Technical note · Academia and think tanks
Cyber risk and bank supervision: lessons from the ECB cyber stress test
Targeted supervisory attention, without capital requirements, can correct banks’ underinvestment in cybersecurity.
- Organization
- SUERF (The European Money and Finance Forum)
- Document date
- 25 June 2026
- Type
- Technical note
- Language
- English
- Scope
- Euro area
- Length
- 8 pages
- Authorship
- Nordine Abidi (IMF); Leonardo Gambacorta (BIS and CEPR); Christoffer Kok, Ixart Miquel-Flores and Alberto Partida (ECB); Leonardo Madio (University of Padua)
What it contains
This SUERF Policy Brief, published on 25 June 2026, summarizes ECB Working Paper No 3222, “Disciplining Digital Risk: Evidence from Cyber Stress Tests”. It starts from the fact that cyber resilience produces positive externalities across interconnected institutions, so each bank may invest less than is socially optimal, and that cyber risk no longer sits in the tail of the distribution of the operational risks banks face: the number of cyber incidents banks reported to the ECB rose sharply through 2024.
The authors use confidential supervisory data on 109 euro area significant institutions between 2019 and 2024, identify “laggard” banks, which invested in cybersecurity less than their risk profile suggested, and exploit the announcement, in March 2023, of the ECB’s 2024 cyber resilience stress test as a quasi-natural experiment. In a difference-in-differences design, laggards raised their cybersecurity investment by about 81% more than their peers, with no detectable pre-trends; the effect is concentrated among the most severe laggards and among those facing more intensive supervisory scrutiny. They also reduced external ICT dependencies, retained specialist staff and reconfigured their cyber insurance coverage.
The conclusion is that targeted supervisory scrutiny, without capital charges or public disclosure of institution-level results, can discipline operational risk-taking in domains with large externalities and relatively blunt regulatory tools. The authors clarify that this does not make capital or disclosure obsolete, but shows that the supervisory toolkit is richer, and that the practical question is no longer whether to extend stress testing to operational resilience, but how to design it. The views are those of the authors and do not necessarily reflect those of the ECB, the IMF or the BIS.
Why it matters for risk management
It provides evidence that a supervisory cyber resilience exercise changes banks’ behaviour, useful for justifying internal investment and anticipating supervisors’ approach. It is the analysis of one case, the ECB’s, and its results are not automatically extrapolated to other countries or to banks of different sizes.
Summary prepared by the Dominican Republic Risk Management Club from a reading of the original document, with the source verified on 12 October 2026. It does not replace reading the official text and is not advice.
Connect with our networks