Banking Sector Dynamics

AI in practice

Across the six largest Belgian banks, AI is positioned as a structural transformation lever. The 2025 annual reports also reflect a shared shift toward scaled deployments. The ambition is consistent: AI is expected to transform both how banks operate internally and how they serve customers.

This shift is also visible in how prominently AI features in what banks choose to communicate publicly. As shown in the figure below, the median number of AI references in annual reports roughly tripled between FY24 and FY25, with the distribution shifting upward and becoming more concentrated at higher values, pointing to a broader and more consistent emphasis on AI across institutions.

The most tangible deployments concentrate around two domains. First, in compliance and financial crime, AI-driven automation of KYC due-diligence, transaction monitoring and fraud detection has moved from roadmap to implementation, with banks reporting benefits including reduced false positives, faster detection and significantly lower manual burden. Second, in customer experience, the most advanced deployments are already operating on a significant scale. ING reports that GenAI chatbots handle over 60% of customer conversations across its entities (including Belgium), while KBC's digital assistant Kate resolves 82% of Belgian client cases fully autonomously.

Looking ahead, the more advanced banks are beginning to frame a next phase centered on greater AI autonomy. Agentic AI – systems capable of acting and deciding independently – features explicitly in their strategic narratives and board-level discussions, though operational deployments remain limited and the language is deliberately cautious. The emerging trajectory moves from AI that supports human decisionmaking, to full process automation, to genuinely autonomous systems, with each step treated as conditional on thorough validation and regulatory alignment before the next begins. This progression is accompanied by a visible tightening of AI-specific risk frameworks as a direct response to the rapid move from pilots to day-to-day use, which has surfaced a shared set of concerns across the sector: data privacy, model accuracy, bias, and cybersecurity exposure.

Technology modernization and cyber resilience

The AI deployments described above rest on a deeper layer of technology modernization that has become one of the most consistently prominent themes across the 2025 annual reports. Almost every institution is running a multi-year program to rebuild core infrastructure, expand digital channels, and automate processes at scale. Digital transformation is, in this sense, both the precondition for AI and a strategic imperative in its own right: banks that fail to modernize their technology stack risk being unable to deploy, scale, or govern AI applications competitively.

The investment programs are substantial. ING Belgium's New Banking Platform completed its first full year on track and under budget, progressively replacing the bank's legacy core with a modular, cloud-compatible architecture designed to reduce time-to-market for new products and improve operational resilience. Crelan launched a three-year Transformation Plan in 2025 covering systemic resilience, digital channel enhancement, and process automation. KBC is advancing multiple platform initiatives across its five core markets simultaneously. Belfius convened its Board-level Technology Committee ten times in 2025 and continued capitalizing significant volumes of internally developed software.

The common thread is a shift from maintaining legacy systems to building flexible, automated, and scalable foundations. For the more advanced institutions, this is already enabling the AI applications described previously – real-time fraud detection, autonomous client servicing, and straight-through processing – that would not be feasible on older architectures.

At the same time, the cyber threat environment intensified. Cybersecurity features as a top-tier risk at board level across all six institutions. KBC explicitly noted that its cyber threat landscape came under increased pressure in 2025 as a direct result of elevated geopolitical tensions, with AI-enabled attack methods – including deepfakes and sophisticated phishing – adding new dimensions to a threat that banks are simultaneously trying to harness internally. BNP Paribas Fortis notes that regulators now consider cybercrime a growing systemic risk for the financial sector, with supervisors emphasizing the need for financial institutions to strengthen their resilience to cyberattacks.

The sector's regulatory framework also caught up in 2025 with the full implementation of DORA, which tightened ICT governance requirements and third-party oversight across the sector. DORA's arrival is welltimed: the accelerating shift toward cloud infrastructure and third-party technology vendors has made concentration risk one of the more prominent entries in risk frameworks. Several institutions have responded by strengthening third-party risk management frameworks and contractual ICT resilience requirements; measures that add compliance cost in the short term but address a structural vulnerability that regulators have flagged with increasing urgency.

The deteriorating threat landscape is not unique to financial institutions. According to our 2025 Cyber Survey, half of Belgian organizations across all sectors reported an increase in cyberattacks over the past twelve months, with state-backed actors and organized crime cited as the dominant sources.

Geopolitical risk

Geopolitical risk continues to rank as a front-row emerging risk that cuts through various transmission channels. Trade protectionism, the Russia-Ukraine war, and Middle East instability are the consistent sources of concern, with knock-on effects spanning energy prices, trade route disruption, market volatility, and cyber threats. The key drivers of geopolitical conflicts are largely emotionally or power-politically motivated, and further escalation aimed at reshaping the global order is to be expected.

Where banks diverge is in how they translate this uncertainty into provisioning decisions. Belfius built a dedicated provisioning overlay for geopolitical uncertainty, conducting a top-down and bottom-up analysis of its corporate and business portfolio to identify counterparties and sectors with elevated sensitivity to US protectionism and shifts in international trade.

KBC Group operates a similar dedicated reserve for geopolitical uncertainties, determined by identifying individual counterparties and sectors exposed to macroeconomic stress and geopolitical tensions. ING Belgium and BNP Paribas Fortis took a different but also explicit approach, incorporating geopolitical shocks directly into the downside scenarios underpinning their probability-weighted expected credit loss calculations: ING's downside scenario captures the possible impact of geopolitical tensions, global trade policy and heightened tariff uncertainty. BNP Paribas Fortis similarly identifies geopolitical tensions – alongside trade fragmentation and public finance pressures – as key drivers of its adverse scenarios four-scenario ECL framework. Crelan and Argenta, by contrast, reported close monitoring of geopolitical developments without a direct translation into provisioning at this stage.

The domestic economic backdrop sharpens the picture. Corporate credit quality deteriorated through 2025, with construction, transport, and chemicals the hardest-hit sectors. The chemical sector attracted targeted portfolio screenings at several banks given its dual exposure to Chinese overcapacity and high European energy costs. On the household side, residential real estate held up supported by fiscal stimulus. Belgium's public finances add a further risk layer: a federal budget deficit approaching 5% of GDP, recent sovereign rating downgrades and public debt projected above 100% of GDP constrain the government's capacity to respond to any renewed economic deterioration. The interest rate environment – still historically elevated despite ECB easing – remains the central variable connecting macro dynamics to bank earnings and portfolio risk, with NII sensitivity to further rate movements a key disclosure theme across the sector.

Regulatory pressure

On the regulatory side, the most structurally significant change was the entry into force of CRR3 on 1 January 2025, which transposed the Basel IV final reforms into EU law. CRR3 introduces more risk-sensitive standardized approaches to credit risk, tightens the use of internal models through a progressive output floor and revises the treatment of operational risk and real estate exposures. The capital impact varies by institution and portfolio composition.

Financial crime compliance has become an equally prominent workstream. The EU's establishment of the Anti-Money Laundering Authority (AMLA) and adoption of the harmonized Anti-Money Laundering Regulation (AMLR), with full implementation expected by 2027, are reshaping the supervisory landscape for KYC and transaction monitoring. At the same time, several banks are managing active remediation programs on their existing AML frameworks. Moreover, supervisory priorities are intensifying, with the ECB's ongoing focus on topics such as risk culture, non-financial risk (NFR) governance, and data quality and aggregation capabilities (BCBS 239) continuing to demand increasing management attention.

Looking ahead, a further wave of regulatory changes are coming that will compete for internal capacity alongside banks’ ongoing transformation programs: sustainability (Omnibus I simplification), digital and data (MiCAR, AI Act, FiDA, Digital Euro), operational security (NIS2, Cyber Resilience Act, DORA follow-on requirements), payments (Instant Payments Regulation, PSD3), and financial markets (EMIR 3, Capital Markets Union developments). The breadth of this regulatory pipeline and its overlap with transformation and technology investment programs are increasingly cited as a resource allocation challenge in its own right, particularly for smaller institutions where compliance and strategic change are competing for the same pools of specialist expertise.

Climate and ESG risk

ESG risk is now embedded in credit risk management across all six institutions. The 2025 focus has shifted from framework-building to operationalization: ESG considerations are increasingly translated into credit underwriting standards, collateral valuation frameworks, and portfolio-level monitoring, with individual exposure assessments applied selectively for material files in climate-sensitive sectors.

The approach splits along portfolio lines. For corporate lending, transition risk is the primary concern, with banks tracking financed emissions via PCAF, applying sector-level decarbonization targets, and incorporating climate scenarios into credit risk assessments. For mortgage books, physical risk dominates, with flood exposure and EPC scores embedded in risk appetite frameworks across the sector. Data gaps remain a binding constraint: EPC coverage is incomplete, and banks rely on proxies pending broader corporate disclosures under CSRD.

The regulatory environment for ESG remains unsettled. The Omnibus I package has created material uncertainty in ESG disclosure obligations, with institutions responding differently: BNP Paribas Fortis continued publishing its GAR, applying available simplification measures under existing taxonomy disclosure rules; Belfius suspended its Pillar 3 GAR and BTAR templates entirely until end-2026, following EBA guidance and a subsequent no-action letter. This regulatory uncertainty is also visible in how banks are communicating: ESG references in annual reports became more uniform across the sector in FY25, with previously high reporters pulling back toward the pack.

Banks that have invested heavily in ESG data infrastructure now face a real strategic choice: maintain the ambition of the original framework or scale back to a simplified regime whose final contours remain unclear. For more information on CSRD reporting, we refer to our benchmarking report ‘Embedding sustainability within Belgian banks 2026’.