Geopolitical Reverse Stress Test: Which Shocks Would Break Europe's Banks

The classical stress test puts the same scenario in front of every bank: a recession, an interest rate shock, a property price collapse. Institutions run the numbers, supervisors evaluate who ends up with how much capital. What the European Central Bank has announced for 2026 is a break from that pattern – at least for one year. On 12 December 2025 ECB Banking Supervision announced that the 2026 thematic stress test will take the form of a reverse stress test. Its focus: geopolitical risk.

Around 110 banks under direct ECB supervision – including all systemically relevant German institutions – must identify during 2026 which geopolitical events could deplete their Common Equity Tier 1 (CET1) ratio by at least 300 basis points. They must quantify these scenarios, describe the transmission channels and outline their response. The ECB prescribes neither scenarios nor macroeconomic paths. What sounds like an academic subtlety is a paradigm shift in supervisory practice: the question is no longer "how resilient are you against our shock?" but rather "which shock would break you – and how close are you to it?"

The timing is not accidental. In that same December 2025 the ECB published its Supervisory Priorities for the 2026–2028 cycle. Two priorities top the list and they interlock: first, strengthening resilience to geopolitical risk and macro-financial uncertainty; second, operational resilience including Information and Communication Technology (ICT). The reverse stress test is the first significant instrument through which the supervisor links both priorities. Geopolitical shocks today rarely work exclusively through credit defaults or market price movements – they propagate through sanctions, cyber-attacks, energy supply and critical third-party providers.

Why the supervisor inverts the classical stress test

The limits of uniform scenarios

The 2025 European Union-wide stress test of the European Banking Authority (EBA) had once again confirmed the systemic robustness of the European banking sector. Under the adverse scenario the CET1 ratio of the 96 tested institutions fell to an aggregate 12.0 per cent, compared with 17.1 per cent under the baseline. Claudia Buch, Chair of the ECB's Supervisory Board, summarised the result in September 2025: the European banking sector would remain resilient even under a hypothetical adverse macroeconomic scenario. At the same time Claudia Buch acknowledged what had long been an undercurrent in supervisory communication: stress tests alone cannot capture the full range of risks and uncertainties facing banks today. Much of the present uncertainty, she noted, is "radical" in nature and therefore not measurable.

This insight has consequences. Classical stress tests operate on prescribed narratives – a recession, an inflation spiral, an oil price shock. They assume the supervisor already knows the relevant shock pattern. Geopolitical risks contradict that assumption fundamentally. They are bank-specific, heterogeneous and ill-suited to a single uniform scenario. A large French bank with substantial Africa exposure faces different pathways from a German Landesbank with a strong Mittelstand franchise or an Italian retail bank with heavy sovereign bond exposure. Putting all three under the same scenario tests irrelevance, not vulnerability.

The reverse stress test as inversion of logic

The reverse stress test inverts the direction of travel. Rather than prescribing a scenario and measuring capital impact, it fixes the outcome – the critical capital threshold – and asks which combination of events could plausibly produce it. In the ECB's design each bank must identify geopolitical risk events that would cost at least 300 basis points of its CET1 ratio, quantify their impact and describe how it would respond.

The merit of this methodology lies in the honesty it enforces. Banks must name their own weaknesses – concentrations, dependencies, blind spots. The supervisor thereby gains a view of what the institutions themselves consider their largest risk. It is neither a pass nor a fail test. The results will not feed directly into Pillar 2 Guidance (P2G) but will qualitatively enrich the Supervisory Review and Evaluation Process (SREP). Institutions that remain superficial in their scenario definitions signal a governance shortfall to the supervisor – and that carries weight in the SREP.

Transmission channels: how geopolitics reaches the bank balance sheet

Beyond credit default risk

The methodological core of the reverse stress test is the analysis of transmission channels – the mechanisms by which a geopolitical event actually reaches a bank's profit and loss account or risk position. The ECB explicitly treats geopolitical risk as a cross-cutting risk driver that simultaneously affects credit, market, liquidity, business model, governance and operational risk. That includes classical mechanisms but reaches well beyond them.

Within the reverse stress test banks will typically need to examine six transmission channels. First: trade and supply chain disruption. An escalation in the South China Sea or new tariff regimes would hit sectors such as automotive, machinery, electronics and semiconductors – with credit risk effects on corporate clients. For German banks with significant Mittelstand exposure this is no theoretical case.

Second: energy and commodity shocks. Supply interruptions, attacks on energy infrastructure or embargoes against commodity producers propagate through the margins and cost structures of corporate clients and simultaneously affect inflation expectations and yield curves.

Third: financial market channels. Sovereign spreads, exchange rates, equity and commodity prices often react to geopolitical events within hours. Institutions with substantial trading books or unhedged positions must model mark-to-market losses, including correlated movements across asset classes.

Fourth: sanctions and compliance. If counterparties or their parent groups are added to sanctions lists, contract breaches, restructurings, unwinds and material legal risks emerge. The complexity of secondary sanctions has increased over recent years – anyone serving international corporate clients will recognise the issue.

Fifth: cyber and operational risks. Geopolitical conflict today almost always comes with elevated cyber activity. State-sponsored attacks on financial infrastructure, payment service providers or cloud providers are no longer a hypothetical category. The ECB explicitly requires banks to include these pathways in the reverse stress test – not as a separate operational risk exercise, but as an integral part of the geopolitical scenario.

Sixth: funding and liquidity. Under stress, certain funding sources dry up faster than asset-liability models assume. Cross-border funding lines, repo markets for specific collateral classes and dollar liquidity for European institutions have historically proven fragile under geopolitical pressure.

The bridge to the Digital Operational Resilience Act

The ECB's geopolitical priority interlocks with its second priority – operational resilience – by design. The Digital Operational Resilience Act (DORA) has applied directly since 17 January 2025, and on 18 November 2025 the European Supervisory Authorities (ESAs) published the first list of Critical Third-Party Providers (CTPPs) under DORA. From January 2026 the direct oversight regime of the ESAs over these providers becomes active – an entirely new supervisory instrument at European level.

The ECB makes clear in its priorities that it regards banks' dependencies on a limited number of external service providers as a significant vulnerability. Many of those providers are based outside the European Union. This is no abstract sovereignty issue. In a geopolitical scenario – for example sanctions between Western and non-European blocs, or regulatory retaliation – cloud services, software-as-a-service platforms or specialised IT services may become unreliable or unavailable. For banks with deep outsourcing to individual hyperscalers or fintech infrastructure providers, concentration becomes an existential question.

Within the reverse stress test this pathway is likely to feature prominently. Banks will have to set out credibly how a failure or politically induced interruption of a critical third-party provider could translate into business interruption, reputational loss and customer outflow, and ultimately into a CET1 depletion. Two On-site Inspection (OSI) campaigns by the ECB across 2026 and 2027 – one on cybersecurity, one on third-party risk management – complete the picture. Anyone submitting only credit-risk scenarios in the 2026 ICAAP has not understood the exercise in substance.

What German banks must deliver by summer 2026

Timeline and ICAAP integration

The ECB's announcement of 12 December 2025 does not specify exact deadlines, but the operational path is clear: the reverse stress test is formally part of the 2026 ICAAP cycle. Banks therefore primarily use existing reporting formats and data collections. Industry analyses – including those of Forvis Mazars and KPMG – expect submission deadlines in the second quarter of 2026. The ECB itself has announced aggregate results for summer 2026; qualitative SREP recognition will follow in the subsequent 2026/2027 cycle.

For institutions the implication is clear: preparation is already under way. Anyone only starting with scenario identification now risks a poorly documented, hastily assembled submission – with all the SREP consequences. Three work streams run in parallel and determine the quality of the submission.

First, the scenario workshop: a structured identification of geopolitical events that can plausibly materialise against the bank's specific business base. This is explicitly not a PowerPoint exercise. Without quantitative underpinning – exposure mapping, portfolio scrutiny, stress parameters – the submission remains supervisory paper.

Second, transmission modelling: the translation of identified events into impact pathways across the balance sheet. This is where the serious institutions separate from the rest. Banks with a robust integrated risk model can credibly capture correlations between market, credit and operational risk. Anyone still operating in risk silos will struggle to construct a CET1 scenario with 300 basis-points depletion without arbitrary assumptions.

Third, the governance and action layer: the ECB explicitly requires banks to describe how they would respond to the identified scenario. That is more than a Business Continuity Plan. The exercise calls for management actions, capital preservation measures, divestments, hedging strategies – all documented, prioritised and aligned at board level.

A particular pitfall: consistency with your own risk appetite

One aspect currently under-discussed in the public debate becomes highly relevant in supervisory review: the consistency between the reverse stress test scenario and the bank's risk appetite framework. If a bank identifies a plausible scenario with 400 basis-points CET1 depletion and that scenario is not inconsistent with its existing limit structure and concentration controls, the supervisor will inevitably ask: why is this vulnerability not subject to active management? The ECB will read inconsistencies between scenario narrative and risk appetite carefully. Adjusting one without the other is the surest recipe for an uncomfortable SREP dialogue.

The other 2026–2028 supervisory priorities: context creates meaning

The 2026 reverse stress test does not stand alone. The ECB's priorities for the 2026–2028 cycle encompass several parallel work streams that flank it. Alongside the OSI campaigns on cybersecurity and third-party risk, the ECB plans targeted reviews on ICT change management, threat-led penetration testing, Risk Data Aggregation and Reporting (RDARR) and credit underwriting standards. Added to that are horizontal workshops with selected banks on Generative Artificial Intelligence (GenAI), exploring opportunities and risks for business models and operational processes.

Climate and nature-related risks remain the subject of targeted reviews but have slipped in the priority ranking behind geopolitics – a signal the industry notes carefully. The ECB thereby communicates that it regards the systemic disruptions of recent years as a persistent state: globalisation will not simply return, bloc formation, trade policy and military tensions are not outliers but a durable condition. The supervisory year 2026 is the first systematic answer to this diagnosis.

Recommendations: what German institutions should prioritise now

The time remaining until the ICAAP submission in the second quarter of 2026 is deceptively short. Four fields of action are decisive from a practical perspective:

Risks and open questions

The reverse stress test has merit but also methodological shoals. The first: the approach requires banks to expose their own weakness profile. Institutions with a professional staff-function architecture will deliver differentiated scenarios; others will be tempted to cut scenarios so that the 300 basis points are just barely reached – without genuine information gain for the supervisor. The ECB is aware of this risk and will try to penalise it through the qualitative SREP input. True transparency, however, can only be enforced administratively to a limited extent.

The second shoal is comparability. If every bank defines its own scenarios, the supervisor loses the aggregated system view that the classical EU-wide stress test delivers. The ECB addresses this by explicitly framing the reverse stress test as a thematic complement rather than a replacement for the biennial EBA exercise. The next EU-wide stress test of the European Banking Authority is expected in 2027; it will again use uniform scenarios. The 2026 reverse stress test is therefore a complementary instrument, not a substitute.

The third question concerns consequences. Without a direct P2G impact the supervisory lever is limited to the qualitative SREP rating. That is not trivial – SREP scores influence capital buffers, restrictions and the supervisory dialogue temperature for years. But for a bank genuinely inclined to ignore geopolitical risk, the short-term incentive is weaker than political rhetoric suggests. Conversely, for banks that take the reverse stress test seriously and dive into it methodologically, genuine management value emerges – a clearer picture of their own vulnerability, a better basis for limit and concentration steering, a more robust governance architecture.

Those who treat the 2026 reverse stress test as a mere duty underestimate its methodological depth. Those who mistake it for a pure compliance exercise miss the strategic opportunity: to examine rigorously, once, where the bank is actually fragile – before a real event supplies the answer. Geopolitical risk will not diminish during this decade. The question is whether the European banking landscape will have developed a robust response to this vulnerability by 2027 or 2028.