European Supervisory Authorities warn banks and insurers of cyber risk from non-EU ICT providers

What happened

• The European Supervisory Authorities released their Autumn 2026 risk update, highlighting external dependencies, emerging technologies and private credit as key vulnerabilities for the EU financial system.
• They note heavy reliance on non‑EU ICT service providers and payment systems, which could amplify geopolitical and cyber shocks.
• The update also flags rapid AI advances and growing private‑credit exposure as emerging risk vectors.
• No new regulatory measures were announced, but the ESA calls for heightened vigilance across banking, insurance and investment‑fund sectors.

Why it matters

Financial institutions with significant non‑EU technology contracts should reassess third‑party risk and cyber‑resilience plans, as similar exposure could attract supervisory scrutiny under DORA.

Business impact

Institutions may need to accelerate diversification of ICT suppliers and strengthen AI governance to mitigate heightened cyber‑risk exposure.

What to check

1. 1

   Review third‑party contractsHigh priority

   Map all non‑EU ICT service providers and assess compliance with DORA's ICT risk management requirements.

2. 2

   Enhance AI risk controlsMedium priority

   Implement governance processes for AI models used in critical operations, documenting risk assessments and mitigation steps.