Joint Committee Update on risks and vulnerabilities in the EU financial system - Autumn 2026

What happened

The European Supervisory Authorities released their Autumn 2026 risk update, highlighting external dependencies, emerging technologies and private credit as key vulnerabilities for the EU financial system. They note heavy reliance on non‑EU ICT service providers and payment systems, which could amplify geopolitical and cyber shocks. The update also flags rapid AI advances and growing private‑credit exposure as emerging risk vectors. No new regulatory measures were announced, but the ESA calls for heightened vigilance across banking, insurance and investment‑fund sectors.

Why it matters

Financial institutions with significant non‑EU technology contracts should reassess third‑party risk and cyber‑resilience plans, as similar exposure could attract supervisory scrutiny under DORA.

Business impact

Institutions may need to accelerate diversification of ICT suppliers and strengthen AI governance to mitigate heightened cyber‑risk exposure.

Checklist

• Review third‑party contractsHigh priority

  Map all non‑EU ICT service providers and assess compliance with DORA's ICT risk management requirements.

• Enhance AI risk controlsMedium priority

  Implement governance processes for AI models used in critical operations, documenting risk assessments and mitigation steps.

Who reported it

Discussion