Global rifts and financial shifts: supervising banks in an era of geopolitical instability

Keynote speech by Claudia Buch, Chair of the Supervisory Board of the ECB, at the eighth European Systemic Risk Board (ESRB) annual conference on “New Frontiers in Macroprudential Policy”

Frankfurt am Main, 26 September 2024

When the ESRB first met in 2011, the global financial system was still recovering from the financial crisis.^[1] The dark clouds of the European sovereign debt crisis were on the horizon, but the full force of the storm had yet to break.

This was a time of institution building in Europe, of designing new microprudential and macroprudential instruments, in a spirit of confidence that global cooperation works. The G20 Pittsburgh Summit of 2009 was emblematic of this cooperative spirit, as policymakers decided on a comprehensive reform package to make the global financial system safer.^[2]

Today, the world looks very different.

On a positive note, the reforms have worked. Banks are better capitalised and have higher liquidity buffers. We have at least a decade of macroprudential policymaking experience. In Europe, we have significantly reformed supervision through the Single Supervisory Mechanism (SSM). Banks across Europe are supervised according to the same standards, their performance can be benchmarked against that of other banks, and non-performing loans have declined considerably. A new resolution framework makes us better prepared for potential bank failures – although further progress is needed here.

Yet the foundations of the post-war international institutional order and global cooperation are becoming shakier.^[3] The rise of protectionist policies has eroded the clear commitment to multilateralism, leading to weakened global trade agreements and cooperation frameworks.^[4] Heightened geopolitical risk is unlikely to dissipate over the nearer-term horizon. We need to prepare for a prolonged period of sustained geopolitical tensions, marked by high uncertainty and increased volatility.

All of this is happening at a time when memories of previous financial crises are fading rapidly. The severe consequences of financial crises for societies and economies alike are still being felt today. But few recall what happens when crises actually strike. The impact of recent shocks such as the pandemic or the energy crisis has been buffered by fiscal and monetary policy. Against this backdrop, the benefits of the existing regulatory framework are being called into question, with strict regulation and supervision being seen by some as an obstacle to competitiveness. Progress on new regulatory initiatives, especially in the area of non-bank financial intermediation, is slow.

How do these global rifts and financial shifts affect banks’ risk management and what do they mean for banking supervision? Today, I would like to make three main points.

First, addressing geopolitical risks requires a framework for dealing with not only “known unknowns” but also “unknown unknowns”. Through the channels of financial markets, the real economy and safety and security, geopolitical events can affect all traditional categories of bank risk. At the same time, there is a high degree of uncertainty about how geopolitical risk may materialise. Tools that have been developed to analyse traditional risk drivers are often not very effective here, and various scenarios need to be assessed. Sufficient resilience – both operational and financial – is needed to withstand unexpected events.

Second, close cooperation between microprudential and macroprudential supervision is needed to address geopolitical risks. Geopolitical risks can have very bank-specific, idiosyncratic effects, but they can also be systemic. Scenario planning and sufficient resilience are needed. The micro- and macroprudential perspectives are highly complementary, and collaboration can exploit synergies. Macroprudential oversight can identify vulnerabilities and spillovers across the whole financial system, while microprudential supervision has much more detailed information about individual banks and can identify vulnerabilities that have not yet come to the surface at the aggregate level.

Third, as geopolitical risks evolve, international cooperation remains as crucial as ever. Strong, well-capitalised banks can serve the real economy, including during periods of stress. Dialling back on Basel III would therefore be harmful. It would not only weaken banks’ resilience at this critical juncture, but it would also undermine trust in global regulatory coordination. Close international cooperation is pivotal to address the global nature of geopolitical risks and the potentially adverse consequences for banks and non-banks.

A framework for assessing geopolitical risk

Although geopolitical risk is a common term, its precise meaning is often unclear. A broadly cited definition of geopolitical risk is the “threat, realization, and escalation of adverse events associated with wars, terrorism, and any tensions among states and political actors that affect the peaceful course of international relations.”^[5] This is the definition I will use here.

Characteristics of geopolitical risks

Geopolitical risks can take many forms, including outright wars, regional conflicts, terrorist attacks, cyberattacks, trade disputes, sanctions and heightened political instability. Each of these events has the potential to disrupt global financial markets, economic activity and policy coordination. Risks can be slow-burning, with the related impact materialising only gradually over time, or fast-burning if shocks occur unexpectedly. They are often difficult to predict and assess ex ante. Geopolitical risk and other novel risks are interconnected. The materialisation of physical, climate-related risk, for instance, can trigger disruptions in trade or migration, which in turn can exacerbate geopolitical risk. And rising geopolitical tensions can affect energy security, which in turn can affect the political roadmap to address climate and environmental risks.

Geopolitical risks differ from traditional risk drivers, and as such do not lend themselves to traditional computations of risk (Table 1). They are less predictable. They are highly uncertain, in both their probability of materialising and their impact. And they originate outside the financial system. Traditional risk drivers can be analysed using historical data, statistical models and relatively easily available economic indicators. In contrast, geopolitical risks arise from political events, shifts in international relations or societal changes, which are not subject to as much quantitative analysis. Policy reversals, political tensions and outright conflicts are influenced by a multitude of human behaviours and external circumstances, making them less suited to traditional risk assessment methods. A sudden political upheaval or an unexpected diplomatic breakdown can have immediate and far-reaching consequences that are difficult to foresee.

Still, geopolitical risks have an impact on banks’ operating environment and risk profiles. While geopolitical risk drivers are external to the financial system, they can affect financial stability, especially if they interact with pre-existing vulnerabilities. This is why microprudential supervision is required in order to strengthen individual banks. At the same time, broader risks to financial stability can arise if shocks are amplified through pre-existing vulnerabilities in the financial system, leading to strong contagion.^[6] And this is why macroprudential policy has an important role to play in shielding the financial system from geopolitical shocks.

In short, geopolitical events are characterised by a high degree of uncertainty – “radical” uncertainty – and therefore require different analytical tools and preventive measures.^[7] If probabilities cannot be assigned to specific outcomes, traditional models for pricing risks might fail. This, in turn, can lead to an abrupt re-pricing of risks if adverse events actually materialise. Financial data do not adequately signal heightened levels of political uncertainty (Chart 1).

Chart 1: Measures of uncertainty in the euro area

Standard deviation from mean; monthly data, July 2007-June 2024

Transmission channels

Geopolitical risk affects traditional risk categories through a variety of transmission channels. Credit, market, operational, liquidity and funding risks – all of these risks are potentially affected (Table 2). Within European banking supervision, we have therefore developed a classification of geopolitical risks and three primary pathways: the financial markets channel, the real economy channel and the safety and security channel.

Table 2: Transmission channels of geopolitical tensions to macrofinancial environment and banks

Through the financial markets channel, geopolitical shocks can lead to heightened uncertainty and risk aversion among investors. This can trigger fluctuations in asset prices, disruptions in global capital flows and increased market volatility. Banks are affected through an erosion of the value of their asset portfolios, making it more difficult to raise capital or secure funding, thereby increasing market and funding risks.

Economic history provides ample evidence of how pre-existing vulnerabilities and political shocks can reinforce each other and lead to disruptive market developments. The end of the Bretton Woods system in the early 1970s, the emerging market debt crisis of the 1980s and the crises in Asia and Russia in the late 1990s were all distinct in nature. At the same time, they also bear testament to the ways in which geopolitical events can disrupt the pricing of risks on financial markets. Such crises are often driven by the interplay of economic fragility and political shocks, which can exacerbate market volatility and the mispricing of risk (Chart 2).^[8]

Chart 2: Types of crises: world aggregate

The real economy channel captures how geopolitical events disrupt trade flows and supply chains. These disruptions can lead to inflationary pressures, alter corporate and consumer behaviour and weaken the economic conditions that underpin banks’ credit portfolios. Credit risks become elevated, leading to higher default rates, increased provisioning for loan losses and pressure on banks’ capital positions. Corporates take counterbalancing measures to de-risk global activities by shortening and diversifying supply chains. But such measures have costs in terms of both time and money, and risks might remain elevated in the meantime.

Geopolitical shocks can have very different implications across sectors, which are not well captured by aggregate patterns of GDP. Changes in energy costs, which are often triggered by geopolitical tensions, can have a negative impact on energy-intensive industries. The oil crisis of the early 1970s and the energy price shock following the Russia’s invasion of Ukraine both put significant pressure on energy-intensive firms and led to significant corporate restructuring. Moreover, looking beyond energy-intensive sectors, industries that are sensitive to value chain disruptions and reliant on well-functioning transport networks are vulnerable to geopolitical shocks.

The safety and security channel impairs banks’ operations. Conflict and unrest can directly affect banks’ operations, as can successful cyberattacks. Banks could face operational risks from damage to their physical infrastructure or the infrastructure of critical third-party service providers, service interruptions and cyberattacks.

Two key trends exacerbate this risk: digitalisation and the growing threat from malicious actors targeting financial institutions. Many banks are heavily reliant on digital supply chains involving third-party apps and cloud-based services. This leaves the banks vulnerable to cyber threats. Cyberattacks might also target critical infrastructure such as power grids or payment systems, resulting in wider instability and affecting economic activity. Although not linked to a cyberattack, the Crowdstrike global IT outage in July 2024, which affected air traffic, payments and IT systems worldwide, showed how interconnected systems can lead to cascading failures, amplifying disruption across multiple sectors. Incidents of this kind underline the importance of building resilience against cyberattacks and IT failures.

Geopolitical shocks trigger policy responses, which can in turn affect banks. These responses could take the form of economic and financial sanctions, trade barriers or shifts in fiscal and monetary policies. International financial sanctions, for instance, can lead to asset freezes, increased compliance costs, financial losses and wider reputational damage. Banks then face greater compliance and operational risks as a result. The failures of banks with connections to Russia in 2022 are prime examples of how international sanctions and reputational risk can translate into acute liquidity risk, counterparty risk and operational failure.

Adverse geopolitical events have broad implications across the financial system. Banks with international exposures or those operating in the region in question are directly affected. But banks without direct exposures may be equally vulnerable, perhaps without being completely aware. Networks of counterparty exposures are complex and opaque, and reliance on critical infrastructure and third-party providers can spread contagion risks to all parts of the financial system. While some risks may be felt more acutely by individual banks with specific exposures or operational footprints, other risks can be systemic, affecting the stability of the financial system as a whole.

Banks therefore need to assess how geopolitical risks can affect their business. They need to address these risks and build resilience, both financially and operationally.

However, individual banks may have neither the incentives nor the means to carefully monitor geopolitical tail risks. Due to the inherent uncertainty, geopolitical risks are often not priced on financial markets until they materialise. As a result, banks’ standard risk models do not reflect these risks either. Monitoring geopolitical risks and the channels through which individual banks are affected – in many cases only through their counterparties – is costly. And geopolitical risks may be building up slowly over time, with their full impact potentially only materialising beyond the time horizon used in banks’ medium-term capital planning.

This is why supervision has a strong role to play. Good supervision can promote a better understanding of the channels through which geopolitical risk affects the traditional risk categories. Supervisory measures can address weaknesses in banks’ risk management and stress testing so that banks take mitigating measures. As we see strategies across different banks, we can identify and share good practices. Building on the framework for assessing geopolitical risk that I have set out, I will now explore the complementary roles of microprudential and macroprudential policies in assessing geopolitical risks and taking preventive measures.

Microprudential and macroprudential policy as complementary approaches to addressing geopolitical risks

Much like a forest, the financial system is a complex ecosystem. Both the individual components and the system as a whole need to be resilient to shocks.

Microprudential supervision is about the resilience of individual banks – the trees in the forest. It aims to protect depositors and other creditors by mitigating bank-specific risks. These risks are intrinsic to the institutions, and they are shaped by the markets in which the banks operate as well as the broader macroeconomic environment.

In addressing geopolitical risks, resilience is important to cushion unforeseen shocks. Sufficient capital and liquidity buffers ensure that shocks can be absorbed without recourse to external sources. Microprudential capital requirements ensure that banks can absorb unexpected losses not captured by accounting provisions. In addition, banks need to have capital buffers which they can draw down in times of stress, without breaching their minimum requirements. Stress tests are the starting point for bank-specific recommendations – known as Pillar 2 guidance – in which we set our expectations for how much capital banks should maintain over and above their minimum requirements and their regulatory buffers. Stress tests ensure that banks would not dip into their minimum requirements even in severe adverse scenarios and they incentivise banks to bolster their own internal stress testing. But financial resilience alone is not enough. Banks also need sufficient operational resilience. They need to have proper risk management systems in place to consider the broader consequences of possible fast-moving changes in the external environment.

Macroprudential oversight, meanwhile, focuses on the whole system – the forest rather than the trees. It is a crucial complement to the work of microprudential supervisors. Its ultimate objective is to safeguard the stability of the financial system by strengthening resilience and preventing the build-up of systemic risks. This ensures a sustainable contribution of the financial sector to economic growth.^[9] Systemic risks are often endogenous to the financial system and can be cyclical or structural.

Addressing radical uncertainty requires close feedback loops from the micro- to the macro-level. In this sense, microprudential and macroprudential supervision complement each other. Individual banks can fail if systemic events cause turmoil that impairs financial stability. And weak individual banks can affect systemic stability through their mere size or through their connectedness to other institutions.

Macroprudential policy can address geopolitical risks by strengthening resilience at the system-wide level. This includes resilience to unforeseen events – the “known unknowns”. One helpful innovation in this respect is the recent adoption of positive neutral rates for the countercyclical capital buffer (CCyB).

Generally, the CCyB protects the banking sector against endogenous financial risk. Periods of excess aggregate credit growth can leave banks vulnerable to sharp reversals in asset prices and macroeconomic conditions. The CCyB ensures that, when the cycle turns, authorities can release buffers, freeing up capital and alleviating fears that banks may cut back on lending to avoid dipping below regulatory thresholds or defying market expectations.^[10] This allows banks to maintain the flow of credit even in times of stress.

Setting a positive neutral rate for the CCyB makes it possible to take uncertainty into account. It is important to raise buffers when standard risk metrics see cyclical risks as neither subdued nor elevated. This hedges against the inherent uncertainty in predicting the financial cycle and guards against the risk of raising buffers too late.^[11] In addition, releasable system-wide buffers will also be in place in the event of unexpected shocks arising outside the financial system, such as pandemics and geopolitical shocks, that can severely disrupt macroeconomic and financial conditions. At the beginning of the pandemic, for example, limited macroprudential buffer space restricted the flexibility of policymakers to respond. This highlights the importance of proactive measures in buffer-building during more stable times.

In addition to cyclical risks, strong buffers are needed to address negative externalities related to size and connectedness. The buffers for “global” and domestic (“other”) systemically important institutions (“G-SII” and “O-SII” buffers) vary from bank to bank, depending on the bank’s individual characteristics. At the current juncture, where geopolitical risk events can have strong amplification effects across the financial system, they offer effective protection against risks that may undermine financial stability.

Supervisory responses to geopolitical risks

Strengthening resilience to geopolitical shocks is a key priority for ECB Banking Supervision.^[12] We follow a three-pronged approach by identifying transmission channels, mapping risks into supervisory initiatives, and identifying gaps. Our focus is on governance and risk management, capital and liquidity planning, credit risk and operational resilience, as well as the assessment of country-specific vulnerabilities.

Governance and risk management

Geopolitical risks differ from traditional risks and require strong governance structures. Management bodies cannot rely on traditional, quantifiable risk indicators to “measure” geopolitical risks. Assessing these risks is not a simple forecasting exercise – it requires judgement, experience and the combination of qualitative and quantitative information. Structured frameworks need to be developed to analyse different scenarios and to apply sound judgement. These tasks cannot be delegated. Adequate risk management requires strong CEOs and boards to minimise the adverse effects of economic and geopolitical uncertainty on banks.^[13]

Hence, governance structures within banks need to address the highly uncertain nature of geopolitical risk. The ECB is currently reviewing risk management processes and frameworks. In July this year, we issued a new ECB Guide on banks’ governance and risk culture for consultation.^[14] Banks are expected to have a robust risk culture, one that adapts to the changing geopolitical landscape and integrates uncertainties into a holistic risk management strategy. Strategic decision-making can be influenced by geopolitical events, requiring management bodies to align business objectives and risk tolerance frameworks.

All banks, not just those that are active globally, need to be vigilant. They need to integrate geopolitical considerations into their risk management practices, ensuring they are prepared for any challenges that such risks may pose. Smaller, more locally active banks need to consider their exposure to critical infrastructures and third-party providers. The framework that has been developed within the SSM can serve as a useful reference point in this regard, and it will be used in our supervisory process to identify vulnerabilities and address them through specific supervisory action.

Capital and liquidity planning

Banks’ capital and liquidity planning need to account for geopolitical risk events. The ECB is scrutinising the tools that banks are using for the planning process – the internal capital adequacy assessment process (ICAAP) and the internal liquidity adequacy assessment processes (ILAAP).^[15] This includes a careful examination of banks’ recovery plans and internal stress testing frameworks to ascertain their readiness to confront shocks that could stem from geopolitical threats. Across these measures, we will increasingly focus on evaluating to what extent banks are sufficiently incorporating geopolitical factors into their risk management.

Credit risk

Adverse geopolitical events can increase credit risks through the real economy channel. Strong underwriting practices are critical in ensuring that lending terms, in particular loan pricing, capture relevant risks. In addition, we have asked banks how they account for novel risks, including geopolitical risk, and higher default rates in their loan loss provisioning. Adequate provisioning for novel risks, including geopolitical risks, is essential for maintaining prudential capital ratios and acting as a safeguard in case these risks materialise. Yet, banks may lack the necessary historical data needed to apply classic expected loss provisioning models.

Banks have thus increasingly turned to overlays to provision against potential loan losses. Overlays are adjustments made outside of traditional credit risk modelling frameworks and they gained prominence during the COVID-19 pandemic. As supervisors, we encourage the use of overlays, but they should be based on sound methodologies and governance, such as simulations and scenario analysis, and should not be used at the expense of improving the regular expected credit loss models.

While most banks now consider novel risks in their provisioning practices, some still ignore them. This was clear in a thematic review on how banks’ IFRS 9 provisioning frameworks capture emerging risks.^[16] Some banks rely primarily on their legacy macro-overlay models to capture novel risks, which restricts the impact of novel risks to their aggregate impact on future GDP. This approach tends to underestimate the true impact of novel risks on expected losses across different sectors. As a result, the ECB will take further supervisory action on both sets of banks: those that ignore the risks altogether and those that rely on outdated models.

In addition, stress testing remains a cornerstone of European banking supervision’s prudential oversight, with scenarios capturing effects of geopolitical tensions. The adverse scenario of the 2023 stress test assumed a partial deglobalisation of the world economy and increased fragmentation.^[17] This would lead to higher inflation, lower growth and higher volatility. Banks reacted to this scenario by projecting higher default rates, riskier credit parameters and, ultimately, higher provisions on exposures to sectors and regions more vulnerable to geopolitical risk.

The results of last year’s stress test shows that if European banks were exposed to three years of stress under challenging macroeconomic conditions, they would have sufficient capital buffers to absorb losses. The Common Equity Tier 1 (CET1) capital ratio of the 98 stress-tested banks would fall by an average of 4.8 percentage points to 10.4%.^[18] Credit and market risk as well as lower income generation drove the negative capital impact in the adverse scenario. Loan losses generated 4.5 percentage points of CET1 ratio depletion, with unsecured retail portfolios being the most vulnerable.

However, any stress test has limitations when it comes to capturing the complex effects of geopolitical risk events. European significant institutions are exposed, for example, to counterparty credit risk arising via non-bank financial institutions which, in turn, are highly sensitive to geopolitical risks via hidden leverage or crowded trades. This is an area of growing concern, as instability can quickly affect the creditworthiness of a bank’s counterparties, potentially leading to a cascade of financial distress. The failure of Archegos in 2021 and the 2022 liability-driven investments turmoil in the United Kingdom are a testament to this. In addition to the 2025 EU-wide stress test, European banking supervision will therefore conduct an exploratory counterparty credit risk scenario analysis.

Operational resilience and cyber risks

Operational resilience is another area where we incorporate geopolitical risk factors into supervisory work since geopolitical upheaval can generate cyber threats and disrupt outsourced services. That’s why European banking supervision is conducting targeted reviews aimed at strengthening the sector’s cyber defences and scrutinising outsourcing arrangements. This is critical as operational disruptions in one area can quickly spread through the entire network.

This year, the ECB conducted its first cyber resilience stress test.^[19] The exercise assessed how banks respond to and recover from a cyberattack, as opposed to looking at their ability to prevent it. Under the stress test scenario, a cyberattack successfully disrupted banks’ daily business operations. Banks tested their response and recovery measures, including activating emergency procedures and contingency plans and restoring normal operations. Supervisors assessed the extent to which banks could cope under such a scenario. The results showed that, generally, banks do have high-level response and recovery frameworks in place. Key areas for improvement include business continuity frameworks, incident response planning, backup security and third-party provider management.

The ECB addresses shortcomings in banks’ cyber resilience framework by formulating supervisory expectations that banks have to meet. Banks should have in place adequate business continuity, communication and recovery plans that consider a sufficiently wide range of cyber risk scenarios. Banks should be able to meet their own recovery objectives, properly assess dependencies on critical third-party information and communications technology (ICT) service providers, and adequately estimate direct and indirect losses from a cyberattack. Importantly, strengthening IT infrastructures and resilience against cyberattacks requires banks to allocate the necessary budgetary resources.

In addition, the Eurosystem’s oversight function of financial market infrastructures supports the cyber resilience of the financial sector more broadly.^[20] And the oversight function established with the EU’s Digital Operational Resilience Act provides for information sources on third-party providers, including a reporting framework for major ICT-related incidents occurring within banks. Banks will be required to place greater emphasis on political risks in their third-party arrangements.

Country-specific vulnerabilities

In response to geopolitical conflicts, European banking supervision has issued communications and decisions to banks with substantial exposures in affected regions. Since Russia’s invasion of Ukraine in February 2022, the ECB has been closely monitoring the situation and has engaged in a dialogue with the supervised institutions that have subsidiaries in Russia. While most of these entities have held on to their Russian subsidiaries, they have made progress in scaling down activities in this market. European significant institutions reduced their exposures to Russia by around 56% between February 2022 and the first quarter of 2024.

Geopolitical risks call for a strong, international policy agenda

History does not repeat itself, but it rhymes. And there are parallels between the 1920s and the 2020s that cannot be overlooked.^[21] A pandemic, war and high inflation have again left deep structural marks on societies and economies. And there are new structural challenges, first and foremost climate change and demographic change, that need to be addressed.

A century ago, the accumulation of shocks led to markets closing down, capital controls being imposed and the activity of financial institutions being restricted. It took decades to reverse these trends and to reap the benefits of open markets. But open markets also make us vulnerable to adverse geopolitical developments. There is pressure to reverse the pattern of integration, with the first signs of this reversal already visible.

If we want to preserve open markets, we need global, coordinated policy responses. Rather than seeking national solutions, we need to continue promoting an agenda of international cooperation, of addressing new fragilities and emerging risks, of taking preventive measures that protect financial institutions against geopolitical risks. By definition, geopolitical risks are of a global nature. If we monitor and address them from a European perspective alone, we might overlook relevant vulnerabilities and pockets of risk. We need strong cooperation and coordination in international fora such as the Financial Stability Board and the Basel Committee on Banking Supervision. This is particularly important today when heightened geopolitical risks call for coordination at the same time as the impetus for broad international policy initiatives is waning.

All stakeholders have a role to play. Financial institutions must address known vulnerabilities that may impede their ability to respond to future shocks and prepare for the unknowns that can threaten their business model. Regulators must resist the pressure to relax regulation and must maintain a framework that ensures resilient financial institutions globally. And supervisors must ensure that banks remain resilient to geopolitical risks, both financially and operationally. This will remain a key priority of European banking supervision.