]

Key vulnerability: Exposures to counterparty credit risk, especially towards non-bank financial institutions

Strategic objective: Supervised institutions should have sound governance and risk management frameworks in place to cope with increased exposures to the counterparty credit risk (CCR) stemming from capital market services.

The low interest rate environment, fostering in turn search-for-yield strategies, has incentivised some banks to increase the volume of the capital market services they provide to more risky and less transparent counterparties, often non-bank financial institutions (NBFIs). The material impacts that recent bankruptcies of such counterparties (e.g. hedge funds and family offices) have had on some banks have put the spotlight on the risks, stemming from weak governance and inadequate risk management practices, that those banks heavily involved in these activities can be exposed to. Against this backdrop, next year ECB Banking Supervision will undertake targeted reviews and on-site inspections in the areas of CCR governance and management to identify any relevant deficiencies. Furthermore, ECB Banking Supervision will finalise its prime brokerage reviews to clarify supervisory expectations in terms of banks’ management of NBFI exposures. Throughout these exercises, JSTs will engage with banks showing material deficiencies in these areas to ensure that any shortcomings are adequately and promptly addressed.

Key planned supervisory activities:

• Targeted reviews and on-site inspections on CCR governance and management
• Finalisation of prime brokerage reviews to clarify supervisory expectations in terms of management of NBFI exposures
• Follow-up by JSTs with banks that show material deficiencies in these areas

Key vulnerability: Deficiencies in IT outsourcing and cyber resilience

Strategic objective: Foster more robust IT outsourcing arrangements and better resilience against cyber threats at supervised institutions by progressively intensifying supervisory activities addressing banks’ risk management practices in these areas.

Inadequate management of IT outsourcing risks by supervised banks in conjunction with their increasing reliance on third-party IT providers (including cloud service providers) raise concerns that warrant a stronger supervisory focus. Supervisors will carry out an assessment of banks’ outsourcing arrangements and engage in a dialogue with those that show material deficiencies to ensure that they implement corresponding remedial action plans in good time.

While significant institutions have demonstrated strong operational resilience throughout the pandemic, the number of cyber incidents reported to the ECB, many of which have had an element of malicious intent and the potential to translate into material losses in the future, has been increasing since 2020.^[21] The acceleration of banks’ digital strategies and their increasing reliance on information technologies makes it essential to strengthen their resilience against cyber threats. Against this backdrop, supervisors will gradually increase their focus on assessing the adequacy of banks’ cyber resilience, and actively follow up with banks showing material deficiencies in this area.

Key planned supervisory activities:

• Data collection on banks’ outsourcing registers
• Targeted reviews and on-site inspections on cyber resilience and IT outsourcing arrangements
• Follow-up by JSTs with banks that show material deficiencies in these areas