Carta Circular No. CC/2026/00000019

Mod. 99999975/T – 01/14

Subject: Supervisory expectations on practices to be considered by institutions in the identification, assessment, and management of geopolitical risk

1. In accordance with the legislation and regulation in force¹, institutions must identify, assess, and manage all risks to which they are or may become exposed in a prudent manner, proportional to the scale and complexity of their business models and operations.

2. Geopolitical risk, in the context of this Circular Letter from the Banco de Portugal, refers to the probability of occurrence and impacts resulting from the threat, realization, and intensification of adverse events associated with wars, terrorism, and any tensions between States and political agents that affect the peaceful course of international relations and, thus, disrupt economic activity, financial markets, or business operations.

3. Risks to financial stability² have increased due to geopolitical uncertainty, and geopolitical risk can be transmitted to the banking system through different channels³. This risk can materialize at the level of credit, concentration, liquidity, market, interest rate, and operational risks, as well as affect the business model and internal governance of institutions.

4. In this regard, geopolitical risk is not a new category of risk, but rather a cross-cutting vulnerability factor with an impact on traditional risk categories and the business and internal control of institutions, which has been assuming increasing relevance in the current macroeconomic context.

5. Thus, the decisions and processes for the identification, assessment, and management of risks by institutions must already incorporate geopolitical risk, thereby ensuring that institutions maintain adequate levels of capital and liquidity and operational resilience to address potential losses or avoid and mitigate disruptions in their activity and organization associated with this external factor.

6. It should also be noted that exposure to geopolitical risk is not limited to financial institutions with direct international presence, but also to entities without direct international activity and/or of smaller size, which may be indirectly affected, e.g., through exposure to companies whose value chain is affected by geopolitical events, dependence on capital markets, dependence on technology service providers with headquarters, activity, or some type of dependence, especially outside Portugal or the European Union (or if geopolitical risk events occur in these regions).

7. In this context, geopolitical risk has been a priority for the prudential supervision of the European Central Bank⁴ and the Banco de Portugal⁵, with the European Central Bank publishing a set of relevant considerations on the impacts of geopolitical risk, how these affect the activity of institutions, and which aspects significant credit institutions should follow in the management of this risk⁶.

8. In the same sense, this Circular Letter disseminates to institutions subject to supervision by the Banco de Portugal⁷ a set of supervisory expectations regarding practices to be considered in the identification, assessment, and management of geopolitical risk. Although it does not constitute a requirement for their cumulative application, this set reflects best practices identified that must be assessed by institutions and will serve as the basis for continuous supervisory dialogue on the identification, assessment, and management of geopolitical risk. These practices, in the Annex, are organized into four dimensions – (i) internal governance and risk management, (ii) capital, liquidity, and recovery planning, (iii) stress tests/sensitivity analysis, and (iv) operational resilience.

9. Without prejudice to the provisions of the previous point, and considering the idiosyncratic characteristics of each institution and the principle of proportionality, it is for institutions to assess the adequacy of the dimensions and examples of practices indicated, as well as the possible need to consider additional or alternative practices.

10. Given that geopolitical risk does not constitute a new risk, the Annex also presents, for each of the aforementioned dimensions, the set of existing legal references that are of particular relevance in the identification, assessment, and management of this risk by institutions.

11. The Banco de Portugal will continue to assess the management of geopolitical risks by institutions within the scope of continuous supervision, thematic analyses, and stress test exercises and/or within the scope of on-site actions, monitoring any individual weaknesses that may be identified.

---

¹ As provided for, among others, in Articles 14, 115-A, 115-J, 115-K, and 115-U of the General Regime of Credit Institutions and Financial Companies.
² For example, see Financial Stability Report | May 2026.
³ See Table 2 in Global rifts and financial shifts: supervising banks in an era of geopolitical instability.
⁴ See ECB supervisory priorities for 2025-27 and ECB supervisory priorities for 2026-28.
⁵ Supervisory Priorities | Banco de Portugal.

Mod. 99999924/T – 01/14

⁶ Approach to the impact of geopolitical risk.
⁷ Excludes institutions classified as significant under Article 6(4) of Council Regulation (EU) No 1024/2013 of 15 October 2013.

---

Annex to Circular Letter No. CC/2026/00000019 of the Banco de Portugal

………………………………………………………………………………………………………………………………………………………………………………………………..
Mod. 99999975/T – 01/14

Annex – Practices to be considered in the identification, assessment, and management of Geopolitical Risk

I - Internal Governance and Risk Management

Institutions must ensure that geopolitical risks are integrated into their governance and internal control systems. In this regard, the Banco de Portugal emphasizes the importance of institutions observing, in particular, the provisions of Articles 19 to 26 of Banco de Portugal Notice No. 3/2020, dedicated to the risk management system.

Without prejudice to the idiosyncratic characteristics and the principle of proportionality to be considered by each institution, the following are examples of practices for integrating geopolitical risk into governance and internal control systems:

• The administrative and supervisory bodies, and the risk committee (when constituted), regularly include in their meeting agendas the discussion of main geopolitical risks and their impacts on the bank, with due weighting of these in decision-making processes.
• Strategic decision committees receive regular, timely, and sufficiently granular information on geopolitical developments and their potential impact on the institution.
• Institutions ensure clear assignment of responsibilities for the identification, assessment, and management of geopolitical risks among business lines (1st line of defense), risk and compliance management functions (2nd line of defense), and internal audit function (3rd line of defense).
• Geopolitical risks are adequately reflected and identified in the risk management system and the institutions' risk tolerance levels (e.g., through quantitative, qualitative metrics, limits, or others, across various risk categories), taking into account the geographical presence, activities, counterparties (and their value chains) of the institutions, as well as any impacts resulting from the exposure of members of the administrative bodies to geopolitical risks.
• For the identification and assessment of geopolitical risk, institutions adopt a comprehensive and prospective approach, considering a diverse set of indicators⁸ that reflect different aspects of this risk and allow for timely identification of potential risk sources.
• Institutions have the capacity to aggregate and report, in a timely manner, positions and operations exposed to geopolitical risk.

⁸ Examples: (i) international trade and macroeconomic indicators, e.g., foreign direct investment flows, Services Trade Restrictiveness Index, sovereign risk premiums; (ii) uncertainty (political and economic) and geopolitical risk indicators, e.g., Global Uncertainty Composite Indicator, Geopolitical Risk Index; (iii) financial market indicators, e.g., credit default swaps, implied volatility indices, non-sovereign debt spreads.

• In order to ensure permanent updates regarding new developments, training plans, particularly training plans for members of the administrative and supervisory bodies and those responsible for internal control functions, may include attendance at courses on this subject.

II - Capital, Liquidity, and Recovery Planning

Since geopolitical risks often cross several traditional risk categories, they must be duly reflected in internal processes for assessing capital and liquidity adequacy and in recovery plans. In this regard, the Banco de Portugal emphasizes the importance of institutions observing European regulation, including delegated acts and guidelines, and national legislation on (i) management and monitoring of main risks to which institutions are or may become exposed (e.g., credit, market, liquidity, operational, cyber, legal, and compliance), (ii) capital/liquidity planning, and (iii) recovery in case of crisis. In particular, the concentration of assets and/or liabilities to geographies, sectors, or counterparties exposed to geopolitical risks, risk mitigation factors, and to what extent they may be impacted by geopolitical risk, as well as the timely and correct identification and classification of asset and liability risk, are highlighted at this level.

Without prejudice to the idiosyncratic characteristics and the principle of proportionality to be considered by each institution, the following are examples of practices for integrating geopolitical risk into internal processes for assessing capital and liquidity adequacy and in recovery plans, including in traditional risk categories:

• Geopolitical risks are integrated into the Internal Capital and Liquidity Adequacy Assessment Processes (ILAAP) and Capital and Funding Plans.
• Institutions regularly review recovery plans, ensuring their feasibility in contexts of market disruption or political restrictions, identifying (i) geopolitical risk events relevant to the institution that justify their inclusion in the development of recovery plan scenarios (see point III), and (ii) credible risk management actions and recovery options that can be implemented in case of geopolitical stress.
• Institutions consider limitations of their shareholder structure, resulting from geopolitical events, to address any potential capital and liquidity needs.
• Institutions consider the interactions between geopolitical risks and other types of risk, such as credit, market, liquidity, operational, legal, and compliance.
• Institutions assess direct and indirect exposures to geopolitical risk, including second and third-order effects.
• [Credit Risk] Institutions (i) review and, when necessary, adjust limits, concentrations, and credit granting criteria regarding geographies, sectors, or counterparties exposed to high geopolitical risk, (ii) identify geopolitically sensitive sectors (e.g., energy, semiconductors, defense, and intercontinental logistics), (iii) ensure the timely recognition of credit risk deterioration, including adequate classification, impairment provisioning, and valuation adjustments⁹.

⁹ See in this regard the European Central Bank report “IFRS 9 overlays and model improvements for novel risks - Identifying best practices for capturing novel risks in loan loss provisions”.

• [Market Risk, including in the banking book] Institutions assess the impact of geopolitical events on asset valuations (at market price or in terms of economic value), margin practices, collateral liquidity, and counterparty resilience.
• [Liquidity Risk] Institutions (i) assess the potential impact of geopolitical events on access to funding, market liquidity, and deposit stability, (ii) consider vulnerabilities resulting from dependence on specific currencies, markets, or investor bases, (iii) maintain adequate liquidity reserves and robust contingency funding plans that incorporate severe but plausible geopolitical scenarios.
• [Operational Risk] see point IV.

III - Stress Tests/Scenarios and Sensitivity Analysis

Institutions' risk assessments must be prospective and incorporate relevant external information, ensuring that risks to which institutions are or may become exposed, including geopolitical risk, are identified and assessed in a timely manner. In this context, the use of stress tests, scenarios, and/or sensitivity analysis to assess institutions' resilience and preparedness level to geopolitical risk is considered an important tool for assessing potential impacts on the financial and operational resilience of institutions.

In this regard, the Banco de Portugal emphasizes the importance of institutions considering, in particular, what is stated in point 9(13) of the European Banking Authority Guidelines on institution stress tests (EBA/GL/2018/04) and point 17 of Chapter 2 of the Guidelines on the various scenarios to be used in recovery plans (EBA/GL/06/2014).

Without prejudice to the idiosyncratic characteristics and the principle of proportionality to be considered by each institution, the following are examples of practices for integrating geopolitical risk from a prospective perspective:

• Institutions develop severe but plausible scenarios and/or sensitivity analyses that capture different types of geopolitical events, including escalation of conflicts, economic fragmentation, and prolonged periods of uncertainty.
• Institutions assess the impact of these scenarios on capital, liquidity, profitability, and risk concentrations, and use the results of these exercises to support strategic decisions, risk appetite calibration, and capital and liquidity planning.

IV - Operational Resilience

Geopolitical tensions can aggravate operational and cyber risks and disrupt services outsourced to third parties. In this regard, the Banco de Portugal emphasizes the importance of institutions adopting a prudent approach in managing their activity and physical presence in other territories (e.g., branches, agencies, representative offices abroad) and observing, in particular, the provisions: (i) in the DORA Regulation¹⁰ and its respective delegated acts on the management of Information and Communication Technology (ICT) risk and ICT third-party service provider risk, with emphasis on concentration, dependence, and criticality of external ICT services, and (ii) in general applicable legislation, namely on cybersecurity¹¹ and resilience of critical entities¹².

Without prejudice to the idiosyncratic characteristics and the principle of proportionality to be considered by each institution, the following are examples of practices for integrating geopolitical risk into the management of operational and cyber risks:

• Institutions identify their critical functions and services that may be affected by geopolitical developments.
• Institutions identify key personnel relevant for exposure to geopolitical risk and crisis management in case of a geopolitical risk incident.
• Institutions identify their dependencies on third-party service providers, whether ICT or not (direct or indirect, including intra-group regarding the origin of service providers), the law governing contracts with third-party service providers, the locations where data is processed and stored, and where the service is provided.
• Institutions strengthen physical security and cybersecurity defense mechanisms and incident response capabilities – taking into account the increase in physical, cyber, and hybrid threats to the integrity of their ICT assets, infrastructure, and people resulting from geographical exposures of these elements – whether incidents of increased risk or with a specific profile (threat agents).
• Institutions apply preventive measures, execute contingency plans, and conduct personnel training on business continuity management and ICT disaster recovery, specifically considering geopolitical risk scenarios, focusing on processes, people, and infrastructure most exposed to this risk.
• Institutions develop, test, and apply, if necessary, secure and resilient alternative communication channels – also from a geopolitical perspective – to be used in case of geopolitical crisis.

---

¹⁰ Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022.
¹¹ Decree-Law No. 125/2025, of 4 December | DR.
¹² Decree-Law No. 22/2025, of 19 March | DR.