Swiss franc mortgage crisis: How mBank weathered Poland's €25 billion legal risk

By the end of 2025, Polish banks had set aside some €25 billion for a risk that sat in no credit model: court rulings on Swiss franc mortgages.

That is more than half of the UK's PPI bill, in a banking system a fraction of the size. Few outside Poland noticed – it unfolded alongside a pandemic and a war. It deserves attention, because the mechanism is European, not Polish: EU consumer law reaching back into contracts signed more than a decade earlier.

For mBank, it was the largest risk of the past decade, and it did not show up in our credit metrics. The borrowers were paying and the collateral was sound. Yet since 2018 we have booked PLN 18.8 billion (~EUR 4.5 billion) of legal-risk provisions on foreign-currency (primarily CHF) mortgages for individual clients – more than the bank's entire equity by the time the legal risk began to materialise.

The instinct in a banking crisis is to shrink. Ours required almost the opposite. The problem was not the franchise; the franchise was the solution. Our job was therefore to ration scarce capital without damaging the earnings engine that had to absorb the legacy losses.

How we got here: A legacy shock inside a polycrisis

Like much of the Polish and CEE market, mBank originated Swiss franc mortgages in the early 2000s, when lower Swiss interest rates made them significantly cheaper than zloty loans. Peak of offering was in 2008 with a rapid decrease thereafter - CHF offering was stopped in August 2011, other FX in 2014. The borrowers continued to pay, but the franc's sharp appreciation – first after the financial crisis, then after the Swiss National Bank's 2015 de-peg – materially increased their debt burden. These mortgages still represented almost a quarter of our loan book; in 2020, about one-sixth.

Unlike Hungary and Croatia, Poland never resolved the issue through statutory conversion. Borrowers turned instead to the courts, challenging FX-indexation clauses under EU consumer-protection law. A 2019 judgment of the Court of Justice of the EU accelerated a strongly consumer-protective line of case law, under which contracts could be annulled rather than rewritten. An annulled contract is unwound: the bank refunds every instalment, even on loans already repaid, and recovers only the zloty amount it originally lent – often well over a decade earlier, worth roughly half as much in real terms, and with no compensation for the use of that money.

A total of 500 thousand CHF mortgage loan cases had been brought before the Polish courts.

The risk had fundamentally changed. Capital was held against currency and credit risk; it was not calibrated for contracts being unwound retroactively.

That shock did not arrive alone. The pandemic lifted credit costs, broken supply chains tested our corporate clients, and the monetary policy rate was cut to 0.1%. That compressed the very income we needed to absorb legal provisions.

Then the cycle reversed. Inflation peaked above 18%, and the central bank delivered the steepest tightening in its history: from 0.1% to 6.75% in under a year. A government-legislated payment holiday, open to all mortgage borrowers regardless of need, shifted part of the affordability burden onto banks.

Meanwhile, in February 2022, Russia invaded Ukraine, a country on Poland’s eastern border. The war pushed the Swiss franc above five zloty in autumn 2022, inflating the legacy book just as we launched our settlement program. In the same months, Poland's eight largest banks, mBank among them, decided to help fund the resolution of a failing peer (putting aside jointly PLN 3.47 billion to the Protection Scheme (IPS)).

Each of these shocks, taken alone, is the kind of event stress tests are built for. What models did not capture was their sequence – and the way each amplified a risk that had never been in the library at all.

Managing legacy risk without shrinking

When I joined mBank as CRO in 2020, the question was no longer whether to lend in francs – it was already a legacy portfolio – but how to manage what those loans had become.

The core bank – retail, corporate, digital – was healthy. Net profit before CHF-related legal risk costs rose from PLN 1.1 billion in 2020 to almost PLN 5.6 billion in 2025. Shrinking that franchise to protect capital would have destroyed the very asset that was paying for the legacy.

So the risk function ran two mandates at once. The first was capital vigilance. That meant forward-looking capital projections at higher frequency, limits anchored in loss-absorbing capacity rather than growth ambitions, and new lending rationed to the best returns on capital. Our loan book was broadly flat between 2021 and 2023.

The second was franchise protection. We kept investing in technology and client experience, and deposits grew by 18% over the same period. Capital was rationed; the franchise was not starved.

Self-help: Earnings, costs and the capital markets

Self-help started in the income statement. Cost discipline kept our cost-to-income ratio at around 28% in 2023 and 2024, turning a strong operating engine into loss-absorbing capacity. Shareholders contributed through patience rather than cheques: no dividend was paid out of profits for 2018-2025.

Capital markets were the second pillar, used as a risk-management toolkit, not just as a financing tool:

• 2021: we issued the first senior non-preferred bond (debt that absorbs losses ahead of other senior creditors) from a Polish financial institution in EUR benchmark format.
• 2022: we closed a PLN 9 billion synthetic securitisation, transferring the credit risk on a loan portfolio to investors without selling the loans. It was the first synthetic deal in Poland to carry the EU's STS (simple, transparent and standardised) label and the largest securitised portfolio in the CEE region. Later risk transfers on renewable-energy and commercial real estate portfolios were regional firsts too.
• 2024: we became the first commercial bank in Poland to offer AT1 bonds in PLN – capital instruments that absorb losses while the bank is still operating – to a broad institutional investor base.
• June 2025: we became the first commercial bank in Poland to offer EUR denominated Tier II bonds in the international capital markets via a EUR 400mln issuance that was nine times oversubscribed.
• August 2026: we closed our 6th securitisation, bringing the total notional of securitised portfolios in excess of PLN 35 billion.
• September 2026: we became the first Polish bank to issue AT1 instruments in euros, seven times oversubscribed.

Each instrument answered a risk question: how much loss can we absorb, where does a given risk sit best, and at what price?

The verdict came from three directions. In December 2023, the supervisor lifted the additional capital requirement tied to our FX mortgages. In early 2025, within 54 days, S&P, Moody's and Fitch all upgraded mBank’s ratings, each citing lower CHF legal risk, stronger earnings and rebuilt capital. For us, that convergence mattered. It suggested that what had begun as crisis management was being recognised externally as a durable change in the bank's risk profile. And investors repriced our debt, from 600 bps to 330 bps in less than two years.

Turning to growth without changing appetite

By mid-2026 the legacy was contained. We had signed more than 34,000 out-of-court settlements, and pending cases were down to around 4,300. Quarterly legal risk costs had fallen to a fraction of their peak levels.

Gross loans have grown from PLN 117 billion at the end of 2023 to PLN 154 billion. Our 2026–2030 strategy targets at least 10% market share in key products. Our message on risk is simple: we are growing the bank, not the risk appetite. Three lessons from the crisis shape how.

Test growth against capacity, not ambition.

Risk appetite is ultimately a statement about how much loss a bank can absorb. Every growth plan is tested against capital consumption under stress, including legal and conduct scenarios outside Pillar 1. For new products we ask not only how they will perform, but how they will look to a court or regulator in ten years.

Read the signals that precede the numbers.

The portfolio signals I watch most closely are the early ones:

• recent vintages;
• where new market share comes from, and at what price;
• margin relative to risk;
• concentration in our priority sectors.

When we gain share quickly, the first question is which clients we are winning – and why our competitors are letting them go. Our cost-of-risk strategic target of around 0.8% sits well above the 30–40 basis points we see today. It is a budget, not a trophy.

Fix the anchors, flex the levers.

Adaptable appetite does not mean moving limits. We fix a few public anchors: a CET1 buffer at least 2.5 percentage points above requirements, a cost-of-risk corridor and an unchanged risk appetite statement. The levers are what flex: capital instruments, risk transfer, sector allocation and pricing. The anchors give boards, supervisors and investors stability; the levers give the business room to move.

Credible challenge, in our experience, is earned the hard way. A risk function that spent years protecting the bank's capital speaks with weight when growth is on the table.

Why this matters beyond Poland

Few European banks still hold significant Swiss franc mortgage portfolios. But many may face the same underlying pattern: a risk outside Pillar 1, repriced retrospectively by courts or legislators and crystallising alongside a macroeconomic shock. The broader lesson is not about CHF mortgages. Banking relies on a reasonable degree of predictability as to how contracts will be interpreted and enforced over their lifetime. Our experience showed that changes in consumer-protection jurisprudence can reach back more than a decade and fundamentally alter the economics of legacy portfolios long after the original credit decision was made.

ICT, cyber and AI risks are rightly high on the agenda of risk functions across Europe. They are visible, actively debated and increasingly supported by dedicated regulatory and governance frameworks. Legal and judicial risks are often less prominent, even though a shift in legislation or jurisprudence can transform a long-dormant exposure into a potential capital event. Such are difficult to model, frequently sit outside Pillar 1 and may crystallise with an impact far greater than perceived probability would suggest.

The lesson is not that every unmodelled risk can be predicted. It is that resilience must be built before the risk is visible: through capital headroom, earnings power, cost discipline and continued access to markets. When an unexpected shock arrives, the healthy core must be able to absorb it without sacrificing the franchise or its capacity to grow.

That is the conversation I look forward to continuing at RiskMinds in November: how CROs can connect risks that models still treat in isolation and build resilience before the risk is visible.