The European Central Bank (ECB) has revealed plans to carry out cyber resilience stress tests on 109 of the banks it directly supervises in 2024, to assess how they both respond to and recover from a cyberattack.
Stress testing the banks will not analyse their ability to prevent it in the first place, the European Central Bank explained. Instead, in the stress test scenario, a cyberattack succeeds in disrupting a bank’s daily business operations. Under these conditions, the banks must then test their response and recovery measures, including activating emergency procedures and contingency plans and restoring normal operations. Supervisors will subsequently assess the extent to which banks can cope under such a scenario.
EU law currently requires the ECB to carry out stress tests on supervised banks at least once per year. The results of annual stress tests provide important input for the SREP in the test year.
As part of the exercise, 28 banks will undergo an enhanced assessment for which they will submit additional information on how they coped with the cyberattack. This sample covers different business models and geographies to provide a meaningful reflection of the euro area banking system and ensure there is efficient coordination with other supervisory activities.
Supervisors plan to discuss the findings and lessons learned with each bank as part of the 2024 Supervisory Review and Evaluation Process, which assesses a bank’s individual risk profile. The exercise’s main findings will be communicated in the summer of 2024.
Continuing stress tests
Last year, 57 of the euro area’s largest banks were part of an EU-wide stress test coordinated by the European Banking Authority (EBA) – which published results for the individual banks in July 2023.
Also in 2023, the ECB conducted stress tests for 41 smaller banks that it supervises directly. The aggregate results and selected bank-specific information were published by the ECB in July 2023. Together, the stress-tested banks broadly cover 80 per cent of the euro area’s banking sector.
Occasionally, to assess significant institutions’ resilience to unexpected external developments during years in which there is no EU-wide EBA stress test, the ECB carries out forward-looking solvency-based vulnerability analyses of significant institutions under its direct supervision.
