Hi everyone! I’ve taken a couple of months off of extended writing - I have been waiting for good topics to focus on which I feel like I can provide some genuine insight and commentary. My energy levels have also been a bit low on the writing front - between the heatwaves here in the UK and parenting - so forgive me for the relative radio silence.
But now we are well into what we’d call back in the States “the dog days of summer” and amidst another heatwave and drought, the European Central Bank (ECB) published long-awaited results of its geopolitical reverse stress test with 110 participating financial institutions. Like many other regulators, the ECB regularly tests its banks on capital adequacy (ICAAP) as part of its core supervisory responsibilities. The purpose of these stress tests is for the regulator to understand how well the banks which make up the financial system would hold up under negative scenarios, and if/how/when they are vulnerable to liquidity and solvency challenges. The eurozone crisis and subprime mortgage crisis are just two of the events which justify rigorous oversight to protect not economic health but also social and political stability of the bloc (e.g. Greece 2010).
It’s probably a good time to run this test - the ECB has noted geopolitical risk as a material macro risk as part of its supervisory interests since at least 2024. Reasons include:
Intensifying trade competition from both China and the US
A concerted pivot to drive more private and public investment into critical infrastructure, defence and the energy transition, led by initiatives like ReArm Europe, European Green Deal, REPowerEU and Electrification Action Plan.
AI-driven disruption to financial markets and real economy
And (of course) - overlapping conflicts in Ukraine and the Middle East, and their myriad ripple effects into European economies, politics and society
So it is fair that the ECB wants to have good visibility on whether banks have solid and well-founded understanding of how geopolitical trends and events can manifest and impact their activities.
What’s different about this type of stress test is that, rather than being given a scenario and then asked to assess risk drivers and impacts to capital, liquidity and solvency, the ECB this time gave the banks an outcome, and ask them to craft up to five geopolitical trigger events which could lead to that outcome. In this case, the ECB chose a major capital depletion which challenges the banks’ liquidity / capital reserves and challenged them to show how geopolitical events transmit risk and impact to their activities e.g. lending, asset values, retail banking losses etc.
The results were not entirely surprising:
Most banks got the assignment, and were able to craft reasonable geopolitical scenarios such as Hormuz, US-China tensions, a blockade of Taiwan.
They were generally good at showing how geopolitical risks show up in the real economy (trade, commodity flows) and financial markets. But they were less proficient in understanding and demonstrating how - and how much - events led to operational risks such as cyber, reputational, fraud, staff safety and security. This is unsurprising as stress-testing functions within banks historically are not purposed to account for non-financial risks with great sophistication.
Unsurprisingly, it was pointed out that banks are overly confident and optimistic of their own ability to anticipate manage risks in a crisis situation. The ECB highlights that banks would struggle to execute their mitigations when many of their peers would be doing very similar things in a crisis. This makes sense (e.g. if everyone is selling down, who’s buying? If everyone is trying to medivac using ISOS or Healix, who does the vendor prioritise). But there is more to this - have banks stress tested their crisis management plans rigorously beyond operational and cyber risks? For many banks, I’m doubtful.
Banks listed their mitigations, or what they would do to respond and manage the crises they’ve sketched out. The top two cited measures were tech resilience / cyber recovery (79% of banks said this) and enhanced monitoring / early warning (60%). Shouldn’t early warning be in place beforehand? If you’re reading this as a CSO or geopolitical analyst, please use this in your next Board or Risk committee presentation, or at the next annual budget submission.
The section regarding operational risks is acknowledged but its treatment is far more qualitative and less rigorous - and many banks would appear to struggle to quantify the transmission channels into balance sheet and liquidity impacts. While other regimes like DORA cover some of the operational resilience gaps, there is still a gap on transmission channels that should be filled in future ICAAP iterations or in bilateral (regulator-bank) engagements.
And what’s next? When the ECB starts something, they tend to keep going. See: cyber, climate. Physical and transitional climate risk management, as another cross-cutting risk you can’t run away from, may be a good guidepost for how European banks may be asked to comply on geopolitical risk management going forward. This is almost certainly just the start on geopolitical risk management supervision and enforcement. If you’re in corporate security and in Europe, you need to be thinking about how you can leverage what’s to come to further grow your function, budget, influence and impact.
If you’re a risk manager that has the ECB as a regulator, it’s best to make friends in the security, intelligence, geopolitical and government relations teams.
Now, for subscribers, let’s take a deeper dive:
