The EBA in this press release informs the public that the European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) have identified external dependencies, emerging technologies and private credit as key vulnerabilities for the EU financial system in their Autumn 2026 risk update.
From the press release on the first two topics:
The ESAs warn that the sector’s reliance on non-EU providers and infrastructures could amplify the impact of geopolitical shocks and operational disruptions. Dependence on ICT service providers outside the European Economic Area remains a particular concern, alongside growing cyber risks linked to increasingly capable AI models. (…)
Role of non-EU exposures and infrastructure dependencies
The ESAs highlight the EU financial sector’s dependencies on non-EU countries across the financial system. Investment funds have substantial exposures to the US, particularly equity UCITS and alternative investment funds, while bond funds are more geographically diversified.
In the insurance sector, global interconnectedness is contained overall and is primarily asset- and reinsurance-driven. While these links bring diversification benefits, they also increase market, counterparty, and concentration risks for the sector.
In the banking sector, heightened geopolitical tensions are increasing uncertainties. Although direct exposures to the regions a”ected by geopolitical tensions remain limited, indirect exposure and secondround e”ects could have wider implications for borrowers and funding conditions. Adverse developments from geopolitical tensions could lead to deteriorating asset quality and subdued credit demand, which are not least reflected in banks’ impairment overlays. Banks also face funding gaps in some non-EU currencies, mainly because of household and non-financial corporation deposits and mostly in USD, GBP and CHF. There is ongoing strong reliance on non-EU ICT service providers and payment systems. Dependence on non-EU service providers also remains visible in financial infrastructures, with clearing, repo and credit ratings markets largely intermediated by non-EU entities.
External dependencies present risks, particularly linked to cyber and AI
This reliance on non-EU counterparties increases dependencies on other regulatory regimes and can increase vulnerabilities to geopolitical events outside the EU. It heightens cyber risks, particularly given the concentration of dependence on non-EEA ICT providers. In the insurance sector, exposure also arises through cyber-insurance underwriting. In a context of severe geopolitical instability, added frequency and severity of orchestrated AI-enabled cyberattacks could increase claims and accumulation risks for insurers, though exclusion clauses could limit the impacts on the sector.
The rapid development of advanced AI systems could make cyberattacks more powerful and harder to contain, allowing malicious actors to identify and exploit vulnerabilities at unprecedented speed.. Quantum computing, another rapidly developing technological area, could soon transform the financial sector in key areas by optimising financial processes, fraud and compliance monitoring, as well as pricing. While it promises significant benefits, it could also create major risks, through undermining cryptography systems widely used to secure communications, transactions, databases, and blockchains. Risks posed could also materialise faster than any commercially viable application. (…)
