EBA Guidance

Key dates

2024-07-09

Directive (EU) 2024/1619 (CRD VI) entered into force, introducing or strengthening governance requirements including responsibility mapping and a dedicated framework for third-country branches.

2025-01-01

The CRD VI banking package began applying according to the EBA consultation materials, with the revised Guidelines intended to support implementation of the updated framework.

2026-11-05

The EBA published the final revised Guidelines and the final report on internal governance.

Suggested considerations

• Compliance teams may wish to identify the competent authority’s expected adoption or comply-or-explain treatment once the final Guidelines are translated and formally notified, because no application date is specified in the published final report.
• Firms should consider performing a gap assessment against the final provisions on management-body responsibilities, senior-management and key-function-holder role statements, responsibility mappings, reporting lines, organisational structures and internal-control arrangements.
• Institutions may wish to review board and committee terms of reference, chair and executive-role combinations, conflict-of-interest registers, recusal controls and escalation procedures against the clarified expectations.
• Third-country-branch operators should consider mapping the new branch-specific governance requirements to the local branch manager, head-office governance, risk management, internal control, oversight and reporting arrangements, using the proportionality available in the final text.
• Firms should consider checking consistency between internal-governance documentation and DORA-related ICT risk, operational resilience, business-continuity and third-party-risk arrangements.
• Groups may wish to determine which entities fall within the Guidelines and whether responsibility mappings should be maintained at entity, branch and group levels, documenting the rationale for the chosen scope.
• Compliance teams may wish to retain evidence of proportionality assessments based on size, nature, scale and complexity, rather than removing governance controls solely because the final Guidelines are less granular than the consultation draft.
• Firms should monitor publication of the final Guidelines in all EU official languages and subsequent national competent-authority communications before setting internal implementation deadlines.

What changed

The Guidelines clarify the responsibilities of the management body, senior management and key function holders, including documented statements of roles and duties and a mapping of responsibilities. They address organisational structures, management of conflicts of interest—including situations where the chair also has executive functions—and key elements of internal control frameworks. They introduce or clarify governance expectations for third-country branches under CRD VI, with greater proportionality than in the consultation draft.

Key dates

2026-06-04

European Commission adoption of the 3rd FRTB Delegated Act under Article 461a CRR modifying own funds requirements for market risk for a three-year period

2026-08-03

EBA publication of no-action letter on the trading/banking book boundary and internal risk transfers, and technical considerations on FRTB application

2027-01-01

Start of modified calculation of own funds requirements for market risk under the 3rd FRTB Delegated Act for a three-year period

Suggested considerations

• Compliance teams at EU banks should consider reviewing the EBA no-action letter to understand which aspects of the FRTB boundary between banking book and trading book, internal risk transfers, and related reporting are currently deprioritised for supervisory or enforcement action, and how this interacts with national competent authority expectations.
• Risk and regulatory capital teams may wish to map their existing and planned FRTB implementation (standardised and internal models approaches) against the technical considerations published by the EBA, focusing on how the 3rd FRTB Delegated Act’s institution-specific multiplier and related boundary rules affect market risk capital calculations from 2027-01-01.
• Firms should consider identifying whether they fall within the scope of "multiplier banks" under the Delegated Act and assess operational implications, including whether their systems and data architecture can support a single, harmonised boundary framework rather than multiple versions during the three-year transitional period.
• Supervisory reporting and Pillar 3 disclosure teams may wish to analyse the EBA’s clarifications on reporting requirements linked to the trading/non-trading book boundary and internal risk transfers to determine whether current templates, data points, and governance need adjustment ahead of the Delegated Act’s entry into force.
• Institutions participating in the EBA supervisory benchmarking exercise should consider reviewing the clarified treatment of institutions in that exercise under the revised FRTB framework, and ensure their benchmarking submissions and internal controls are aligned with the EBA’s technical considerations.
• Legal and regulatory policy teams may wish to monitor the scrutiny process of the 3rd FRTB Delegated Act by the European Parliament and Council, as the practical relevance of the no-action letter and technical considerations is contingent on the Delegated Act entering into force as adopted on 2026-06-04.

What changed

The EBA has formally issued a no-action letter recommending that competent authorities do not prioritise supervisory or enforcement action regarding provisions of the FRTB framework that govern: (i) the boundary between the banking book and the trading book; (ii) internal risk transfers between these books; and (iii) certain related reporting requirements, during the transition to the revised market risk regime.

Key dates

2026-07-31

Joint ESA statement on ICT risks from frontier AI models in the EU financial sector published

Suggested considerations

• Compliance teams may wish to map existing and planned uses of frontier AI models (including large language models and other advanced generative or predictive systems) to current ICT risk and cyber resilience frameworks under Regulation (EU) 2022/2554 (DORA) to demonstrate that these models are covered by documented risk assessments, controls and monitoring.
• Firms should consider reviewing governance arrangements for frontier AI, including board and senior management oversight, clear accountability, and integration of AI-related ICT risks into the firm’s risk appetite, risk taxonomy and operational risk frameworks, with specific escalation and reporting lines.
• Risk and technology functions may wish to update ICT and cyber risk management policies to explicitly address frontier AI threats (e.g. prompt injection, model poisoning, data leakage, adversarial attacks) and to align detection, logging and incident response capabilities with the ESAs’ emphasis on prevention, detection and management of AI-related cyber risks.
• Operational resilience teams should consider conducting scenario analysis and testing around frontier AI incidents (such as compromised AI-enabled customer interaction tools or automated decision engines) to evidence the ability to maintain critical services in line with DORA requirements on ICT-related incident management and business continuity.
• Compliance and procurement teams may wish to review contracts and due diligence for critical ICT third‑party providers that supply or host frontier AI models, assessing how provider controls, service levels and incident processes meet DORA expectations and the ESAs’ focus on frontier AI risks.
• Supervisory engagement teams should consider preparing to discuss the firm’s frontier AI strategy, risk management and governance with competent authorities, using the ESA statement as a reference point for how existing supervisory expectations on ICT risk and cyber resilience are applied to AI use cases.
• Internal audit and second‑line control functions may wish to plan thematic reviews of frontier AI deployments to assess coverage of AI-specific ICT risks within existing control frameworks, including documentation quality, model oversight, and alignment with DORA and sectoral guidance.
• Firms should consider monitoring forthcoming ESA and national competent authority publications on frontier AI and DORA oversight activities, as the statement signals that supervisory practices and expectations in this area are evolving and may be further operationalised.

What changed

The publication introduces a consolidated supervisory expectation that frontier AI models be treated explicitly as a source of ICT and cyber risk within existing EU operational resilience and ICT risk management frameworks, rather than as a separate technology domain. It emphasises the need for robust governance, risk management, and controls around the prevention, detection and management of cyber risks stemming from frontier AI, including model governance, validation, monitoring and incident handling.