Regulatory updates in the banking space

The assessment and scoring of liquidity and funding risks have been merged into a combined assessment, yielding a single adequacy score. This amendment reflects the intrinsic interrelationship between these risks and streamlines the supervisory process. By consolidating these factors, the resulting score should reflect a more holistic evaluation of an institution’s capacity to mitigate the risks to liquidity and funding.

A separate addition to the liquidity and fundings risk assessment is the consideration of the impact of digitalisation and the potential for social media to amplify deposit withdrawals under stressed scenarios. This aligns with the regulator’s increasing focus on ensuring that the bank’s digital risk management effectively manages risks stemming from new technologies, and one which has also been identified by the ECB as a medium-to-long-term priority for the period 2026-2028.

For the first time, consideration of credit spread risk arising from non-trading book activities (CSRBB) is incorporated alongside the existing assessment of interest rate risk in the banking book (IRRBB). Given the growing importance of CSRBB as a risk category, particularly amid evolving market conditions, supervisors will now include CSRBB explicitly in their capital risk evaluations. A combined IRRBB/CSRBB score is to be assigned to institutions based on this joint assessment.

The revision extensively updates the internal governance assessment by integrating recent regulatory standards and best practices. Areas such as risk culture, management body composition, and internal control functions have been strengthened with clearer supervisory expectations, including documenting responsibility mappings and ensuring effective remediation capabilities.

Reflecting the evolving cyber and operational risk landscape, the guidelines now fully integrate DORA’s requirements on ICT risk management within the general SREP framework. This integration eliminates the previous stand-alone ICT SREP guidelines, folding ICT risk assessments into operational risk and internal governance reviews. Supervisors will evaluate ICT systems, third-party dependencies, incident management, and operational resilience in a harmonised manner aligned with the EU’s digital resilience standards.

ESG risk considerations have been embedded across all relevant SREP elements rather than treated as a new siloed risk category. Supervisors will assess the impact of environmental transition and physical risks on business model viability, risk management robustness, capital adequacy, and liquidity. The approach recognises the forward-looking nature of ESG risks, urging institutions and supervisors to consider medium- to long-term resilience in strategic planning (including transition planning), and risk governance.

The updated guidelines clarify that the scope of application of the SREP procedures and methodologies for TCBs should include an assessment of the business model, internal governance arrangements and controls, capital endowment, liquidity resources, and booking arrangements, with guidance being provided to competent authorities on each area of focus. The minimum period between full assessments of all SREP elements has been set at 3 years, with the option to extend to 5 years for certain Class 2 institutions.