Summary
- The reverse stress test covered 110 banks and required scenarios causing a 300-basis-point reduction in core capital ratios.
- Cyber incidents and third-party service disruption were the most prominent non-financial threats identified.
- Supervisors found gaps between scenario narratives, financial effects, liquidity pressure, and proposed recovery measures.
European banking supervisors have found weaknesses in how some banks translate cyber incidents, supplier outages, and geopolitical disruption into credible estimates of capital and liquidity pressure.
The European Central Bank assessed 110 directly supervised eurozone banks through a reverse stress test focused on geopolitical risk. Each institution had to design a plausible scenario severe enough to reduce its Common Equity Tier 1 capital ratio by 300 basis points.
Unlike a conventional stress test, in which banks are subjected to the same economic assumptions, the exercise required institutions to begin with a specified loss and work backwards. They had to identify the events, exposures, and transmission channels capable of producing that result in their own business model.
The scenarios included military conflict, sanctions, trade and energy disruption, supply chain failures, macroeconomic shocks, and cyber incidents. Banks were required to show how those events could move through financial markets, the real economy, and safety and security risks.
Most institutions identified the real economy as the principal transmission channel, followed by financial-market disruption. In scenarios involving military conflict and cyberattacks, physical, cyber, and hybrid threats became an important route through which geopolitical events affected the bank.
Credit losses and profitability pressure were common mechanisms for capital depletion. Manufacturing, energy, and transport exposures appeared prominently, while banks with large trading operations also modelled declines in fees and trading income.
Liquidity positions generally remained above regulatory minimums. Several banks, however, produced only a muted movement in liquidity metrics despite the severe capital reduction built into their scenarios.
The ECB said solvency and liquidity stress are often closely connected during a crisis and will follow up with institutions whose models did not show that interaction convincingly. A major operational incident can affect payment activity, customer behaviour, collateral movements, market access, and confidence before the underlying technical problem is fully understood.
Cyber incidents and disruption at third-party service providers emerged as the most prominent non-financial threats. Their position in the exercise reflects how technology failures can become financial events rather than remaining confined to operational or security functions.
A prolonged outage at a cloud platform, telecommunications provider, payment service, or other concentrated supplier can interrupt transactions and customer access while creating additional funding and reputational pressure. Several effects may develop at once, and recovery of the affected system does not immediately reverse all of them.
Supervisors also found gaps in the granularity and sensitivity of risk assessments, the connection between narrative scenarios and calculated financial impacts, and the realism of proposed management actions.
Some institutions assumed they could sell loan portfolios or raise capital at ambitious prices during adverse market conditions. Such measures may appear plausible in an isolated recovery plan but become less credible when several banks or sectors are responding to the same systemic shock.
The ECB emphasised the role of boards in ensuring that scenario analysis and contingency planning reflect those constraints. Management actions need to account for the availability of buyers, market liquidity, execution time, and the possibility that normal sources of capital are under pressure.
The exercise complements the Digital Operational Resilience Act, which imposes requirements around technology risk, incident management, resilience testing, and third-party oversight. The reverse stress test examines the next part of the chain: how operational disruption affects capital, liquidity, funding, and strategic decisions.
The findings will feed into supervisory dialogue and may inform qualitative assessments under the Supervisory Review and Evaluation Process. They will not directly change Pillar 2 capital or leverage guidance, but identified weaknesses remain subject to follow-up.
The exercise sets a more demanding standard for severe-event planning. A scenario must do more than describe a plausible cyberattack or supplier failure; it must show how the event passes through operations, markets, liquidity, and management decisions under conditions where familiar mitigations may no longer be available.
