SREP 2026: Preliminary results

The 2026 SREP cycle marks a major milestone in the ECB’s efforts to make the SREP simpler, shorter and more flexible. Implementation of the new P2R methodology means that most key reforms have now taken effect. That builds on 2025’s introduction of a shorter timeline, streamlined decision template, and tiered approach to supervisory follow-up.

As a result of these changes, some banks have already received their 2026 SREP decisions and more are expected by the end of October. If the overall timeline mirrors that of 2025, then the ECB is likely to publish final results in the second half of November.

Based on our conversations with clients, we expect 2026’s SREP results to include some of the following themes.

Limited changes in SREP scores

Early indications suggest that the overall distribution of SREP scores for Significant Institutions will be similar to last year, with most banks clustering around the median grades of 2-, 3+ or 3. As in 2025 there are relatively few outliers, with no institutions likely to be scored 1 and only a handful of banks receiving scores of 3- or 4.

Steady overall P2R capital levels

Despite bank concerns that the new P2R methodology could generate a systematic increase in capital requirements, it seems more likely that the new framework is being used to increase risk sensitivity. Initial observations suggest there has been no broad-based capital increase, with average P2R outcomes looking broadly in line with last year.

Adoption of tiered approach to findings

Our 2025 article described how the ECB’s new tiered approach gave banks more latitude to manage the remediation of less severe F1 and F2 findings. Conversations with banks suggest this has required an increase in effort from internal control functions (including Internal Audit), with institutions strengthening processes for the monitoring, escalation, oversight and review of remediation. However, some banks have seen the benefits of less supervisory follow-up partly offset by JSTs consolidating F1 and F2 findings into a smaller number of severe F3 or F4 findings.

Persistent areas of weakness

Supervisors continue to highlight persistent cross-industry weaknesses, including:

• Internal Governance & Risk Management (IG & RM): As in prior cycles, IG & RM is likely to remain a challenging area for many banks, with outcomes expected to remain centred around a score of 3 for a large proportion of institutions. Despite ongoing investment and remediation, risk data aggregation and risk reporting (RDARR) is a persistent concern. So too is risk culture, with JSTs increasing their focus on ownership and accountability. Banks should take into account the ECB’s report on good practice due in early 2027, superseding 2024’s draft guide on governance and risk culture.
• Technology-related risks: Potential risks in areas such as cyber resilience, data security and third-party risk management are increasingly central to supervisory thinking. The ECB’s focus has moved beyond verifying the existence of risk management frameworks to judging their proven, practical effectiveness.
• Credit risk: Despite relatively benign credit trends, the current context of rising interest rates, global tensions and increasing indebtedness mean that supervisors are maintaining a strong focus on banks’ creditworthiness monitoring and early warning processes.

In addition, although we understand that AI related risks were not a major driver of 2026 SREP outcomes, it seems likely that the SREP’s new flexible approach to risk assessment will focus more heavily on this area in future. With many banks stepping up digitalisation and the use of AI, supervisors will increasingly expect strong risk management and governance mechanisms around AI applications – and robust resilience against external AI-powered threats.

Based on our preliminary impressions of the 2026 SREP cycle, we believe that many SSM banks could benefit from:

• Increasing their focus on the effectiveness and execution of controls. In persistent areas of weakness such as RDARR or cyber resilience the challenge now is to demonstrate tangible real-world improvements.
• Treating data, technology and risk management as inherently linked. Key supervisory themes like credit risk management, RDARR, operational resilience, and AI are united by consistent expectations for robust governance, data quality and effective lines of defence.
• Strengthening the governance and ownership of remediation processes – ensuring clear accountability, sufficient management attention and the effective escalation of supervisory findings.