Senior Managers / Governance in European Union

Key dates

2026-08-26

EBA consultation launched and consultation period opened.

2026-09-25 Deadline

Deadline to register for the EBA virtual public hearing, at 16:00 CEST.

2026-09-29

EBA virtual public hearing from 10:00 to 12:00 CEST (Paris time).

2026-12-31 Deadline

Deadline for submitting consultation responses to the EBA, at 23:59 CEST.

Suggested considerations

• Compliance and operational-risk teams should obtain and map the consultation draft against Article 323(1), points (a) to (h), of the CRR and identify requirements that would require changes to policies, committee mandates, controls or management information.
• Institutions should determine their business indicator and assess whether it is below the proposed EUR 750 million proportionality threshold, while treating that threshold as proposed rather than final.
• Firms should inventory operational-risk data sources, loss-event thresholds, taxonomies, reporting processes, validation controls and audit coverage, and assess whether data granularity is sufficient for the proposed framework.
• Management-body and senior-management responsibilities should be compared with existing governance arrangements, including the independence, authority and resourcing of the operational risk management function.
• Firms should assess alignment between the proposed RTS, CRR3 operational-risk capital and reporting implementation, the EBA Guidelines on internal governance and DORA, avoiding duplication or gaps for ICT-related risk.
• Affected stakeholders should consider submitting comments to the EBA by 31 December 2026; compliance teams may wish to coordinate responses with risk, finance, internal audit and industry associations.
• Stakeholders wishing to participate in the EBA public hearing should register by 25 September 2026 at 16:00 CEST and prepare questions on proportionality, data granularity, thresholds, reporting frequency and implementation timing.
• Institutions should monitor the EBA’s final draft, the European Commission’s endorsement process and the eventual application date before treating the consultation text as a binding requirement.

What changed

The proposed RTS would give detailed effect to Article 323(1), points (a) to (h), of the CRR by requiring three framework components: governance arrangements, an operational risk management process and an operational risk assessment system. They clarify responsibilities of the management body, senior management and the independent operational risk management function, and address operational risk data and taxonomy, the business indicator component, reporting, validation and audit. ICT risk requirements are intended to remain governed primarily by Regulation (EU) 2022/2554 (DORA).

Key dates

03 August 2026

- ESAs publish the Final Report and draft RTS proposing amendments to Delegated Regulation (EU) 2016/2251 to simplify bilateral margin requirements for counterparties below the EUR 8 billion initial margin threshold

TBD (European Commission adoption)

- The European Commission reviews and, if satisfied, endorses the draft RTS amending the EMIR bilateral margin Delegated Regulation; exact date to be set by the Commission’s internal process

TBD (European Parliament and Council scrutiny)

- Following Commission endorsement, the RTS are subject to scrutiny by the European Parliament and the Council under the standard RTS procedure before publication in the Official Journal

TBD (Entry into force – OJ publication + 20 days)

- The amended RTS enter into force on the date specified in the Official Journal (typically 20 days after publication), from which firms can legally apply the new exemption regime

TBD (Three years after entry into force) Deadline

- By the date three years after entry into force, the ESAs must complete a review of the application and impact of the exemption from initial margin requirements in Article 28(1), potentially informing further changes

Suggested considerations

• Map all EMIR in-scope entities within the group and identify those whose AANA of non-centrally cleared OTC derivatives is close to or below the EUR 8 billion threshold, to assess which relationships may benefit from the expanded exemption.
• Review current collateral and margin frameworks to identify legacy contracts where initial margin is still being exchanged solely because the regime requires continuation despite the counterparty having fallen below the EUR 8 billion threshold.
• Prepare an internal policy update so that, once the RTS enter into force, initial margin requirements are switched off for counterparties below the EUR 8 billion threshold on both new and existing uncleared OTC derivatives, subject to group risk appetite.
• Update EMIR margin procedures and AANA calculation processes to ensure accurate annual determination of whether each counterparty is above or below the EUR 8 billion threshold, including documentation of the March–May calculation methodology.
• Review and amend collateral agreements, credit support annexes (CSAs) and associated legal documentation to incorporate the revised treatment for below-threshold counterparties, including terms for stopping margin exchange and potentially releasing segregated collateral.

What changed

• - Counterparties whose average aggregate notional amount (AANA) of non-centrally cleared OTC derivatives falls below the EUR 8 billion threshold will no longer be required to exchange initial margin...
• The current framework, under which below-threshold counterparties are exempt from initial margin for new trades but must continue to exchange initial margin for pre-existing “legacy” contracts, will...
• Article 28(1) of Delegated Regulation (EU) 2016/2251 will be amended to explicitly extend the exemption from initial margin requirements to outstanding contracts where one of the two counterparties...
• The RTS introduce a clearer operational framework for entry into and exit from the initial margin regime based on the annual AANA calculation for March–May, including scenarios where one or both...
• Once a counterparty falls below the EUR 8 billion threshold under the revised rules, firms will be permitted to terminate related initial margin processes, including ceasing ongoing calculation,...

Key dates

2026-07-31

Joint ESA statement on ICT risks from frontier AI models in the EU financial sector published

Suggested considerations

• Compliance teams may wish to map existing and planned uses of frontier AI models (including large language models and other advanced generative or predictive systems) to current ICT risk and cyber resilience frameworks under Regulation (EU) 2022/2554 (DORA) to demonstrate that these models are covered by documented risk assessments, controls and monitoring.
• Firms should consider reviewing governance arrangements for frontier AI, including board and senior management oversight, clear accountability, and integration of AI-related ICT risks into the firm’s risk appetite, risk taxonomy and operational risk frameworks, with specific escalation and reporting lines.
• Risk and technology functions may wish to update ICT and cyber risk management policies to explicitly address frontier AI threats (e.g. prompt injection, model poisoning, data leakage, adversarial attacks) and to align detection, logging and incident response capabilities with the ESAs’ emphasis on prevention, detection and management of AI-related cyber risks.
• Operational resilience teams should consider conducting scenario analysis and testing around frontier AI incidents (such as compromised AI-enabled customer interaction tools or automated decision engines) to evidence the ability to maintain critical services in line with DORA requirements on ICT-related incident management and business continuity.
• Compliance and procurement teams may wish to review contracts and due diligence for critical ICT third‑party providers that supply or host frontier AI models, assessing how provider controls, service levels and incident processes meet DORA expectations and the ESAs’ focus on frontier AI risks.
• Supervisory engagement teams should consider preparing to discuss the firm’s frontier AI strategy, risk management and governance with competent authorities, using the ESA statement as a reference point for how existing supervisory expectations on ICT risk and cyber resilience are applied to AI use cases.
• Internal audit and second‑line control functions may wish to plan thematic reviews of frontier AI deployments to assess coverage of AI-specific ICT risks within existing control frameworks, including documentation quality, model oversight, and alignment with DORA and sectoral guidance.
• Firms should consider monitoring forthcoming ESA and national competent authority publications on frontier AI and DORA oversight activities, as the statement signals that supervisory practices and expectations in this area are evolving and may be further operationalised.

What changed

The publication introduces a consolidated supervisory expectation that frontier AI models be treated explicitly as a source of ICT and cyber risk within existing EU operational resilience and ICT risk management frameworks, rather than as a separate technology domain. It emphasises the need for robust governance, risk management, and controls around the prevention, detection and management of cyber risks stemming from frontier AI, including model governance, validation, monitoring and incident handling.

Key dates

2026-07-17

EBA published the final draft RTS and ITS on material acquisitions, material transfers, mergers and divisions under the CRD

Suggested considerations

• Compliance teams may wish to map proposed acquisition, transfer, merger, and division workflows against the draft minimum-information template and identify which data points are already held by competent authorities.
• Firms may wish to review whether planned intra-group transactions could qualify for the simplified treatment described in the draft RTS, including any discretion not to assess certain transactions.
• Groups planning mergers or divisions may wish to check which documentation can be reused from Company Law Directive processes and where CRD-specific supplements will still be needed.
• Legal and regulatory teams may wish to assess how multiple-notification scenarios are handled today and whether internal controls need to align with the proposed harmonised terminology and coordination timelines.
• Firms may wish to prepare for supervisory coordination across jurisdictions by identifying the authorities likely to be involved in cross-border transactions and the likely sequence of notifications.

What changed

The EBA’s final draft RTS would specify the minimum information to be provided for material acquisitions, material transfers of assets and liabilities, mergers, and divisions, together with a common assessment methodology for the prudential scrutiny of those transactions. The draft RTS also streamline notifications by excluding information already held by competent authorities and by allowing reliance on documentation prepared under Directive (EU) 2017/1132 (the Company Law Directive) for mergers and divisions.

Key dates

15 March (annually from 2025 onward) Deadline

- Recurring annual deadline for submission of the core ICAAP and ILAAP packages, including the Capital Adequacy Statement, Liquidity Adequacy Statement, risk inventory, stress testing information and liquidity stressed assumptions template

10 February 2025

- ECB publishes the clarification paper on ICAAPs and ILAAPs and respective package submissions, setting out new expectations on governance, content and submission processes

14 March 2025 Deadline

- For the SREP 2025 cycle only, general transition date by which all documents foreseen for annual submission must be provided to the ECB, marking the first application of the new two‑leg submission process and shortened deadline

15 March 2025 Deadline

- New general submission date for ICAAP and ILAAP information becomes effective, replacing the former 31 March deadline for annual packages and applying to ICAAP quantifications, ILAAP templates and other annual information

Continuous (from SREP 2025 cycle onward)

- Ongoing, year‑round obligation to submit to the ECB any new or significantly updated ICAAP/ILAAP‑relevant documents, together with a description and justification of changes and their implications for capital and liquidity adequacy

Suggested considerations

• Review existing ICAAP and ILAAP submission calendars and internal governance timelines and formally reset them to ensure core packages can be prepared, approved by the management body, and submitted by 15 March each year.
• Design and implement a documented two‑step submission process, including procedures for continuous, year‑round identification, approval and transmission to the ECB of any new or materially updated ICAAP/ILAAP‑relevant documents.
• Develop, approve and embed the new Capital Adequacy Statement and Liquidity Adequacy Statement, ensuring they reflect the management body’s signed‑off view on adequacy and are supported by clear references to ICAAP/ILAAP analyses and results.
• Update ICAAP and ILAAP governance frameworks to reflect ECB expectations, including explicit roles and responsibilities, escalation paths, periodic reviews triggered by external developments, and Board‑level oversight of capital and liquidity planning.
• Compile and maintain a comprehensive risk inventory covering both normative and economic perspectives, and ensure it is aligned with business models, risk appetite frameworks, recovery plans, stress testing programmes and SREP submissions.

What changed

• - Introduced a two‑step ICAAP/ILAAP submission model under the SREP: (1) annual submission of the main “ICAAP & ILAAP package” by 15 March and (2) continuous, year‑round submission of any new or...
• Shortened the standard annual deadline for ICAAP/ILAAP information from 31 March to 15 March, reducing the preparation and governance window by roughly two weeks versus prior practice.
• Confirmed that the clarifications apply from the SREP 2025 cycle onwards, with a general transition approach for 2025 and limited transitional flexibilities for banks whose internal processes cannot...
• Required inclusion of two distinct, concise documents within the annual packages: a “Capital Adequacy Statement” and a “Liquidity Adequacy Statement” reflecting the management body’s formal view on...
• Clarified governance expectations around capital and liquidity planning, including regular updates of governance frameworks to reflect external conditions and the submission of a complete risk...

Key dates

10 January 2025

- The FASTER Directive was published in the Official Journal of the EU, establishing the legal basis for ESMA’s market capitalisation mandate

June 2025

- ESMA published a consultation paper on the draft RTS methodology for calculating market capitalisation and the market capitalisation ratio

25 July 2025

- The consultation period for ESMA’s draft RTS methodology closed

October 2025

- ESMA was expected to finalise the RTS and submit them to the European Commission

16 January 2026

- The European Commission issued a final document referring to the FASTER framework and its threshold mechanics

Suggested considerations

• Compliance teams should map whether any serviced Member State may approach or exceed the 1.5% threshold over a rolling four-year period and flag jurisdictions that could trigger special withholding tax relief consequences.
• Tax operations teams should align withholding tax relief workflows with the ESMA-published ratios so that jurisdictional eligibility assessments use the current official figures.
• Data and controls teams should document the calculation source, methodology, and reconciliation process for any internal use of ESMA market capitalisation data.
• Investment firms and intermediaries should review client-facing tax-relief processes to ensure they can respond to changes in Member State status under FASTER.
• Market-data and regulatory-reporting teams should prepare for annual updates by building a recurring review process around each ESMA publication cycle.

What changed

• - ESMA has started publishing annual market capitalisation figures and market capitalisation ratios for each EU Member State under its FASTER Directive mandate.
• The published figures are based on a harmonised methodology developed by ESMA in technical standards, using transaction data reported under MiFIR.
• Market capitalisation is calculated from shares admitted to trading on a regulated market or multilateral trading facility, with aggregation at the level of the issuer’s legal address in the relevant...
• The market capitalisation ratio is calculated as the Member State’s market capitalisation divided by the total market capitalisation of all Member States on the same date, expressed as a percentage.
• Member States whose market size exceeds 1.5% of total EU market capitalisation for four consecutive years are subject to specific withholding tax relief-related requirements.

Key dates

Q4 2025

- ESMA conducted a public consultation on the draft RTS

November 2025

- ESMA held a public hearing on the draft RTS

05 January 2026

- The consultation period referenced in ESMA’s prior consultation paper closed

08 July 2026

- ESMA published the Final Report on the RTS concerning CCP admission criteria elements

TBD (post

08 July 2026); - The RTS will be submitted to the European Commission for endorsement

Suggested considerations

• CCPs should review their current admission criteria to ensure they are explicitly tied to a documented assessment of risks posed by each clearing member type.
• CCPs should update membership rulebooks and onboarding procedures to reflect the RTS requirement to consider financial resources, operational capacity, and liquidity support arrangements.
• CCPs should build or refine documented methodologies for assessing NFC clearing members’ ability to meet margin and default fund obligations.
• CCPs should ensure sponsored membership frameworks clearly define how the sponsor’s support, the sponsored member’s profile, and relevant risk controls are assessed for eligibility purposes.
• CCPs should prepare to publish clear admission criteria, application steps, timelines, required documentation, and explanations for any category-specific requirements.

What changed

• - CCPs must base admission criteria on a comprehensive risk assessment of the risks posed by clearing members and ensure the criteria reflect those risks.
• CCPs must consider whether clearing members have sufficient financial resources to meet obligations arising from participation in the CCP.
• CCPs must assess whether clearing members have access to reliable credit, liquidity, and foreign exchange facilities commensurate with the scale and nature of their clearing activity.
• CCPs must examine the clearing member’s operational capacity to meet CCP obligations, including readiness to support clearing operations and margin obligations.
• CCPs must take account of the client clearing activity of a clearing member, including the relative importance of that activity and the member’s ability to meet margin requirements if clients default.

Key dates

Since July 2011

– ESMA has been responsible for the supervision and registration of credit rating agencies in the EU under the CRA Regulation, including enforcement actions for breaches

TBD (post‑02 July 2026)

– Potential appeal window for Moody’s Germany to bring the case before the Board of Appeal of the European Supervisory Authorities; any appeal does not have automatic suspensive effect, though suspension can be granted by the Board of Appeal on request

02 July 2026

– ESMA Board of Supervisors adopts supervisory measures and imposes fines on Moody’s Deutschland GmbH for four negligent breaches of the CRA Regulation, and publishes a public notice and press release

Suggested considerations

• Conduct a comprehensive review of all ESMA‑related reporting processes to ensure that data submitted to ESMA (including rating information, historical performance data, rating changes, and other CRA regulatory reports) is complete, accurate, and kept up‑to‑date at all times.
• Map and document all responsibilities for ESMA reporting within the CRA group, ensuring that where one entity reports on behalf of others, the allocation of roles, ownership of data, and validation steps is explicitly defined, approved, and regularly reviewed.
• Perform a gap analysis of existing regulatory reporting policies, procedures, and internal control mechanisms against CRA Regulation requirements and ESMA supervisory expectations, and update documentation to remove ambiguities and outdated provisions.
• Implement or strengthen data validation and reconciliation controls over submissions to the European Rating Platform and ESMA’s central repositories, including automated checks for missing ratings, non‑withdrawn ratings, incorrect rating actions, and inconsistencies in historical performance data.
• Establish a formal governance process for changes to regulatory reporting frameworks, ensuring regular review, independent challenge by compliance or risk functions, and clear escalation routes for identified data quality issues or control failures.

What changed

• - ESMA has clarified, through enforcement, that CRAs must ensure complete, accurate and up‑to‑date data is reported to ESMA across all relevant CRA reporting channels (including the European Rating...
• ESMA has reinforced that errors limited to regulatory reporting data (and not directly affecting published ratings) can still constitute material breaches of the CRA Regulation, demonstrating that...
• ESMA has indicated that group reporting arrangements (where one CRA entity reports on behalf of others in the group) must have clear documentation of responsibilities, validation processes, and...
• ESMA has emphasized that regulatory reporting frameworks must include robust policies, procedures and internal control mechanisms, and that deficiencies in these frameworks constitute distinct...
• ESMA has signalled that negligence, rather than intentional misconduct, is sufficient to trigger significant fines under the CRA Regulation, and that both aggravating and mitigating factors will be...

Key dates

15 October 2013

- Council Regulation (EU) No 1024/2013 enters into force, granting the ECB sanctioning powers for prudential supervision of credit institutions (contextual basis for this enforcement)

Q4 2023

- Start of the period during which BIL failed to apply its approved internal models to expected loss calculation for defaulted retail and corporate exposures, leading to overstated capital

Q1 2024

- Second consecutive quarter in which incorrect expected loss and IRB shortfall calculations continued to affect reported capital and capital ratios

Q2 2024

- Third consecutive quarter of miscalculation; end of the period identified by the ECB as affected by the breach

29 June 2026

- The ECB publishes its decision imposing an administrative penalty of €3.255 million on BIL for the severe breach of its decision on internal models

Suggested considerations

• Review and confirm that all regulatory capital calculations, including expected loss and IRB shortfall for defaulted exposures, consistently use the approved internal models as authorised by the ECB or national competent authority.
• Map and reconcile the internal-model implementation across risk systems, finance, and regulatory reporting to ensure that there are no manual overrides, alternative methods, or parallel calculations that deviate from the approved model specifications.
• Strengthen model risk governance by ensuring that any proposed changes to expected loss methodologies, including for defaulted retail and corporate portfolios, are formally approved by the competent authority before being used in regulatory capital reporting.
• Implement robust controls and periodic testing within Finance, Risk, and Regulatory Reporting functions to detect and prevent misapplication or non-application of approved internal models, with clear escalation procedures for identified discrepancies.
• Ensure that the calculation of IRB shortfall (difference between expected loss and accounting provisions) is independently validated and appropriately deducted from CET1 capital in accordance with CRR and ECB internal models guidance.

What changed

• - The ECB has reaffirmed that institutions using internal ratings-based (IRB) approaches must apply their approved internal models consistently for expected loss calculation on defaulted retail and...
• The ECB has underscored that the IRB shortfall (difference between expected loss and accounting provisions) must be correctly calculated and deducted from regulatory capital whenever expected loss...
• The ECB has classified intentional failure to apply approved internal models to expected loss calculations as a “severe” breach under its Guide to the method of setting administrative pecuniary...
• The enforcement action confirms the ECB’s readiness to use its sanctioning powers under Article 18 of Council Regulation (EU) No 1024/2013 against internal-model users that misreport capital due to...
• The case highlights that miscalculation of expected loss and IRB shortfall over multiple reporting periods, even without an explicit capital ratio breach of minima, can be sanctioned where capital...

Key dates

26 June 2026

- ECB announces the comprehensive review of around 130 supervisory guidance publications, confirms discontinuation of about 40 outdated documents, and signals targeted and in‑depth revisions for the remaining guidance set

Q3 2026 (approx.)

- Revised **Guide to the internal capital adequacy assessment process** is expected to be published “shortly” after the press release, incorporating clarified treatment of the management buffer and its relationship to Pillar 2 guidance

Q3–Q4 2026 (approx.)

- Removal of supervisory expectations on **credit conversion factor (CCF)** from the **Guide to internal models** and the removal of **CVA references** from the **Guide on assessment methodology** and the **Guide on materiality assessment** are implemented as part of the ongoing review and alignment with EBA guidance and CRR III

Q4 2026–2027 (TBD)

- **Public consultations** will be launched on those guidance documents identified as needing substantial revision, ahead of finalising the updated versions

Q1 2027

- Publication of the new **report on good practices in governance and risk culture**, replacing the existing Draft guide on governance and risk culture, following finalisation of the revised EBA Guidelines on internal governance

Suggested considerations

• Review the ECB press release and associated lists of discontinued publications to identify any ECB guides, reports, letters or methodologies currently referenced in your internal policies, risk frameworks or model documentation that are now labelled as discontinued.
• Update internal policy inventories, regulatory mapping and compliance registers to reflect the new classification of ECB supervisory guidance as non‑binding and to distinguish clearly between binding EU/national law and non‑binding ECB expectations.
• For banks using the ICAAP Guide, perform a gap analysis of capital planning and management buffer practices against the forthcoming clarified expectations, ensuring internal documentation clearly differentiates management buffers from Pillar 2 requirements and guidance.
• For institutions using internal models for credit risk, remove any reliance on the ECB’s former CCF expectations by re‑mapping modelling policies and documentation to forthcoming EBA guidelines on credit conversion factors and to CRR/CRD provisions, once those guidelines are finalised.
• For risk and finance functions, review the CVA treatment in internal capital and risk methodologies to verify alignment with CRR III and ensure that internal references to ECB guidance (assessment methodology, materiality assessment) are updated to reflect the removed CVA content.

What changed

• - The ECB is conducting a comprehensive review of around 130 supervisory publications (guides, reports, letters, methodologies) to assess their relevance, effectiveness and clarity and to align them...
• Approximately 40 supervisory documents have been classified as outdated, superseded or no longer relevant and have been formally discontinued, with the texts remaining accessible but clearly labelled...
• The ECB has updated its classification of supervisory guidance documents to emphasise explicitly that they are non‑binding, do not create new legal obligations and do not replace binding EU or...
• The Guide to the internal capital adequacy assessment process (ICAAP Guide) will be revised to clarify supervisory expectations on the management buffer, explicitly positioning it as the bank’s own...
• The ECB has removed all content on supervisory expectations for the credit conversion factor (CCF) from the Guide to internal models, in anticipation of forthcoming EBA guidelines on CCF, thereby...

Key dates

Q2 2026

- ESMA reviews responses to assess potential regulatory adjustments under CRA Regulation

31 May 2026 Deadline

- Deadline for submitting evidence-based responses, including quantitative data and market examples, via ESMA's online consultation form in docx format

Suggested considerations

• Review the full Call for Evidence document and annexes for specific questions on restricted subscription (Annex I) and private credit ratings (Annex II).
• Prepare and submit evidence-based responses addressing key areas: use cases/benefits vs. public ratings, contracting/distribution parties, analytical/governance comparability, transparency impacts, risks/mitigations, and multi-CRA practices.
• Provide quantitative data, concrete examples, and rationale; indicate specific questions and alternatives considered.
• Submit online by 31 May 2026 using the docx reply form; note responses may be published unless confidentiality requested.

What changed

There are no immediate regulatory changes; this is a fact-finding call for evidence to assess whether adjustments to the CRA Regulation are needed. ESMA seeks views on definitions (e.g., restricted subscription ratings as selectively distributed to limited subscribers with economic interest; private ratings excluded from CRA scope if not distributed to >150 persons), production processes, governance comparability to public ratings, distribution risks, and market needs. Potential future outcomes include enhanced clarity on CRA Regulation application, but none are confirmed yet.

Key dates

2022

2024; - Period during which BofA Securities Europe SA committed the breach across six consecutive reporting periods

27 March 2026

- ECB penalty announcement and effective date

Ongoing Deadline

- Bank has the right to challenge the decision before the Court of Justice of the European Union (no statutory deadline specified, but typically within 2 months of notification)

Suggested considerations

• *Immediate (for all firms with internal models):
• *Audit Internal Models Scope: Conduct comprehensive review of all asset classes currently included in internal models approaches to confirm supervisory permission exists for each category
• *Verify Sovereign Bond Derivatives Treatment: Specifically validate that all sovereign bond options, forwards, and other derivatives are explicitly covered by supervisory approval documentation
• *Reconcile RWA Calculations: Recalculate historical RWAs (at minimum for the past 3-5 years) to identify any unauthorized inclusions and assess whether prior reporting was accurate
• *Strengthen Internal Controls: Implement automated controls to prevent unauthorized asset classes from being included in model calculations, with documented supervisory permission matrices

What changed

• This enforcement action does not introduce new regulatory requirements but rather clarifies existing obligations:
• Internal Models Scope Limitation: Banks must strictly adhere to supervisory permissions when applying internal models approaches; unauthorized asset classes cannot be included regardless of...
• Risk-Weighted Asset Accuracy: RWA calculations must reflect actual supervisory permissions, not theoretical modeling capabilities
• Capital Ratio Integrity: Misreporting of RWAs directly affects CET1 ratios and capital adequacy disclosures, which are fundamental to regulatory reporting
• Intentionality Standard: The ECB's classification of this breach as "intentional" (rather than negligent) indicates that awareness of supervisory limitations combined with non-compliance triggers...

Key dates

15 April 2026, 14:00

15:30; - Public hearing on joint guidelines

15 April 2026, 15:30

16:30; - Public hearing on EBA RTS

25 May 2026 Deadline

- Deadline for submitting comments on joint guidelines and EBA RTS

Post

25 May 2026; - EBA publishes all contributions (unless requested otherwise)

TBD (post

consultation); - Revised guidelines enter into force, repealing 2021 guidelines

Suggested considerations

• Assess current suitability processes against new requirements (e.g., ex-ante applications, AML/CFT checks, third-country branch specs) and prepare for mandatory assessments of additional roles like CFOs.
• For large institutions, evaluate EBA RTS on documentation and align internal templates (e.g., suitability questionnaires, CVs).
• Participate in public hearings on 15 April 2026 if relevant.
• Plan governance updates, including ongoing monitoring of collective/individual suitability and corrective measures.

What changed

• - Incorporation of revised CRD requirements for large institutions, including ex-ante applications where authorities perform ex-post assessments, and mandatory suitability assessments for key roles...
• Expanded application to CRD-covered entities and MiFID II investment firms, with further specifications for third-country branches.
• Strengthened integration with AML/CFT framework, providing guidance on identifying reasonable grounds to suspect money laundering or terrorist financing risks during assessments.
• Introduction of targeted simplifications to streamline processes, reduce administrative burdens, and offer greater flexibility/clarity for institutions and supervisors.
• Parallel EBA consultation on RTS specifying standardized documentation (e.g., suitability questionnaires, CVs, internal assessments) for large institutions to ensure consistent submissions.

Key dates

14 November 2013

- REGIS-TR initial registration with ESMA under EMIR

7 May 2020

- REGIS-TR registration extended to SFTR reporting

14 June 2024

- ESMA Supervisory Report identifying serious indications of breaches

17 June 2024

- Public notice references investigations leading to findings (dated in decision docs)

17 February 2026

- ESMA Board of Supervisors meeting discussing the case

Suggested considerations

• For REGIS-TR specifically: Cease three ongoing breaches (policies/procedures under EMIR/SFTR; SFTR organisational structure for business continuity) per ESMA supervisory measures (EMIR Art. 73).
• For all TRs: - Review and strengthen policies/procedures for clarity on governance roles/responsibilities.
• Audit organisational structure for SFTR business continuity and orderly functioning.
• Conduct operational risk assessments, implementing controls/systems to minimise risks under EMIR/SFTR.
• Enhance data confidentiality/integrity protections and misuse prevention measures.

What changed

• This is an enforcement decision, not new legislation, but it reinforces existing EMIR and SFTR requirements on TRs, particularly:
• Policies and procedures: Must be adequate to ensure compliance, with clear roles and responsibilities for governing bodies (breaches under EMIR Art. 78(3) and SFTR Art.
• Organisational structure: Must ensure business continuity and orderly functioning, especially for SFTR services (breach under SFTR).
• Operational risk management: Identify and minimise risks via systems, controls, and procedures (breaches under EMIR and SFTR, Point (a) Section II Annex I EMIR).
• Data confidentiality and integrity: Protect information received under EMIR and prevent misuse (breaches under EMIR). Fines were calculated per EMIR Art.

Key dates

Summer 2026

- European Commission aims to adopt revised ESRS into a delegated act, considering ESMA, EBA, EIOPA, ECB opinions

FY 2029 (reporting in 2030)

- End of certain temporary reliefs on quantitative information for anticipated financial effects (if ESMA recommendations adopted)

First years post

adoption (2026+); - Learning curve period with pragmatic NCAs supervision and flexibility in examinations

Suggested considerations

• Monitor Commission process: Track final delegated act by summer 2026, incorporating ESMA/EBA/EIOPA/ECB opinions; review full ESMA opinion PDF for detailed recommendations.
• Assess current reporting: Evaluate use of permanent/temporary reliefs (e.g., #3/#4 on quantitative data, #9/#11 on metrics) and prepare for time limits; refine transition plans for emissions/targets.
• Enhance governance disclosures: Strengthen reporting on sustainability competences in management/supervisory bodies and financial resources for actions.
• Review subsidiary exemptions: Check materiality exclusions for sustainability risks/opportunities in consolidated statements.
• Prepare for supervision: Leverage NCAs flexibility during transition; integrate into data governance and risk systems per CSRD implementation trends.

What changed

• The draft revised ESRS introduce simplifications such as improved readability, language, format, reduced volume of requirements, and a focus on material matters.
• Introduce time limits to certain permanent reliefs (e.g., reliefs #3, #4, #9, #11 on quantitative information for anticipated financial effects until FY 2029, and metrics).
• Refine requirements on transition plans (e.g., consistent disclosure of absolute financed emissions and contextual information).
• Strengthen reporting on sustainability competences of administrative, management, and supervisory bodies.
• Enhance transparency on financial resources allocated to sustainability actions.

Key dates

3 March 2026 Deadline

- Application deadline for ESMA Chair position

What changed

This publication announces no direct regulatory changes or new requirements; it is a vacancy notice for ESMA's leadership position rather than a policy update or consultation imposing obligations on market participants. Responsibilities outlined align with the existing ESMA Regulation, including chairing the Board of Supervisors and Management Board, strategy development, and navigating potential governance adjustments from the European Commission's market integration proposal.