The Eurosystem has expanded its operations well beyond what a central bank would have traditionally undertaken. It now owns assets that are not 'central bank money' definitionally. Assets have credit ratings as low as BB in the Standard and Poor's system, which means they are 'Speculative Grade' and involve 'Substantial credit risk'. It does not even perform credit risk analysis itself, but relies on its public credit rating agencies and on commercial banks.
This is laid out in the newly-released book 'The shadow liabilities of EU Member States, and the threat they pose to global financial stability', written by Bob Lyddon and published by The Bruges Group.
Even before the Pandemic, the Euro system had laxer criteria than its peers for admitting a particular asset (a bond) onto its list of collateral eligible for its monetary and payment operations. An eligible asset could be placed at a Euro system member as collateral for an overdraft, or it could be purchased into one of the Asset Purchase Programmes. Up until 2020 the asset had to carry an 'Investment Grade' rating from at least two of the four EU-approved credit rating agencies. That would mean a Baa3 from Moody's or BBB- from Standard and Poor's, lower by several rungs than the equivalent criteria at the Bank of England.
Since the Pandemic the Euro system significantly lowered its criteria and in several ways.
It allows assets with public credit ratings of Ba2/BB, outside 'Investment Grade'.
It reduced its 'haircuts' by 1/5th across the board thus taking more credit and market risk on each asset.
It allowed commercial banks to act as a surrogate for a public credit rating agency, which is already a surrogate for its own assessment. It did this by adding new asset types to its eligible list, notably 'credit claims', which are certificates confirming ownership rights over a portfolio of bank loans, which could be car loans, credit card balances, consumer loans or whatever. The bank had made a credit risk assessment of the portfolio and assigned it an internal credit rating that it attested was equivalent to a given level of public credit rating. The bank's methodology goes by the name of 'Internal Ratings-Based' and the bank has a strong motivation for assigning a high internal credit rating, but possibly, if it is in Italy, Spain, Cyprus or Greece, not a particularly strong track record of getting its homework correct.
Via these practices the Euro system has now become a hybrid of a commercial bank with central banking powers, exposed to a wide range of assets beyond those that constitute 'central bank money'. The Euro system relies on external credit assessment, whether by credit rating agencies or commercial banks.
Losses on Euro system operations track back to the ECB but it has next-to-no loss-absorption cushion. A cushion of €8.3 billion at the end of 2021 on a balance sheet of €680.1 billion can sustain losses on assets of only 1.2% of their value, a decline that can occur in a few minutes. All the ECB has is the implied backing of Eurozone member states to subscribe fresh capital if things go wrong. If they do, the member states will need to dig deep, or that would be the end of the ECB, the Euro and possibly the EU itself.