Nos derniers articles

𝗘𝗜𝗢𝗣𝗔'𝘀 𝗦𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗰 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲 𝘁𝗼 𝗦𝘆𝘀𝘁𝗲𝗺𝗶𝗰 𝗖𝘆𝗯𝗲𝗿 𝗧𝗵𝗿𝗲𝗮𝘁𝘀
The strategy employs four interlocking pillars to build a multi-layered defense. It is anchored in enhancing foundational digital operational resilience across the financial market through collaboration with other European Supervisory Authorities and crucial oversight of critical third-party service providers. This internal strengthening is complemented by a public-facing initiative to close the significant cyber protection gap, promoting informed decision-making to encourage mitigation and adaptation actions among businesses and citizens. To sustain these efforts amid rapid digitalization, EIOPA mandates the continuous adaptation of supervisory frameworks, leveraging SupTech and enhanced data sharing to detect vulnerabilities and structural shifts more efficiently. These pillars are unified through fostering collaborative risk management, working with other relevant EU and international authorities to enable a coordinated response.

The document describes an approach to regulatory adaptation that emphasizes flexible, risk-based supervision in response to digital and technological change. It presents Risk-Based Supervision as a framework intended to identify emerging risks beyond existing legislation through systematic risk identification. The discussion outlines a dual-level process combining industry-wide analysis of technological trends with firm-level assessments of IT systems and operational resilience. It further notes that identified risks are evaluated for potential impact, highlighting cybersecurity as an example that may involve cross-regulatory coordination and could threaten critical operations if severe.

These Joint Guidelines on ESG Stress Testing provide a unified European framework for assessing how environmental, social, and governance risks impact the financial sector. These standards require competent authorities to evaluate both the short-term financial stability and long-term business model resilience of credit institutions and insurance firms. The methodology initially prioritizes climate-related environmental risks, examining both physical threats like weather events and transition risks such as policy shifts. To ensure practical application, the guidelines emphasize proportionality and materiality, allowing for simplified approaches based on the size and complexity of the entity. 𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗶𝘀 𝘀𝗲𝘁 𝗳𝗼𝗿 𝗝𝗮𝗻𝘂𝗮𝗿𝘆 𝟭, 𝟮𝟬𝟮𝟳, following a refinement process that integrated public feedback on data granularity and scenario timelines. Ultimately, the guidelines aim to foster supervisory consistency across the EU while adapting to the evolving maturity of ESG data and modeling.

The 𝗘𝗕𝗔 announces updated guidance for banks concerning 𝗲𝗻𝗵𝗮𝗻𝗰𝗲𝗱 𝗿𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀 𝗳𝗼𝗿 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗿𝗶𝘀𝗸. This guidance follows a postponement of the mandatory application date for new reporting obligations, now shifted from March 2026 to the 𝗲𝗻𝗱 𝗼𝗳 𝗝𝘂𝗻𝗲 𝟮𝟬𝟮𝟲 by the European Commission's Regulation (EU) 2025/2475. The EBA specifies that institutions must use the 𝗖𝗢𝗥𝗘𝗣 𝗢𝗙 𝗺𝗼𝗱𝘂𝗹𝗲 (𝗿𝗲𝗹𝗲𝗮𝘀𝗲 𝟰.𝟮) 𝗮𝗻𝗱 𝗰𝗹𝗮𝗿𝗶𝗳𝗶𝗲𝘀 𝘄𝗵𝗶𝗰𝗵 𝘀𝗽𝗲𝗰𝗶𝗳𝗶𝗰 𝗿𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝘁𝗲𝗺𝗽𝗹𝗮𝘁𝗲𝘀, 𝗖 𝟭𝟲.𝟬𝟮, 𝗖 𝟭𝟲.𝟬𝟯, 𝗮𝗻𝗱 𝗖 𝟭𝟲.𝟬𝟰, 𝗮𝗿𝗲 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝗱 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗠𝗮𝗿𝗰𝗵 𝗿𝗲𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝗱𝗮𝘁𝗲 𝗯𝘂𝘁 𝘄𝗶𝗹𝗹 𝗯𝗲 𝗺𝗮𝗻𝗱𝗮𝘁𝗼𝗿𝘆 𝗶𝗻 𝗝𝘂𝗻𝗲 𝟮𝟬𝟮𝟲. This announcement also mentions the availability of updated technical instructions and IT solutions to help banks implement the revised operational risk reporting framework smoothly. Finally, this information is framed within the EBA's broader roles, which include developing harmonized rules, promoting supervisory convergence, and providing risk and data analysis for the European financial system.

"The three European Supervisory Authorities (EBA, EIOPA and ESMA – ESAs) published two factsheets designed to help consumers protect themselves from crypto and other online frauds and scams and explain how fraudsters increasingly use artificial intelligence (AI) to deceive consumers. To make the information easily accessible, 𝘁𝗵𝗲 𝗳𝗮𝗰𝘁𝘀𝗵𝗲𝗲𝘁𝘀 𝘄𝗶𝗹𝗹 𝗯𝗲 𝘁𝗿𝗮𝗻𝘀𝗹𝗮𝘁𝗲𝗱 𝗶𝗻𝘁𝗼 𝗮𝗹𝗹 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹 𝗘𝗨 𝗹𝗮𝗻𝗴𝘂𝗮𝗴𝗲𝘀 𝗮𝗻𝗱 𝗿𝗲𝗽𝗿𝗼𝗱𝘂𝗰𝗲𝗱 𝗯𝘆 𝗻𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗮𝘂𝘁𝗵𝗼𝗿𝗶𝘁𝗶𝗲𝘀."

EIOPA’s December 2025 Financial Stability Report outlines several risks facing European insurers and pension funds, including growing exposures to private credit, vulnerabilities from a weakening U.S. dollar, and the impact of global market interconnectedness. It describes private credit’s expansion, associated liquidity, valuation and concentration risks, and insurers’ sizable U.S. dollar-denominated holdings with complex hedging needs. The report also notes interconnected international exposures that could elevate market and currency risks, alongside other topics like cyber threats and AI-related systemic vulnerabilities, while acknowledging resilient capital and funding ratios amid economic uncertainty.

France Assureurs publie la 9ᵉ édition de son étude annuelle “Assurance et finance durable”, présentant les données clés du secteur de l’assurance à fin 2024 dans une perspective ESG (environnementale, sociale, gouvernance) à l’occasion du 10ᵉ anniversaire de la COP 21 et de l’Accord de Paris. Le rapport dresse un état des politiques d’investissement responsable des assureurs, incluant objectifs de neutralité carbone à 2050, analyse de l’impact sur la biodiversité, niveaux d’investissements verts et exposition aux énergies fossiles, ainsi que l’intégration de critères durables dans les produits d’assurance et l’accompagnement des épargnants.

Europe is facing an unprecedented surge in cyber threats. Malware targeting banking apps alone has grown 200% year-on-year, with affected applications tripling from 600 to 1,800. These numbers reflect a simple truth: cybersecurity is no longer just a tech challenge—it’s a talent challenge.

Despite growing investments, Europe’s cybersecurity skills gap continues to widen, leaving our digital ecosystem exposed. Today, this shortage of skilled professionals is arguably our single greatest vulnerability.

To close this gap, ENISA introduced the European Cybersecurity Skills Framework (ECSF)—a much-needed step toward a common skills language across Member States. Its ambition is right. Its mission is essential. But its practical impact remains limited.

A recent structural analysis highlights six critical gaps holding the ECSF back:

🔹 No seniority levels, making career pathways unclear

🔹 Weak links between tasks, skills, and knowledge, complicating curriculum design

🔹 No graded proficiency levels, limiting meaningful assessment

🔹 Inconsistent role definitions, misaligned with real-world job functions

🔹 Flat, unstructured knowledge lists, difficult to reuse or map

🔹 Lack of scalable coding, hindering interoperability with frameworks like NICE, SFIA, and CyBOK

The good news? These issues are solvable.

A smarter, next-generation ECSF could be built by:

1️⃣ Introducing hierarchical categories for tasks, skills, and knowledge

2️⃣ Defining explicit links between them

3️⃣ Integrating competence tiers

4️⃣ Adding junior–mid–senior levels

5️⃣ Creating a modular structure for emerging domains

6️⃣ Mapping skills directly to training and certifications

This is more than framework design—it’s a strategic investment in Europe’s digital sovereignty. A coherent ECSF empowers educators, enables precise hiring, enhances mobility across Member States, and builds the coordinated workforce we urgently need.

This annual report analyzes how cybersecurity policy translates into practical actions, investments, and operational changes within organizations across the EU, particularly those in high-criticality sectors under the NIS2 Directive. The findings, based on a survey of over 1,000 professionals, highlight that while regulatory compliance is the main driver of investment, challenges persist, such as the cyber talent crunch and difficulties with fundamental tasks like patching and security assessments. Key insights from the report show a shift in spending toward technology and outsourcing, and an ongoing concern over ransomware and supply-chain attacks. This ENISA study ultimately aims to inform policymakers by revealing the practical obstacles and shifting priorities faced by entities working to enhance their cyber resilience.

Le baromètre 2025 met en évidence une prise de conscience généralisée du risque géopolitique, désormais perçu comme un facteur de rupture majeur pour les entreprises. Si son intégration dans la gouvernance et les cartographies progresse, les moyens dédiés restent limités : budgets faibles, absence de ressources spécialisées et formations rares. Le pilotage demeure fragmenté et souvent réactif, malgré une reconnaissance de l’interdépendance croissante entre tensions internationales, chaînes de valeur et risques opérationnels. Les organisations identifient comme menaces principales les conflits potentiels impliquant les grandes puissances et appellent à une évolution vers une culture d’anticipation structurée et transversale.