European Union financial supervisors have issued a stark joint risk assessment warning that Europe’s banking, funds and insurance sectors face material threats from dependence on non-EU infrastructure, AI-driven cyberattacks and the future arrival of cryptographically capable quantum computers.
The Joint Committee of the European Supervisory Authorities — comprising the European Banking Authority, the European Insurance and Occupational Pensions Authority and the European Securities and Markets Authority — submitted its autumn findings to the Financial Stability Table of the EU’s Economic and Financial Committee on 10 September 2026, with public details released on 23 September.
Regulators warned that EU finance remains closely linked to non-EU systems at nearly every layer. Equity UCITS funds and alternative investment funds carry large U.S. exposures, while banks depend on information and communications technology suppliers and payment systems outside the European Economic Area. They also run funding gaps in dollars, sterling and Swiss francs. Clearing, repo and credit ratings are largely routed through non-EU firms, leaving EU institutions exposed to foreign regulatory decisions and geopolitical shocks they cannot control.
On cybersecurity, the report says frontier AI models can find and exploit software weaknesses quickly and easily, increasing the potential damage of AI-assisted attacks. ENISA, the EU’s cybersecurity agency, reached similar conclusions in its 2026 threat report, logging more than 48,000 new vulnerabilities in 2025, a 22% increase, and noting that threat groups are increasingly using AI in their operations.
The most striking crypto-specific warning concerns quantum computing. The supervisors said an advanced quantum machine could undermine cryptography protecting communications, transactions, databases and blockchains, and that this could materialise earlier than any viable commercial application. They also warned of harvest now, decrypt later attacks, where encrypted data stolen today could be decrypted once quantum capability matures.
For Bitcoin and Ethereum, the exposure is already measurable. Glassnode found in May that 6.04 million BTC, representing 30.2% of issued supply and worth more than $469 billion at the time, had public keys visible on-chain and would be targetable without any transaction being required. Estimates for Q-Day, the point at which a machine can break Bitcoin and Ethereum cryptography, range from 2030 to 2032 and later.
Google Quantum AI researchers estimated in March that building a machine capable of breaking many cryptocurrency cryptosystems might require roughly 20 times fewer physical qubits than previously thought. In response, developers are already working on defenses. In February, Bitcoin’s Jameson Lopp and five collaborators proposed retiring the network’s current signature scheme. The Ethereum Foundation is aiming to strengthen Ethereum against quantum attacks by December 2029.
The EU's Digital Operational Resilience Act already requires financial entities to use state-of-the-art cryptography, and the NIS Cooperation Group has separately recommended that member states adopt a post-quantum cryptography migration strategy by the end of 2026. The supervisors also flagged fast-growing, opaque private credit markets as a third emerging risk, with EU and EEA bank exposures currently at just 0.6% of total assets but worth watching closely.
