Every six months the three European Supervisory Authorities (EBA, ESMA, and EIOPA) publish a Joint Committee Report on risks and vulnerabilities. The Autumn 2025 edition comes at a particularly unsettled time, shaped by tariff shocks from the US, ongoing wars in Ukraine and the Middle East, and rising defence spending across Europe. While the report recognises that banks, insurers, pension funds and market infrastructures have held up well so far, the message is clear: financial institutions should not confuse resilience with immunity.
From a regulatory perspective, this report matters because it signals where supervisors are likely to turn their attention over the coming months. It also provides useful insight into how the EU views the balance between financial stability, competitiveness, and security in a world that is fragmenting economically and politically.
The ESAs identify five priority areas. First is the embedding of geopolitical risks into daily business operations. Firms are urged to look beyond traditional credit and market risks, and to map dependencies on non-EU markets, supply chains, and service providers. The message aligns closely with earlier calls from the Commission and ECB for greater EU “strategic autonomy” in financial infrastructures, particularly given the reliance on US clearing houses, rating agencies, and cloud service providers.
Second, institutions are told to prepare for market corrections. The report warns that sudden shifts in tariffs, currency valuations, or defence spending could generate liquidity squeezes and trigger repricing. Regulators expect banks and insurers to conduct robust stress tests and to maintain forward-looking provisioning policies. This will be an area where supervisors can test whether firms are genuinely embedding risk-based planning, or simply checking boxes.
Third, the ESAs emphasise cyber resilience, noting the combination of heightened geopolitical tensions and growing dependence on third-party ICT providers. With DORA now in effect, supervisors will be looking closely at how banks, insurers, and funds operationalise the new framework, covering risk management, incident reporting, and penetration testing. Given the surge in state-sponsored and hacktivist cyberattacks, this is more than a compliance exercise. It is about safeguarding financial stability itself.
Fourth, the report underlines contagion risks from crypto markets. Even though direct exposures remain limited, interlinkages with banks and traditional financial intermediaries are growing. Some EU banks are already experimenting with digital assets. Supervisors will expect clear governance around these activities, as well as transparency in how risks are identified, managed, and disclosed.
Finally, the ESAs link these risks back to the EU’s broader strategic projects: the Banking Union and the Savings and Investments Union. The idea is that a well-supervised, resilient financial system can channel household savings into productive investments, including alternative assets. But the report is careful to flag liquidity and credit risks in alternatives, reminding policymakers and firms that investor protection must remain at the core of these initiatives.
Taken together, the Autumn 2025 report sends a dual message. The EU financial sector has shown resilience in the face of extraordinary turbulence, but that resilience must be constantly reinforced. Supervisors will expect institutions to demonstrate not only that they can withstand current shocks, but also that they are preparing for future ones. For legal and compliance teams, this means updating risk assessments, strengthening cyber and outsourcing governance, documenting stress tests, and revisiting disclosures to clients and investors.
In short: resilience is not a static achievement but a regulatory expectation. The ESAs have mapped the risks and it is now up to firms and supervisors to prove that Europe’s financial system can absorb them without losing its footing.
Leave a Reply