Operational Resilience / Outsourcing in European Union

Key dates

2026-08-26

EBA consultation launched and consultation period opened.

2026-09-25 Deadline

Deadline to register for the EBA virtual public hearing, at 16:00 CEST.

2026-09-29

EBA virtual public hearing from 10:00 to 12:00 CEST (Paris time).

2026-12-31 Deadline

Deadline for submitting consultation responses to the EBA, at 23:59 CEST.

Suggested considerations

• Compliance and operational-risk teams should obtain and map the consultation draft against Article 323(1), points (a) to (h), of the CRR and identify requirements that would require changes to policies, committee mandates, controls or management information.
• Institutions should determine their business indicator and assess whether it is below the proposed EUR 750 million proportionality threshold, while treating that threshold as proposed rather than final.
• Firms should inventory operational-risk data sources, loss-event thresholds, taxonomies, reporting processes, validation controls and audit coverage, and assess whether data granularity is sufficient for the proposed framework.
• Management-body and senior-management responsibilities should be compared with existing governance arrangements, including the independence, authority and resourcing of the operational risk management function.
• Firms should assess alignment between the proposed RTS, CRR3 operational-risk capital and reporting implementation, the EBA Guidelines on internal governance and DORA, avoiding duplication or gaps for ICT-related risk.
• Affected stakeholders should consider submitting comments to the EBA by 31 December 2026; compliance teams may wish to coordinate responses with risk, finance, internal audit and industry associations.
• Stakeholders wishing to participate in the EBA public hearing should register by 25 September 2026 at 16:00 CEST and prepare questions on proportionality, data granularity, thresholds, reporting frequency and implementation timing.
• Institutions should monitor the EBA’s final draft, the European Commission’s endorsement process and the eventual application date before treating the consultation text as a binding requirement.

What changed

The proposed RTS would give detailed effect to Article 323(1), points (a) to (h), of the CRR by requiring three framework components: governance arrangements, an operational risk management process and an operational risk assessment system. They clarify responsibilities of the management body, senior management and the independent operational risk management function, and address operational risk data and taxonomy, the business indicator component, reporting, validation and audit. ICT risk requirements are intended to remain governed primarily by Regulation (EU) 2022/2554 (DORA).

Key dates

2026-07-31

Joint ESA statement on ICT risks from frontier AI models in the EU financial sector published

Suggested considerations

• Compliance teams may wish to map existing and planned uses of frontier AI models (including large language models and other advanced generative or predictive systems) to current ICT risk and cyber resilience frameworks under Regulation (EU) 2022/2554 (DORA) to demonstrate that these models are covered by documented risk assessments, controls and monitoring.
• Firms should consider reviewing governance arrangements for frontier AI, including board and senior management oversight, clear accountability, and integration of AI-related ICT risks into the firm’s risk appetite, risk taxonomy and operational risk frameworks, with specific escalation and reporting lines.
• Risk and technology functions may wish to update ICT and cyber risk management policies to explicitly address frontier AI threats (e.g. prompt injection, model poisoning, data leakage, adversarial attacks) and to align detection, logging and incident response capabilities with the ESAs’ emphasis on prevention, detection and management of AI-related cyber risks.
• Operational resilience teams should consider conducting scenario analysis and testing around frontier AI incidents (such as compromised AI-enabled customer interaction tools or automated decision engines) to evidence the ability to maintain critical services in line with DORA requirements on ICT-related incident management and business continuity.
• Compliance and procurement teams may wish to review contracts and due diligence for critical ICT third‑party providers that supply or host frontier AI models, assessing how provider controls, service levels and incident processes meet DORA expectations and the ESAs’ focus on frontier AI risks.
• Supervisory engagement teams should consider preparing to discuss the firm’s frontier AI strategy, risk management and governance with competent authorities, using the ESA statement as a reference point for how existing supervisory expectations on ICT risk and cyber resilience are applied to AI use cases.
• Internal audit and second‑line control functions may wish to plan thematic reviews of frontier AI deployments to assess coverage of AI-specific ICT risks within existing control frameworks, including documentation quality, model oversight, and alignment with DORA and sectoral guidance.
• Firms should consider monitoring forthcoming ESA and national competent authority publications on frontier AI and DORA oversight activities, as the statement signals that supervisory practices and expectations in this area are evolving and may be further operationalised.

What changed

The publication introduces a consolidated supervisory expectation that frontier AI models be treated explicitly as a source of ICT and cyber risk within existing EU operational resilience and ICT risk management frameworks, rather than as a separate technology domain. It emphasises the need for robust governance, risk management, and controls around the prevention, detection and management of cyber risks stemming from frontier AI, including model governance, validation, monitoring and incident handling.

Key dates

24 December 2024

– EMIR 3 enters into force, establishing the legal basis for the Active Account Requirement and related RTS framework

2025 (full year)

– First year of operation of the Joint Monitoring Mechanism, covering monitoring of AAR implementation and broader EU clearing landscape developments, as described in the JMM’s first Annual Report

25 June 2025 Deadline

– Active Account Requirement becomes applicable, starting the reference period for AAR compliance and reporting and triggering obligations to maintain an active account at an EU CCP for specified derivatives

February 2026 (as of)

– Approximately 500 entities have notified ESMA and national competent authorities that they are subject to the AAR, marking a key supervisory data‑collection milestone

26 February 2026 Deadline

– Regulatory Technical Standards specifying detailed AAR conditions, including operational obligations, stress‑testing, activity and reporting requirements, enter into force, operationalising how the AAR must be met in practice

Suggested considerations

• Confirm whether your entity (and any funds or branches) is subject to the Active Account Requirement by assessing EMIR clearing obligation status and relevant notional clearing volumes against EMIR 3 thresholds for AAR‑scope derivatives.
• Implement and document annual stress‑testing of the active account arrangements, including at least one test per year, to evidence that positions and new trades can be shifted from Tier 2 CCPs to EU CCPs under stress scenarios.
• Map and quantify exposures to Tier 2 CCPs across AAR‑relevant derivatives, and establish an internal monitoring framework to track shifts in clearing volumes between Tier 2 CCPs and EU CCPs in line with AAR objectives.
• Align trade booking, clearing workflows, and client documentation so that the required minimum number of trades per relevant subcategory and contract class can be cleared through the EU active account on an annual average basis, taking into account representativeness requirements where applicable.
• Prepare to submit the first AAR report by 31 July 2026, ensuring that systems and controls can capture and report activity from 25 June 2025 to 30 June 2026 in accordance with ESMA’s reporting templates and instructions.

What changed

• - ESMA has published an Interim Report on the effectiveness of the Active Account Requirement, covering implementation and market impact during 2025 and early 2026, and explicitly framing this as the...
• ESMA confirms that roughly 500 entities have formally notified ESMA and national competent authorities that they are subject to the AAR, indicating that competent authorities now have a defined...
• Notified entities represent more than 90% of notional outstanding held by EU entities in relevant AAR‑scope derivatives, signalling supervisory focus on a concentrated set of high‑exposure...
• ESMA identifies early signs of increased clearing activity at EU CCPs, particularly among smaller entities, including some full relocation of positions from Tier 2 CCPs to EU CCPs for AAR‑relevant...
• ESMA notes a gradual but limited shift in market shares from systemically important Tier 2 CCPs to EU CCPs in certain AAR‑related products, indicating that supervisors will monitor market‑share...

Key dates

Since July 2011

– ESMA has been responsible for the supervision and registration of credit rating agencies in the EU under the CRA Regulation, including enforcement actions for breaches

TBD (post‑02 July 2026)

– Potential appeal window for Moody’s Germany to bring the case before the Board of Appeal of the European Supervisory Authorities; any appeal does not have automatic suspensive effect, though suspension can be granted by the Board of Appeal on request

02 July 2026

– ESMA Board of Supervisors adopts supervisory measures and imposes fines on Moody’s Deutschland GmbH for four negligent breaches of the CRA Regulation, and publishes a public notice and press release

Suggested considerations

• Conduct a comprehensive review of all ESMA‑related reporting processes to ensure that data submitted to ESMA (including rating information, historical performance data, rating changes, and other CRA regulatory reports) is complete, accurate, and kept up‑to‑date at all times.
• Map and document all responsibilities for ESMA reporting within the CRA group, ensuring that where one entity reports on behalf of others, the allocation of roles, ownership of data, and validation steps is explicitly defined, approved, and regularly reviewed.
• Perform a gap analysis of existing regulatory reporting policies, procedures, and internal control mechanisms against CRA Regulation requirements and ESMA supervisory expectations, and update documentation to remove ambiguities and outdated provisions.
• Implement or strengthen data validation and reconciliation controls over submissions to the European Rating Platform and ESMA’s central repositories, including automated checks for missing ratings, non‑withdrawn ratings, incorrect rating actions, and inconsistencies in historical performance data.
• Establish a formal governance process for changes to regulatory reporting frameworks, ensuring regular review, independent challenge by compliance or risk functions, and clear escalation routes for identified data quality issues or control failures.

What changed

• - ESMA has clarified, through enforcement, that CRAs must ensure complete, accurate and up‑to‑date data is reported to ESMA across all relevant CRA reporting channels (including the European Rating...
• ESMA has reinforced that errors limited to regulatory reporting data (and not directly affecting published ratings) can still constitute material breaches of the CRA Regulation, demonstrating that...
• ESMA has indicated that group reporting arrangements (where one CRA entity reports on behalf of others in the group) must have clear documentation of responsibilities, validation processes, and...
• ESMA has emphasized that regulatory reporting frameworks must include robust policies, procedures and internal control mechanisms, and that deficiencies in these frameworks constitute distinct...
• ESMA has signalled that negligence, rather than intentional misconduct, is sufficient to trigger significant fines under the CRA Regulation, and that both aggravating and mitigating factors will be...

Key dates

30 April 2023

- ESMA’s withdrawal of recognition decisions for six Indian CCPs, including CCIL, took effect under EMIR, prohibiting EU clearing members and trading venues from using those CCPs for EU‑regulated clearing activity

Earlier 2026

- ESMA and the Reserve Bank of India sign a Memorandum of Understanding establishing supervisory cooperation arrangements for Indian CCPs, including CCIL

30 June 2026

- ESMA’s decision recognising CCIL as a Tier 1 third‑country CCP under EMIR takes effect, and CCIL is added to ESMA’s updated list of recognised TC‑CCPs

Suggested considerations

• Confirm and document that CCIL now appears on ESMA’s official list of recognised third‑country CCPs and that its status is Tier 1 under EMIR, updating internal CCP eligibility lists and counterparty approval registers accordingly.
• Review and update internal clearing policies, procedures and governance documents to reflect that EU entities may again clear eligible products through CCIL, subject to EMIR and firm‑specific risk appetite.
• Reassess and formally approve CCIL within the firm’s CCP due‑diligence framework, including credit risk, operational risk, legal risk and jurisdictional risk assessments, taking account of the RMU with RBI and the Tier 1 classification.
• Update EMIR compliance mappings to ensure that trades cleared via CCIL are correctly treated for clearing obligation, risk‑management, reporting and collateral requirements, and that no activity is undertaken through non‑recognised CCPs in India.
• Coordinate with front‑office, clearing operations and collateral management teams to re‑open or adjust clearing access to CCIL (e.g. membership arrangements, client clearing channels, account structures, margin and collateral workflows).

What changed

• - CCIL is formally recognised as a Tier 1 third‑country central counterparty (TC‑CCP) under Regulation (EU) No 648/2012 (EMIR), allowing it to offer clearing services to EU clearing members and EU...
• The recognition is contingent on an equivalence decision adopted by the European Commission for the Indian regulatory framework applicable to CCPs under EMIR Article 25.
• ESMA has assessed and confirmed effective supervision and enforcement by the Reserve Bank of India (RBI) over CCIL as a prerequisite for recognition.
• ESMA and RBI have put in place cooperation arrangements, formalised through a Memorandum of Understanding, to support ongoing supervisory coordination over CCIL’s activities that affect EU...
• CCIL is now included in ESMA’s updated list of recognised third‑country CCPs, clarifying that EU firms may use CCIL’s clearing services while complying with EMIR’s clearing and risk‑management...

Key dates

13 November 2023

– Week-long 2023 Global CCP fire drill coordinated by ESMA and other authorities, simulating the default of a hypothetical major clearing member across more than 30 CCPs

5 December 2024

– Kick-off meeting for the second industry-led multi-CCP default simulation (CIDS 2025) organised by CCP Global in Singapore, setting parameters and expectations for the 2025 exercise

3 November 2025

– Start of the 2025 CCP Global International Default Simulation (CIDS) multi-CCP fire drill window (up to 7 November 2025 for some CCPs), simulating the failure of a hypothetical common participant

4 December 2025

– Debrief meeting in Singapore for CIDS 2025 participants to discuss operational outcomes, bottlenecks, and potential improvements

19 June 2026

– ESMA and the lead authorities publish the 2025 CIDS key findings and recommendations, outlining expectations for further progress in standardisation, porting, portal-based solutions, and potential market stress overlay modules

Suggested considerations

• CCPs should review and update their default management procedures to align with emerging cross-CCP standards, including harmonised communication conventions, standardised information templates, and coordinated auction timelines.
• Clearing members should conduct a cross-CCP gap analysis of their default-management playbooks to ensure they can support simultaneous auctions and calls from multiple CCPs without creating operational bottlenecks.
• CCPs and clearing members should implement or upgrade portal-based communication and workflow tools for default events, replacing fragmented email- or spreadsheet-based processes where feasible.
• Clearing brokers and client-clearing firms should test and, where necessary, redesign their porting arrangements (including client consent, documentation, booking models, and operational capacity) to ensure they can port positions and collateral under stressed but realistic timelines.
• Risk and operations teams at CCPs and clearing members should incorporate findings from the 2023 and 2025 CIDS exercises into their internal default-management training, drills, and board reporting on operational resilience.

What changed

• - Supervisory expectations are raised for standardisation and reduction of fragmentation in CCP default-management procedures and communication conventions, with a strong push toward harmonised...
• Lead authorities explicitly promote greater use of portal-based solutions (rather than ad hoc email or bespoke channels) for communication, information sharing, and auction-related workflows between...
• Authorities call for more realistic testing of porting arrangements, including end-to-end operational tests that reflect real-life constraints (documentation, client consent, timing of transfers, and...
• The lead authorities propose considering a voluntary “market stress overlay” module in future CIDS exercises, creating a coherent cross-CCP macro stress scenario to test whether operational capacity...
• ESMA confirms that global CCP fire drills are now a core component of system-wide resilience expectations, effectively embedding regular multi-CCP default simulations into ongoing supervisory...

Key dates

17 January 2025

– DORA (Regulation (EU) 2022/2554) applies, and financial entities become obliged to report major ICT‑related incidents to their competent authority once classification thresholds are met

Annual (from 2026 onwards) Deadline

– Under Article 22(2) DORA, the ESAs must issue a yearly report covering number, nature, impact, remedial actions and costs of major ICT‑related incidents; the publication in early June 2026 is the first such report and sets the expectation for future annual cycles

Suggested considerations

• Review and, where necessary, recalibrate internal incident classification criteria against the DORA definition of “ICT‑related incident” and “major ICT‑related incident”, ensuring consistency with applicable RTS on classification and materiality thresholds.
• Validate that your firm’s incident management and escalation processes can identify, assess and classify incidents “without undue delay” and trigger major‑incident reporting within the prescribed timelines (initial, intermediate and final reports).
• Conduct a gap analysis of cross‑border incident handling, ensuring that governance, communication and coordination arrangements adequately address incidents affecting multiple Member States or shared cross‑border infrastructures.
• Strengthen third‑party and outsourcing risk management by mapping critical and important functions to their supporting ICT service providers, and ensuring contracts, SLAs and incident‑response clauses support DORA reporting and cooperation obligations.
• Test and, if needed, enhance incident response runbooks to ensure close coordination with ICT service providers during incident containment, remediation and recovery, including clear roles for data provision required for regulatory reporting.

What changed

• - The ESAs have operationalised Article 22(2) DORA by issuing the first annual overview of major ICT‑related incidents, confirming that yearly ESA‑level aggregation and analysis of incident data is...
• Incident reporting under DORA is now demonstrably harmonised and centralised, with major ICT‑related incidents being notified to all competent authorities involved and then aggregated by the ESAs for...
• The report confirms that cross‑border incidents are prevalent (around one third of major incidents), reinforcing that the “borderless and interconnected” nature of ICT risk is a key supervisory...
• System failures and external events, rather than pure cyber‑attacks, are identified as the main drivers of major incidents, placing regulatory emphasis on ICT change management, resilience of core...
• The ESAs highlight third‑party and outsourcing risk as a core theme, stressing the need for robust oversight of ICT service providers and close coordination with them during incident response and...

Key dates

2025 (completed) Deadline

– ESMA and NCAs conduct the 2025 Common Supervisory Action on compliance and internal audit functions of fund managers, establishing benchmarks for good and poor practices in the funds sector

2025 (completed)

– First year of enforcement of European Sustainability Reporting Standards (ESRS) and application of ESMA Guidelines on Enforcement of Sustainability Information for in‑scope issuers’ 2025 reporting

2025 (throughout year)

– ESMA and NCAs carry out corporate reporting enforcement across the EEA, including financial, sustainability and digital (ESEF) reporting, feeding into ESMA’s 2025 corporate reporting enforcement report

Q2 2026

– ESMA launches the sixth CCP stress test exercise, with follow‑up supervisory actions by ESMA and NCAs expected after results are analysed

Q2 2026

– ESMA publishes reporting templates and instructions for the EMIR 3 Active Account Requirement, enabling firms and CCPs to begin design and implementation work ahead of EMIR 3 go‑live

Suggested considerations

• Map your firm’s current EMIR, MiFIR and fund reporting obligations against ESMA’s stated objective of simplifying EU reporting frameworks and begin scenario‑planning for changes to templates, data models and validation rules.
• For CCPs and clearing members, review participation in the sixth ESMA CCP stress test, ensure timely and accurate data delivery, and assess internal implications of potential stress test findings for risk management frameworks.
• CCPs should compare existing recovery and resolution plans and playbooks against ESMA’s new guidance on effective use of resolution tools, updating governance, triggers, communications and coordination arrangements with resolution authorities.
• Counterparties and CCPs in scope of EMIR 3 should identify products and business lines affected by the Active Account Requirement and begin implementing systems, processes and controls to populate ESMA’s reporting templates and instructions.
• Investment firms active in equity markets should respond to ESMA’s call for evidence on European equity market structure where appropriate, and internally assess potential impacts on best execution, order routing, internalisation and transparency obligations.

What changed

• - ESMA is advancing the simplification of EU reporting frameworks for funds and transaction reporting, indicating upcoming changes to reporting templates, data fields and/or reporting channels under...
• ESMA has launched its sixth EU‑wide stress test exercise for Central Counterparties (CCPs), expanding supervisory scrutiny of CCP risk management, default management processes and resilience to...
• ESMA has published guidance on the effective use of resolution tools in CCP crisis planning, clarifying expectations for CCP resolution planning, coordination with resolution authorities and use of...
• ESMA has issued reporting templates and instructions for the Active Account Requirement under EMIR 3, operationalising new obligations for counterparties and CCPs to maintain and report active...
• ESMA has published a call for evidence on the structure of European equity markets, opening a policy workstream that may lead to changes in market structure, transparency, and best execution...

Key dates

2025 (exact dates TBD)

– ESMA’s Call for Evidence on streamlining reporting across EMIR, MiFIR and SFTR is scheduled, with stakeholders expected to provide input on duplication removal and “report once” options

18 June 2026

– ESMA will host a webinar to present the main findings of the annual report on the quality and use of regulatory data

Suggested considerations

• Map all existing regulatory reporting obligations across EMIR, SFTR, MiFIR, AIFMD, MMFR, Prospectus and DORA ICT‑incident reporting, and document the underlying data sources, systems and ownership for each regime.
• Review and enhance data quality controls for EMIR, SFTR and MiFIR reporting, including validation rules, completeness checks, reconciliations, pairing and matching processes, and governance around Unique Transaction Identifiers and counterparty data.
• Perform a gap analysis of Prospectus reporting and DORA ICT‑incident reporting processes against ESMA’s emerging cross‑regime data quality expectations and ensure they are covered in the firm’s enterprise data governance framework.
• Establish or update a centralised regulatory data governance framework that explicitly covers cross‑regime consistency (for example, trade and position data alignment between EMIR, SFTR and MiFIR) and defines clear accountability at senior management level.
• Engage with internal IT and reporting teams to identify where a future “report once” model could be supported technically, including harmonised reference data, common identifiers and golden‑source transaction and position records.

What changed

• - ESMA confirms measurable data quality improvements across EMIR, SFTR, MiFIR, AIFMD and MMFR regulatory datasets, indicating that regulators now consider these data sufficiently reliable for...
• ESMA highlights extensive and growing supervisory use of regulatory data by ESMA and NCAs for investor protection, financial stability, orderly markets and market integrity, increasing the...
• The scope of the annual data quality and use report is expanded to include Prospectus reporting obligations, bringing prospectus‑related data formally into ESMA’s cross‑regime data quality scrutiny.
• The report scope is also expanded to include ICT‑related incident reporting under the Digital Operational Resilience Act (DORA), signaling that operational resilience incident data will be monitored...
• ESMA has launched a 2025 Call for Evidence on streamlining reporting across EMIR, MiFIR and SFTR, including options to remove duplications and apply a “report once” approach, which will likely lead...

Key dates

07 July 2026 Deadline

– Deadline stated by ESMA for stakeholders to submit consultation feedback on the revised guidelines

October 2026

– ESMA expects to publish its final report, including updated and finalised guidelines on standardised procedures and messaging protocols

07 December 2026

– Expected application date of the revised ESMA Guidelines on allocations and confirmations, aligned with the anticipated application of the amended CSDR RTS on Settlement Discipline requirements for allocations and confirmations

11 October 2027 Deadline

– EU transition date to a T+1 settlement cycle, when trades in in‑scope instruments must settle one business day after the trade date and firms must fully operate under the new T+1‑aligned post‑trade framework

Suggested considerations

• Map all current allocation and confirmation workflows and identify any use of non‑electronic, non‑standardised or non‑machine‑readable communication (including email attachments, faxes, PDFs, and oral instructions).
• Develop and execute a remediation plan to replace manual or oral allocation and confirmation processes with fully electronic, machine‑readable workflows using recognised international messaging standards.
• Review and update front‑to‑back trade processing systems (OMS, EMS, middle‑office, back‑office, matching engines) to ensure they can generate, receive and process standardised electronic allocation and confirmation messages within same‑day T+1‑compatible timelines.
• Engage with CSDs, custodians, brokers, counterparties and third‑party vendors to confirm their roadmap and readiness for the mandated electronic standards and to align implementation timelines to the 7 December 2026 application date.
• Update contractual documentation with clients and counterparties (including terms of business and service level agreements) to incorporate obligations for electronic, standardised, machine‑readable allocations and confirmations and to remove reliance on manual methods except as contingency.

What changed

• - ESMA proposes revised Guidelines on standardised procedures and messaging protocols for allocations and confirmations under CSDR Settlement Discipline, specifically to support the transition to a...
• The guidelines will mandate the use of electronic, standardised communication channels for post‑trade allocations and confirmations, moving away from mixed paper / manual practice to fully electronic...
• Firms will be required to use international messaging standards (e.g. ISO‑based protocols) for post‑trade communication, to ensure interoperability and faster straight‑through processing across EU...
• The guidelines remove references to non‑electronic and non‑machine‑readable methods, including oral allocations and confirmations, except where there is a temporary technical disruption that prevents...
• The revisions are explicitly aligned with ESMA’s Final Report on Amendments to the CSDR RTS on Settlement Discipline, which introduce same‑day timing for allocations and machine‑readable formats for...

Key dates

26 February 2026

- ESMA launches consultation

Q2 2026

- ESMA considers feedback received and prepares final report

20 April 2026 Deadline

- Deadline for stakeholder feedback submissions

Q4 2026

- Draft RTS submitted to the European Commission

Suggested considerations

• *For PTRR Service Providers:
• *Assess current operations against proposed RTS requirements, particularly regarding market risk neutrality and risk reduction thresholds
• *Review algorithm safeguards and execution protocols to ensure compliance with transparency and non-discrimination standards
• *Establish record-keeping systems capable of documenting PTRR exercises and demonstrating exemption qualification
• *Prepare monitoring capabilities to support NCA oversight and supervisory reporting

What changed

• The draft RTS introduce a structured framework governing how PTRR services operate under the clearing obligation exemption: Eligible Service Types The standards focus on three primary PTRR service...
• Market risk neutrality in PTRR exercises—transactions must not alter the overall market risk profile of portfolios
• Required risk reduction in submitted portfolios—genuine risk mitigation rather than speculative activity
• Compliance with pre-agreed rules and reasonable, transparent, non-discriminatory conduct Operational & Governance Framework The RTS establish requirements across multiple dimensions:
• Transparency towards participants in PTRR exercises

Key dates

End of 2026

- ESMA to submit final draft technical standards to the European Commission following final report preparation

30 April 2026 Deadline

- Consultation response deadline; submit online via ESMA portal, addressing specific questions with rationale

Suggested considerations

• Review and Respond to Consultation: CCPs, clearing members, NFCs, and clients should analyze the paper, prepare responses to Annex 1 questions by 30 April 2026, and submit online; indicate confidentiality if needed.
• Assess Internal Policies: CCPs must evaluate current collateral, investment, and emission allowance frameworks against proposed conditions; clearing members/NFCs should model impacts on liquidity and margin posting.
• Monitor Developments: Track ESMA's final report and RTS submission; prepare for potential supervisory expectations on guarantee acceptance and debt instrument eligibility post-2026.
• Engage with Industry: Join associations like EACH for coordinated feedback on risk-based approaches and proportionality.

What changed

• - Permanent expansion of eligible CCP collateral to include public guarantees, public bank guarantees, and commercial bank guarantees, with specified conditions for acceptance.
• Criteria for deeming debt instruments as eligible financial instruments under CCP investment policies.
• Requirements for highly secured arrangements to deposit emission allowances as margins or default fund contributions. These build on EMIR 3's measures to broaden collateral scope and entity coverage,...

Key dates

26 February 2026

- AAR RTS enter into force (20 days after Official Journal publication on 6 February 2026)

31 July 2026 Deadline

- First EMIR 3 representativeness reporting deadline

31 January 2027 Deadline

- First AAR compliance report due

Suggested considerations

• *Immediate (by 26 February 2026):
• Review the ESMA supervisory briefing and Commission Delegated Regulation (EU) 2026/305 in detail
• Assess whether your firm meets the €6 billion notional clearing volume outstanding threshold triggering AAR obligations
• Identify internal teams responsible for AAR compliance (trading, operations, compliance, reporting)
• *Short-term (by 31 July 2026):

What changed

The supervisory briefing addresses three core compliance areas: Identifying Most Relevant Subcategories: Counterparties must continuously identify the five most relevant subcategories for each class of derivatives over each reference period, based on their trading activity. The guidance clarifies that the number of subcategories to select equals the maximum number available for that derivative class. Representativeness Compliance Standard: Counterparties must clear, on an annual average basis, at least five trades in each of the most relevant subcategories per class of derivative contracts...

Key dates

14 November 2013

- REGIS-TR initial registration with ESMA under EMIR

7 May 2020

- REGIS-TR registration extended to SFTR reporting

14 June 2024

- ESMA Supervisory Report identifying serious indications of breaches

17 June 2024

- Public notice references investigations leading to findings (dated in decision docs)

17 February 2026

- ESMA Board of Supervisors meeting discussing the case

Suggested considerations

• For REGIS-TR specifically: Cease three ongoing breaches (policies/procedures under EMIR/SFTR; SFTR organisational structure for business continuity) per ESMA supervisory measures (EMIR Art. 73).
• For all TRs: - Review and strengthen policies/procedures for clarity on governance roles/responsibilities.
• Audit organisational structure for SFTR business continuity and orderly functioning.
• Conduct operational risk assessments, implementing controls/systems to minimise risks under EMIR/SFTR.
• Enhance data confidentiality/integrity protections and misuse prevention measures.

What changed

• This is an enforcement decision, not new legislation, but it reinforces existing EMIR and SFTR requirements on TRs, particularly:
• Policies and procedures: Must be adequate to ensure compliance, with clear roles and responsibilities for governing bodies (breaches under EMIR Art. 78(3) and SFTR Art.
• Organisational structure: Must ensure business continuity and orderly functioning, especially for SFTR services (breach under SFTR).
• Operational risk management: Identify and minimise risks via systems, controls, and procedures (breaches under EMIR and SFTR, Point (a) Section II Annex I EMIR).
• Data confidentiality and integrity: Protect information received under EMIR and prevent misuse (breaches under EMIR). Fines were calculated per EMIR Art.

Key dates

February 17, 2026

- ESMA Board of Supervisors adopts decision

February 19, 2026

- ESMA publishes supplementary deferrals list

March 2, 2026

- Original implementation date (subsequently extended)

May 4, 2026

- **Effective date for supplementary deferrals application**

Suggested considerations

• *Immediate Compliance Preparation (by May 4, 2026)
• *System Configuration: Trading venues and investment firms must update post-trade reporting systems to implement volume omission deferrals for Group 1, Category 1 sovereign bonds, with automated end-of-day publication triggers.
• *Instrument Classification: Establish processes to correctly identify which sovereign bonds qualify as Group 1, Category 1 under Commission Delegated Regulation (EU) 2017/583 (RTS 2), referencing Table 2.6 of Annex III.
• *APA Coordination: Approved Publication Arrangements must configure deferral management services to apply volume omission rules consistently across all reporting firms, with fallback procedures for system failures.
• *Policy Documentation: Update post-trade transparency policies, procedures, and client disclosures to reflect the new deferral regime and explain the timing of volume publication.

What changed

Scope of Supplementary Deferrals The decision permits volume omission deferrals for sovereign bonds classified as Group 1, Category 1 instruments (medium-size, liquid instruments) under MiFIR's post-trade transparency framework. Market operators and investment firms may defer publication of transaction volumes until end-of-trading-day, rather than the standard 15-minute deferral period. Regulatory Rationale ESMA determined that these deferrals are necessary to account for specific characteristics of sovereign bond markets, particularly protecting market liquidity and ensuring orderly price...

Key dates

4 December 2025

- European Commission publishes market integration legislative package; legislative process expected to take at least one year

23 December 2025

- Newsletter publication date

Suggested considerations

• Review the final non-equity transparency RTS and assess impacts on trading and reporting systems for compliance by any upcoming application dates (not specified).
• Evaluate MiFID II conflicts of interest policies in preparation for the CSA; conduct internal audits and enhance training/staff attestations on identification and mitigation.
• Monitor equity CTP rollout for changes to post-trade data access and costs; update vendor contracts if applicable.
• For DORA-impacted firms, map exposures to designated critical ICT providers and strengthen due diligence, contractual clauses, and exit strategies.
• Asset managers: Audit fund names against guidelines and review UCITS distribution practices for cost transparency.

What changed

• - ESMA welcomes the European Commission's 4 December 2025 legislative package on market integration, emphasizing robust governance and market infrastructure for deeper EU capital markets.
• Announcement of selected applicant for the equity consolidated tape provider (CTP), advancing MiFIR transparency for equity markets by improving post-trade data consolidation and access.
• Publication of ESMA's final report on Regulatory Technical Standards (RTS) for non-equity transparency, clarifying pre- and post-trade transparency rules for bonds, derivatives, and other non-equity...
• Launch of a Common Supervisory Action (CSA) on MiFID II conflicts of interest requirements to promote supervisory convergence and governance across Member States.
• European Supervisory Authorities (ESAs) designate critical ICT third-party providers under DORA, enhancing oversight of key outsourcing risks.