The European Central Bank (ECB) has emphasized the urgent need for banks across Europe to strengthen their operational resilience in response to the growing cyber threats posed by artificial intelligence (AI). During a keynote speech at the Goldman Sachs European Financials Conference in Zurich, Frank Elderson, a member of the ECB’s Executive Board and Vice-Chair of its Supervisory Board, outlined the challenges and necessary actions for banks to maintain robust defenses in an evolving digital landscape.
Elderson highlighted that Europe faces unprecedented geopolitical and technological challenges, including overreliance on external providers for critical infrastructure such as energy, technology, and financial systems. He stressed that safeguarding Europe’s autonomy requires massive investments, estimated at €1.2 trillion annually until 2031, particularly in green, digital, and defense sectors. In this context, strong and competitive banks are essential for financing these transitions.
However, operational resilience—banks’ ability to continue delivering critical services during disruptions—goes beyond traditional financial strength measures like capital and liquidity. Elderson pointed to recent incidents such as ransomware attacks and widespread system failures that disrupted financial operations despite banks’ solid financial positions. These events illustrate how cyber risks can jeopardize banking services even when capital buffers are sufficient.
The rise of AI introduces new complexities to the cyber threat landscape. While more than 85% of banks supervised by the ECB use AI to improve operations and security, malicious actors are also leveraging advanced AI tools to launch faster, more sophisticated cyberattacks. These AI-driven methods reduce the expertise and time previously required for complex breaches, potentially lowering barriers for attackers and increasing risks across the banking sector.
In response, the ECB has intensified its supervisory efforts. In 2024, it conducted a cyber resilience stress test involving 109 banks to assess their preparedness against severe cyber incidents. The results showed that while many banks have adequate frameworks in place, improvements remain necessary. Since then, most identified weaknesses have been addressed. Furthermore, the Digital Operational Resilience Act (DORA), which came into effect last year, provides a regulatory framework mandating continuous enhancement of IT and cyber risk management and stronger oversight of third-party service providers like cloud platforms.
Elderson underscored the strategic role of bank management in tackling these challenges. Effective governance is crucial to allocate resources appropriately and ensure timely responses to vulnerabilities. Given that many banks depend on shared infrastructure such as cloud services and payment systems, failures can cascade across the sector. Thus, enhanced supervision of third-party risks and improved information sharing within the financial ecosystem are vital.
The ECB plans to send a “dear CEO letter” to all supervised banks urging proactive measures against AI-driven threats. This initiative aims to encourage institutions to strengthen their defenses before threat actors widely adopt frontier AI technologies. Elderson warned that complacency is not an option; early investment and continuous improvement in operational resilience are necessary to protect trust in banking services.
He also noted disparities between larger banks with greater IT budgets and smaller institutions that may face more challenges in enhancing resilience. Despite these differences, all banks must meet adequate standards to maintain system-wide stability. Proportionality in supervision remains important but cannot compromise prudent risk management.
In conclusion, the ECB’s message is clear: Europe’s future depends on resilient banks capable of supporting critical economic transitions amid an increasingly complex threat environment shaped by rapid advances in AI technology. Strengthening operational resilience is not only a defense mechanism but a fundamental pillar for sustaining competitiveness and trust in Europe’s banking sector.
