EBA, EIOPA, ESMA. Real-time regulatory developments, technical standards, and supervisory guidance, curated for compliance professionals.
Union-level publications only: the ESAs, the Commission and the Official Journal. Every entry links to the publication itself, dated by its publisher, and no figure appears here that is not in the source document. National authority guidance is not tracked.
Draft RTS under Article 323(2) CRR3 (EBA/CP/2026/18) specifying how institutions must govern, process and assess operational risk. Article 2 lets institutions rely on the policies, procedures and controls already established under DORA where they meet the same requirement. Consultation runs to 31 December 2026; virtual public hearing on 29 September 2026.
A joint statement asking financial entities for robust governance and risk management on the cyber risks tied to frontier AI models, covering prevention, detection and management. The ESAs are adapting ongoing and planned oversight of critical ICT providers to the same risk.
First annual overview built from the DORA reporting mechanism: 3,383 major incidents reported by financial entities, around one third with cross-border effects. System failures and external events, not cyberattacks, lead the causes.
National competent authorities collected the registers in the first quarter and forwarded them to the ESAs by 31 March 2026, on a 31 December 2025 reference date. The exercise then repeats every year.
Principles and procedures for cooperation, information sharing and coordination of oversight activities on critical ICT third-party service providers across the EU and the UK.
A Lead Overseer per designated provider, Joint Examination Teams drawn from the ESAs and national authorities, annual risk assessments feeding an oversight plan per provider. First examinations may lead to recommendations and follow-up.
One interface, operated by ENISA, to file a notification once under NIS2, the GDPR, DORA, the Critical Entities Resilience Directive and the EU Digital Identity Regulation. Still in negotiation: DORA reporting is unchanged until it is adopted.
Nineteen providers designated under Article 31, spanning core infrastructure, business and data services used by financial entities of every size. Designation opens Union oversight of the provider, it does not move your own obligations.
How the ESAs run oversight through Joint Examination Teams: governance, the oversight process end to end, the principles applied and the tools available to overseers.
Oversight harmonisation (2025/295), incident reporting content and forms (2025/301 and 2025/302), subcontracting (2025/532) and threat-led penetration testing (2025/1190) completed the second batch. All thirteen RTS and ITS now apply.
The Guidelines were cut back to what DORA does not already cover, leaving only the payment service user relationship requirements in scope for the entities concerned.
Every article of the Regulation applies from this date, with no transition period: the ICT risk framework, incident classification and reporting, the testing programme, the third-party rules and the Register of Information.
How a financial entity determines and assesses the conditions for subcontracting ICT services that support a critical or important function, from the pre-contractual assessment onward.
The ICT risk management framework and its simplified regime, the classification of major incidents, the policy on ICT services supporting critical or important functions, and the Register of Information template.
Nothing matches that filter.
Run the gap analysis against the five pillars and get the list of what is missing, article by article.
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.