Esas warn about external dependencies, cyber threats, and private credit risks in the EU

The European Supervisory Authorities (EBA, EIOPA, and ESMA) have identified key vulnerabilities in the EU financial system in their Autumn 2026 risk update. These include external dependencies, emerging technologies, and private credit risks.

The ESAs warn that reliance on non-EU providers and infrastructures could amplify the impact of geopolitical shocks and operational disruptions. Particular concern is expressed over dependence on ICT service providers outside the European Economic Area and increasing cyber risks linked to advanced AI models.

Vulnerabilities related to private credit are also highlighted. Although the sector remains small in the EU, its rapid growth, limited transparency, and connections to the broader financial system could pose risks during stress periods.

Despite these challenges, the EU financial system remains resilient. Investment funds, insurers, and banks continue to show strong fundamentals, though geopolitical tensions, cyber threats, natural catastrophes, and technological advances influence the outlook.

The ESAs call on supervisors and market participants to enhance preparedness and closely monitor risks from external dependencies, private credit, and emerging technologies.

Background details were presented at the EU’s Economic and Financial Committee meeting on September 10, 2026, based on the ESAs’ findings.

Key findings include:

• The EU financial markets have remained resilient despite geopolitical tensions, energy price fluctuations, and crypto-asset volatility. EU equities reached record highs, bond yields increased with limited spread widening, and the sector’s fundamentals stayed strong.
• European banks maintained profitability and high capital ratios, with low Non-Performing Loans, though asset quality deterioration is expected in some portfolios, especially Commercial Real Estate and SMEs.
• Dependencies on non-EU countries are significant across investment funds, insurance, and banking sectors, with notable exposures to the US and reliance on non-EU ICT service providers and payment systems.
• Increased geopolitical tensions may affect asset quality and credit demand, with potential impacts on funding conditions and asset impairments.
• Cyber risks are heightened due to dependence on non-EEA ICT providers and the potential for AI-enabled cyberattacks and quantum computing threats, which could undermine cryptography and financial processes.
• Private credit markets are expanding but remain relatively small in the EU, with risks stemming from limited transparency, valuation inaccuracies, leverage, and interconnected exposures. Liquidity mismatches could lead to spillovers and increased credit risks for banks.

The ESAs emphasize the importance of proactive supervision, crisis preparedness, and risk management to address these vulnerabilities and technological developments.