← Back to Downloads

CRO Briefing · 2026
— What a CRO must own between now and the 2027 EBA submission

A one-page briefing for CROs running a European bank into the 2027 EBA EU-wide stress test. Written for people who already know how the exercise works — and need the partner-level view on where their personal ownership should sit between now and Q1 2028.

April 2026 · Practitioner Brief
The 30-second framing

The 2027 number will anchor P2G for three SREP cycles (2028, 2029, 2030). Decisions taken in 2026 are high-leverage; decisions taken in 2027 are cosmetics. A CRO who is not personally holding the pen on the six items below in 2026 is, in substance, delegating their P2G to the Director of Prudential Reporting — which is not the title the ECB expects to see on the submission letter.

Anchor window
Q3 2026 → Q1 2028
Submission
March 2028
SREP cycles anchored
2028 · 2029 · 2030
Author
Hannan Mohammad · Ezelman

1Six things a CRO must personally own

Each of these items has a failure mode where the work gets delegated into the risk organisation, the CRO signs the cover letter without having touched the substance, and the JST catches the seam. These are the six seams. A CRO must hold the pen.

i.

FY2025 → Dec-2026 starting-point bridge, signed by the CFO

The T-0 the EBA will accept is 31-Dec-2026. The bridge from audited FY2025 to projected Dec-2026 — CRR3 Day-1 adjustments, RWA migration, DTA movement, dividend policy — must be reconciled against the accounting close and co-signed by the CFO. If the CRO is signing it alone, it will not hold. If the CFO has not personally read the RWA walk, it will not hold under JST challenge.

Non-delegable
ii.

ICAAP internal adverse ≥ EBA adverse, with documented overlays

The single worst optic in the 2028 SREP file is an ICAAP milder than the EBA exercise. The internal adverse must sit at or beyond the EBA adverse on CET1 depletion, with the delta justified by bank-specific overlays (concentration, sovereign, behavioural). The documentation must pre-date the EBA methodological note to read as a genuine internal view.

Non-delegable
iii.

Bottom-up vs top-down reconciliation package

The JST runs a top-down challenger model. The bank's bottom-up projection sits next to it. The reconciliation walk between the two — line by line, driver by driver — is where the methodology argument is won or lost. A CRO must have personally read the material drivers of the gap and be able to defend them in an 8-minute conversation.

Non-delegable
iv.

IRRBB peer-triangulation briefing note

NII under stress is the workstream most likely to look out of line against peers, and the least well understood at board level. The CRO needs a two-page briefing triangulating the bank's re-pricing assumptions, behavioural-deposit caps, and IRRBB shock response against a cohort median. Not a 40-page SLR; a note the CRO can read in the car before the Risk Committee.

Non-delegable
v.

Management Body engagement cadence from Q2 2026

The Management Body needs to see the exercise four times between Q2 2026 and the submission: scenario landing, T-0 bridge sign-off, unconstrained-run readout, and pre-submission package. If the MB first sees the CET1 depletion in Q4 2027, the MB minutes will read thin. Thin MB minutes are the single easiest SREP negative the JST can write.

Non-delegable
vi.

Delivery-partner selection and scope

Who owns which workstream, and how the commercial incentives are structured, is a CRO decision — not a Procurement decision. The Big-4 default is a thin-pyramid footprint model; the boutique default is senior-judgment carve-outs. The wrong shape becomes visible in the bottom-up/top-down reconciliation. The CRO must be the one who drew the boundary.

Non-delegable

2Calendar for 2026 — quarter by quarter

If the CRO has not done these things in the quarter listed, the project is behind. The dates are not aspirational; they are the latest moment at which the item can still be done in sequence without compressing the later quarters.

Q1 Positioning
  • Landscape readout to the Risk Committee: 2027 scoping, likely scenario direction, methodology-note expectations.
  • Internal PMO stood up under a named Director reporting to the CRO weekly.
  • Delivery-partner shortlist issued; commercial shape decided by end-Q1.
  • ICAAP FY2025 freeze reviewed for 2027-readiness gaps.
Q2 Engagement
  • Management Body session #1 — scenario landing and governance framework. Minute it.
  • Bottom-up methodology refresh completed for credit, market, NII, op-risk.
  • ECB JST informal dialogue on bank-specific topics (sovereign, CRE, IRRBB).
  • Peer benchmark re-baseline against the 2025 transparency data.
Q3 Bridging
  • FY2025 → Dec-2026 bridge first cut, joint CRO/CFO review.
  • Methodology note response on the EBA consultation draft.
  • Management Body session #2 — T-0 bridge pre-read.
  • Dry-run on credit losses using the 2025 scenarios.
Q4 Lock-down
  • Dec-2026 bridge signed by CFO & CRO jointly before year-end.
  • ICAAP internal adverse locked above EBA adverse with overlays documented.
  • Full 2027 project plan issued, critical path on reconciliation package.
  • Management Body session #3 — confirmation of readiness, formal mandate to submit.

3Red flags that say “we’re behind”

If any of these are true in April 2026, the project is already behind. Call them out at the next Risk Committee, not the one after.

!

NII methodology not refreshed since the 2023 cycle, with no documented review of behavioural-deposit assumptions against the current rate environment.

!

ICAAP internal adverse milder than the most recent EBA adverse — an automatic SREP negative regardless of how defensible the overlay narrative is.

!

Management Body minutes thin on stress testing through Q1–Q2 2026. If the MB has not seen the 2027 scoping by June, the JST will note it in the 2028 SREP engagement letter.

!

Day-1 CRR3 bridge unsigned between CRO and CFO, or signed but not reconciled to the audited FY2025 accounts with a line-by-line walk.

!

No named owner of the bottom-up vs top-down reconciliation package, with explicit authority to challenge both the bank's and the JST's numbers.

!

Delivery partner selected on price without the CRO having read the SOW and drawn the senior-judgment / footprint boundary personally.

30-minute partner diagnostic.

A confidential conversation with the partner who would run the mandate — not a pre-sales consultant, not a director, not a deck-with-graphs. Thirty minutes, no deck, no follow-up unless you ask for one. We will tell you where in the calendar above we think you actually sit.

Book the 30 minutes → Email the partner
Follow Ezelman on LinkedIn — Regulatory insights read by 2,000+ risk professionals across Europe & the GCC Follow →