Digital, operational and cyber resilience are key priorities for the year to come, says CSSF director-general Claude Marx, who points out that Europe is already being targeted by hybrid warfare attacks and expects to see more in the future.
Conflict in the Middle East, drone strikes on a UK military base in Cyprus, Russia’s full-scale war against Ukraine entering its fifth year: we are surrounded by geopolitical turmoil, and Europe is not immune.
“In Europe, we are not in a state of war, but we are not far, actually, from this,” said CSSF director-general Claude Marx, delivering a keynote speech at the European Financial Planning Association Luxembourg’s annual sustainable finance forum on Thursday. “What is often forgotten is that we have sabotage attacks—many. We have drones spying on critical infrastructure, we have internet cables that are disabled, we have power outages due to attacks.”
“We have invented a word which is called ‘hybrid warfare’. But in a way, it’s silly, because either we have warfare—or we don’t. And I consider that these attacks are a kind of a war.”
Over the last year, drones have been detected over a nuclear submarine base in France, over military installations and critical infrastructure like power plants in Germany, and over Brussels Airport, to name just a few examples. Incursions into Romanian airspace have happened several times; three Russian fighter jets entered and stayed in Estonian airspace for 12 minutes last September. Underwater cables in the Baltic Sea have been damaged or cut. Eurojust, the EU agency for criminal justice cooperation, last week reported that a joint investigation team had identified 22 people suspected of carrying out attacks across Europe involving self-igniting parcels; they are suspected to have been working on behalf of Russia’s military-intelligence service.
“We have invented a word which is called ‘hybrid warfare,’” said Marx, who also is a member of ESMA’s board of supervisors. “But in a way, it’s silly, because either we have warfare—or we don’t. And I consider that these attacks are a kind of a war.”
“At the same time, we haven’t seen it all. I think we have to be conscious that we will see more of this, unfortunately,” he continued. “Financial service providers, the important finance centre we have here, is a primary target for attacks. I don’t believe we will have Russian tanks rolling down Boulevard Royal, but we will have further attacks on our systems. That’s a top priority for us, but also a priority for the European Central Bank, and other international organisations.”
Five priorities for banking, five for asset management
Whilst not new or a surprise, digital and operational resilience is a supervisory priority for the banking sector in 2026. “In the current context, it is particularly important that people make sure that they have resilient systems, that they are tested—penetration testing, cyber testing, and so on—and also that we take care of emerging risks from AI and other new technologies,” said Marx.
Credit quality and real estate vulnerabilities constitute another supervisory priority for the CSSF this year. “On the commercial real estate side, we have seen quite high [levels of] non-performing loans; nothing to be alarmed about in terms of solvency of banks, but still at high levels, in this country, but also in other countries.”
Measures concerning anti-money laundering and countering the financing of terrorism (AML/CFT) are also a key priority. “Liquidity funding structure and intra-group channels—this interconnectedness—is a big subject,” continued Marx, whilst the fifth priority concerns business models and governance.
On the asset management side, liquidity risk remains high on the agenda. “We monitor fund liquidity quite carefully, we do outlier analysis. This year, we will have a specific focus on ELTIFs, on semi-liquid alternative investment funds, and other retail alternative investment funds—the Part II types of funds, as they are called,” said Marx.
The second priority is contagion, and the CSSF accordingly monitors and supervises leverage via a special task force. “The third one would be asset valuation,” said Marx. “We look at valuation methodologies, we look at governance, and we look at conflict of interest.”
Fund disclosures are the CSSF’s fourth priority for the asset management industry. “Here, we look at ESG claims in particular. We review the periodic disclosures of funds, but we also compare the pre-contractual type of disclosures with the reality. We are developing automated risk-scoring systems, and also we are developing—with the help of AI—automated systems that can check the prospectus versus the real investments. It’s a medium-term project, but we are working on it, and then it will enable us to have a really good view on ESG claims and similar claims.”
The fifth priority—as for the banking sector—concerns IT and cyber risk.
Sustainable finance linked to EU objectives
With all that being considered, does sustainable finance—the topic of the EFPA forum—still matter today? “The answer is clear,” said Marx. “Yes. It does still matter, it’s a subject that’s there to stay.”
That being said, the role of sustainable finance has changed and matured. It’s not an isolated policy. “Today, we observe links between sustainable finance and the key objectives of the EU,” said Marx. Those include the Savings and Investment Union; digital operational resilience; the energy transition, related infrastructure, and the need for independence; and defence.
Public finance alone cannot fund the green transition, he pointed out. Private capital must also be mobilised. Household savings in Europe—amongst the highest in the world—ought to be directed towards financing the transition. There is interest, but this doesn’t always translate into investment decisions. A Climate Policy Observatory survey last year showed a “disconnect” between citizens’ concerns regarding climate change and the ability to identify effective solutions.
“This gap mirrors the challenges faced by investors trying to navigate the sustainable finance landscape,” said Marx. “It’s already difficult for institutional investors to understand article 6, 8, 9 and the other changes in taxonomy… but for retail investors, it’s impossible to understand.” The European Commission’s proposal for SFDR 2.0, presented last November, aims to simplify sustainability disclosures and introduce a different categorisation system.
Technological resilience and sustainable finance are linked. “Artificial intelligence is already used to process sustainability information and support ESG reporting, and DLT presents opportunities to improve traceability and transparency of ESG data through the blockchain,” said Marx. But many companies still report data quality and consistency issues, making this a key challenge.
The energy transition and energy resilience are also key EU priorities. “The Russian war of aggression against Ukraine, but also now the war in Iran that has spread to the Gulf region, have highlighted the importance of energy resilience for the European economy,” said Marx.
A reliable supply of energy is crucial for the economy, and the EU has increased its efforts to reduce vulnerabilities, diversify energy sources, and boost the system’s independence. Launched in May 2022, the REPowerEU plan aims to end dependency on Russian gas and oil, secure affordable energy, and promote investment in renewable energy. “But this goes beyond energy policy alone,” he argued. “Energy resilience is closely linked to economic stability, to industrial competitiveness, and ultimately political independence.”
Finally, defence. “Recent geopolitical developments have led the European Union to realise that defence is not something ‘dirty,’ but it’s vital. We cannot rely on other partners, necessarily, to safeguard our defence,” said Marx. “In this context, financing becomes a key element.” Several hundred billions of euros will be needed per year, and once again, both public and finance money will be needed.
The European Commission in September issued a notice regarding the EU’s sustainable finance rules, like SFDR, and investment in the defence sector, which stated: “Given its contribution to resilience, security and peace, the EU defence industry enhances sustainability. The Commission notes that the sustainable finance framework is fully consistent with the EU’s efforts to facilitate the European defence industry’s access to sufficient finance and investment. It does not impose any limitations on the financing of the defence sector.”
“Resilience,” concluded Marx, “depends not only on policy decisions but also the capacity to allocate capital efficiently to strategic sectors,” whether that’s renewable energy, defence, or technology.