European Regulatory Radar

The ECB’s supervisory priorities for 2026-2028 focus on banks’ ability to withstand external shocks and to boost their operational resilience. The strategy addresses heightened geopolitical risks, macro-financial uncertainties and the need to strengthen ICT capabilities and digital strategies, including the responsible integration of artificial intelligence. In 2026, the ECB will conduct a geopolitical reverse stress test across 110 directly supervised banks. This will complement the wider EBA stress test.

The ECB is also considering how it can simplify rules and reform supervision. The Governing Council’s High Level Task Force on Simplification published recommendations in December which include simplifying bank capital requirements, expanding the simpler regime for smaller banks, simplifying stress testing, rationalising reporting requirements and reforming the SREP process to take a more risk-based outcomes-focused approach which is more responsive to the risk profiles of individual banks. The ECB’s recommendations follow the EBA’s October consultation on revised Guidelines on the supervisory review and evaluation process and supervisory stress testing, refining supervisory methodology and expectations for capital adequacy assessment.

EU implementation of the final Basel requirements under CRR3 began on 1 January 2025. However, with the UK and US working to later timelines, the European Commission has proposed (i) targeted amendments to the market risk framework (FRTB) to address aspects on which other jurisdictions have already deviated or indicated that they plan to deviate in their final FRTB implementation, and (ii) the introduction of a multiplier to allow banks negatively impacted by the new rules to limit increases in their market risk capital requirements for three years.

The publication of EIOPA’s Revised Single Programming Document set out supervisory priorities for 2026, including Solvency II implementation, digital resilience and cross-border oversight.

Unsurprisingly, there continues to be a high volume of regulatory publications on the twin files approaching implementation in January 2027: Solvency II and the Insurance Recovery and Resolution Directive (IRRD).

EIOPA issued a set of consultation papers on the IRRD in December 2025 covering elements including recovery planning indicators and valuation methodology. This was followed in February 2026 by the first batch of guidelines and technical standards, as well as guidelines on the identification of critical functions.

The European Commission has adopted amendments to Solvency II delegated acts under the Savings and Investments Union (SIU) strategy, while EIOPA has progressed technical implementation and issued revised guidelines relating to group supervision, related undertakings, internal models and market and counterparty risk exposures. EIOPA is looking to review all existing guidelines under the Solvency II Directive, so more will follow.

Last but certainly not least, EIOPA is consulting on a Supervisory Statement concerning the authorisation and ongoing supervision of (re)insurance undertakings linked to private equity firms. The initiative aims to foster consistent, high-quality, risk-based supervision across the EU, addressing identified risks and supervisory challenges arising from the increasing acquisitions of European insurers by private equity (PE) firms.

Steps continue to be taken towards T+1 settlement in October 2027. The update to the Central Securities Depositories Regulation (CSDR) is progressing through the legislative steps. A testing plan and methodology is likely to be launched shortly that will be consistent across the UK, EU and Switzerland. Market participants are expected to continue to update and ideally automate systems throughout 2026 and engage on the transition with counterparties and service providers.

There is also movement towards the launch of consolidated tapes in the EU. ESMA has selected the first Consolidated Tape Provider (CTP) for shares and ETFs in the EU, and it now needs to apply for authorisation allowing it to operate for a period of five years. At the start of 2026, ESMA launched the selection procedure for a CTP for OTC Derivatives, and the authorisation process is ongoing for the provider that has been selected to be the CTP for bonds.

The implementation of European Market Infrastructure Regulation (EMIR) 3 continues – the RTS specifying the operational conditions, the representativeness obligation and the reporting requirements related to the active account requirement has now been published in the Official Journal. Final draft RTS on clearing thresholds have been submitted to the European Commission for endorsement and ESMA has open consultations on post-trade risk reduction services and the use of guarantees as collateral.

The MIP proposes to give ESMA greater centralised supervisory powers. However, the last few months have seen ESMA consolidate and clarify its existing supervisory powers, publishing guidelines on internal controls for Benchmark Administrators, Credit Rating Agencies and Market Transparency Infrastructures, and supervisory expectations for management bodies under its supervision.

Fund managers in the bloc are making final preparations for wide-ranging amendments to the AIFMD and UCITS regimes that take effect from 16 April. For many firms, the most challenging aspect of the package of changes will be implementing the new product-level regime for loan-originating funds. Although there is a transition period for certain funds, the process of categorising funds, implementing revised policies and procedures, and executing all necessary operational changes will be complex. Some firms will also need to implement relatively significant uplifts to comply with new rules and guidance on liquidity management tools.

The European Council and Parliament finally reached agreement on the proposed Retail Investment Strategy (RIS), nearly three years after the Commission published its original proposal in May 2023. Following significant back and forth between the authorities and the industry, some firms may feel that the result runs counter to the simplification agenda, with new rules to be introduced, for example on value for money. More positively, firms will have a relatively long lead in time to implement rules – 30 months from publication of the final rules in the Official Journal of the EU.

Industry is likely to push back strongly on proposals in the Commission’s proposed MIP, to centralise aspects of supervision of asset managers by ESMA. Other important initiatives on the horizon include reforms to the Sustainable Finance Disclosure Regulation (see more in the article below). 

The “Omnibus 1” package, intended to boost EU competitiveness and reduce regulatory burden by simplifying reporting and due diligence requirements, was adopted by the European Commission on 26 February. The resulting revisions to the Corporate Sustainability Reporting Directive (CSRD) and Corporate Sustainability Due Diligence Directive (CSDDD) have been published in the Official Journal of the EU and entered into force in March. Member States will have 12 months to transpose the provisions into national law. The Commission has also proposed revisions to the SFDR, with the updated regime likely to come into force in 2027 or 2028.

ESMA is enforcing requirements on supervisory enforcement around sustainability disclosures, reporting on NCAs' compliance with enforcement guidelines and on firms’ use of ESG or sustainability-related terms in fund names.

The ESAs and the ECB continue to focus on climate and environment-related risk. The ECB will impose penalties where firms do not comply with expectations, and the ESAs have published joint guidelines on ESG supervisory stress testing which will apply from 1 January 2027.

The new EU regime for ESG ratings providers will apply to firms from July 2026, expanding the regulatory perimeter. 

The European Supervisory Authorities (ESAs) Joint Committee Work Programme for 2026 identified digital resilience as a continued area of supervisory focus. This was echoed in the ECB 2026-2028 priorities which highlight further work required to implement DORA fully and remediate weaknesses in cyber security and third-party risk management.

In November 2025, the ESAs designated critical ICT third-party providers under DORA following formal assessment procedures, marking a further step in operationalising EU-level oversight of systemically relevant technology providers.

This was followed by the signing of a Memorandum of Understanding (MoU) between the ESAs, Bank of England, PRA and FCA to enhance cooperation and oversight of critical third parties (CTPs) that fall under the EU CTPP and UK CTP regimes. The MoU came into operation in January and establishes a framework for coordinating and sharing information on the oversight of CTPs, including during incidents such as power outages or cyber-attacks.

In February, the EBA published a follow-up to its 2022 peer review report on ICT risk assessment under the supervisory review and evaluation process (SREP). The report notes progress by competent authorities, largely due to the implementation of DORA, but stresses that further work and continued investment are necessary to ensure consistent and effective ICT risk supervision across the EU.

Meanwhile, the European Commission has proposed a new Cybersecurity Package to address increasing digital threats and de-risk the ICT supply chain. Whilst not specifically aimed at financial services, this will be an area to watch.

The ESAs Joint Committee Work Programme for 2026 identified AI governance as a continued area of supervisory focus.

In November 2025, the European Commission introduced its Digital Omnibus initiative to simplify and rationalise the EU’s regulatory framework on data, cyber and AI, including proposed amendments to the EU AI Act and GDPR and a single central point for reporting all cybersecurity incidents.

The ECB aims to be ready for a potential first issuance of the digital euro in 2029. However, this is dependent on MEPs and EU heads of government agreeing a legal framework for the establishment of the digital euro in 2026. The scope of the digital euro has been contentious, with some factions favouring both online and offline versions and others favouring an offline-only version. A recent vote in favour of both versions by MEPs saw the Parliament’s view move closer to the Council’s – the final vote in June will determine the ECB’s timeline for issuance.

The MIP proposes amendments to CSDR and Settlement Finality Directive (SFD) to encourage the use of distributed ledger technology (DLT). ESMA has also postponed its report on the success of the EU DLTR pilot – launched in March 2023 to allow providers to use DLT for the issuance, trading and settlement of qualifying digital assets – from March 2026 to 2027 in light of the MIP which proposes to expand its scope and scale and to make it more flexible and proportionate to increase uptake of the initiative. The ECB has confirmed it will accept assets issued on DLT as acceptable collateral from April 2026.