ECB Supervisory Priorities 2026–2028: Where Inspectors Will Focus
The SSM’s two headline priorities signal an intensification of on-site activity, tighter SREP scoring, and zero tolerance for implementation delays. Banks that misread the supervisory temperature will pay in capital add-ons.
On the OSI count. The ECB launched 163 OSIs and 77 IMIs in 2025 (ECB Annual Report on supervisory activities 2025, March 2026). It does not publish finding-level statistics by theme; the campaign structure — cyber, third-party risk, C&N, RDARR, credit — tells you where the pipeline concentrates.
This analysis was published in December 2025 against the ECB’s 2026–28 priorities. As of July 2026, the Q1–Q2 preparation window has closed: those actions should be complete or formally escalated. Banks are now in the demonstration phase — OSI season and JST evidence requests — with SREP dialogue ahead in Q4. The priority analysis itself is unchanged.
Priority Impact Matrix
The ECB’s 2026–28 priorities are two headline commitments — geopolitical/macro-financial resilience and operational/ICT resilience. In practice, JST attention lands on three fronts, each assessed below across capital impact potential, inspection likelihood, and typical bank readiness. Severity reflects the combined risk of supervisory action if deficiencies are found.
| Priority | Capital Impact | OSI Likelihood | Bank Readiness | Overall Severity |
|---|---|---|---|---|
| P1: Credit Risk Under Macro Uncertainty | CRITICAL | VERY HIGH | MODERATE | CRITICAL |
| P2: Operational & Digital Resilience | HIGH | HIGH | MODERATE | HIGH |
| P3: CRR3 Implementation Readiness | CRITICAL | HIGH | LOW | CRITICAL |
Priority 1: Credit Risk Management Under Macro Uncertainty
The ECB’s top priority reflects concern that benign recent conditions have bred complacency in credit risk governance. Expect deep scrutiny of provisioning models, sector concentrations, and IFRS 9 implementation quality.
What the ECB Expects
Provisioning & IFRS 9
- Forward-looking ECL models with documented macroeconomic variable selection and sensitivity analysis
- Stage migration criteria that are sufficiently conservative — the ECB has found too many banks using overly narrow SICR triggers
- Post-model adjustments (management overlays) with clear governance, sunset clauses, and documented rationale
- Evidence that provisioning levels are adequate for the current macro outlook, including CRE and leveraged lending
Sector Concentration
- Commercial real estate: LTV monitoring, vacancy rate stress testing, and collateral revaluation frequency
- Leveraged lending: covenant compliance tracking, refinancing risk assessment, and sponsor quality analysis
- Consumer unsecured: delinquency trend analysis, cost-of-living stress scenarios, and behavioural scoring adequacy
Common Deficiencies Found in 2025
- CRITICAL Insufficient data granularity for CRE collateral valuations — many banks rely on outdated appraisals
- HIGH IFRS 9 stage 2 triggers not calibrated to current macro conditions — lagging indicators used instead of forward-looking
- HIGH Management overlays lacking clear governance and time-bound sunset provisions
- MEDIUM Sector concentration limits not binding or not monitored against early warning indicators
What the ECB Expects
Priority 2: Operational & Digital Resilience
- Critical service mapping with documented recovery time objectives (RTOs) for all critical business functions
- Third-party risk management framework covering cloud providers, IT vendors, and outsourced operations
- Cyber resilience testing: red team exercises, tabletop simulations, and documented incident response playbooks
- DORA compliance readiness: ICT risk management, incident reporting, and digital operational resilience testing
Common Deficiencies Found in 2025
- CRITICAL No tested fallback for single-vendor cloud dependencies — concentration risk without contingency
- HIGH Incident response plans exist on paper but have never been tested in realistic simulation
- HIGH Third-party SLA monitoring is passive — no proactive assessment of vendor resilience capabilities
- MEDIUM DORA gap assessments incomplete or not started at banks expecting January 2025 compliance
What the ECB Expects
Priority 3: CRR3 Implementation Readiness
- Detailed implementation plan with milestones, resource allocation, and progress tracking
- Data quality framework adequate for CRR3 reporting: exposure-level data, classification accuracy, and completeness metrics
- IRB model change pipeline managed with pre-assessed materiality classifications and ECB submission timelines
- Output Floor impact assessment with clear understanding of binding constraint timing and capital planning implications
Common Deficiencies Found in 2025
- CRITICAL Implementation timelines unrealistic — 35% of banks behind schedule on key CRR3 workstreams
- CRITICAL Data quality insufficient for new SA reporting requirements — material gaps in exposure classification
- HIGH IRB model change applications not submitted — creating queue risk at ECB for 2027 approval deadlines
- MEDIUM Output Floor impact not integrated into capital planning and dividend distribution frameworks
Inspection Intensity Grid
Expected on-site inspection (OSI) frequency by risk area and bank type. G-SIBs face the most intensive scrutiny, but large and medium banks should not assume they are below the radar — the ECB’s 2026 plan expands OSI coverage to smaller SIs.
| Risk Area | G-SIB (7 banks) | Large SI (>€100bn) | Medium SI (€30–100bn) | Smaller SI (<€30bn) |
|---|---|---|---|---|
| Credit Risk / IFRS 9 | Annual OSI | Annual OSI | Every 2 years | Thematic review |
| IT / Cyber Risk | Annual OSI | Every 2 years | Every 2–3 years | Thematic review |
| IRB Models | Continuous (IMI) | Annual OSI | Every 2 years | As needed |
| CRR3 Readiness | Quarterly check-ins | Semi-annual | Annual review | Annual review |
| Governance & Risk Appetite | Every 2 years | Every 2–3 years | Every 3 years | As needed |
| Third-Party / Outsourcing | Annual (DORA) | Every 2 years | Thematic review | Thematic review |
SREP Score Impact Analysis
Each priority area feeds directly into SREP Pillar 2 requirements. Deficiencies translate into capital add-ons (P2R/P2G), qualitative measures, and operational restrictions. Understanding the SREP transmission mechanism is critical for capital planning.
Credit Risk → SREP Element 2 (Credit Risk Assessment)
Deficiencies in provisioning adequacy, IFRS 9 implementation, or sector concentration management directly impact SREP Element 2 scores. A downgrade from score 2 to score 3 on credit risk alone can trigger 25–75 bps P2R increase. Banks with CRE concentrations >200% CET1 face automatic enhanced scrutiny and potential targeted Pillar 2 capital guidance (P2G) of 50–150 bps.
Operational Resilience → SREP Element 4 (Operational Risk)
Cyber incidents, third-party failures, and IT governance weaknesses feed into SREP Element 4. The ECB has increasingly used qualitative measures (restrictions on IT projects, mandatory remediation timelines) alongside capital add-ons. Severe operational resilience deficiencies can trigger 15–50 bps P2R and operational restrictions that constrain business growth.
CRR3 Readiness → SREP Element 1 (Business Model) + Element 3 (Capital Adequacy)
CRR3 implementation delays signal weak project governance and inadequate forward capital planning. The ECB views implementation readiness as a proxy for management quality. Banks materially behind schedule face combined P2R increases of 25–100 bps plus mandatory implementation milestones with supervisory monitoring. Failure to meet milestones can trigger further escalation including restrictions on distributions.
Banks with deficiencies across all three priority areas face compounding P2R increases of 75–200+ bps. At a €100bn RWA bank, 100 bps P2R equals €1bn additional capital requirement. The supervisory incentive to address all three priorities proactively is not theoretical — it is directly capital-relevant.
Where Your Bank Likely Stands vs. Peer Group
Based on publicly available SREP data and supervisory communications, here is a benchmarking framework for self-assessment against peer expectations in each priority area.
Credit Risk Leaders
Automated SICR triggers calibrated quarterly. CRE collateral revalued semi-annually with market-based inputs. Management overlays governed by committee with formal sunset dates. ECL sensitivity analysis published to board with scenario ranges. IFRS 9 models validated annually with documented backtesting.
Credit Risk Average
SICR triggers based on rating downgrades with annual recalibration. CRE collateral revalued annually. Management overlays exist but governance is informal. ECL sensitivity analysis conducted but not systematically presented to board. IFRS 9 validation conducted but challenge is limited.
Operational Resilience Leaders
Annual red team cyber exercises with documented lessons learned. Multi-cloud strategy with tested failover. DORA-compliant ICT risk framework in production. Third-party risk scored and monitored with automated alerts. Incident response tested quarterly with board involvement.
Operational Resilience Average
Annual penetration testing but no red team exercises. Single cloud provider with contractual SLA but untested failover. DORA gap assessment complete but implementation in progress. Third-party risk register maintained but monitoring is manual. Incident response plan exists but last tested 18+ months ago.
CRR3 Readiness Leaders
All CRR3 workstreams on track with documented milestones. IRB model change applications submitted to ECB by Q2 2026. Output Floor impact integrated into capital planning. Parallel run for SA reporting completed. Data quality framework meeting CRR3 requirements.
CRR3 Readiness Average
CRR3 programme established with governance but 2–3 workstreams behind schedule. Some IRB model change applications submitted, others still in preparation. Output Floor impact quantified but not yet integrated into capital planning. Data quality remediation in progress with known gaps.
For each priority area, is your bank in the top quartile, median, or bottom quartile? If you cannot confidently answer this question with evidence, that itself is a finding — and one the ECB will also identify during supervisory engagement.
Action Plan Matrix
Prioritised actions mapped against urgency and resource requirements, as published in December 2025. As of July 2026, the Q1–Q2 items should be complete — treat any that are still open as overdue escalations, not backlog.
| Action | Priority | Urgency | Resource (FTE) | Timeline |
|---|---|---|---|---|
| IFRS 9 model recalibration & SICR trigger update | P1 | OVERDUE IF OPEN | 4–6 FTE | Q1–Q2 2026 |
| CRE collateral revaluation programme | P1 | Q1 2026 | 3–5 FTE + external | Q1–Q3 2026 |
| Submit priority IRB model change applications | P3 | OVERDUE IF OPEN | 6–10 FTE | Q1–Q2 2026 |
| Cyber red team exercise | P2 | Q1 2026 | 2–3 FTE + vendor | Q1 2026 |
| Third-party resilience testing (cloud failover) | P2 | Q2 2026 | 3–4 FTE | Q2 2026 |
| CRR3 data quality remediation | P3 | Q1 2026 | 8–12 FTE | Q1–Q4 2026 |
| Output Floor integration into capital planning | P3 | Q2 2026 | 2–3 FTE | Q2–Q3 2026 |
| Board briefing on ECB priorities & SREP impact | ALL | OVERDUE IF OPEN | 1–2 FTE | Q1 2026 |
Implementation Roadmap
Aligned to the ECB’s supervisory cycle: SREP decisions are typically notified in Q4, and on-site inspections run throughout the year. Each phase maps to the supervisory calendar to ensure readiness before engagement.
- Conduct self-assessment against all three priority areas
- Brief the board on ECB priorities and SREP capital implications
- Launch IFRS 9 SICR trigger recalibration project
- Submit first wave of IRB model change applications
- Execute cyber red team exercise before OSI season
- Initiate CRR3 data quality remediation programme
- Prepare OSI documentation packages for likely inspection areas
- Complete CRE collateral revaluation and document methodology
- Test third-party failover and document results
- Run CRR3 parallel reporting on SA and Output Floor
- Update management overlay governance framework
- Respond to ECB JST questions with evidence-backed analysis
- Prepare SREP discussion materials with documented progress
- Integrate Output Floor into ICAAP and capital distribution framework
- Establish continuous monitoring dashboards for all priority areas
- Document remediation actions taken on any OSI findings
- Begin preparation for 2027 supervisory priorities (early signals)
- Annual board review of supervisory relationship strategy
Banks that proactively share progress on ECB priority areas during regular JST interactions build supervisory credibility. This translates into more collaborative (vs. confrontational) SREP discussions and moderates the risk of punitive capital add-ons. The investment in proactive supervisory engagement has a measurable ROI in capital terms.
Primary documents cited in this analysis
- [1]
- [2]ECBECB SREP methodology — Pillar 2 Guidance and Pillar 2 Requirement formation (most recent edition) → source
- [3]ECBECB SSM Supervisory Manual — European banking supervision: an overview (most recent edition) → source
Dates, paragraph numbers and document versions verified at publication. Where consultations are still open, we flag draft status in text. Corrections: research@ezelman.com.
This analysis underpins our SREP and supervisory-priority mandates.
Partner-led, senior-only, no audit conflict. If the question in this piece is live at your institution, the first conversation is with a partner — not a BD team.
Talk to a partner →