The European Securities and Markets Authority has published its second Risk Monitoring report of 2026, cautioning that investor optimism across European markets sits uneasily alongside deteriorating macroeconomic fundamentals and a widening set of operational threats, including those posed by advanced artificial intelligence systems.
In the report, part of ESMA's regular Trends, Risks and Vulnerabilities series, the authority rates market, contagion and operational risks at the highest level on its internal scale, while credit risk is described as elevated. The assessment comes despite a rally in European equities, which advanced 12% over the first half of 2026 after an initial slide, a recovery ESMA suggests may understate the fragility beneath it.
Macro pressures mount
ESMA points to an escalation of conflict in the Middle East that disrupted transit through the Strait of Hormuz during the first half of 2026, pushing oil prices to near $126 per barrel. Against that backdrop, the European Union's growth forecast for 2026 has been revised down to 1.1%, while inflation is now projected to rise to 3.1%. The authority also notes that correlation between stock and bond returns has reached historic highs in several member states, eroding the traditional safe-haven role of sovereign debt.
Stress has also surfaced in private markets. ESMA flags outflows from US Business Development Companies amid broader concerns over private credit, a segment it treats as a channel through which strain could spread more widely.
Crypto losses deepen
Digital assets feature prominently in the report's risk picture. The crypto market has fallen 28% year-to-date, with total market capitalisation now at EUR 1.9 billion, according to ESMA's figures. Since peaking in October 2025, the sector has shed roughly 2 trillion euros in value, a decline ESMA cites as evidence of the asset class's continued volatility and its potential to transmit stress into broader markets.
AI enters the threat model
A notable addition to this edition of the report is ESMA's focus on frontier artificial intelligence models. The authority names Claude Mythos, GPT-5.5 Cyber and GPT-6 as systems now capable of discovering, validating and executing exploits, a capability it says introduces a new category of operational risk for the financial sector.
ESMA describes the resulting risk as a "asimetría defensiva", warning that the proliferation or leakage of such tools to malicious actors could outpace the defensive capabilities of financial institutions. The report notes that the EU financial sector remains a priority target for cyberattacks, with phishing and ransomware among the most prevalent incident types recorded.
In light of these combined pressures, ESMA urges financial institutions and retail investors alike to maintain strong liquidity buffers and to strengthen operational resilience frameworks, positioning both macro-financial and cyber preparedness as immediate priorities for the remainder of 2026.
