The national supervisory programme (NSP) contains the supervisory priorities jointly defined each year by the Federal Financial Supervisory Authority (BaFin) and the Bundesbank for the institutions subject to national supervision in Germany. These priorities are the outcome of a comprehensive assessment of the risks and the areas of activity of the institutions under supervision. The second step is to formulate supervisory measures to address those risks and areas of activity. In parallel to this, the Single Supervisory Mechanism (SSM) sets priorities for the SSM as a whole, and these feed into the formulation of the national priorities. In addition to the focus areas of supervision for 2025, medium-term supervisory priorities up to 2027 are identified that take into account structural and medium-term challenges facing the banking sector.

Furthermore, BaFin and the Bundesbank closely monitor current developments at institutions and developments in financial markets, and take additional supervisory measures where necessary and adapt the focus areas of supervision.

The economic environment continues to be shaped by structural, cyclical and, in particular, geopolitical challenges. This has been accompanied by a significant increase in corporate insolvencies, which have led to the materialisation of credit risks caused by mounting write-downs. Supervisors are focusing on developments in the commercial real estate market as well as the probabilities of default and the recoverability of collateral for corresponding credit exposures.

The ECB’s monetary policy has an impact on credit institutions’ net interest income. While the latter rose sharply in the wake of monetary policy tightening in 2023 and 2024, interest expenditure could rise more strongly than interest income, not least due to shifts into higher-yielding deposits. For example, the higher interest rate level, together with the weakness in the economy, has led to a significant decline in credit growth. This is likely to have a negative impact on the net interest income of German institutions. Supervisors therefore closely monitor interest rate developments and obtain an overview of interest rate risk in order to identify flagged institutions at an early stage.

In addition, sound governance has a significant impact on a credit institution's long-term stability. Weaknesses in the business organisation and governance in particular may lead to risks being misassessed or to bad decisions. This applies all the more in an environment characterised by rapid change and uncertainty. 

The risk of cyberattacks is high and, overall, has risen again, partly owing to geopolitical tensions. At the same time, technological dependence on critical service providers is growing and banking business is becoming increasingly digital. Modern and efficient IT should therefore be regarded as indispensable. In addition, the outsourcing of essential IT activities and processes is continuing to gain in importance and is increasing the dependence of credit institutions on third parties. From a supervisory perspective, it is therefore important for institutions to identify the potential of cyber and IT risks, take into account possible concentrations on multi-client service providers and implement the requirements of the Digital Operational Resilience Act (DORA).

In light of these risks, the following supervisory priorities and their main areas of activity for 2025 have been defined:

1. Economic environment (incl. commercial real estate market)

• Developments in lending standards, credit default ratios and collateral values are monitored on an ongoing basis. Adequate risk provisioning is checked via special inspections of lending business at flagged institutions.
• Institutions are identified that do not generate sustainable profitability due to a material decline in lending.
• Thematic analysis of the focus area proprietary exposures to real estate (proprietary safe custody account business).

2. IT security

• The aim is to identify the risk potential presented by cyber/IT risks, including concentrations on third-party providers.
• Implementation of DORA requirements is checked by means of thematic reviews at selected institutions and their IT service providers. The focus here is on the ICT risk management framework in particular.

3. Governance (incl. business models)

• Continuing identification of institutions with governance vulnerabilities and misconduct.
• The focus is increasingly on ensuring that top management and the supervisory body are qualified.
• In addition, in the case of flagged institutions, areas of focus are established for the auditor of the annual accounts or special inspections are ordered.

4. Interest rate developments

• Horizontal analyses are carried out, inter alia, on the interest rate sensitivity of depositors and the assumptions underpinning institution-specific models.
• Credit institutions with material unrealised losses or a vulnerable depositor structure should be monitored more closely. In addition, special inspections are increasingly conducted on the topic of market price risk.

Compared with 2024, the focus on IT security, in particular, has thus once again gained in importance. Governance is now no longer treated as a medium-term priority, but as a focus area for 2025.