Insurance & Pensions in European Union

Key dates

03 August 2026

- ESAs publish the Final Report and draft RTS proposing amendments to Delegated Regulation (EU) 2016/2251 to simplify bilateral margin requirements for counterparties below the EUR 8 billion initial margin threshold

TBD (European Commission adoption)

- The European Commission reviews and, if satisfied, endorses the draft RTS amending the EMIR bilateral margin Delegated Regulation; exact date to be set by the Commission’s internal process

TBD (European Parliament and Council scrutiny)

- Following Commission endorsement, the RTS are subject to scrutiny by the European Parliament and the Council under the standard RTS procedure before publication in the Official Journal

TBD (Entry into force – OJ publication + 20 days)

- The amended RTS enter into force on the date specified in the Official Journal (typically 20 days after publication), from which firms can legally apply the new exemption regime

TBD (Three years after entry into force) Deadline

- By the date three years after entry into force, the ESAs must complete a review of the application and impact of the exemption from initial margin requirements in Article 28(1), potentially informing further changes

Suggested considerations

• Map all EMIR in-scope entities within the group and identify those whose AANA of non-centrally cleared OTC derivatives is close to or below the EUR 8 billion threshold, to assess which relationships may benefit from the expanded exemption.
• Review current collateral and margin frameworks to identify legacy contracts where initial margin is still being exchanged solely because the regime requires continuation despite the counterparty having fallen below the EUR 8 billion threshold.
• Prepare an internal policy update so that, once the RTS enter into force, initial margin requirements are switched off for counterparties below the EUR 8 billion threshold on both new and existing uncleared OTC derivatives, subject to group risk appetite.
• Update EMIR margin procedures and AANA calculation processes to ensure accurate annual determination of whether each counterparty is above or below the EUR 8 billion threshold, including documentation of the March–May calculation methodology.
• Review and amend collateral agreements, credit support annexes (CSAs) and associated legal documentation to incorporate the revised treatment for below-threshold counterparties, including terms for stopping margin exchange and potentially releasing segregated collateral.

What changed

• - Counterparties whose average aggregate notional amount (AANA) of non-centrally cleared OTC derivatives falls below the EUR 8 billion threshold will no longer be required to exchange initial margin...
• The current framework, under which below-threshold counterparties are exempt from initial margin for new trades but must continue to exchange initial margin for pre-existing “legacy” contracts, will...
• Article 28(1) of Delegated Regulation (EU) 2016/2251 will be amended to explicitly extend the exemption from initial margin requirements to outstanding contracts where one of the two counterparties...
• The RTS introduce a clearer operational framework for entry into and exit from the initial margin regime based on the annual AANA calculation for March–May, including scenarios where one or both...
• Once a counterparty falls below the EUR 8 billion threshold under the revised rules, firms will be permitted to terminate related initial margin processes, including ceasing ongoing calculation,...

Key dates

2026-08-03

ESAs publish final report and draft RTS proposing amendments to Delegated Regulation (EU) 2016/2251 bilateral margin requirements

Suggested considerations

• Compliance teams may wish to review current EMIR margin frameworks and inventories of uncleared OTC derivatives to identify portfolios and counterparties that are below the €8 billion initial margin threshold and could be affected by the proposed phase-out of initial margin exchange.
• Risk and collateral management functions should consider assessing the operational processes, documentation and systems currently used to calculate, call and exchange initial margin on legacy uncleared OTC derivative contracts, to understand the potential impact of a removal of these obligations on collateral flows and counterparty risk management.
• Legal and documentation teams may wish to map existing credit support annexes (CSAs) and collateral agreements to EMIR margin requirements, evaluating whether standard terms referencing Delegated Regulation (EU) 2016/2251 would need amendment if the RTS are endorsed and the obligation to exchange initial margin for below-threshold portfolios is removed.
• Regulatory affairs and policy teams should consider monitoring the European Commission’s endorsement process and subsequent scrutiny by the European Parliament and Council, tracking any changes to the draft RTS text that could affect scope, thresholds or transitional arrangements.
• Firms subject to EMIR in multiple jurisdictions may wish to compare the proposed EU treatment of below-threshold initial margin portfolios with requirements in other key jurisdictions (e.g. US, UK) to ensure consistent cross-border collateral and margin policies and avoid regulatory arbitrage or misalignment.
• Compliance teams may wish to prepare briefing materials for senior management and boards outlining the anticipated simplification and burden reduction, alongside any residual risks or supervisory expectations that could accompany the phase-out of initial margin for below-threshold counterparties.

What changed

Under the current EU bilateral margin framework in Delegated Regulation (EU) 2016/2251, counterparties with an aggregate average notional amount of non-centrally cleared derivatives below the €8 billion initial margin threshold specified in Regulation (EU) No 648/2012 (EMIR) are exempt from exchanging initial margin on new uncleared OTC derivative contracts, but must continue to exchange initial margin on existing contracts.

Key dates

2026-07-31

Joint ESA statement on ICT risks from frontier AI models in the EU financial sector published

Suggested considerations

• Compliance teams may wish to map existing and planned uses of frontier AI models (including large language models and other advanced generative or predictive systems) to current ICT risk and cyber resilience frameworks under Regulation (EU) 2022/2554 (DORA) to demonstrate that these models are covered by documented risk assessments, controls and monitoring.
• Firms should consider reviewing governance arrangements for frontier AI, including board and senior management oversight, clear accountability, and integration of AI-related ICT risks into the firm’s risk appetite, risk taxonomy and operational risk frameworks, with specific escalation and reporting lines.
• Risk and technology functions may wish to update ICT and cyber risk management policies to explicitly address frontier AI threats (e.g. prompt injection, model poisoning, data leakage, adversarial attacks) and to align detection, logging and incident response capabilities with the ESAs’ emphasis on prevention, detection and management of AI-related cyber risks.
• Operational resilience teams should consider conducting scenario analysis and testing around frontier AI incidents (such as compromised AI-enabled customer interaction tools or automated decision engines) to evidence the ability to maintain critical services in line with DORA requirements on ICT-related incident management and business continuity.
• Compliance and procurement teams may wish to review contracts and due diligence for critical ICT third‑party providers that supply or host frontier AI models, assessing how provider controls, service levels and incident processes meet DORA expectations and the ESAs’ focus on frontier AI risks.
• Supervisory engagement teams should consider preparing to discuss the firm’s frontier AI strategy, risk management and governance with competent authorities, using the ESA statement as a reference point for how existing supervisory expectations on ICT risk and cyber resilience are applied to AI use cases.
• Internal audit and second‑line control functions may wish to plan thematic reviews of frontier AI deployments to assess coverage of AI-specific ICT risks within existing control frameworks, including documentation quality, model oversight, and alignment with DORA and sectoral guidance.
• Firms should consider monitoring forthcoming ESA and national competent authority publications on frontier AI and DORA oversight activities, as the statement signals that supervisory practices and expectations in this area are evolving and may be further operationalised.

What changed

The publication introduces a consolidated supervisory expectation that frontier AI models be treated explicitly as a source of ICT and cyber risk within existing EU operational resilience and ICT risk management frameworks, rather than as a separate technology domain. It emphasises the need for robust governance, risk management, and controls around the prevention, detection and management of cyber risks stemming from frontier AI, including model governance, validation, monitoring and incident handling.

Key dates

2026-07-31

Launch of the public consultation on DPM 2.1 and publication of naming conventions for metadata used in reporting

2026-09-30 Deadline

Deadline for submitting comments to the DPM 2.1 public consultation

2023-06-01

Publication month of DPM Standard 2.0 by EBA and EIOPA, establishing the current baseline data dictionary standard

2024-03-01

Establishment of the DPM Alliance joint governance framework by EBA, EIOPA and ECB to extend DPM to ECB statistical reporting

Suggested considerations

• Compliance teams may wish to review the DPM 2.1 factsheet and the published naming conventions to understand proposed changes in metadata versioning, logical data model support and naming structures, and how these could impact existing COREP, FINREP, resolution and insurance reporting implementations.
• Regulatory reporting and technology teams should consider mapping current data dictionaries and reporting taxonomies (including those used for CRR/CRD prudential reports, BRRD/SRB resolution reports and EIOPA insurance and pensions reports) against the DPM 2.1 metamodel to assess the scale of future migration effort and potential system changes.
• Firms should consider engaging in the consultation process, either directly or via industry bodies, to provide feedback on the practicality of the proposed metamodel and naming conventions, particularly where they affect multi-framework reporting or large-scale data integration projects.
• Compliance and regulatory change functions may wish to flag DPM 2.1 internally as a strategic development in EU reporting architecture and ensure it is reflected in medium-term reporting transformation programmes, including planning for alignment with the ESCB Integrated Reporting Framework (IReF).
• Reporting vendors and in-house IT teams should consider evaluating whether their current regulatory reporting tools and data models can support DPM 2.1’s enhanced versioning and logical data model capabilities, and identify potential design changes needed to remain aligned with future EBA, EIOPA and ECB requirements.
• Supervisory liaison and public policy teams may wish to monitor subsequent EBA, EIOPA, ECB and SRB communications following the close of the consultation for indications of timelines when DPM 2.1 and the naming conventions will become expected or mandatory for specific reporting frameworks.

What changed

The DPM Alliance is consulting on DPM 2.1, an updated version of the DPM metadata model that introduces enhanced metadata versioning and extends the metamodel to host logical data models, with the explicit objective of supporting integrated European reporting across all regulatory frameworks in the financial sphere. The consultation also covers newly published naming conventions that set out a common approach for naming metadata used in reporting, designed to ensure consistent use of the common data dictionary across regulatory reporting frameworks.

Key dates

17 January 2025

– DORA (Regulation (EU) 2022/2554) applies, and financial entities become obliged to report major ICT‑related incidents to their competent authority once classification thresholds are met

Annual (from 2026 onwards) Deadline

– Under Article 22(2) DORA, the ESAs must issue a yearly report covering number, nature, impact, remedial actions and costs of major ICT‑related incidents; the publication in early June 2026 is the first such report and sets the expectation for future annual cycles

Suggested considerations

• Review and, where necessary, recalibrate internal incident classification criteria against the DORA definition of “ICT‑related incident” and “major ICT‑related incident”, ensuring consistency with applicable RTS on classification and materiality thresholds.
• Validate that your firm’s incident management and escalation processes can identify, assess and classify incidents “without undue delay” and trigger major‑incident reporting within the prescribed timelines (initial, intermediate and final reports).
• Conduct a gap analysis of cross‑border incident handling, ensuring that governance, communication and coordination arrangements adequately address incidents affecting multiple Member States or shared cross‑border infrastructures.
• Strengthen third‑party and outsourcing risk management by mapping critical and important functions to their supporting ICT service providers, and ensuring contracts, SLAs and incident‑response clauses support DORA reporting and cooperation obligations.
• Test and, if needed, enhance incident response runbooks to ensure close coordination with ICT service providers during incident containment, remediation and recovery, including clear roles for data provision required for regulatory reporting.

What changed

• - The ESAs have operationalised Article 22(2) DORA by issuing the first annual overview of major ICT‑related incidents, confirming that yearly ESA‑level aggregation and analysis of incident data is...
• Incident reporting under DORA is now demonstrably harmonised and centralised, with major ICT‑related incidents being notified to all competent authorities involved and then aggregated by the ESAs for...
• The report confirms that cross‑border incidents are prevalent (around one third of major incidents), reinforcing that the “borderless and interconnected” nature of ICT risk is a key supervisory...
• System failures and external events, rather than pure cyber‑attacks, are identified as the main drivers of major incidents, placing regulatory emphasis on ICT change management, resilience of core...
• The ESAs highlight third‑party and outsourcing risk as a core theme, stressing the need for robust oversight of ICT service providers and close coordination with them during incident response and...

Key dates

Summer 2026

- European Commission aims to adopt revised ESRS into a delegated act, considering ESMA, EBA, EIOPA, ECB opinions

FY 2029 (reporting in 2030)

- End of certain temporary reliefs on quantitative information for anticipated financial effects (if ESMA recommendations adopted)

First years post

adoption (2026+); - Learning curve period with pragmatic NCAs supervision and flexibility in examinations

Suggested considerations

• Monitor Commission process: Track final delegated act by summer 2026, incorporating ESMA/EBA/EIOPA/ECB opinions; review full ESMA opinion PDF for detailed recommendations.
• Assess current reporting: Evaluate use of permanent/temporary reliefs (e.g., #3/#4 on quantitative data, #9/#11 on metrics) and prepare for time limits; refine transition plans for emissions/targets.
• Enhance governance disclosures: Strengthen reporting on sustainability competences in management/supervisory bodies and financial resources for actions.
• Review subsidiary exemptions: Check materiality exclusions for sustainability risks/opportunities in consolidated statements.
• Prepare for supervision: Leverage NCAs flexibility during transition; integrate into data governance and risk systems per CSRD implementation trends.

What changed

• The draft revised ESRS introduce simplifications such as improved readability, language, format, reduced volume of requirements, and a focus on material matters.
• Introduce time limits to certain permanent reliefs (e.g., reliefs #3, #4, #9, #11 on quantitative information for anticipated financial effects until FY 2029, and metrics).
• Refine requirements on transition plans (e.g., consistent disclosure of absolute financed emissions and contextual information).
• Strengthen reporting on sustainability competences of administrative, management, and supervisory bodies.
• Enhance transparency on financial resources allocated to sustainability actions.

Key dates

08 January 2026

Publication of Final Report and Joint Guidelines by ESAs

10 January 2026 Deadline

Statutory deadline for ESAs to publish guidelines per CRD Article 100(4) and Solvency II Article 304c(3)

Two months after official EU translations (expected ~March/April 2026) Deadline

NCAs notify respective ESAs of compliance or intent to comply

01 January 2027

Application date of Joint Guidelines for NCAs

Suggested considerations

• For NCAs: Review and integrate ESG risks into stress testing frameworks via materiality assessments; define objectives, scenarios, and governance; notify ESAs of compliance post-translation; maintain risk-based, phased approach.
• For Firms: No direct mandates, but prepare by enhancing internal ESG risk modeling, data collection (especially climate/physical/transition risks), and stress testing capabilities to align with supervisory expectations; conduct voluntary ESG scenario analyses.
• General: Monitor NCA implementations, update policies for ESG risk integration in ICAAP/ORSA, and engage in industry feedback on data/methodological gaps.

What changed

• - Standardized Integration of ESG Risks: NCAs must embed ESG risks into existing supervisory stress tests or ad-hoc assessments, using a risk-based materiality assessment to scope relevant risks,...
• Methodological and Governance Guidance: Outlines design for ESG-inclusive tests, including objectives (e.g., capital/liquidity robustness, strategy resilience), scenario analysis, and organizational...
• No New Obligations: Does not require NCAs to conduct dedicated ESG stress tests, but ensures consistency when they do, improving legal certainty and transparency in approval processes.
• Phased Approach: Initial focus on climate/environmental risks, with gradual extension to full ESG coverage based on data and model maturity.