Europe’s banks look strong on the usual scorecard. The new warning is about what sits outside the balance sheet.
On September 23, the European Banking Authority, European Insurance and Occupational Pensions Authority and European Securities and Markets Authority published a joint risk update that put dependence on non-EU technology providers near the center of the financial system’s operational-risk map. In the EBA questionnaire summarized by the regulators, roughly 80% of banks identified dependencies on ICT service providers as a challenge. Payment-solution dependencies came next at roughly 60%.
The twist is AI. The same report says frontier models can help attackers find and exploit vulnerabilities at speed and scale. A concentrated supplier network therefore creates two risks at once: an outage or policy shock at a shared provider, and a faster attacker searching for the common seam.
What changed
This is not a new capital rule and it does not name Amazon, Microsoft, Google or any other vendor. It is a supervisory signal about concentration.
The regulators say European banks rely heavily on third-party cloud, software and payment providers that are often domiciled outside the EU. They recommend continued monitoring of non-EU service dependencies, stronger crisis preparation and readiness for risks from rapid AI and quantum-computing development.
That matters because operational resilience is no longer only an IT department concern. If many banks depend on the same provider, a failure can become a sector event. If AI makes vulnerability discovery cheaper, the time between a flaw appearing and attackers testing it may shrink.
The report’s baseline is not a weak banking system. EU and EEA banks produced a 10.5% return on equity in the first quarter of 2026 and held a 16.2% common-equity Tier 1 ratio. Non-performing loans were about €375 billion, or 1.8% of total loans. The warning lands precisely because conventional capital and credit metrics look resilient.
Why it matters
For banks, the next resilience premium may be paid in duplicated infrastructure, exit plans, contract rights and recovery drills rather than in extra loan-loss provisions. Those costs can pressure margins even when credit losses stay low.
For cloud and software providers, concentrated demand is both a moat and a regulatory target. The report does not call for breaking contracts or forcing localization. But a supervisor that sees concentration as a systemic vulnerability can push customers toward multi-provider architecture, stricter audit rights and proof that workloads can be moved.
For insurers, AI-enabled cyberattacks can raise both claim frequency and accumulation risk: one incident can hit many insured institutions through a common supplier. Exclusions may cap insurer losses, but they can also leave banks carrying more of the tail risk themselves.
The investor question is not whether European banks suddenly lack capital. It is whether the cost of resilience rises faster than institutions can spread it across vendors, products and customers.
The case
The strongest argument for the regulators’ warning is structural. Shared infrastructure creates efficiency in normal times and correlation in bad times.
A bank can diversify borrowers and securities, yet still route critical services through the same cloud region, software stack or payment network as its peers. Traditional balance-sheet diversification does not remove that operational commonality.
AI changes the search economics. Attackers can automate reconnaissance, social engineering and vulnerability testing. Defenders can use the same tools, but concentration means a successful technique against one shared layer may travel farther than an attack on an isolated system.
The report also links the dependency issue to private credit. EU and EEA banks’ exposures to private-credit funds and related asset managers reached nearly €150 billion in June 2025, equal to 0.6% of total assets. That is limited in aggregate, but the regulators warn that stress could travel through financing lines, shared borrowers and commitments to private-market vehicles.
The common theme is visibility. External technology and private credit can both move risk outside familiar reporting lines without making it disappear.
The other view
Concentration is not automatically fragility. Large cloud providers can spend more on security, redundancy and specialist staff than most banks could build alone. Forcing every institution to recreate infrastructure can increase cost and create weaker, uneven defenses.
The regulators also describe the banking system as profitable and well capitalized. The 80% and 60% figures are survey signals about perceived challenges, not probabilities of failure. They do not show that four out of five banks will suffer a cloud incident.
Multi-cloud strategies have their own failure modes. More vendors can mean more interfaces, more configuration errors and less accountability when an incident crosses systems.
The practical goal is therefore not maximum fragmentation. It is credible substitutability: banks should know which services are truly critical, how long an exit would take, what data can move, and which backup arrangements have actually been tested.
What to watch next
- Whether European supervisors turn this cross-sector warning into specific concentration tests or recovery-plan requirements.
- Whether banks disclose higher technology and resilience spending, especially for duplicated cloud capacity and migration tools.
- Whether large providers offer stronger portability, audit and incident-liability terms to regulated customers.
- Whether cyber insurers narrow coverage for common-provider events or reprice accumulation risk.
- Whether the EU’s operational-resilience regime produces public evidence that exit and recovery plans work under stress.
Decision in 30 seconds
Europe’s banks are not being warned about a classic run. They are being warned that many institutions may share the same technological chokepoints.
About 80% of surveyed banks identified ICT-provider dependencies as a challenge, while roughly 60% pointed to payment-solution dependencies. Frontier AI can make those shared seams faster to probe.
The investment consequence is a new cost line: resilience, portability and vendor diversification. The winners will not simply be the biggest provider or the bank with the highest capital ratio. They will be the firms that can prove a critical service can fail without the institution failing with it.
Primary sources
- European Supervisory Authorities: risk update news release, September 23, 2026
- Joint Committee Update on Risks and Vulnerabilities in the EU Financial System — Autumn 2026, JC 2026 29
