← Back to updates
BIS

BIS

Low Impact

BIS publishes ECB speech on digital innovation, AI, tokenisation and bank business model resilience

Published

Sep 30, 2026

Topics

Digital transformation, Artificial intelligence, Cyber resilience, Outsourcing and cloud concentration, Tokenised deposits, Payments, Risk data aggregation, DORA, MiCA

Executive Summary

BIS published a keynote speech by Claudia Buch, Chair of the ECB Supervisory Board, delivered on 22 September 2026, on whether digital innovation hinders or boosts banks’ business models. The speech is not a binding rulemaking document and does not introduce a new effective date, filing deadline or regulatory template. It is nonetheless a useful supervisory signal for banks under ECB supervision. The ECB’s message is technology-neutral but not risk-neutral: banks may use AI, cloud, tokenisation and digital channels, but must manage the resulting operational, conduct, liquidity, outsourcing and business model risks. The speech highlights board-level accountability for digitalisation strategies, multi-year investment planning, reliable data architecture, remediation of risk data weaknesses, cyber action plans, outsourcing concentration analysis under DORA, and preparation for quantum-resistant cryptography. It also points to public-sector infrastructure developments, including Pontes and Appia, that may affect tokenised finance and settlement models. Firms should treat the speech as an input to supervisory engagement and strategic planning rather than as a standalone compliance obligation.

What Changed

newNon-binding supervisory signal on digital strategy

Previous

Digital transformation was already part of ECB supervisory and industry attention, but this publication does not cite a new rule change.

New

Banks are expected, as a supervisory matter, to maintain long-term digitalisation strategies supported by governance, risk controls, resilient IT infrastructure and multi-year budgets.

newAI risk and cyber action-plan emphasis

Previous

AI was treated as part of broader digital transformation and model-risk discussions.

New

The speech states that the ECB asked banks in summer 2026 to reassess cyber defences and submit concrete action plans, to be assessed horizontally for good practices.

newTokenised finance infrastructure update

Previous

Banks exploring tokenised deposits faced fragmented private networks and limited interoperability, while EU law did not clearly delineate tokenised deposits from e-money tokens.

New

Pontes is described as live from 21 September 2026 for settlement of tokenised financial assets in central bank money, while Appia is described as developing a blueprint by 2028.

newSystem-wide outsourcing and cloud concentration lens

Previous

Outsourcing risk was primarily managed through firm-level outsourcing governance and existing operational resilience controls.

New

The speech frames common infrastructures and concentrated third-party providers as risks that can propagate across banks and require sectoral supervisory analysis.

newRisk data aggregation remediation remains a supervisory pressure point

Previous

Banks with fragmented legacy systems or weak data architecture could still pursue individual digital initiatives.

New

The ECB states that it closely monitors remediation of open supervisory findings and may use supervisory escalation if material deficiencies are not addressed in a timely manner.

Business Impact

Who is affected

Directly affected

euro area significant institutions and other banks under ECB supervision using AI, cloud or outsourcing arrangements, tokenisation, digital channels, online deposit platforms or digital lending tools.

Indirectly affected

payment institutions, e-money and crypto-asset service providers, cloud and technology providers, fintech partners, investors, and non-EU banking groups with euro area supervised entities.

Jurisdictions

Euro area, European Union

Business processes

Board oversight of digital transformation strategy, AI governance, model risk and human-judgement controls, Cyber resilience and remediation action planning, DORA outsourcing and ICT third-party dependency management, Deposit stability and liquidity risk monitoring, Tokenised deposit and payments product governance, Risk data aggregation and supervisory finding remediation

Estimated effort

Medium

Compliance risk

Medium

Affected Reports

Digital transformation strategy, roadmap and board management informationAI use-case inventory, model governance file and human-oversight controlsCyber resilience remediation plan and action-plan trackerOutsourcing, cloud and ICT third-party dependency registerRisk data aggregation and supervisory finding remediation tracker
FieldValidation rule

Recommended Actions

7 suggested next steps· derived from source analysis
  1. 1
    AI generatedStep 1 of 7

    brief the board and executive risk committees that the speech is non-binding but relevant to ECB supervisory dialogue on digitalisation and business model resilience.

  2. 2
    AI generatedStep 2 of 7

    review whether digital transformation budgets, delivery indicators and risk appetite measures are documented on a multi-year basis and aligned with strategic objectives.

  3. 3
    AI generatedStep 3 of 7

    refresh the AI inventory to identify use cases in fraud, cyber, customer support and credit scoring, and confirm human oversight, bias controls and accountability owners.

  4. 4
    AI generatedStep 4 of 7

    reconcile cyber resilience action plans, open supervisory findings and remediation commitments, especially where AI-enabled cyber threats or recovery weaknesses are relevant.

  5. 5
    AI generatedStep 5 of 7

    test whether outsourcing and cloud dependency registers can support DORA-style concentration analysis, substitutability assessment and severe provider disruption scenarios.

  6. 6
    AI generatedStep 6 of 7

    for tokenised deposit or digital-asset initiatives, document legal classification, settlement model, operational dependencies and cross-border scalability constraints before launch.

  7. 7
    AI generatedStep 7 of 7

    include quantum-readiness and migration to quantum-resistant cryptography in longer-term technology risk planning where cryptographic assets, data or transactions are material.

Timeline

other

Jul 7, 2026

The speech refers to a letter from the ECB Supervisory Board Chair to chief executive officers of significant institutions on AI-enabled cybersecurity threats and related bank action plans.

implementation

Sep 21, 2026

Pontes is described in the speech as having gone live, enabling settlement of tokenised financial asset transactions in central bank money.

publication

Sep 22, 2026

Claudia Buch delivered the keynote speech at the annual Foreign Bankers’ Association of the Netherlands conference in Amsterdam.

publication

Sep 30, 2026

BIS publication date inferred from the official BIS source URL for the speech PDF.

implementation

2028

The speech states that Appia will have developed a blueprint for an integrated European ecosystem for tokenised finance by 2028.

Sources

AI-generated analysis is based on the following primary sources. Always verify against the official publication.

Related Evidence

Verified source support for this analysis

The evidence agent checks whether the drafted finding is supported by official publications and relevant public source material.

Receive updates like this by email

Get AI-generated analysis for the regulators and topics you care about.

Pulse is built by Datox. Datox automates AIFMD Annex IV and SEC Form PF reporting end to end.

See the Datox platform