ESAs call for vigilance over external dependencies, cyber threats and private credit risks

The ESAs warn that the sector's reliance on non-EU providers and infrastructures could amplify the impact of geopolitical shocks and operational disruptions. Dependence on ICT service providers outside the European Economic Area remains a particular concern, alongside growing cyber risks linked to increasingly capable AI models.

The findings also highlight vulnerabilities related to private credit. Although the sector remains relatively small in the EU, its rapid growth, limited transparency and increasing links with the wider financial system could create risks during periods of stress.

Despite these challenges, the EU financial system has remained resilient. Investment funds, insurers and banks continue to show strong fundamentals, although geopolitical tensions, cyber threats, natural catastrophes and technological developments continue to shape the outlook.

The ESAs call on supervisors and market participants to strengthen their preparedness and continue closely monitoring risks stemming from external dependencies, private credit and emerging technologies.

Background

The key findings of Autumn 2026 Joint Committee update on Risks and Vulnerabilities were presented at the meeting of the Financial Stability Table of the EU’s Economic and Financial Committee (FST-EFC) on 10 September 2026 as input from the ESAs.

Findings in detail: 

The EU financial system remains resilient

Financial markets have remained resilient despite a volatile environment marked by geopolitical tensions, fluctuations in energy prices and continued crypto-asset volatility. EU equities reached record highs even amid the geopolitical tensions in the Middle East. Bond yields rose but spread widening was limited. Resilience was also evident across the wider financial system. EU investment funds remained resilient throughout the period of volatility. Fundamentals in the insurance and pension sector stayed strong, and capital and funding positions strengthened, however, more frequent natural catastrophes could widen protection gaps, reinforcing the need for stronger action on adaptation.  European banks continued to operate from a position of strength, with strong profitability and high capital ratios supported by organic capital creation. Bank asset quality is also resilient with low levels of Non-Performing Loans, but with expectations of asset quality deterioration in certain portfolios, particularly Commercial Real Estate and Small and Medium-sized Enterprises. Nevertheless, risks remain. Geopolitical developments, energy prices, and rapid technological advances including AI continue to shape the risk outlook, while operational risks are increasing with cyber and fraud risk remaining the main sources of concern.

Role of non-EU exposures and infrastructure dependencies 

The ESAs highlight the EU financial sector’s dependencies on non-EU countries across the financial system. Investment funds have substantial exposures to the US, particularly equity UCITS and alternative investment funds, while bond funds are more geographically diversified.

In the insurance sector, global interconnectedness is contained overall and is primarily asset- and reinsurance-driven. While these links bring diversification benefits, they also increase market, counterparty, and concentration risks for the sector. 

In the banking sector, heightened geopolitical tensions are increasing uncertainties. Although direct exposures to the regions affected by geopolitical tensions remain limited, indirect exposure and second-round effects could have wider implications for borrowers and funding conditions.  Adverse developments from geopolitical tensions could lead to deteriorating asset quality and subdued credit demand, which are not least reflected in banks’ impairment overlays. Banks also face funding gaps in some non-EU currencies, mainly because of household and non-financial corporation deposits and mostly in USD, GBP and CHF. There is ongoing strong reliance on non-EU ICT service providers and payment systems. Dependence on non-EU service providers also remains visible in financial infrastructures, with clearing, repo and credit ratings markets largely intermediated by non-EU entities.

External dependencies present risks, particularly linked to cyber and AI 

This reliance on non-EU counterparties increases dependencies on other regulatory regimes and can increase vulnerabilities to geopolitical events outside the EU. It heightens cyber risks, particularly given the concentration of dependence on non-EEA ICT providers. In the insurance sector, exposure also arises through cyber-insurance underwriting. In a context of severe geopolitical instability, added frequency and severity of orchestrated AI-enabled cyberattacks could increase claims and accumulation risks for insurers, though exclusion clauses could limit the impacts on the sector. 

The rapid development of advanced AI systems could make cyberattacks more powerful and harder to contain, allowing malicious actors to identify and exploit vulnerabilities at unprecedented speed. Quantum computing, another rapidly developing technological area, could soon transform the financial sector in key areas by optimising financial processes, fraud and compliance monitoring, as well as pricing. While it promises significant benefits, it could also create major risks, through undermining cryptography systems widely used to secure communications, transactions, databases, and blockchains. Risks posed could also materialise faster than any commercially viable application.

Private credit exposures have grown and present risks

Private credit markets continue to expand rapidly as a source of financing globally, although the EU market remains relatively small, with limited aggregate exposures among banks and insurers. Nonetheless, the sector presents vulnerabilities linked to increasing complexity, limited transparency, and interlinkages across the financial system. These include infrequent and potentially inaccurate loan valuations, high credit risk, uncertainty about leverage across the value chain, and data gaps affecting both market participants and regulators. Risks may also arise from EU entity exposures to the larger US private credit market. Liquidity mismatches in private credit funds could amplify redemption pressures and generate spillovers to banks through funding and common exposures. Banks could also face credit risks through shared borrowers and financing commitments to private credit vehicles.

Supervisors and market participants should stay ready and responsive 

Given the ongoing geopolitical risks, the Joint Committee of the ESAs calls on supervisors and market participants to strengthen resilience through crisis preparedness, resolution coordination, and more effective and adaptable regulation. It also calls for proactive monitoring and management of risks related to external dependencies, private credit, and AI. This includes managing exposures to non-EEA entities, particularly those linked to private credit, monitoring dependencies on non-EU/EEA service providers, and strengthening preparedness for risks arising from the rapid development of AI and quantum computing.

Further information:

Tayfun Yilmaz

Communications Officer
press@esma.europa.eu