Esas warn about external dependencies, cyber threats, and private credit risks in the EU

The European Supervisory Authorities (EBA, EIOPA, and ESMA – the ESAs) have identified key vulnerabilities in the EU financial system in their Autumn 2026 risk update.

The ESAs warn that reliance on non-EU providers and infrastructures could amplify impacts from geopolitical shocks and operational disruptions. Particular concern exists over dependence on ICT service providers outside the European Economic Area and rising cyber risks linked to advanced AI models.

The update also highlights vulnerabilities related to private credit, which, despite being relatively small in the EU, is growing rapidly. Its limited transparency and increasing links with the wider financial system could pose risks during stress periods.

Despite these challenges, the EU financial system remains resilient. Investment funds, insurers, and banks continue to show strong fundamentals, though geopolitical tensions, cyber threats, natural catastrophes, and technological advances influence the outlook.

The ESAs call on supervisors and market participants to strengthen preparedness and closely monitor risks from external dependencies, private credit, and emerging technologies.

The findings were presented at the EU’s Economic and Financial Committee meeting on September 10, 2026, as part of the Autumn 2026 Risks and Vulnerabilities update.

Key points include:

• The EU financial markets have remained resilient despite geopolitical tensions, energy price fluctuations, and crypto-asset volatility. EU equities reached record highs, and bond yields increased with limited spread widening.
• EU investment funds and the insurance sector remain strong, though natural catastrophes could widen protection gaps.
• European banks maintain profitability and high capital ratios, but asset quality may deteriorate in certain portfolios, especially Commercial Real Estate and SMEs.
• Dependence on non-EU countries and infrastructures, especially in banking, insurance, and investment sectors, presents risks, including cyber and geopolitical vulnerabilities.
• Reliance on non-EU ICT providers and payment systems increases exposure to cyber threats and operational risks, especially with the development of advanced AI and quantum computing.
• Private credit markets are expanding globally, with the EU sector remaining small but vulnerable due to limited transparency, high credit risk, and interconnected exposures.

The ESAs emphasize the importance of proactive supervision, crisis preparedness, and monitoring of risks related to external dependencies, private credit, and technological advancements to maintain financial stability.