ESAs call for vigilance over external dependencies, cyber threats and private credit risks

The European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) have identified external dependencies, emerging technologies and private credit as key vulnerabilities for the EU financial system in their Autumn 2026 risk update.

The ESAs warn that the sector's reliance on non-EU providers and infrastructures could amplify the impact of geopolitical shocks and operational disruptions. Dependence on ICT service providers outside the European Economic Area remains a particular concern, alongside growing cyber risks linked to increasingly capable AI models.

The findings also highlight vulnerabilities related to private credit. Although the sector remains relatively small in the EU, its rapid growth, limited transparency and increasing links with the wider financial system could create risks during periods of stress.

Despite these challenges, the EU financial system has remained resilient. Investment funds, insurers and banks continue to show strong fundamentals, although geopolitical tensions, cyber threats, natural catastrophes and technological developments continue to shape the outlook.

The ESAs call on supervisors and market participants to strengthen their preparedness and continue closely monitoring risks stemming from external dependencies, private credit and emerging technologies.

The key findings of Autumn 2026 Joint Committee update on Risks and Vulnerabilities were presented at the meeting of the Financial Stability Table of the EU’s Economic and Financial Committee (FST-EFC) on 10 September 2026 as input from the ESAs.