EBA Recovery Plan Dry Runs: Lessons for Luxembourg Banks

ByOfficer

Last updated: April 2026

A recovery plan that has never been tested under pressure is a filing exercise, not a crisis tool. The EBA confirmed exactly this in its April 2026 report on recovery plan dry runs (EBA/REP/2026/09), published on 13 April 2026. The report benchmarks how 16 European cross-border banking groups test their recovery plans through simulated exercises and finds that the gap between mature testers and compliance-driven box-tickers is wide enough to raise supervisory concern.

For Luxembourg banks preparing their next CSSF recovery plan submission, the timing matters. The EBA’s supervisory convergence priorities for 2026 explicitly flag the usability and testing of recovery plans as a key focus area. The CSSF will read these findings. If your dry run section is three paragraphs of generic narrative with no concrete lessons learned, expect questions.

Related reading: our ICAAP and ILAAP guide

What the EBA Report Actually Found

The EBA examined recovery plan submissions from 16 institutions across 10 EU countries, all submitted during the second half of 2024. The analysis covered four dimensions: governance, scope, preparation and execution, and outcomes and lessons learned. The sample was limited to institutions with an established EU supervisory college under the CRD.

The headline finding: two-thirds of banks in the sample have carried out dry runs. That sounds decent until you read the detail. Among those that did run exercises, most presented results at a high level with limited documentation. Some banks in the sample have never conducted a dry run at all, though several indicated plans to do so in 2025.

The real problem starts when the EBA distinguishes between two types of institutions. Those treating dry runs as genuine management tools reported detailed results, structured lesson-learned processes, and concrete follow-up actions that fed into subsequent recovery planning cycles. Those treating dry runs as supervisory compliance exercises produced shallow documentation, no meaningful lessons learned, and no follow-up. The EBA’s language is diplomatic but the message is clear: if your dry run generates zero actionable findings, the exercise was probably not meaningful.

Governance: Where Most Banks Fall Short on EBA Recovery Plan Dry Runs

Only a limited number of institutions in the EBA sample provided detail on the internal governance underpinning their dry run exercises. That is a problem. Without a clear governance framework, dry runs become ad hoc exercises run by the recovery planning team with no board-level oversight and no structured feedback loop.

The EBA identified several governance practices that separate mature institutions from the rest:

  • Board-level approval of the dry run schedule and presentation of results, including key strategic messages, directly to the board of directors
  • A multi-year roadmap that progressively covers different components of the recovery plan over consecutive submission cycles
  • Explicit frequency commitments, whether annual or biennial, driven by an internal roadmap rather than ad hoc supervisory requests

Where I see Luxembourg banks get this wrong most often is the governance handoff. The recovery planning unit designs and runs the exercise, produces a summary, and that summary sits in a recovery plan annex. Senior management gets a briefing but is not an active participant. The EBA report makes clear that good practice means the board of directors explicitly approves the next dry run schedule and reviews the results with enough detail to challenge them. A board that rubber-stamps a three-slide summary is not adding governance value.

The Multi-Year Roadmap Gap

The report includes an illustrative roadmap showing institutions that plan dry runs over a three-year cycle. The example starts with liquidation of assets and restoring LCR in year one, driven by competent authority expectation. Year two covers crisis governance and communication, driven by the institution’s internal roadmap. Year three is a full-scale subsidiary dry run, also internally driven. The progression from supervisor-driven to internally-driven testing is part of the illustrative message: mature programmes move beyond reacting to supervisor flags and onto a multi-year plan that the institution owns.

Most institutions do not operate this way. The more common pattern is a single dry run focused on whatever the supervisor flagged last time. That reactive approach leaves entire sections of the recovery plan untested for years. If your 2024 submission tested collateral mobilisation because the CSSF asked about it, but your crisis communication procedures and escalation framework have never been simulated, that is a gap the EBA report now makes visible.

What Banks Actually Test and What They Skip

The EBA found three main categories of dry run scope across the sample:

Operational Feasibility of Recovery Options

This was the most commonly tested area. Banks simulated the practical execution of specific recovery options, most frequently liquidity-related: collateral mobilisation, issuance of debt securities, and asset sales including non-eligible securities. In some cases, institutions used their actual IT platforms in a dedicated testing environment to replicate execution conditions as closely as possible to a real scenario.

This is where teams usually misclassify what “testing” means. Running a collateral mobilisation exercise that confirms you can technically pledge assets to the central bank is not the same as testing whether you can do it within the timeframes your recovery plan assumes, with the staff who would actually be involved, during a period when your operations team is simultaneously managing a liquidity stress. The difference between a dry run that confirms a theoretical capability and one that stress-tests execution under realistic conditions is the difference between a useful exercise and a compliance artifact.

Escalation and Decision-Making

The second most tested area was the recovery plan indicator framework and the escalation process it triggers. These exercises typically simulated breaches of recovery plan indicators, tested committee involvement, and walked through the decision sequence for activating specific recovery options.

The Luxembourg angle matters here because CSSF-supervised banks operate under EBA/GL/2021/11 (recovery plan indicators, transposed through CSSF Circular 22/808) and EBA/GL/2023/06 (overall recovery capacity, transposed through CSSF Circular 24/851). The indicator framework is not optional. But testing whether your escalation process actually works when an indicator breaches is rarely done with the urgency it deserves. The EBA report notes that governance-focused tests generally require less preparation and execution time. That is true, but it also means there is no good excuse for not having done one.

Communication: The Consistently Undertested Area

Internal and external communication strategies were tested less frequently than recovery option execution and escalation processes. The EBA report flags this without much elaboration, but the implication is significant. A recovery plan that assumes you can communicate with the CSSF, the BCL, counterparties, and the market within specific timeframes has to test those assumptions. In practice, few institutions simulate the actual communication chain during a dry run.

No institution in the EBA sample tested the full spectrum of recovery plan components within a single dry run. The EBA does not treat this as a failing. The recommended approach is a multi-year roadmap that covers different components progressively. The failing is when institutions test one narrow area repeatedly and ignore everything else.

Preparation and Execution: Practical Lessons

The report surfaces several operational details that matter for how Luxembourg banks structure their next dry run.

Preparation periods range from a few weeks to a few months, with execution sessions lasting from one to two hours up to a couple of days. The variance depends on scope. Testing an escalation framework takes less effort than simulating a cross-border recovery option involving multiple subsidiaries.

One finding that stood out: ex-ante training sessions for participants are uncommon. Some institutions deliberately keep the exercise unannounced, arguing that it better simulates real-life conditions. Others provide preparatory briefings, particularly when subsidiaries across different countries are involved. Both approaches have merit, but the EBA flags as good practice the preparation of a dedicated “dry run documents kit” containing all relevant information on the exercise structure, decisions to be taken, and supporting materials from the recovery plan. This does not mean training participants in advance. It means giving them enough context to participate meaningfully without coaching the outcome.

The Resolution-Recovery Disconnect

Most institutions do not identify clear links between recovery dry runs and resolution planning. The EBA highlights this as a missed opportunity. Institutions with more advanced practices use information from resolution planning in their recovery dry runs and vice versa. The recently published EBA Handbook on Simulation Exercises for Resolution Authorities (EBA/REP/2025/20) provides structured guidance that could serve as a reference point for recovery-side exercises.

For Luxembourg banks operating under the SRB’s resolution framework, this integration point is practical. If your resolution authority has already run a simulation exercise that tested data availability or valuation processes, those findings are directly relevant to recovery plan assumptions. Running both exercises in isolation wastes effort and misses consistency checks. The EBA report explicitly calls for stronger synergies and better integration of testing activities across the recovery and resolution domains.

Outcomes and Lessons Learned: The Quality Divide

This is where the maturity gap is starkest. The EBA found that most banks conducting dry runs identified lessons learned and areas for improvement. The most frequently cited areas were:

Recovery plan governance adjustments: refinements to the internal steps for senior management involvement when recovery plan indicators breach, and adjustments to the decision-making process for activating recovery options.

Recovery options specification: inclusion or amendment of preparatory measures, changes to the description of how options are operationalised. In a few cases, dry run findings led to upgrades or downgrades of the feasibility assessment of specific recovery options compared to the initial assessment in the plan.

Interaction with supervisors: some institutions realised they had not simulated the actual communication with competent authorities and considered this crucial for effectiveness, especially for complex or time-consuming recovery options.

When a Dry Run Finds Nothing

The EBA report is pointed about cases where dry runs did not generate significant lessons learned. These cases were characterised by limited documentation across the board: not just the lessons learned section, but also the objectives, preparation, and execution description. The EBA does not say these were bad-faith exercises, but the correlation between shallow documentation and zero findings is hard to ignore.

I have reviewed recovery plan sections where the dry run write-up amounts to: “We tested the escalation framework. The exercise confirmed that the process works as designed. No material issues were identified.” That is not a lesson learned. Every dry run should produce at least one concrete finding, even if the finding is that a specific timing assumption needs updating or that a particular committee’s terms of reference do not clearly cover crisis-mode decision authority. If the exercise genuinely reveals nothing, either the scope was too narrow or the scenario was too soft.

What This Means for CSSF Submissions

The EBA report is explicitly positioned as a benchmarking exercise, not prescriptive guidance. But the context leaves little room for ambiguity. The EBA’s 2026 supervisory convergence priorities list the usability and testing of recovery plans as a key focus. The CSSF, as the competent authority for Luxembourg credit institutions, operates within this framework.

Several practical implications follow for the next Luxembourg recovery plan submission cycle:

Document the Dry Run Properly

The EBA report draws a direct line between documentation quality and exercise quality. If your dry run section in the recovery plan is high-level narrative with no structure, expect the CSSF to push back. Good practice means documenting: the objectives set ex ante, the scope and rationale for the components tested, the preparation steps and participants involved, the execution timeline, and a structured presentation of outcomes and lessons learned with concrete follow-up actions.

Show Concrete Follow-Up

Lesson learned without a follow-up action is an observation, not a lesson. The EBA identifies as good practice an internal action plan with priorities, responsible parties, and timelines. If your 2024 dry run identified that your collateral mobilisation process takes longer than the recovery plan assumes, the 2025 submission should show what was done about it. The CSSF will increasingly look for this feedback loop.

Build a Multi-Year Testing Roadmap

A single dry run per submission cycle covering one narrow area is no longer sufficient if you want to demonstrate mature crisis preparedness. The roadmap does not need to be complex. It needs to show that over a defined period, all major recovery plan components will be tested. Present it to the board. Get explicit approval. Include it in the recovery plan submission.

Engage Senior Management as Participants, Not Recipients

The EBA report makes a distinction between senior management being informed of results and senior management being actively involved in the exercise. Board members who participate in a simulated escalation process develop a fundamentally different understanding of the recovery plan than those who receive a post-exercise summary. For Luxembourg institutions where the CSSF assesses governance quality as part of the recovery plan review, this distinction will matter.

The CMDI Framework Connection

The EBA report is not isolated. It sits alongside the EBA Handbook on Simulation Exercises for Resolution Authorities and references the upcoming Crisis Management and Deposit Insurance (CMDI) regulatory framework, under which the EBA will have a mandate to coordinate EU-wide simulation exercises across competent and resolution authorities.

For Luxembourg banks, this means the integration pressure between recovery and resolution testing will increase. The CMDI package – BRRD amendment Directive (EU) 2026/806, SRMR amendment Regulation (EU) 2026/808, and DGSD amendment Directive (EU) 2026/804, all adopted 30 March 2026 and published in the Official Journal in April 2026 – strengthens the crisis management continuum. Banks that have already built synergies between their recovery dry runs and resolution-side exercises will be better positioned. Those operating in silos will face duplication and potential consistency gaps that supervisors will notice.

Common Mistakes Luxembourg Banks Should Avoid

Based on the EBA report findings and the patterns visible in CSSF-supervised recovery plans, here are the traps to watch for:

Treating the dry run as a compliance deliverable rather than a management exercise. The EBA’s language is unambiguous: dry runs conducted primarily to meet supervisory expectations tend to be less effective, yielding limited insights and follow-up actions.

Testing only what the supervisor last asked about. If the CSSF flagged liquidity options in the previous assessment, testing only liquidity options in the next cycle addresses the specific feedback but ignores every other untested component. Build a roadmap.

Running the exercise without involving the people who would actually execute recovery options in a real crisis. If your dry run is designed and run entirely by the recovery planning unit with no participation from treasury, operations, or communications, the exercise tests the plan on paper, not the institution’s ability to execute it.

Documenting results at the wrong altitude. A three-paragraph narrative that says the exercise went well is not documentation. Meeting minutes, decision logs, timing records, and a structured lessons-learned section with action items are documentation.

Ignoring the resolution planning connection. The EBA explicitly calls out the informational benefits of linking recovery and resolution exercises. Luxembourg banks under both CSSF and SRB oversight have a practical reason to connect these processes.

Frequently Asked Questions

Are recovery plan dry runs legally required under the BRRD?

No. The BRRD (Directive 2014/59/EU) requires institutions to draw up and maintain recovery plans under Articles 5 to 9, but does not explicitly mandate dry run exercises. However, the EBA’s 2026 supervisory convergence priorities identify the usability and testing of recovery plans as a key focus. In practice, supervisors including the CSSF expect institutions to demonstrate that their recovery plans are operational, and dry runs are the primary tool for doing so.

How often should a Luxembourg bank conduct a dry run?

The EBA report does not prescribe a specific frequency. Observed practices range from annual to biennial to ad hoc. The key recommendation is to establish a multi-year roadmap that progressively covers different recovery plan components. For Luxembourg banks submitting annually to the CSSF, conducting at least one dry run per submission cycle and covering all major plan elements over a three-year period is a reasonable benchmark aligned with the EBA’s observed good practices.

What recovery plan components should be tested first?

The EBA report found that operational feasibility of recovery options (especially liquidity-related) and escalation frameworks were the most commonly tested areas. Communication strategies were tested less frequently. A practical starting point is to test whatever component was flagged in the CSSF’s last recovery plan assessment, then use a multi-year roadmap to cycle through remaining areas: other recovery option categories, communication chains, data availability, and cross-border coordination with subsidiaries.

Does the CSSF participate in dry run exercises?

In the EBA sample, competent authorities were generally not directly involved in dry runs and were informed ex post through subsequent recovery plan submissions. Some institutions reported plans to involve supervisors more actively. The EBA does not prescribe supervisor participation but notes that testing communication with competent authorities increases the realism of the exercise. Luxembourg banks could inform the CSSF in advance of planned exercises without requiring direct participation.

How does this report relate to the EBA Handbook on Simulation Exercises?

The EBA Handbook on Simulation Exercises for Resolution Authorities (EBA/REP/2025/20) covers the resolution side. The dry run report covers the recovery side. The EBA explicitly calls for stronger synergies between the two domains. Institutions should look for opportunities to share data and findings between recovery and resolution exercises rather than running them as entirely separate processes.

What documentation should a dry run produce?

Based on the EBA’s observed good practices, a well-documented dry run includes: ex-ante objectives and scope definition, a description of participants and their roles, a timeline of activities, relevant meeting minutes where senior management or committees were involved, operational snapshots of key steps, a structured presentation of outcomes and lessons learned, and a follow-up action plan with responsible parties and deadlines. These should be included in the subsequent recovery plan submission.

What happens if a dry run reveals no significant findings?

The EBA report correlates zero findings with shallow documentation and limited exercise scope. A well-designed dry run should always produce at least incremental findings, even if the conclusion is that timing assumptions need updating or specific preparatory measures need refinement. If a dry run consistently generates no lessons learned, the institution should consider whether the exercise scope is too narrow, the scenario too soft, or the assessment criteria too lenient.

Will the CMDI framework change dry run expectations?

The CMDI regulatory framework strengthens the EBA’s mandate to coordinate EU-wide simulation exercises. While the immediate impact on recovery-side dry runs is indirect, the framework reinforces the expectation of integration between recovery and resolution testing. Luxembourg banks should monitor EBA guidance on how EU-wide simulation exercises will interact with institution-level recovery plan testing.

Related Articles

Key Takeaways

  • The EBA’s April 2026 report (EBA/REP/2026/09) benchmarks recovery plan dry run practices across 16 EU banking groups and finds significant maturity gaps between institutions
  • Dry runs are not explicitly required under the BRRD, but the EBA’s 2026 supervisory convergence priorities make recovery plan usability and testing a key supervisory focus
  • Institutions that treat dry runs as compliance exercises produce shallow documentation, zero lessons learned, and no follow-up actions. The EBA flags this as ineffective
  • Good practice includes a multi-year roadmap, board-level approval and participation, structured documentation, and a formal action plan with responsible parties and timelines
  • Operational feasibility of recovery options and escalation frameworks are the most commonly tested areas. Communication strategies are consistently undertested
  • The resolution-recovery disconnect is a missed opportunity. The EBA calls for stronger synergies between recovery dry runs and resolution simulation exercises
  • Luxembourg banks should expect CSSF scrutiny of dry run documentation quality in upcoming recovery plan assessments, aligned with EBA supervisory convergence priorities
  • The CMDI framework published in April 2026 reinforces the crisis management continuum and will increase integration expectations between recovery and resolution testing

Sources and References

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.

Similar Posts