ECB Banking Supervision: SSM supervisory priorities for 2024- 2026

A positive note .underpins the ECB's priorities for 2024-2026 – banks have demonstrated remarkable resilience in navigating the challenging macro-financial and geopolitical landscape of recent years. Their successful management of Non-Performing Loans (NPLs), bolstered by robust capital positions and liquidity buffers, has equipped them to confront recent challenges, including the COVID-19 pandemic, supply chain disruptions, and bank failures.

However, banks and their supervisors must stay alert despite multiple occurring challenges. The volatility of funding sources and costs in the mid-term, associated with the possibility of asset quality deterioration due to further geopolitical unrest, necessitates banks to strengthen their credit risk management and asset and liability management frameworks. Recent bank collapses underline the urgency for banks to remedy shortcomings in governance, particularly in risk data aggregation and reporting capacities. Moreover, as banks increasingly shift to digital transformation to stay competitive, supervisory attention will also concentrate on arising threats, including cybersecurity risks and the continuity of critical services.

Building on the continuity of the ECB's supervisory priorities and activities from 2022, the updated plan for 2024-2026 maintains a steady course. While a few adjustments have been made to address the evolving risks, the overall direction remains consistent, providing stability and predictability.

Priority 1: Boost resilience to immediate macro-financial and geopolitical shocks

• Prepare for targeted examinations focusing on portfolio resilience, particularly those more sensitive to the prevailing macro-financial conditions and exposed to refinancing risk. This incorporates continuing targeted reviews on Residential Real Estate (RRE) and Commercial Real Estate (CRE) lending and forming a new targeted review focusing on vulnerable Small and Medium-sized Enterprises (SMEs).
• Be prepared for an extension of previous OSIs, paying attention on IFRS 9 collective staging and provisioning for SMEs, retail portfolios, and CRE, including collateral valuations and Counterparty Credit Risk Management (CCR).
• Expect different activities, including deep dives into forbearance and unlikely-to-pay policies, a priority on overlays as part of IFRS 9 reviews, and more scrutiny on internal model investigations and follow-up.
• Get prepared to examine – and, if necessary, redevelop – liquidity and funding plans, contingency planning and adequacy of collateral optimization capabilities, and ALM governance and strategies.
• Banks not yet subject to a targeted review focusing on interest rate and credit spread risks should anticipate more activity in this area.

Priority 2: Accelerate the effective remediation of deficiencies in governance
and the management of climate-related and environmental risks

• Draft documentation and review policies around management bodies' collective suitability and diversity, risk culture and risk management before publishing supervisory expectations and best practices regarding banks' governance and risk culture.
• Be ready to discuss the ongoing weaknesses in governance arrangements directly with the JST. Prepare for targeted reviews of the effectiveness of bank management bodies and, in some cases, OSIs.
• Evaluate progress regarding persistent risk data aggregation and reporting deficiencies, especially the draft supervisory expectations for implementing risk data aggregation and risk reporting principles in 2023 and the final publication in 2024. Expect a continuance of the OSI campaign in the RDAR space.
• Prepare documentation and sufficient resources to react to the annual questionnaire and produce the Management Report on Data Governance and Quality.
• Expect further supervisory communication and targeted follow-ups by the end of 2024 concerning banks' progress aligning with supervisory expectations on C&E risks.
• Expect deep dives into banks' capabilities to address reputational and litigation risks associated with C&E-related commitments. Targeted OSIs will continue on a stand-alone or as part of other on-site inspections (e.g., Credit risk, operational risk, business model)

Priority 3: Further progress in digital transformation and building robust operational resilience frameworks

• Expect targeted deep dives on digital transformation impacts and JST follow-ups on material deficiencies.
• Keep in mind the new publication of supervisory expectations and sharing of best practices on digital transformation plans.
• Ensure the organization is ready for an intrusive but essential 2024 system-side cyber resilience stress test exercise.
• Continue to focus on continuing activities concerning data collection, horizontal analysis of outsourcing registers, and targeted reviews and OSIs in this area.

Banks should thoroughly assess the priorities, pinpoint the most pressing challenges, and identify areas already highlighted in their supervisory examination plans. They should then devise proactive strategies to address these issues. Over 2023 and 2024, the ECB has increasingly demonstrated its readiness to leverage its comprehensive supervisory toolkit, including imposing penalties where necessary. The language of the 2024-2026 priorities emphasizes this shift towards more stringent oversight — banks are encouraged to proactively address any enduring deficiencies within their portfolios.