1 Introduction

The 2024 Supervisory Review and Evaluation Process (SREP) shows that, as in the previous cycle, euro area banks supervised by the ECB have strong capital and liquidity positions and remain resilient. Against improvements in some risk indicators, downside risks called for caution in the supervisory assessments. Geopolitical risks persist amid the conflict in the Middle East, Russia’s ongoing war against Ukraine, a potential escalation between the United States and China over Taiwan and the possible impact of the outcome of the US elections. Due to their inherent uncertainty, geopolitical risks are often not priced in on financial markets until they materialise, and their full impact might only show beyond the time horizon used in banks’ medium-term capital planning. As a result, strengthening resilience to geopolitical shocks has become a key priority for ECB Banking Supervision. Furthermore, the ongoing macroeconomic challenges mean that banks are operating in a more uncertain environment.

In line with the European Banking Authority (EBA) Guidelines on the SREP, the overall SREP score, which ranges from 1 to 4, reflects the supervisor’s overall assessment of the viability of the institution: higher scores reflect higher risks to the viability of the institution stemming from one or more features of its risk profile. The average overall SREP score in 2024 remained stable at 2.6, but with score changes for several banks as compared with the previous cycle.

The overall capital requirements and guidance stood at 15.6% of risk-weighted assets (RWA), on average, against a total capital ratio (transitional definition) of 19.9% as at the second quarter of 2024. Some adjustments were made on account of changes in the risk profile of several banks, as well as the application of the non-performing exposure (NPE) shortfall and leveraged finance (LF) add-ons. The Pillar 2 requirement (P2R) in total capital remains stable at around 2.1%, as compared with last year when it stood at 2%. For nine banks, the P2R includes a LF add-on of, on average, 14 basis points. For 13 banks, a Pillar 2 requirement concerning the leverage ratio (P2R-LR) add-on was applied, ranging between 10 and 40 basis points. The weighted average leverage ratio (transitional definition) as at the second quarter of 2024 stood at 5.8%. Quantitative measures for liquidity risk were imposed on four banks.

The qualitative measures taken in the SREP 2024 were issued primarily to address deficiencies in the areas of credit risk, internal governance, and capital adequacy. The escalation ladder (the framework encompassing the range of supervisory tools to be used by supervisors to achieve the timely resolution of findings) was set in motion to request more binding measures be exercised to address severe weaknesses identified during on-site inspections and horizontal analyses. Going forward, should any long-standing deficiencies fail to be adequately remedied, ECB Banking Supervision will move up the escalation ladder and impose enforcement measures in line with the supervisory priorities set for 2025-27.

Banks continued to exhibit strong profitability, thanks to the monetary policy regime shift from the low interest rate environment resulting in continued favourable net interest income (NII), with the aggregated annual return on equity standing at 9.3% in 2023, as compared with 7.7% in 2022, and peaking at 10.1% in the second quarter of 2024. At the same time, the cost-to-income ratio decreased to 54.2%. Supervisors exercised caution in their assessments, considering the slowing down of NII, structural cost challenges, weaknesses in strategic execution and business planning, as well as the deteriorating outlook for core business at some supervised banks.

The ratio of non-performing loans (NPLs) to total loans remained largely stable at 2.3% between year-end 2022 and 2023, with the trend continuing into the second quarter of 2024 and remaining close to historical lows. This is the result of benign macroeconomic conditions, intense supervision resulting in improved bank practices following the ECB Banking Supervision guidance to banks on non-performing loans and the related addendum on supervisory expectations for prudential provisioning of non-performing exposures, as well as better regulatory frameworks. However, it is crucial to avoid any renewed build-up of NPLs as European economies undergo phases of transformation where they are exposed to new shocks, particularly amid an uncertain economic environment going forward. Since mid-2022, corporate insolvencies have increased across Europe, with the insolvency rates exceeding pre-pandemic levels and reaching a record high since 2015. This marked increase shows that the deterioration of asset quality is beginning to materialise across banks’ balance sheets. Supervisors have taken into account the priority of credit risk management in their assessments and have therefore remained prudent about credit risk stemming from exposures to vulnerable sectors such as commercial real estate, which has deteriorated in asset quality. At the same time, supervisors have positively highlighted the reduced NPL ratios observed for banks with previously high NPL ratios.

The area of internal governance and risk management continues to be a priority for ECB Banking Supervision, with a renewed focus on the effectiveness of management bodies and increasing attention to long-standing deficiencies in risk data aggregation and risk reporting. Supervisors shall renew their efforts to ensure that these deficiencies are remediated, and, where necessary, they will escalate any issues.

Increased uncertainty stemming from cyber incidents requires banks to manage their IT risks effectively. Dependence on critical third-party providers remains a concern, and ageing IT systems may also make them more vulnerable as these cyber incidents become more sophisticated. As a result, ECB Banking Supervision continues to consider operational resilience a key priority. Banks are therefore expected to step up their efforts to remediate identified vulnerabilities in terms of their cyber resilience and outsourcing arrangements, while making the necessary improvements to fully comply with the legal requirements stemming from the Digital Operational Resilience Act^[1].

This report summarises the outcome of the 2024 SREP cycle. Chapter 2 covers the assignment of SREP scores to banks’ overall risk profiles and their main elements. Chapter 3 sets out the determination of the Pillar 2 capital requirements and Pillar 2 guidance and Chapter 4 elaborates on qualitative measures. Chapter 5 contains a detailed analysis of selected elements identified as supervisory priorities for 2024-26, including references to dedicated activities conducted by ECB Banking Supervision to address them.

Details on the SREP can be found under the SREP methodology.

2 Developments in scores

2.1 Key messages

The average overall SREP score for 2024 remained stable at 2.6, albeit there were some changes to the distribution across different buckets (Chart 1). Specifically, the proportion of banks with scores of 2-, 3+ and 3 increased, from 65% to 76%, while the proportion of banks with scores of 2, 3- and 4 decreased, from 34% to 23%. The improved scores were mainly driven by the boost to profitability, thanks to the continued favourable economic environment, whereas the poorer scores were attributable to persistent weaknesses in risk data aggregation and reporting and in the effectiveness of management body and internal governance controls. In addition, while some improvements were observed in risk management and internal controls, credit risk deficiencies persist (e.g., concerns about the outlook for commercial and residential real estate portfolios, as well as NPL inflows).

74% of institutions received the same overall SREP score as in 2023, while 11% saw their score worsen and 15% improve (Chart 2). Some of the factors behind the poorer scores included the market impact of commercial real estate, which affected the credit risk scores, and the change in the interest rate environment, which had a particularly heavy impact on the interest rate risk in the banking book (IRRBB) scores. By contrast, the increased profitability and the reduction in market volatility had a positive impact on the overall scores. This was complemented by bank-specific drivers.

Overall improvements in SREP scores were supported by better scores more broadly spread across two or three SREP elements (such as the business model and capital adequacy, or the business model and governance), whereas the poorer scores tended to be associated with a deterioration in only one of the SREP element scores (such as capital adequacy or liquidity).

Chart 1

Overall SREP scores

(percentages)

Chart 2

Changes to banks’ overall SREP scores in 2024 compared with 2023

(percentages)

Table 1 shows the migration of the overall SREP score compared with last year. While the overall SREP scores have remained broadly stable, year on year, the underlying risk-specific scores have shifted. This reflects the detailed supervisory assessment of banks’ specific improvement or deterioration in various areas. Further improvements were observed for the business model, governance, liquidity, market risk and capital, whereas poorer scores were seen not only across the IRRBB categories, but also in credit risk and operational/IT risk. Improvements in business model SREP score were driven by strategic enhancements and strong profitability supported by a favourable macroeconomic environment, while poorer scores reflected a slowdown in NII, cost challenges and strategic weaknesses. Governance scores were mostly affected by management body risk scores, as well as an increase in the relevance of risk data aggregation and risk reporting (RDARR). Liquidity scores reflected banks’ overall robust position in spite of the gradual tightening in financial markets. Market risk scores improved and reflected the exclusion of credit spread risk in the banking book (CSRBB) as a result of the update to the market risk SREP methodology. Nonetheless, supervisors exercised caution in their judgement of risk control. The IRRBB scores were affected by interest rate environment changes, the outcomes of on-site inspections (OSIs) and targeted reviews and the inclusion of the CSRBB. The average capital adequacy score improved slightly mainly on account of increased profitability in 2023, which, in the context of sustainable dividend distribution policies, had improved capital positions. Credit risk scores were steered by the supervisory priority on risk management, together with developments in asset quality. Operational/IT risk scores were largely driven by bank-specific factors.

Over a longer time horizon, e.g., five years, the overall SREP scores show a higher degree of variability as compared with that over one year, as it can take some time to remediate severe structural deficiencies.

2.2 Breakdown by business model

Chart 3 shows the distribution of overall SREP scores in 2024 for different business models. Most overall SREP scores lie in the range of 2- to 3.

• Most asset managers and custodians, as well as a smaller number of corporate/wholesale and development/promotional lenders, closely followed by global systemically important banks (G-SIBs) received a strong score of up to 2-. In the case of asset managers and custodians, this reflects the effects of increased profitability, while there are still some issues regarding internal governance and operational risk. Universal and investment banks, as well as small market lenders, fall evenly between scores of 2 and 3.
• As in the previous year, more than half of retail and consumer credit lenders, as well as more than half of diversified lenders, continued to receive a score of 3+ or worse. For the retail and consumer credit lenders, this continues to be rooted in unresolved weaknesses in management bodies and risk culture, together with deficiencies in their internal control functions.

Chart 3

Breakdown of overall SREP scores by business model

(percentages)

Details on the distribution of the overall capital requirements and guidance by business model are available in Chapter 3. The distribution of scores by risk can be found in Chapter 5, which also includes the supervisory expectations and the key vulnerabilities to be addressed.

3 Capital requirements and guidance

3.1 Key messages

Based on the outcome of the 2024 SREP, the overall capital requirements and guidance applicable for 2025 increased slightly to 15.6% of RWA, compared with 15.5% in 2024 (Chart 7). This was largely driven by an increase in the Common Equity Tier 1 (CET1) P2R, from 1.1% to 1.2%, and in the countercyclical capital buffer requirements (CCyB), from 0.6% in the first quarter of 2024 to 0.7% in the first quarter of 2025. All P2R figures shown include NPE and LF add-ons. The total capital ratio (transitional definition) stood at a weighted average of 19.9% in the second quarter of 2024, and the CET1 ratio (transitional definition) stood at 15.81% in the same quarter. The weighted average RWA density as at the second quarter of 2024 stood at 33.68% and has remained broadly stable since 2020.

Chart 4

Risk-weighted asset density

(percentages, annual average)

The total capital P2R increased slightly but remains, on average, largely in line with the requirements set out in previous years, at around 2.1% of the RWA applicable in the first quarter of 2025, compared with 2.0% of the RWA applicable in the first quarter of 2024. In terms of P2R distribution, the median P2R remained largely stable at around 2.2%, whereas the interquartile range narrowed (Chart 5). The CET1 P2R increased marginally, reaching an average of 1.2% compared with 1.1% in 2023 (Chart 8). The related interquartile range for 2025 is the smallest observed in recent years, ranging between 1.12% and 1.54% (Chart 6).

Chart 5

Distribution of total capital Pillar 2 requirements

(percentages of RWA)

Chart 6

Distribution of CET1 Pillar 2 requirements

(percentages of RWA)

Chart 7 shows the developments in overall capital requirements and guidance over time. In 2022 and 2023, several national competent authorities announced the introduction of or increases in the CCyB and in systemic risk buffers, applicable from 2023 onwards. The current change in the overall capital requirements and guidance was mainly driven by changes in the institution’s risk profile, the NPE coverage shortfall, and LF add-ons. The latter were issued for nine banks, falling within the range of 10 and 20 basis points.

This year, ECB Banking Supervision continued to monitor leveraged transactions and the progress being made in remediating identified deficiencies. At the same time, new banks were added to this sample to ensure a level playing field. The methodology focuses on the concentration of bank exposures to highly leveraged transactions, and the expectation that LF exposures are to be captured in the banks’ risk appetite framework. Several banks were considered to have made insufficient progress and, as a result, a dedicated P2R LF add-on was applied.

Chart 7

Developments in overall capital requirements and Pillar 2 guidance – the total capital stack

(percentages of RWA)

Chart 8 shows the overall capital requirements and P2G to be met with CET1 capital. The average level of CET1 capital increased slightly to 11.3% (compared with 11.2% in 2023). This development brings the capital requirements and P2G back in line with the pre-pandemic level of 11.3%, which was applicable in 2020 following the adjustment of the micro- and macroprudential requirements (i.e., structural and cyclical buffers) during the pandemic.

Chart 8

Developments in overall capital requirements and Pillar 2 guidance in CET1

(percentages of RWA)

Chart 9 shows the breakdown of average capital requirements and guidance for each business model, as applicable in 2025, using estimated values for the combined buffer requirement for the first quarter of 2025. Overall capital requirements and guidance are set at the highest levels for small market lenders, corporate and wholesale lenders and G-SIBs. In terms of the P2R, requirements are set at a comparatively high level for small market lenders, corporate and wholesale lenders and for diversified lenders. Differences in quantitative requirements reflect diverse risk profiles and the possibility that, in some cases, relevant risks may already be addressed effectively by the qualitative requirements.

Chart 9

Overall capital requirements and guidance by business model

(percentages of RWA)

As regards leverage-based own funds requirements, in 13 cases, a P2R-LR add-on (in the range of 10 to 40 basis points) was assigned. In line with the backstop nature of the leverage-based capital stack, the P2R-LR add-ons had a limited impact on the relevant banks. This is because for most banks, the total leverage-based own funds requirements in nominal terms are lower than the risk-based own funds requirements. Overall, the risk of excessive leverage is considered to be low. The weighted average leverage ratio (transitional definition) in the second quarter of 2024 stood at 5.8% in comparison with the overall leverage requirements and guidance which are set at around 3.34% for 2025 (Chart 10).

Chart 10

Overall leverage requirements and guidance

(percentages of total exposure)

3.2 Non-performing exposure (NPE) Pillar 2 requirement add-on

The 2024 SREP cycle resulted in NPE P2R add-ons for 18 banks. For these, a shortfall was identified as against the ECB’s expectations, because the coverage for risks arising from aged NPEs was assessed to be inadequate.

Chart 11

Non-performing exposure shortfall add-ons

(total, basis points)

The relevant institutions were encouraged to close their provisioning gaps by posting the maximum level of provisions permitted under the relevant accounting standards. Where the accounting treatment does not align with the prudential provisioning expectations, the institutions also have the option of adjusting their CET1 capital on their own initiative.^[2]

The RWA-weighted average shortfall in NPE provisions in 2024 amounted to 5 basis points, thus continuing to be stable overall as compared with 2023.

Banks may ask for their P2R add-ons linked to NPE coverage shortfalls to be updated at three quarterly time windows if they reduce the NPE coverage shortfall over the course of the year. This can be achieved through further NPE disposals, increases in provisions, or voluntary deductions from CET1 capital.

For certain institutions with persistent and material coverage shortfalls arising from older NPEs, the relevant P2R add-on was imposed fully in the form of CET1 capital.

4 Qualitative measures

4.1 Key messages

Qualitative measures to address supervisory findings were issued for 97 banks during the 2024 SREP cycle. Most of these were for deficiencies in credit risk (29%), internal governance (23%) and, to a lesser degree, capital adequacy (11%).

• Measures to mitigate deficiencies in credit risk were imposed on 71% of the institutions, equating to the highest percentage across all measures (Chart 12) in line with the supervisory priorities for 2024-26. Almost half of these measures concern the level of NPLs.
• The total number of measures issued across all risk areas decreased as compared with the previous SREP cycle. However, despite this overall decline, in 2024 the percentage of measures relating to credit risk and operational risk increased. For credit risk, this was driven by a rise in internal governance and data reporting measures. For operational risk, this increase reflected ongoing supervisory concerns about cyber resilience in particular.

Chart 12

Qualitative measures

(percentages)

4.2 Distribution of qualitative measures

Chart 13 shows a breakdown by business model of qualitative measures issued during the 2024 SREP cycle. As in 2023, diversified lenders were subject to the highest number of SREP measures in absolute terms (as this is the largest business model category). In relative terms, diversified lenders and G-SIBs averaged around six measures per bank, while the other business model categories averaged around four to five measures per bank.

Chart 13

Breakdown of qualitative measures by business model

(percentages)

For banks with an overall SREP score of 4, an average of around seven new qualitative measures were issued, while for banks with an overall SREP score of 3, the average was six (Chart 14). Among banks with an overall SREP score of 4, governance and liquidity risk measures were the most common type. For further information on qualitative measures, please see Chapter 5.

Chart 14

Average number of qualitative measures by overall SREP score

(totals)

5 Detailed analysis

5.1 Element 1: Business model

5.1.1 Key messages

Euro area bank profitability continued to grow in 2023, with a new high being reached in 2024. Cost pressures began to intensify, with operating profits showing weaknesses in the second half of 2023. As in the previous year, the burgeoning profits and higher revenue generation capacity, coupled with strategic improvements led to 24% of the overall scores improving in the SREP 2024 cycle, clearly outweighing the 7% of scores that had deteriorated. Banks’ profits have increased considerably over recent years thanks to higher interest income as a result of the monetary policy regime shift from a low interest rate environment. Despite the continued positive performance of banks, supervisors still continue to be cautious about the sustainability of banks’ business models. A slowdown in NII, cost challenges, weaknesses in strategic execution, and a worsening business outlook were the main factors behind the few poorer scores.

In 2023 the aggregate return on equity of banks directly supervised by the ECB rose by 1.6 percentage points with respect to 2022, reaching a high of 9.3%, a level last seen prior to the global financial crisis. Banks’ aggregate return on assets rose from 0.5% to 0.6% year on year. As in 2022, the increase in 2023 was driven by higher core revenues. The year-on-year NII grew by 19.7% in 2023, even more than the 14.3% increase seen in 2022. While the aggregate net fee and commission income (NFCI) remained largely flat compared with the previous year, the net trading and investment income (NTII) showed a slight decline. Overall expenses went up year on year by 3.1%, mostly driven by an increase in staff and other administrative expenses, which stood slightly above the euro area annual inflation level of 2.9%. In the second half of 2023, NII growth slowed down amid indications of interest margins contracting. After a short rebound in the first quarter of 2024, NII growth weakened again slightly in the second quarter of 2024.

Supervisory measures in the SREP 2024 cycle addressed shortcomings primarily in the areas of strategy (governance and implementation, strategic change and business plan updates), digitalisation, profitability monitoring and cost review or reduction.

Chart 15

Element 1: Business model SREP scores

(percentages)

5.1.2 Breakdown of SREP scores by business model

Chart 16 shows the distribution of SREP scores by business model across banks with different types of business model.

Chart 16

Breakdown of SREP scores by business model

(percentages)

Against the backdrop of a high interest rate environment, the sustainability of banks’ business models continues to face certain challenges in terms of strategic execution risks; inflationary pressures coupled with macroeconomic uncertainties; shrinking benefits, as lower loan volumes are neutralising the positive contribution of expanding net interest margins; increasing funding costs; as well as gradually deteriorating asset quality. Banks continued to adapt to a changing environment characterised by digital transformation and the impact of climate change. Overall, banks’ profits are expected to decline somewhat in second half of 2024 and 2025, albeit remaining at a comfortable level.

The key observations when comparing peer groups in the 2024 SREP cycle were as follows:

• For G-SIBs, the SREP scores for business model risk in 2024 remained unchanged with no significant deterioration in the bank’ risk profiles. Overall, profitability and income generation improved slightly as against the previous SREP cycle. Cost efficiency deteriorated slightly, as banks struggled to contend with inflationary pressures and implement cost rationalisation. Headwinds remained in terms of delivering on ambitious growth targets and efficiency transformation, balancing complexity against the macroeconomic environment.
• Universal banks continued to significantly benefit from the favourable NII environment. Some score improvements were driven by burgeoning profitability, strategic enhancements and improvements in operating expenses. By contrast, score deteriorations were observed as NII lost its steam and operating expenses increased with respect to their peers. As for other business models, sustainability will depend on strategic execution risks, macroeconomic uncertainties and the forward-looking assumptions for pass-through rates.
• For a second year in a row, diversified lenders remained to be the one peer group with the highest number of score improvements (13 banks) thanks to improved profitability and revenue generation, both in terms of NII and to some extent in NFCI, on the back of past business restructuring and cost-cutting measures. The weak spots for some banks were their NII vulnerability to falling interest rates and shortcomings in strategic governance.
• Investment banks scores continued to be stable with one score improvement attributable to increased profitability on the back of NII. Overall, this peer group’s profitability and revenue generation improved thanks to NII and NTII. Strategic plans and efficient steering mechanisms, improvements in risk management and forecasting capabilities are key areas that require further attention. Cost bases remained excessively high in some cases, affected by revenue and cost-sharing arrangements with parent entities. 
• Contrary to last year, corporate/wholesale lenders managed to improve their revenue generation and profitability, finally benefiting from the interest rate environment. There were two score improvements, fuelled by strong profitability and the implementation of strategic plans, while there was one poorer score owing to difficulties in commercial real estate markets. A further deterioration in the outlook for real estate and certain other markets, cost rationalisation and strategic project steering are areas warranting attention.
• Promotional/development lenders remained to be the peer group with the strongest business model score thanks to a low risk profile and a simple business model. The business model scores continued to be stable. While revenue generation capacity rose slightly, profitability and cost efficiency fell on account of rising administrative and other expenses.
• Retail and consumer credit lenders significantly improved their profitability and revenue generation on the back of favourable NII. Three banks improved their scores boosted by strong results and benefits from strategic transactions, while one score deteriorated as a result of strategic uncertainties. Concerns such as income diversification and cost containment persist.
• Small market lenders had the best performing business model in terms of profitability, revenue generation as well as cost efficiency. The large gains in NII were attributable to the prevalence of variable rate portfolios. There were two score improvements resulting from strong profitability, while one score deteriorated on account of qualitative deficiencies. In terms of sustainability, deficiencies in forecasting and in the realisation of ambitious growth targets, coupled with shortcomings in risk management prevailed, as well as higher exposures to geopolitical risks.
• Asset managers and custodians continued to be among the most profitable peer groups, aided by favourable NII. NFCI continued to fall owing to downward trends across markets, affecting asset valuations and client activity. The business model scores remained stable except for one score deterioration owing to uncertainties surrounding business restructuring. For weaker banks, cost efficiency is now the priority, while competitive pressure emerges as a new concern for some service providers.

5.1.3 Focus on business model profitability and structural factors

In 2023, the return on equity continued to grow, reaching new year-end highs for most business models. The return on equity reached a peak of 10.04% in the second quarter of 2023, gradually falling in the second half of the year to 9.31% at year-end. Year-end return on assets also continued to increase, from 0.5% in 2022 to 0.6% in 2023.

Rising operating expenses, lower operating income, and higher loan loss provisions all contributed to the broad-based fall in profitability in the second half of 2023.

After increasing steadily in the eight preceding quarters, NII ceased to grow during the fourth quarter of 2023, amid early indications that interest margins could be narrowing. Lower loan volumes have now fully offset the positive contribution from expanding net interest margins.^[3]

In the first quarter of 2024, NII rebounded slightly, growing by 2% as compared with the last quarter of 2023, only to weaken again in the second quarter of 2024. NII grew by 6.5% in the first half of 2024 as compared with the same period in 2023, with increasing margins as banks managed to push up their NII faster than their expenses. Furthermore, cyclical variations in loan volumes contributed positively to their NII. In the first half of 2024, NFCI picked up by 8%, as compared with the same period in 2023, with strong contributions from asset management, securities and insurance fees. In terms of NTII, the first half of 2024 showed a significant increase of 22%, as compared with the same period in 2023, on the back of strong contributions from equity and foreign exchange instruments. As a result of these developments, the aggregated return on equity and return on assets reached new highs of 10.1% and 0.7%, respectively, in the second quarter of 2024 (see Chart 17).

Chart 17

Return on equity and cost of equity by business model

(percentages)

As shown in Chart 18, the year-end 2023 aggregated cost-to-income ratio decreased by 4.2 percentage points to 57% as income grew faster, outpacing operating expenses on the back of positive NII. Operating expenses increased by 3.1% in 2023, with staff costs being the main driver. The cost-to-income ratio has been gradually declining since the first quarter of 2022, with this trend stalling somewhat in the fourth quarter of 2023. This was mainly driven by a sharp increase of 13% in quarterly operating expenses, as compared with the third quarter of 2023, which included an increase in staff costs of 14%, while NII growth came to a halt. This sharp quarterly increase might, however, have reflected some seasonal adjustments, given that, when comparing with the fourth quarter of 2022, costs increased more moderately, by 4.2% and 6.2% for operating and staff costs, respectively. This compares with euro area inflation and wage growth of 2.9% and 4.5%, respectively, in 2023.

The trend of a declining cost-to-income ratio continued into the first half of 2024, reaching a new low of 54.2%, as income rose and expenses fell. In the first half of 2024, custodians and asset managers, on the one hand, and small market lenders, on the other, were the only peer groups with a deteriorating cost-to-income ratio. In the first half of 2024, development and promotional lenders saw a significant improvement in their cost-to-income ratio driven mostly by revenues. The cost-to-income ratio of G-SIBs showed some improvement. However, inflationary pressures, difficulties in streamlining cost-heavy business structures and additional investments weighed heavily on some G-SIBs. On the revenue side, the NII generation capacity of French banks was dampened by a significant share of fixed rate assets and regulated deposits.

Chart 18

Cost-to-income ratio by business model

(percentages)

5.1.4 Focus on digitalisation

ECB Banking Supervision continues to prioritise its assessment of banks’ progress in digitalisation, focusing on how banks identify, monitor, and mitigate related risks. The ECB has developed and published key assessment criteria and sound practices to be considered when determining the impact of digitalisation on banks’ business models, governance, and risk management.

The targeted reviews performed in 2023-24 involved 21 significant institutions and resulted in bank-specific feedback letters being sent to these institutions, with the purpose of i) sharing feedback on specific gaps identified in respect of the assessment criteria, also based on a comparison with peers; and ii) encouraging banks to reflect on those gaps and provide an action plan to address them.

The key observations were that banks that had adopted sound practices carefully assessed both the opportunities and risks inherent in their digital strategies, ensured that these strategies were embedded in their business and IT frameworks and consistently assessed their effectiveness. The digitally most advanced banks focused on incremental digital improvements and had transformed both back and front office operations, albeit many still did not have sufficiently granular key performance indicators to measure the impact of their digital strategies on profit and loss. Establishing clear key performance indicators throughout the execution phase of digitalisation projects can effectively support the assessment of progress, while strong organisational awareness, a digital culture, and enhanced digital expertise at management level are crucial for effective strategy implementation and risk monitoring. Sound practices also include involving independent internal control functions from the outset and conducting holistic assessments of the digital strategy’s impact on the overall risk profile, including IT-related risks, outsourcing dependencies, and financial risk exposure. Effective data governance and robust information sharing with a well-equipped management body are essential for managing the risks associated with digitalisation.

Going forward, ECB Banking Supervision will expand the focus of its supervisory activities to include reviewing the use of specific technologies more broadly, including the deployment of artificial intelligence and related business use cases. In addition, the ECB will strive to better understand the linkage between banks’ effort to evaluate digitalisation initiatives and their decision to make and measure investments. This will allow supervisors to sharpen their assessment of the profitability implications, risks and benefits of banks’ digitalisation strategies and banks’ use of innovative technologies.

5.1.5 Supervisory expectations

In this SREP cycle, supervisors continued to focus on tackling the long-standing issues affecting the robustness of business models, such as strategic concerns, profitability steering and cost challenges. The largest group of qualitative measures in the 2024 SREP (Chart 19) related to the need for improvements in strategic governance and its implementation (29%), followed by i) changes or updates to banks’ strategies, ii) improvements in profitability monitoring frameworks, iii) cost review and reduction, and iv) digitalisation (16% in each category).

Chart 19

Detailed breakdown of business model-related measures

(percentages)

5.2 Element 2: Internal governance and risk management

5.2.1 Key messages

The importance of strong governance and sound risk controls was once again brought to the fore by the failures of some US and Swiss banks in 2023. Despite the progress made by banks over the past few years, internal governance and risk management remain areas of high concern. ECB Banking Supervision expects banks to step up their efforts and adequately adjust the risk dimensions in their business strategies and risk management frameworks to successfully address any adverse changes in the continuously evolving risk environment.

The main 2024 SREP findings on internal governance and risk management can be grouped together as follows.

1. Despite some progress, the effectiveness of management bodies, and in particular their oversight role, remains an area warranting attention for several institutions. This concerns some insufficiencies in the board composition and its collective suitability, in the succession planning and in the bank’s challenge culture.
2. Despite a positive trend, insufficient resources, in both qualitative and quantitative terms, still weaken the operational functionality of internal control functions for several institutions (especially for risk management and compliance functions).
3. Progress on the risk data aggregation and risk reporting remediation programmes drawn up over recent years remains slow and insufficient, causing persisting fragmented and non-harmonised IT landscapes, with a low capacity for aggregating data at group level.

As shown in Chart 20, these issues are reflected in the internal governance and risk management scores. The concentration around the scores between 3+ and 3- increased further in 2024 (85% of banks), driven by a decline in the number of banks that scored 4 and 2.

Chart 20

Element 2: Internal governance SREP scores

(percentages)

5.2.2 Breakdown by business model

As shown in Chart 21, the distribution of internal governance and risk management scores is highly concentrated around scores of 3 across all business models, except for those of asset managers and custodians. Banks with these business models score better in almost all sub-categories, and particularly in terms of organisational structure, the compliance function, remuneration and RDARR.

Although Element 2 scores generally remained stable, there were several changes at the sub-category level. Whereas RDARR worsened for most banks, the other sub-categories improved overall for G-SIB and G-SIB universal banks, development/promotional lenders, corporate/wholesale lenders, small market lenders and investment banks. By contrast, the scores deteriorated for custodian and asset managers as well as for diversified lenders. The score of only one of the five institutions that had a score of 4 in last year’s SREP cycle did not improve, remaining the only one with such a score. This institution’s score falls under the business model of retail and consumer credit lenders. Severe weaknesses in RDARR and management bodies were the primary drivers behind this score.

Chart 21

Breakdown of internal governance SREP scores by business model

(percentages)

5.2.3 Focus on risk data aggregation and risk reporting

Risk data aggregation and risk reporting (RDARR) has been a supervisory priority for ECB Banking Supervision over the past few years, as the ability of institutions to effectively manage and aggregate risk-related data is an essential precondition for sound decision-making and strong risk governance. This applies to any data used to steer and manage institutions, both strategically and operationally, as well as data used for risk, financial and supervisory reporting. However, difficulties in terms of data accuracy, integrity, completeness, timeliness and adaptability are still widely encountered, suggesting that institutions are still focusing on the cost and implementation challenges of improving their RDARR, rather than the benefits of remediating long-standing deficiencies in this area.

Against this background, ECB Banking Supervision has intensified its supervisory approach, including the recent publication of the ECB Guide on effective risk data aggregation and risk reporting. In this context, in 2024, the ECB conducted targeted reviews of banks’ RDARR capabilities, in which supervisors analysed their weaknesses in RDARR, communicated them to banks and decided to follow up with an enhanced framework for addressing severe findings with prudentially relevant implications.

Furthermore, a management report on data governance and data quality was integrated into the 2024 SREP assessment of RDARR, which allowed supervisors to identify potential signs of weaknesses in data aggregation capabilities, as well as to check the status of compliance with the supervisory expectations as outlined in the aforementioned ECB Guide. The purpose of this initiative was also to increase the level of awareness and accountability of banks’ management bodies in terms of the oversight of the production and submission of supervisory data, as well as the production of internal and financial reporting.

5.2.4 Focus on the effectiveness of management bodies

In line with the ongoing focus on governance shortcomings, a targeted review of management body effectiveness was conducted on 39 banks. This exercise identified concerns regarding the board’s and board committees’ challenging capacity and effective performance of oversight tasks, with root causes in composition and functioning. ECB Banking Supervision focused on the remediation of these shortcomings and followed up by addressing the findings in the supervisory dialogue with the institutions, targeting specific concerns via operational acts or by escalating long-standing structural issues through the SREP for the affected banks.

5.2.5 Other key supervisory concerns and actions

Both the global financial crisis and idiosyncratic bank failures have shown that deficiencies in internal governance and risk culture can often be seen as early warning signals or, more importantly, as a root cause of difficulties ahead. Shaping the organisation of a bank and its management body, as well as defining its values, norms, expected behaviours and collective mindset are key to ensuring the soundness of its business operations, strategic planning, and decision-making. Better strategic steering capabilities particularly help to address the challenges stemming from the constantly evolving environment in which banks operate.

In line with the draft ECB guide on governance and risk culture, ECB Banking Supervision has increased its focus on risk culture through a benchmarking exercise targeting the remuneration policies and practices of a sample of banks and their impact on how incentives align risk-taking behaviour with the bank’s risk profile and long-term interests. The attention to risk culture will continue in the upcoming SREP cycle with another benchmarking exercise targeting the risk appetite frameworks of a sample of banks and allowing supervisors to understand how banks integrate and monitor certain cross-cutting risks, such as geopolitical risks.

5.2.6 Supervisory expectations

In the 2024 SREP cycle, the largest group of qualitative measures relating to internal governance and risk management focused on the need to improve the management body (34%), followed by measures relating to RDARR (15%), the risk management framework (11%) and risk control functions (ranging between 8% and 10%).

Chart 22

Breakdown of qualitative measures relating to internal governance and risk management

(percentages)

The proportion of qualitative measures relating to management bodies remained relatively high in 2024, in line with the supervisory priorities for 2024-26. Almost one-third of the banks was subject to at least one measure in this area.

The number of measures relating to RDARR has increased since the SREP 2023 cycle, with RDARR remaining the worst-rated sub-category of internal governance. This can be attributed to the increased application of supervisory pressure in this area.

5.3 Element 3 – Block 1: Credit risk

5.3.1 Key messages

Average credit risk scores remained overall stable in the context of a gradual deterioration in asset quality since the second half of 2023, which reversed the long-term declining trend in NPLs. On the one hand, this can be explained by a resilient retail sector supported by the prevalence of fixed rate mortgages and a robust labour market, as well as by sustained NPL reductions in countries with high NPLs, particularly those in southern Europe, all of which has led to some improvement in credit risk scores. On the other hand, commercial real estate (CRE) markets have weakened, particularly in Germany and Austria, owing to high interest rates, sluggish economic growth, and shifting demand dynamics. Furthermore, exposures to small and medium-sized enterprises (SMEs) have experienced a more widespread deterioration, reflecting a marked increase in corporate insolvencies across Europe from mid-2022, with insolvency rates exceeding pre-pandemic levels by mid-2023, and reaching their highest levels since 2015^[4]. Overall, 35% of the credit risk scores changed given these developments, nonetheless leaving the average credit risk score unchanged.

As in the previous year, credit risk scores continue to reflect supervisory concerns about banks’ credit risk management, which remains a priority for ECB Banking Supervision. Particular attention has been paid to the remediation of long-standing deficiencies with respect to the International Financial Reporting Standard (IFRS) 9 frameworks, and to risk identification and monitoring.

Therefore, and throughout 2023, ECB Banking Supervision continued to take extensive supervisory action, reflecting several of its supervisory concerns. To begin with, supervisors carried out targeted reviews of portfolios that were more sensitive to the current macro-financial situation. A follow-up targeted review of CRE lending was performed to i) address the material increase in the refinancing risk of bullet loans as a result of elevated interest rates and falling market prices, and ii) assess how banks were capturing heightened refinancing risk within their CRE portfolios. The targeted review of residential real estate was extended to include more banks to assess the resilience of their portfolios, their loan origination process, as well as their collateral valuations. Finally, given the deteriorating asset quality within the SME sector, supervisors now assess the process by which banks identify and manage vulnerable sectors within the SME portfolio across the credit risk management cycle (loan origination, monitoring, risk classification, and repayment capacity).

Furthermore, several supervisory actions initiated during the previous SREP cycle were continued, followed up or extended. The targeted review of IFRS 9 overlays and novel risks coverage was repeated to monitor banks’ progress and remediation of past findings. Similarly, dedicated activities conducted by ECB Banking Supervision on forbearance and unlikeliness to pay (UTP) risk introduced last year were extended to include more banks. The purpose of the forbearance review was to evaluate how well banks identify, implement and classify their forbearance measures, as well as monitor their portfolio of forborne exposures. As for the UTP risk review, it was used to examine the adequacy of the governance set-up and the completeness of the UTP indicators and triggers for the appropriate classification of NPLs.

As regards counterparty credit risk, ECB Banking Supervision is currently scrutinising the remediation of findings from previous off-site and on-site reviews, with a particular focus on exposures to non-banking financial institutions and highly leveraged or risky counterparties, as well as on convergence towards good practices at the international level.

The outcomes of these supervisory activities have either informed the credit risk scores and already been factored into the 2024 SREP, or are expected to feed into the 2025 SREP, as in the case of the ongoing review of SME portfolios, for example.

Chart 23

Element 3: Credit risk SREP scores

(percentages)

5.3.2 Breakdown by business model

Significant differences remained between business models in terms of credit risk scores (Chart 24).

• The greatest deterioration in average credit risk scores was observed within corporate and wholesale lenders (3.1 compared with 2.6 in 2023). This can be explained by a material increase in significant exposures to CRE and the pending remediation of deficiencies relating to early warning systems, forbearance, and UTP.
• Diversified lenders marginally improved their credit risk profile (3.0 in 2024), with 14 banks scoring the same as in 2023 and 7 banks achieving better scores. Some of these succeeded in further reducing their NPLs and foreclosed assets, as well as increasing their risk coverage. Nonetheless, some banks continued to experience increasing NPLs originating from portfolio exposures to vulnerable sectors, such as the CRE and SME sectors. Additionally, diversified lenders still revealed deficiencies in risk identification and risk monitoring, particularly in areas such as IFRS 9, internal ratings-based models, as well as in collateral revaluation.
• Retail and consumer credit lenders (including two new banks in 2024) also improved their credit risk profile (2.4 as compared with 2.5 in 2023) following the remediation of deficiencies related to residential real estate, internal governance, and a reduction in NPLs and foreclosed assets. This improvement was undermined by the pending remediation of several deficiencies falling under the supervisory priorities. Some banks were faced with severe weaknesses in interest-only loans or the IFRS 9 overlay framework, while others were challenged by CRE pressures.

Chart 24

Breakdown of credit risk SREP scores by business model

(percentages)

5.3.3 Credit risk and counterparty credit risk management

A moderate deterioration in asset quality continued, following the same trend observed throughout the third and fourth quarters of 2023. The volume of NPLs held by banks at the end of the second quarter of 2024 continued, increasing to €356 billion, thus resulting in a year-on-year change of +3.7%. This amounted to a NPL ratio of 2.3% (excluding cash balances at central banks and other demand deposits), broadly unchanged from the year before, as shown in Chart 25. This increase was primarily attributable to the deteriorating quality of assets in SME and CRE portfolios, particularly in institutions located in Austria, Germany, and to a lesser extent, France. NPL ratios were, on average, higher in those countries most affected by the earlier global financial crisis, such as Greece, Italy, Cyprus, Spain and Portugal, however, these ratios have now converged, reaching the average NPL ratio of the other euro area countries. In addition, legacy NPLs past due more than two years stood higher, on average, as a percentage of all loans and advances, in Greece and Cyprus than in all other euro area countries.

Chart 25

Non-performing loans held by banks

(Volumes in EUR billions, ratio as a percentage)

Stage 2 loans and advances (defined under IFRS 9 as loans for which credit risk has significantly increased since initial recognition), while fairly stable, remained high. 9.45% of total loans and advances were classified as Stage 2 as at the second quarter of 2024, as compared with the pandemic level of 8.41% in the second quarter of 2020 (Chart 26). Stage 2 stock continued to be quite stable, with the stock of loans (denominator) increasing. Coverage ratios across portfolios continued to decline, currently standing at 3.47%. In addition, total forborne exposures continued to gradually fall, dropping to below pre-pandemic levels, and levelling out at €296 billion in the second quarter of 2024, as compared with €332 billion at the end of 2019.

Chart 26

Stage 2 ratio, Stage 2 coverage and total forborne exposures

(percentages, EUR billions)

As an ongoing supervisory priority, the review of credit risk management frameworks continued to be the focus of a range of targeted activities. ECB Banking Supervision followed up on the targeted review of IFRS 9 provisions, as well as on areas raised in the “Dear CEO letters” by way of coordinated deep dives on forbearance and UTP policies. In addition, ECB Banking Supervision performed targeted reviews to assess banks’ credit risk management, focusing on credit risk-sensitive portfolios such as residential real estate, CRE and vulnerable borrowers within SME portfolios.

In recent years, banks have faced an evolving landscape of risks, brought to the fore by the COVID-19 pandemic’s impact on borrower solvency, followed by energy supply risks, geopolitical uncertainties, higher interest rates, inflation, and climate change. This dynamic environment has challenged traditional provisioning frameworks reliant on historical data. To address this, ECB Banking Supervision encouraged banks to use forward-looking tools to help them anticipate and mitigate these emerging risks, with a particular focus on how banks incorporated forward-looking information into their expected loan loss provision practices under IFRS 9. The purpose of the targeted follow-up review of collective IFRS 9 provisions was to understand how supervised banks captured such novel risks and challenges. The exercise was a follow-up to the 2022 targeted review, triggered by the wide use by banks of out-of-model adjustments, called overlays, in order to capture the impact of extraordinary events such as the pandemic, Russia’s war against Ukraine or the energy crisis.^[5] In the targeted follow-up review, ECB Banking Supervision observed that overlays remained the most widely used tool to address novel risks but that the reliance on these overlays remained very different across banks. The review revealed clear progress in banks’ identification of novel risks. However, much attention still needed to be paid to quantification and accounting implementation techniques (e.g., methodologies to build overlays, interaction between overlays and staging). ECB Banking Supervision is following up on these remaining deficiencies through dedicated operational acts sent to the supervised entities.

The preliminary results of the deep dive on the UTP process revealed deficiencies predominantly in terms of the forward-looking elements and documentation on the assessment of repayment capacity, as well as on the irregularities exiting from the default UTP process. This exercise will be followed up as part of the regular supervisory engagement.

Last year’s analysis of the deep dive on forbearance was made available in the Supervision Newsletter and revealed that banks needed to improve in three particular areas: identifying clients in financial difficulties, and granting and monitoring forbearance measures. As part of the ongoing deep dive on forbearance, ECB Banking Supervision also identified additional deficiencies relating to inconsistencies in the classifications and assessments across banks of such financial difficulties, a lacking approach to standardisation with inadequate documentation of the forbearance measure processes, weak portfolio monitoring and incomplete implementation of the forbearance-related UTP triggers. The outcome of this exercise was either communicated to banks in dedicated operational acts or incorporated into existing supervisory engagements. With regard to the aforementioned targeted reviews, ECB Banking Supervision will oversee the corrective measures taken by banks to close their remaining gaps in credit risk management.

5.3.4 Vulnerable sectors

In the face of the challenging macroeconomic climate of higher interest rates, geopolitical uncertainties and higher inflation, banks are currently operating in an environment that increasingly challenges the creditworthiness of borrowers. This is reflected in a marked rise in corporate insolvencies across Europe since mid-2022, with bankruptcy rates already surpassing pre-pandemic levels by mid-2023.^[6] Firms in the CRE sector and SMEs have been particularly vulnerable in this respect owing to factors such as higher interest expenses, declining property values and lower profits. While government support during the pandemic subdued the insolvency rates, the recent surge in inflation indicates a growing deterioration in the quality of assets, which is also beginning to emerge on banks’ balance sheets.

The ongoing corrections in the CRE sector, particularly in the lower asset quality segments, such as office and retail, posed a significant challenge as the demand dynamics shifted and asset prices fell. The NPL ratio for loans secured by CRE has increased significantly over the past cycle. Bullet and balloon loan structures with shorter maturities were particularly vulnerable to refinancing risks, as identified in the follow-up to the targeted review of CRE.

In addition to the CRE sector, SME portfolios, which represent around 50% of the corporate loans in supervised entities, are currently showing early signs of asset quality deterioration. This heightened risk is evidenced by increasing NPLs, arrears and default probabilities, particularly in the construction sector, fuelled by falling demand and rising material costs.

On the positive side, asset quality in the retail sector remains relatively stable, supported by a strong labour market and the prevalence of fixed rate mortgages in several European countries. That said, the full impact of higher interest rates on the refinancing of low interest rate mortgages from the previous decade could lead to an increase in NPLs in the future.

Looking ahead, supervisors will continue to actively engage with banks to ensure that the management of vulnerable portfolios is both robust and responsive to the evolving risk landscape. They will follow up on the results from the CRE targeted review, with a focus on bullet loans, and will continuing to monitor collateral valuation practices. A recent targeted review of residential real estate, focusing on emerging risks, found that residential real estate exposures were material across supervised entities and that emerging risks had not yet been adequately mitigated.^[7] Additional inspections of SME and retail portfolios are planned for the upcoming cycle and are expected to provide deeper insight into banks’ risk management practices for these loans.

5.3.5 Supervisory expectations

In this SREP cycle, supervisors addressed bank-specific concerns about credit risk management by applying 141 qualitative measures to 74 banks across all business models (Chart 27). Similarly to last year, most qualitative measures (44%) pertained to strategic and operational planning regarding the level of NPLs for banks with high NPLs, to prudential NPL coverage expectations and the related reporting. While other measures relating to governance, data and reporting increased (24% as compared with 17% last year), a lower number of measures related to prudential classification and IFRS 9 (5% as compared with 11% last year).

Focusing on the supervisory priorities for 2024-26, 46% of the qualitative measures related to shortcomings in credit risk management frameworks in all categories listed below other than NPEs, to internal models/ICAAP and FX settlement risk.

Chart 27

Breakdown of credit risk-related qualitative measures

(percentages)

5.4 Element 3 – Capital adequacy and Element 3 – Block 2: ICAAP

5.4.1 Key messages

Capital adequacy scores remained broadly stable, albeit with several changes in their distribution as compared with 2023. Around 68% of banks were assigned the same score as in the previous SREP assessment cycle, while 10% saw their score deteriorate and 22% received an improved score (Chart 28).

In the 2024 SREP cycle, supervisors continued to focus on progress in institutions’ capital planning, by assessing their capital planning frameworks, processes, capacity and the general quality of these frameworks in the context of political and macroeconomic uncertainties. These factors have a major impact on the reliability and timeliness of updates to banks’ capital projections, which accentuates the importance of prudent, comprehensive, forward-looking capital plans. Moreover, banks’ risk identification, measurement and aggregation capacities warranted continued scrutiny, in addition to their risk data and IT infrastructures.

Based on data from the second quarter of 2024, no institutions had capital levels below the required sum of overall capital requirements, buffers and guidance (Chart 29). The weighted average RWA density as at the second quarter of 2024 stood at 33.68% and has remained broadly stable since 2020.

Chart 28

Element 3: Capital adequacy SREP scores

(percentages)

Chart 29

CET1 capital headroom against overall capital requirements and Pillar 2 guidance after the 2024 SREP

(percentages)

5.4.2 Breakdown by business model

As for the distribution of capital adequacy scores broken down by business model, there is a strong concentration of scores of 2 and 3 among G-SIBs, universal and investment banks, and retail and consumer credit lenders. The capital adequacy score of 1 is less frequent and mainly assigned to corporate/wholesale lenders and development/promotional lenders, followed by asset managers/custodians, and small market lenders.

Chart 30

Breakdown of capital adequacy SREP scores by business model

(percentages)

5.4.3 Supervisory expectations

ECB Banking Supervision expressed ongoing concerns about the effectiveness of banks’ capital planning frameworks and their ability to generate reliable capital projections under baseline and adverse scenarios as part of the overall ICAAP assessments.^[8] Consequently, 38% of capital adequacy-related measures issued in the 2024 SREP cycle required institutions to improve capital planning. 15% of new measures focused on risk identification, aggregation and measurement methodologies and procedures, while 13% related to capital adequacy specifically. As set out in the ECB 2018 ICAAP Guide, institutions are expected to continuously improve their ICAAPs and the related practices, as these constitute key factors in effective risk management.

Chart 31

Breakdown of capital adequacy-related qualitative measures

(percentages)

5.5 Other risks

5.5.1 Market risk

As part of market risk, supervisors assessed risk management practices across institutions, as well as the size and materiality of market exposures given the risk factors underlying the instruments held by the bank. Compared with the previous SREP cycle, the market risk combined scores had improved overall, reflecting low to medium level risk in the current macroeconomic and financial context.

An update of the SREP methodology, which also reflected the new EBA guidelines (EBA/GL/2022/14) on the IRRBB and the CSRBB, implied the reallocation of the assessment of the CSRBB from market risk to the IRRBB. This translated into an overall positive effect on the market risk combined scores.

During the current SREP cycle, most of the qualitative measures issued to address severe findings related to market risk identification and strategy, as well as to the risk appetite.

5.5.2 Interest rate risk in the banking book

The combined scores of the IRRBB were seen to have deteriorated, reflecting a fast- changing interest rate environment requiring the dynamic adaptation of risk modelling, ongoing supervisory scrutiny through horizontal projects and an on-site inspection campaign, as well as the methodological reallocation of the CSRBB from market risk to the IRRBB.

After a relatively long period of very low/negative interest rates that continued well into the post-pandemic phase, a global surge in inflation triggered a gradual increase in official interest rates by central banks. In some cases, the upward trend in interest rates was exacerbated by heightened uncertainty in the financial markets, as well as by increasing geopolitical risks. Changes in interest rates directly affected institutions’ NII, as well as their equity valuations, both with an opposite effect, independently of the direction of the interest rates. This required institutions to undertake dynamic repositioning and to redevelop modelling approaches in order to adapt their management of the IRRBB and the CSRBB in such a way as to withstand these effects.

In line with the supervisory priorities for 2024-26, supervisory activities continued in 2024 to assess banks’ ability to adapt to the changing interest rate and credit spread environments. These activities were based on four consolidated pillars: (i) targeted reviews of interest rate and credit spread risks, (ii) an on-site inspection campaign, (iii) an IRRBB SREP methodology update, and (iv) targeted reviews of asset and liability management (ALM) governance and strategy.

The targeted review of interest rates and credit spread risks assessed institutions’ ability to manage the impact of interest rate shocks, such as a 400 basis point shock, which is 200 basis points higher than the regulatory shock. In addition, it also addressed aspects such as hedging practices, behavioural modelling of customers and the CSRBB. The review, which had covered 29 banks in 2022, was extended to cover an additional sample of ten banks in 2023.

The targeted review of ALM governance and strategy complemented the review of interest rate and credit spread risks, placing the focus on the interaction between IRRBB management and funding and liquidity risk management. These reviews covered risk management and measurement, data quality controls, the preparedness of banks to implement the latest EBA Guidelines on IRRBB and CSRBB, as well as the overall ALM governance and strategy. The results of these two reviews also served as a basis for planning and conducting more focused and thorough on-site inspections. The results of the targeted reviews and the on-site inspections pointed in some cases to room for improvement in the management of the IRRBB/CSRBB, namely in terms of risk quantification, model validation, monitoring and risk appetite frameworks. In particular, the CSRBB frameworks appeared in some cases underdeveloped. Nonetheless, supervisors were also able to harness good practices during these exercises, which provided input for the ECB’s implementation of the new EBA Guidelines on IRRBB and CSRBB, as well as for the update of the SREP methodology.

As the interest rate environment in Europe continues to evolve, and with recent decisions by the ECB Governing Council to cut interest rates, supervisors will remain vigilant in monitoring banks’ ability to manage the IRRBB and the CSRBB effectively, as risk premia shocks could still materialise at short notice if ECB rates were to remain lower than market rates. The focus will be on ensuring that banks have robust, forward-looking risk management practices in place that can adapt to various interest rate scenarios, including the associated impact on net interest margins and the overall economic value of the balance sheet. Not only ECB rates, but also market rates and changes in risk perspectives could also affect the IRRBB and the CSRBB and this needs to be reflected in banks’ forward-looking risk management.

5.5.3 Operational and ICT risk

Operational and ICT risk continued to be the SREP element with the worst average scores, with its ICT risk component being the worst average scored of all.

A revised 2024 SREP methodology for IT risk, operational risk and operational resilience was used for this SREP cycle. The three main objectives of the revision were to (i) reduce the dilution of IT risk in the SREP framework, (ii) facilitate a SREP multi-year assessment of operational risk, and (iii) allow for a single view of operational resilience. This more targeted approach enabled supervisors to better identify ICT-related risks within aggregate operational risk, while also facilitating more tailored supervisory follow-ups in the area of ICT risk.

The continuous importance of operational risk and resilience and the ever-growing importance of ICT for banks remained key challenges. This could be explained not only by increasing digitalisation, changes in consumer preferences, competition from fintech and an increased reliance on IT outsourcing but also by the new Digital Operational Resilience Act requirements and the ongoing industry effort being made in anticipation of it. Operational risk and ICT risk scores were driven by idiosyncratic factors. The two key common deficiencies identified in the 2024 SREP cycle were (i) the management of risks related to IT outsourcing, and (ii) IT security and cyber risk management, including cyber resilience, and in some cases, basic cyber hygiene measures.

IT-related outsourcing expenses continued to increase, particularly cloud expenses. This phenomenon was also coupled with a rising trend in the unavailability or poor quality of outsourced services, including those relating to critical activities. Nevertheless, banks’ cybersecurity resilience and reporting of cyber incidents still showed room for improvement and therefore warrants further attention.

Operational risk loss and loss events were still primarily driven by (i) execution, delivery, and process management; and (ii) conduct risk and external fraud.

The targeted review on outsourcing evaluated the outsourcing policies and risk controls of banks. The review consisted of an assessment of the outsourcing governance framework and a review of sampled outsourcing arrangements. This review is scheduled to span three years. In this SREP cycle, it revealed deficiencies particularly in the areas of (i) outsourcing policies and definitions, (ii) governance arrangements, (iii) pre-outsourcing analyses, and (iv) exit strategies and business continuity management. In 2023, the review covered 11 banking groups and was extended to include ten more banking groups in 2024.

The targeted review of cyber resilience assessed the implementation of basic cybersecurity measures by participating banks. The results identified room for improvement in some banks’ cybersecurity posture, e.g., in the areas of backups and recovery, identity and access management, hardening, and network segmentation. The findings were broadly in line with observations from on-site inspections and the cyber resilience stress test. The review, which covered 15 entities from 13 banking groups in 2023, was extended to cover an additional nine entities from six banking groups in 2024.

5.5.4 Climate risk

Climate and environmental (C&E) risks have been a supervisory priority since 2022. To address these risks, ECB Banking Supervision has gradually intensified its efforts to ensure that banks properly identify, evaluate and manage C&E risks.

Following the 2022 thematic review of C&E risks, ECB Banking Supervision announced that it would closely monitor and, if necessary, enforce climate-related deadlines, which would be communicated to the supervised entities. These institution-specific interim deadlines generally followed a number of milestones.

By March 2023, supervised entities were expected to focus on adequately categorising C&E risks and conducting a full assessment of their impact on their institutions’ activities. A number of banks had not yet satisfactorily delivered on this. In response, ECB Banking Supervision adopted 28 binding decisions, 22 of which envisaged periodic penalty payments for non-compliant institutions. Most banks have meanwhile submitted a meaningful materiality assessment.

By December 2023, banks were required to incorporate C&E risks into their governance, strategy, and risk management frameworks.

In the first half of 2024, a review of and a benchmarking exercise on banks’ remedial efforts with regard to identified shortcomings in C&E risks were conducted as part of the monitoring of the December 2023 deadlines, outside of the regular SREP cycle.

As with the first interim deadline, most banks have progressed and foundational frameworks for C&E risks are now broadly in place. That said, weaknesses further impairing the adequate management of C&E risks remain prevalent and these were communicated in further feedback letters to the relevant banks. The ECB continues to closely monitor the progress of these institutions, also as part of the ongoing supervisory dialogue. At the same time, in a concentrated group of outliers, foundational elements for adequate C&E risk management are still missing, for which further follow-up action is being taken in line with the escalation ladder. Therefore, the ECB is currently engaging with the banks concerned in the context of the formal process to issue binding supervisory decisions with the potential imposition of periodic penalty payments if they fail to deliver on these requirements.

Supervisory efforts to address C&E risks were also reflected in the 2024 SREP. In the 2024 SREP cycle, C&E risks continued to play an increasing role as a key risk driver in the related supervisory assessments as compared with previous years. C&E risks were considered across all risk types, with a higher relevance for the business model assessment in particular.

Furthermore, for the second time in a row, ECB Banking Supervision increased the number of dedicated on-site inspections relating to C&E risks.

In a final step to monitor and follow up on C&E-related deadlines, by the end of 2024, banks were expected to meet all remaining supervisory expectations regarding C&E risks, as outlined in 2020 by ECB Banking Supervision in the Guide on climate-related and environmental risks, including full integration of these risks into the ICAAP and stress testing.

In addition, ECB Banking Supervision will continue to engage with the supervised entities through further supervisory assessments, on-site inspections, ad hoc workshops and other interactions as part of its ongoing supervisory activities.

5.5.5 Liquidity and funding risk

Liquidity and funding risk has been identified by ECB Banking Supervision as a key supervisory priority for the past two years, targeting the vulnerabilities regarding the lack of diversification of funding sources, deficiencies in funding plans, as well as shortcomings in ALM frameworks.

The overall score remained stable, with liquidity indicators also remaining robust and well above regulatory requirements.

Short-term liquidity risk remained stable, reflecting medium to low riskiness. The aggregate liquidity coverage ratio (LCR) of all banks marginally improved, from 158% to 159%, between the second quarter of 2023 and 2024 respectively, despite the repayment of more than 80% of borrowed targeted longer-term refinancing operation funds over recent quarters. Repayments of these funds released high-quality liquid assets and had a limited impact on the LCR.

Funding sustainability risk improved slightly, while remaining medium to low. The aggregate net stable funding ratio remained broadly stable, increasing by two percentage points to 128%, while banks retained good access to both retail and wholesale funding. That said, supervisors remained cautious, as some institutions had moved to more volatile sources of funding, which could be a source of vulnerabilities during periods of stress.

On the risk control side, this risk was assessed as being medium to low, with some improvements being driven by the ongoing remediation of existing deficiencies. However, some issues were identified in data quality and reporting, internal controls, and risk management.

Effective liquidity risk management has now become pivotal after years of ample liquidity, the failure of the Silicon Valley bank in March 2023 and heightened geopolitical risks. Without effective risk management, credible contingency funding plans and prudent collateral management, banks remain vulnerable to adverse shocks. In line with the supervisory priorities for 2024-26, supervisors therefore assessed potential shortcomings in ALM frameworks. For that, three targeted reviews were conducted, covering the feasibility of the supervised banks’ funding plans, the adequacy of their collateral mobilisation capabilities, and ALM governance and strategy.

The review of the feasibility of funding plans targeted 28 banks. Banks retained good access to both retail and wholesale funding. However, the review also identified an increasing reliance on market funding sources, with some banks relying more on short-term funding. Moreover, the review revealed that some banks had low or concentrated counterbalancing capacity. In some cases, too optimistic assumptions about developments in deposits and weaknesses in projections or scenarios were identified, which can increase banks’ vulnerability to shocks or stressed conditions.

The review of the adequacy of collateral mobilisation capabilities covered 26 banks. Most have a collateral management policy in place and have solid levels of quickly available liquidity to cover for unforeseen outflows, with cash reserves as a dominating source. However, banks are not equally well equipped in terms of quickly mobilising available liquidity. In addition, the review identified areas of improvement in governance of collateral identification and mobilisation.

The targeted review of ALM governance and strategy covered 22 banks and aimed to understand the features of ALM models and their integration into ALM management, the internal arrangements, and decision-making processes, as well as the level of sophistication of ALM information systems. The review was expected to conclude in the second half of 2024, when good practices and potential deficiencies would be communicated to the supervised entities.

As one of the main supervisory outcomes from the 2024 SREP, qualitative measures were raised for the funding strategy, funding plans and internal controls. In addition, four quantitative measures were included for liquidity risk, which were of an idiosyncratic nature. These measures required, respectively, an add-on for LCR outflows, a currency-specific LCR, and a minimum survival period.

In 2024, ECB Banking Supervision launched an on-site inspection campaign, with a focus on liquidity and funding risk, targeting 14 supervised entities and covering the robustness and appropriateness of banks’ funding and contingency plans, as well as the assessment of the compliance with regulatory liquidity ratios.

For 2025, supervisors will focus on the remediation process for vulnerabilities identified during the targeted reviews, as well as on the finalisation of the on-site inspection campaign, which is expected to take place in the first quarter of 2025.

6 Conclusions and future outlook

The results of the 2024 SREP cycle are a credit to the resilience of the European banking sector, while also revealing existing vulnerabilities and emerging risks. Overall, SREP scores, capital requirements and guidance have remained broadly stable over the past few years, with improvements in banks’ soundness somewhat weighed down by an environment of heightened risk. Despite strong profitability, banks face several challenges, including a slowdown in NII, cost pressures, strategic execution weaknesses, and a deteriorating outlook for core business areas. Also, the declining trend in the ratio of NPLs has reversed, despite remaining at historical lows. ECB Banking Supervision will continue its focused effort to promote prudent risk behaviour and proactive risk management, ensuring that banks remain resilient and continue to support the real economy during these challenging times.

Over the past decade, ECB Banking Supervision has successfully strengthened banks’ resilience, reduced legacy risks, and promoted sound governance, while harmonising supervisory standards across the banking sector through best practices and comprehensive methodologies. While the banking sector continues to exhibit strength and stability, supervisory caution is warranted in view of factors such as increasing geopolitical risks, ongoing macroeconomic challenges, and key megatrends such as digitalisation, climate change and demographics, as well as the threat of cyber incidents.

In response to this evolving risk landscape, ECB Banking Supervision has undertaken a major initiative to further enhance the efficiency and effectiveness of European banking supervision, particularly through the SREP. This new approach aims to make European banking supervision more efficient, targeted, and flexible by focusing on key risks, reducing changes to supervisory methodologies, improving communication, and exploiting advanced technology, while maintaining strong oversight at all times.

The 2024 SREP outcome has also helped to identify the key vulnerabilities for the euro area banking sector going forward and therefore to inform the decision on the supervisory priorities for 2025-27.