Credit and cybersecurity risks faced by European banks have increased over the past year as asset quality deterioration and digital security challenges ticked up.
The volume of risk-weighted assets (RWA) of banks in the EU and the European Economic Area increased by more than 3% to €9.72 trillion at the end of March from €9.42 trillion a year before, according to the European Banking Authority's latest risk dashboard. Credit risk contributed €233.72 billion to the total RWA increase, while operational risks contributed €72.03 billion.
The increase in credit risk comes as banks' overall nonperforming loans (NPLs) rose 2% to €372.3 billion over the first quarter, corresponding to an NPL ratio of 1.86% at the end of March.
Most banks are bracing for an asset quality deterioration in the next six to 12 months in sectors such as consumer credit, small and medium-sized enterprises and commercial real estate (CRE), the European Banking Authority said.
Small and medium-sized enterprises' NPLs increased to €111.9 billion at the end of March from €108.6 billion three months before and €104.9 billion a year ago. The NPL ratio for the sector was 4.5%. Meanwhile, the consumer credit NPL ratio was 5.4% and 4.3% for the CRE sector.
CRE loans, which make up 6.3% of the total euro area bank loans and 20% of corporate loan portfolios, will be among the most affected by the economic slowdown in the region, the European Commission said in its latest financial stability review. Banks' loan income may also decrease due to lower loan demand from nonfinancial businesses and households and stricter credit standards for riskier loans, the review found.
Cyberrisks on the rise
Banks reported a rise in operational risks as cyberattacks became more frequent and sophisticated. About 18% of global cyberattacks targeted financial institutions, Moody's said in a report, citing data from the IBM X-Force Threat Intelligence Index of 2024.
In a survey conducted as part of the report, 78% of respondents said cyberrisk and data security were the main drivers of their operational risk increase, with 25% reporting one to five successful cyberattacks.
In January, the European Central Bank initiated a cyber stress test to assess how banks respond to and recover from a cyberattack. "Many banks operate with aging IT systems, making them vulnerable to cybersecurity threats, data breaches and operational disruptions..." Claudia Buch, chair of the central bank's supervisory board, said in March.
The results of the stress test are expected to be released in the summer.