SREP 2025: results for SSM banks

Supervisors highlighted challenges in the sustainability of bank business models, including ambitious strategies, reliance on concentrated income sources and weaknesses in business planning and cost management. In our view, banks should reinforce governance practices around their strategic steering, ensure that business plans are based on realistic bank capabilities and undergo robust challenging processes, supported by credible financial projections and a clear link with risk appetite levels. Additionally, banks should enhance the granularity of cost allocation procedures to support profitability analysis and further enable informed decisions. Accelerating digitalisation will help to streamline processes, boost execution capacity and support more resilient business models.

Supervisors identified persistent shortcomings particularly around RDARR, board effectiveness and internal control functions. To address them, banks should:

• maintain their focus on RDARR related topics as a key priority at Board level; this includes adequately investing in data architecture, IT infrastructure and data-quality controls, ensuring at the same time clear executive oversight;
• reinforce board composition with specialised expertise (e.g. on IT and digital risks) and promote a stronger risk culture to enhance decision-making capabilities;
• strengthen internal control functions by equipping them with the necessary resources, skills and authority to deliver effective and well-informed challenge and oversight across all key risk areas.

Supervisors noted that the average credit risk score for SSM banks has only marginally improved in SREP 2025. Weaknesses remain in asset quality across specific portfolios and regions, and persistent deficiencies in credit risk management for some banks. Given these weaknesses, banks should consider reviewing credit-risk identification and monitoring procedures by e.g. enhancing early-warning systems, improving sectoral risk assessments and ensuring more timely identification of deteriorating exposures, particularly in light of potential further NPL inflows. Banks should also strengthen their credit-risk management frameworks by tightening underwriting standards, improving the consistency of provisioning practices, e.g. by reviewing IFRS9 methodologies, and enhancing periodic borrower reviews.

In SREP 2025, ICT risk continued to be the SREP category with the worst average score (3). Supervisors highlighted vulnerabilities in bank ICT frameworks, driven by accelerating digitalisation, greater reliance on outsourced service providers and challenges from stricter DORA requirements. To improve in this area, banks should strengthen ICT governance by e.g. clarifying accountability for IT-risk decisions and ensuring a more robust oversight of outsourced services and 3^rd party arrangements. Institutions should also step up efforts to meet DORA requirements by improving key elements such as risk controls, documentation standards, resilience testing, IT-security and incident-response capabilities.

Regarding C&E risks, gaps persist in integrating them into risk management frameworks, KPIs and IT systems. A small number of banks also showed slower progress in linking C&E risks to operational-risk processes and broader risk frameworks.

Banks should intensify their effort to address identified gaps, by both improving data, metrics, methodologies and systems used to assess and manage C&E risks, and ensuring that these risks are properly embedded into governance, risk assessment and decision-making processes. Strengthening these capabilities is key for institutions to demonstrate credible progress and avoid further supervisory escalation by the ECB.