ECB sets supervisory priorities for banks 2026-28 focusing AI, climate

European Central Bank (ECB) Banking Supervision has published its supervisory priorities for 2026-28.

• Main announcement and work programme: ECB Banking Supervision sets two headline priorities for 2026-28: Priority 1 — resilience to geopolitical and macro-financial risks, and Priority 2 — operational resilience and ICT capabilities (including AI oversight). Planned supervisory actions include thematic reviews, targeted reviews, on-site inspections (OSIs), a 2026 thematic stress test on geopolitical scenarios, and targeted OSI campaigns on cybersecurity, third-party risk and RDARR. Key timelines and concrete items:

  • CRR III/CRD VI: implemented in the EU and came into force on 1 January 2025 (affects capital requirement calculations and output floor implementation).
  • DORA oversight: the oversight of critical third-party providers under the DORA framework will be launched in January 2026; ECB will conduct deep dives, threat-led penetration testing and ICT change-management reviews.

• Background, scope and targeted follow-up: The ECB highlights growing climate and nature-related (C&N) risks, slower progress to net-zero, and persistent shortcomings in banks’ C&N risk management; supervisors will require prudential transition plans in line with CRD VI and EBA guidelines, thematic reviews of transition planning and targeted Pillar 3 disclosure assessments. The ECB also intensified monitoring of AI (notably generative AI) and plans horizontal workshops to assess materiality and governance. Supporting facts:

  • Banks’ preparedness: around 90% of surveyed banks now consider C&N risks material (up from ~50% in 2021) and ECB will follow up on remaining shortcomings.
  • Observed loss trend: Swiss Re Institute reports insured natural-catastrophe losses on trend to USD 145 billion in 2025, cited by ECB as a background risk factor.