On 21 February 2025, the European Commission adopted Decision 2025/369 expanding the role of the Chief Risk Officer (CRO). The new legal framework for the Commission's CRO reacts to the increasing and more complex financial instruments that leverage the EU budget over the past years. It implements the recommendations of the European Court of Auditors' special report 16/2023 on EU debt management. The CRO acts independently, with an oversight over now all of the Union's financial operations:

• Borrowing, debt, and liquidity management;
• Lending operations and budgetary guarantees;
• Asset management.

Operating independently from other Commission services responsible for financial operations, the function of the CRO can be seen as a central pillar of the "three lines of defence" model, a best-practice framework for risk governance:

• The first line of defence consists of the Commission departments managing EU borrowing, lending, and asset management operations as well as budgetary guarantees.
• As an independent, corporate, second line of defence, the CRO formulates risk management policies and provides independent risk oversight, ensuring additional controls and accountability.
• The third line of defence is the Internal Audit Service, providing independent assurance on risk governance.

The CRO was established in 2021 and its position is held by liyana Tsanova. The new Commissioner for Budget, Anti-Fraud and Public Adminstration, Piotr Serafin, said:

"Strengthening the role of the Chief Risk Officer is a testament to the EU's commitment to maintaining high standards of financial risk oversight. The use of loans and budgetary guarantees will remain an essential instrument to drive the EU’s political priorities and support investments for climate transition, competitiveness and external action. As we navigate an increasingly complex financial landscape, these measures ensure that the EU remains prepared to address emerging challenges with robust risk management practices."