Top European financial regulators issue a warning: The risks extend far beyond reports and stress tests. Without proper monitoring, Europe's dependence on foreign technology providers, the rise of artificial intelligence, and the rapidly growing private credit market could all become risk factors for the EU financial system. In their risk update for autumn 2026, European supervisory authorities – namely EBA, EIOPA, and ESMA (collectively referred to as ESAs) – identified these three areas as the most pressing sources of financial risks for the EU in the remainder of this year, while emphasizing that the broader financial system remains robust.

Key Vulnerabilities

The clearest message conveyed by the latest assessment from ESAs is that Europe's financial stability is increasingly dependent on factors over which it does not have full control. According to the results presented at the Financial Stability Group meeting of the European Commission's Economic and Financial Affairs Council on September 10, 2026, external providers, technologies that have not been fully verified, and opaque lending markets are no longer considered marginal issues but are now regarded as structural risk factors.

External dependence on non-EU providers

A large portion of the EU's financial infrastructure operates on foreign “tracks.” ESAs indicates that clearing, repurchase, and credit rating markets are largely mediated by non-EU entities, while banks still rely heavily on ICT service providers and payment systems located outside of the European Economic Area. Regulators warn that this dependence can magnify the consequences of geopolitical shocks and operational disruptions, as a single failure or changes in overseas policies could directly affect European markets. Investment funds also have a significant exposure to the United States, particularly through stocks UCITS and alternative funds, whereas the geographical distribution of bond funds is relatively more diversified.

For ordinary market participants, the risk lies in the fact that if key software suppliers, cloud service providers, or clearing institutions are located outside of EU jurisdiction, it becomes more difficult for European regulatory authorities to intervene promptly during a crisis. This gap between economic dependence and regulatory reach is precisely what ESAs urges regulators to address.

Emerging Technologies: Artificial Intelligence and Quantum Computing

Artificial intelligence is at the core of this update's cybersecurity warnings. ESAs points out that increasingly powerful AI models may make cyberattacks more formidable and harder to contain, allowing malicious actors to discover and exploit vulnerabilities at a pace that defenses struggle to match. In the insurance industry, the update specifically warns that during periods of severe geopolitical instability, coordinated cyberattacks driven by AI could lead to higher insurance payouts and accumulated risks, although exemption clauses may be able to mitigate the impact to some extent.

Quantum computing is also being viewed from this dual perspective. ESAs acknowledges that it has the potential to optimize financial processes, fraud detection, compliance monitoring, and pricing. However, they also warn that quantum computing could undermine the encryption technologies currently used to protect communications, transactions, databases, and blockchain, and this risk may become apparent before any commercially viable quantum applications are actually realized.

This warning has reached the crypto market. Reports regarding this ESA update indicate that the EU's "Digital Operational Resilience Act" requires financial entities to adopt the most advanced encryption technologies, while the European Commission's post-quantum roadmap calls for member states to begin the transition by the end of 2026 and sets a more definitive 2030 deadline for high-risk use cases. Analysts focusing on the crypto sector have raised a related but independent concern: The founder of CryptoQuant, Ki Young Ju, estimates that approximately 6.89 million BTC coins—including those in P2PK addresses whose public keys are already visible on the blockchain, as well as coins that may have been exposed after previous transaction fees—could face quantum risks in the future. Of these, about 3.4 million BTC coins have been dormant for over a decade, some of which are associated with the founder of Bitcoin. Ju points out that resolving this issue requires consensus from the entire Bitcoin community, a process that has historically been slow, citing past disputes over block size and SegWit2x disagreements as examples. The above content does not imply that quantum computers can crack Bitcoin encryption today; what is described is a prospective risk, not a vulnerability that has already occurred. However, it indeed sets a regulatory and technical timeline for traditional finance and crypto assets that rely on similar encryption foundations.

Risks in the private credit market

Private credit is the third aspect of the ESAs warning, and it is also the one with the fastest growth. The market is still relatively small within the European Union, with limited overall exposure among banks and insurance companies. However, its rapid expansion, lack of transparency, and increasingly deep connections with the broader financial system could evolve into real problems during times of stress. ESAs specifically points out that loan valuations are not frequent and may be inaccurate, credit risks are higher, leverage in the value chain is uncertain, and data gaps prevent both market participants and regulators from fully understanding the risks.

In addition, there are transatlantic factors at play: EU entities have exposure to the much larger US private credit market, and mismatches in liquidity within private credit funds could amplify redemption pressures, which can be transmitted to banks through joint financing channels and common exposures. Banks may also indirectly face credit risks through joint borrowers or financing commitments made for private credit instruments.

The Resilience of the EU Financial System under Risk

Despite the aforementioned concerns, the conclusion of ESAs is that the EU financial system has performed well overall. Financial markets have maintained their resilience during periods of geopolitical tensions, volatile energy prices, and ongoing fluctuations in crypto assets. During times of tension in the Middle East, EU stock markets even reached record highs, and the rise in bond yields did not lead to a significant widening of yield spreads.

Bank Profitability and Asset Quality

European banks are in a strong position. ESAs states that banks have strong profitability, high capital adequacy ratios, and benefit from endogenous capital accumulation, while also having lower levels of non-performing loans. However, the update also indicates that the quality of certain asset portfolios may deteriorate—especially in commercial real estate and loans to small and medium-sized enterprises—these areas deserve close attention in the coming months.

The Resilience of Investment Funds and the Insurance Industry

According to the updates, there were no major disruptions to EU investment funds during the recent round of volatility. The fundamentals in the insurance and pension sectors remain strong, and the capital and financing conditions have further improved. It is worth noting that more frequent natural disasters may widen the gap in insurance coverage. ESAs indicates that this further highlights the need for stronger adaptation measures across the industry.

The Impact of Geopolitics and Cyber Threats

Banks have limited direct exposure to regions affected by geopolitical tensions, but indirect exposures and secondary effects may still be transmitted to borrowers and financing conditions. Negative geopolitical developments could lead to a deterioration in asset quality and a weakening of credit demand—this has already been partially reflected in banks' impairment provisions. Banks also face financing gaps in some non-EU currencies, mainly related to household and corporate deposits in US dollars, British pounds, and Swiss francs. At the same time, cyber and fraud risks remain major concerns at the operational level for the entire industry, which are also directly linked to the cyber threats driven by AI.

Call to action from European regulatory authorities

Given the coexistence of geopolitical uncertainties and rapidly changing technological risks, the ESAs Joint Committee urges regulators and market participants not to take it lightly. Regulatory authorities call for enhanced crisis preparedness, improved coordination in response to emergencies, and the establishment of regulatory rules that can be quickly adjusted to changing circumstances, rather than waiting until a crisis exposes gaps before taking remedial action.

Strengthen crisis preparedness and regulation

Specifically, this means managing exposures to entities outside the European Economic Area (EEA), particularly those related to private credit, monitoring dependence on service providers outside the EU and EEA, and building defenses to address the risks posed by the rapid development of artificial intelligence and quantum computing. This is also one of the two moments in the text that best reflect a broader significance: if regulators cannot act as quickly as the technologies and markets they oversee, the gap between risk and preparedness will only continue to widen.

Proactive monitoring and management of risks

The second, more broad meaning pertains to the market participants themselves. ESAs explicitly requires banks, insurance companies, and investment institutions to continuously monitor external dependencies, private credit exposures, and emerging technologies, rather than treating them as one-time issues. In fact, this indicates that EU regulators view these three types of risks as a interconnected set of pressures that may overlap during times of stress – dependence on non-EU ICT entities exacerbates network vulnerabilities, the opacity of private credit may be amplified by AI attacks, and geopolitical shocks can test all of these factors simultaneously.

Frequently Asked Questions

What are the main vulnerabilities in the EU financial system?

ESAs pointed out that the main vulnerabilities include external dependencies on non-EU ICT providers, emerging technologies such as artificial intelligence and quantum computing, as well as risks associated with the rapidly growing private credit market.

Despite these risks, how resilient is the EU financial system?

The EU financial system remains resilient, with banks having strong profitability and capital adequacy ratios. The investment fund, insurance, and pension sectors also remain stable, despite facing geopolitical tensions, cyber threats, and natural disasters.

Why is there concern that relying on non-EU ICT suppliers could become a problem for the EU financial system?

Dependence on non-EU ICT suppliers increases vulnerability to geopolitical shocks and operational disruptions, as well as network risks, particularly the risk of attacks driven by advanced AI.

What actions do European regulatory agencies recommend taking?

ESAs calls on regulators and market participants to strengthen crisis preparedness, improve regulation, and proactively monitor and manage risks related to external dependencies, private credit, and emerging technologies.

This article was generated with the assistance of artificial intelligence and has been reviewed by an editorial team.