Measured and monitored: what the ESAs’ risk update says about Europe’s external dependence

On Wednesday 23 September 2026, the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA) published their joint risk update for the autumn. The press release from the three European Supervisory Authorities (ESAs) is headed “ESAs call for vigilance over external dependencies, cyber threats and private credit risks”. Behind it sits a 19-slide deck, which the authorities had already presented on 10 September to the Financial Stability Table of the EU’s Economic and Financial Committee. Its resilience figures are sound. According to the EBA, banks in the European Economic Area (EEA) earned a return on equity of 10.5 per cent in the first quarter of 2026, with a Common Equity Tier 1 ratio of 16.2 per cent and a non-performing loan ratio of 1.8 per cent.

The headline of the press release invites a reading of the update as a warning about three risks. What it mostly does is measure. The ESAs put numbers on the European financial sector’s reliance on players outside the EU more broadly than the two previous editions, from the portfolios of equity funds to the clearing houses for interest rate derivatives. Every one of these channels ends in the same kind of recommendation: monitor, manage, prepare. None of the six blocks of recommendations asks for any of these dependencies to be reduced. The word “reduce” appears exactly once in the recommendations, and it applies to the complexity of regulation. None of this is a forecast of whether or when any of these dependencies will cause damage.

Each channel is measured with its own denominator, and no common total emerges

Slides 12 to 14 are where the deck goes beyond earlier editions. For funds, the ESAs find that 52 per cent of the geographic exposure of equity funds under the UCITS Directive lies in the United States, based on Morningstar and ESMA data as at September 2025. For clearing, they note that in euro interest rate derivatives UK central counterparties (CCPs) “do the bulk of clearing”, while a US clearing house does the same for credit derivatives. In the repo market, according to the deck, “over half of total principal of outstanding transactions for EEA entities” is “still with non-EEA” counterparties. For insurers, the deck draws on EIOPA’s figures: around 13 per cent of investments sit outside the EEA, and around 28 per cent of ceded risk goes to reinsurers outside it, concentrated in the United Kingdom, Bermuda and Switzerland.

For banks, the deck relies on an EBA survey covering providers of information and communication technology (ICT) and other dependencies. Its result is that banks see “ICT service provider-related dependencies as biggest challenge (c. 80%)”, with dependencies on payment solutions in second place at around 60 per cent. Two further channels complete the picture. The ESAs consider dependence on credit rating agencies mitigated, because 95 per cent of EU issuers are rated by analysts in the EU. In crypto markets, only 8 per cent of trades are against the euro. Neither of the two previous editions set the channels side by side this completely. The autumn 2025 report did contain a box on reliance on US infrastructure, stating that 98 per cent of clearing in EU currencies carried out by Tier 1 CCPs runs through two US-owned clearing houses. What has changed in autumn 2026 is the rank of the theme and its breadth across funds, insurers, banks and infrastructure.

These figures, however, measure very different things. The 52 per cent refers to the geography of securities holdings, the 28 per cent to ceded insurance risk, the 80 per cent to an EBA survey of banks whose answer categories the deck does not explain, and the repo figure to outstanding principal. That puts at least six denominators under one heading, and none of them measures how quickly a provider could be replaced. In risk management terms, the deck describes exposures rather than substitutability. For a supervisory slide that is legitimate, since its job is to provide a situational picture rather than a ranking. For a firm that wants to know where its own vulnerability lies, the work begins exactly where the deck stops.

Six blocks of recommendations, and none asks for a reduction

The recommendations sit on slides 18 and 19, grouped into six blocks. Three concern the authorities and the system as a whole: maintaining responsiveness to geopolitical risks, strengthening crisis preparedness and resolution coordination, and improving the effectiveness and adaptability of regulation. The other three cover the themes of the deck. They read “Proactively monitor and risk manage exposures to non-EEA entities, with a focus on private credit”, “Continue to monitor non-EU/EEA dependencies on technology service providers” and “Continue to plan and prepare for the risks from the rapid development of AI and quantum computing”. The sub-points mention transparency, disclosure, stress testing, scenario analysis and the monitoring of critical technology providers in the joint oversight teams set up under the Digital Operational Resilience Act (DORA). No verb of reduction, relocation or diversification with dependence as its object appears anywhere.

A risk update for the Financial Stability Table is, of course, no legislative programme, and the ESAs have no mandate to tell banks which cloud provider to use or insurers which reinsurer to choose. Monitoring is therefore not necessarily the wrong register. Yet the deck does not stay in that register throughout. In the block on regulation it explicitly recommends reducing “unnecessary complexity”, and slide 7 adds “adequate simplification”. Where the authorities consider a reduction right, they say so. They say it about regulation, not about dependence.

One finding reflects well on the firms. The chart on the EBA survey on slide 14 distinguishes between banks that see a risk without mitigants and those that see one with mitigants already under way. Read from the bars, around 70 per cent of banks report identified risks from ICT service providers with mitigants under way or implemented, and only a few per cent report identified risks without any. The surveyed banks are not waiting for the supervisors. The slide does not reveal what they count as a mitigant, though, and an exit plan for a hyperscaler is not the same as a second data centre location with the same provider.

The only reduction instrument is missing from the deck

For one of the channels measured, an instrument exists whose declared purpose is reduction. Regulation (EU) 2024/2987, known as EMIR 3, requires counterparties above the clearing threshold under Article 7a to hold an active account at a CCP authorised in the EU and to clear a representative number of trades through it. It covers interest rate derivatives in euro and Polish zloty as well as short-term interest rate derivatives in euro, which is precisely the channel the deck describes on slide 12. EMIR stands for the European Market Infrastructure Regulation, and EMIR 3 is its third revision. Accounts had to be opened by 25 June 2025. The regulatory technical standards have been in force since 26 February 2026. The autumn update does not mention the instrument. A full-text count finds no mention of “active account”, and EMIR appears only in two source lines beneath charts.

ESMA has only just measured its effect. In its interim report under Article 7a(10), submitted in June 2026, the authority reaches a cautious conclusion.

The interim report is expressly preliminary, and ESMA says the full assessment will follow in 2027, once reporting data on the active account is available. Even so, the share of initial margin that EU clearing members post at Tier 2 CCPs, relative to EU clearing houses, fell only from 58 per cent at the end of 2024 to 51 per cent at the end of 2025, and according to ESMA mainly because more margin was posted at EU CCPs rather than less at Tier 2 CCPs. ESMA gives no reason for the limited effect. Anyone who has hedged an interest rate book through a clearing house can guess one: an account at a second venue is quickly opened, but the liquidity does not follow it of its own accord. The other channels have no comparable instrument. The designation of 19 critical ICT third-party providers under DORA in November 2025 creates oversight of those providers without reducing reliance on them. The equivalence rules for third-country reinsurers under Solvency II, if anything, make them easier to use.

The AI block leaves out the time axis

In the autumn update, artificial intelligence is closely tied to dependence. Slide 5 states that frontier AI models can identify and exploit IT vulnerabilities “at speed and scale”, and slide 11 puts it this way for banks: “Vastly enhanced threat capabilities of Frontier AI models raise concerns about the sector's capacity to cope.” Slide 17 adds that such tools could also find previously unknown vulnerabilities, “making it harder for all market players to respond in time”. The European Systemic Risk Board (ESRB) had already issued a formal warning about this development in July, and ECB Banking Supervision had written to the significant institutions under its supervision. The deck’s own response is on slide 19.

It reads: “The EU's regulatory framework (including DORA and the AI Act) provides a solid foundation for managing cyber and AI-related risks”, together with the recommendation to adopt “AI-powered security testing”. The phrase about a solid foundation is not new. It already appears in the ESAs’ statement on frontier AI models published on 31 July 2026, which says that DORA and the AI Act “provide a solid foundation to tackle risks stemming from the release of highly capable AI models”. The same paragraph of that statement, however, continues with a second sentence that the autumn update leaves out.

Diagnosis and recommendation do not contradict each other. A legal framework can be sound while implementation is too slow, and that is how the Financial Stability Institute of the Bank for International Settlements (BIS) described the situation on 9 September: frontier AI “does not fundamentally change the foundations of cyber resilience, but it significantly increases the speed and intensity with which established practices need to be executed.” The July statement carries this time axis, down to the remark that annual penetration tests or compliance audits may no longer be sufficient. The deck keeps the foundation and drops the pace. For a document that serves the Financial Stability Table as a situational picture, that abridgement has consequences, because anyone who reads only the deck reads a diagnosis without a time axis. The hard figures available so far support a calmer reading. According to the ESAs’ first report on major ICT-related incidents, financial entities in the EU reported 3,383 such incidents in 2025, of which 10 per cent were related to cybersecurity. The models at issue, however, only became known in spring 2026, as the ESRB describes it, so they cannot yet be reflected in the 2025 figures.

The section on quantum computing follows the same pattern. The deck refers to the recommendation of the Cooperation Group under the Network and Information Security (NIS) Directive to adopt a migration strategy for post-quantum cryptography by the end of 2026. That roadmap, published in June 2025, is addressed to the Member States. For firms, the general DORA requirement to use state-of-the-art cryptography applies. For high-risk use cases, the roadmap envisages completing the transition by the end of 2030. For a financial firm, that is a planning parameter with a little over four years’ lead time.

The private credit figure is small, dated and half unattributed by country

On the third theme, the figures are modest. According to the EBA’s large exposures data, exposures of EEA banks to private credit funds and their related asset managers reached nearly EUR 150 billion in June 2025, equal to 0.6 per cent of total assets, most of it held by global systemically important institutions. European private credit funds manage EUR 97.1 billion, 95.2 per cent of it invested in Europe, including the United Kingdom and Switzerland. The ESAs conclude that substantial risks are more likely to come from US exposures, and that liquidity mismatches in such funds could spill over to banks. In May, the European Central Bank arrived at EUR 62.5 billion for euro area banks on a different definition. The two figures measure different things and can neither be added up nor set off against each other.

The deck’s footnotes carry more caveats than its text. On the day this article appears, the bank figure is more than fifteen months old, and according to the source line on slide 16, banks reported no country of domicile for the counterparty for around half of the exposures. The ESAs themselves write that private credit lacks a widely accepted definition and that the figures offer only an indicative measure. The deck also adds a sentence without a number: “Private credit has also played a rapidly growing role in AI-related financing.” Others supply the scale. In its Financial Stability Review published in May, the ECB cites market estimates that up to 30 per cent of the roughly USD 3 trillion needed to build AI data centres over the next few years could come from private credit. The Bank of England refers to an OECD estimate according to which private credit’s share in financing AI investment rose from 9 per cent in 2024 to 34 per cent in 2025.

What comes next is set out in a letter written at around the same time, not in the deck. On 19 September, following a letter from Commissioner Maria Luís Albuquerque two days earlier, John Berrigan, Director-General of the Commission’s Directorate-General for Financial Stability, Financial Services and Capital Markets Union (DG FISMA), asked the chairs of the three authorities, Petra Hielkema, Verena Ross and François-Louis Michaud, for a technical assessment. The EBA published the Call for Advice on 24 September, one day after the deck. The legal basis is Article 16a of the ESAs’ founding regulations. The Commission asks for the assessment “to the extent possible, within 6 months”, with data as at end-2025 and, where available, more recent data to capture the “redemption run on US private credit funds in Q1 2026”. The first task is to identify common definitions, which is exactly what the deck says is missing in its footnote. Afterwards the Commission intends to consider “whether a one-off and targeted data collection from selected entities is necessary”. For firms, that is the most practical sentence in the whole exercise.

In spring, AI was a credit risk. By autumn, it had become a tool of attack

Comparing the deck with its predecessor, the spring update of 27 March 2026, shows how quickly supervisory priorities shift. Both documents take the same form, a deck for the Financial Stability Table with 17 and 19 slides and around 4,400 and 4,300 words respectively. The switch from a written report to a deck had already taken place between autumn 2025 and spring 2026. The spring themes were “current geopolitical risks and private finance”, while the autumn themes are external dependencies, their link to cyber and AI risks, and private credit. Counted across the full text including chart labels, the stem “geopolit” falls from 36 to 11 mentions, while “non-EU” and “non-EEA” in all spellings rise from 6 to 45. “Frontier” does not appear at all in spring and appears four times in autumn.

The role the deck gives to artificial intelligence is more telling than the numbers. In spring, AI appeared as a valuation and credit risk. The spring deck traced the wave of redemptions at US private credit funds in February and March to “AI effects on software business and credit quality”, meaning borrowers from the software industry whose business models are under pressure from AI, and it warned of corrections to high AI valuations. In the recommendations, AI featured in half a sentence alongside cyber threats and quantum computing. By autumn, AI had become a tool of attack with its own block of recommendations, and also something that private credit helps to finance. Three spring recommendations have gone: the dedicated one on cautious management of sovereign exposures, the call for investor due diligence given the opacity of private markets, and the point on insurance supervision on Solvency II. Regulatory simplification has been added. Bank metrics barely moved in those six months, with the return on equity slipping from 10.7 to 10.5 per cent and the CET1 ratio from 16.3 to 16.2 per cent. The balance sheets barely moved, while the supervisors’ attention did.

Recommendations

Glossary