EBA sets its 2027 supervisory agenda

EU RegCORE Client Alert | Banking Union, Capital Markets Union + Savings and Investment Union

QuickTake

On 30 September 2026, the European Banking Authority (EBA) published its Annual Work Programme 2027 (AWP).Available here.Show Footnote It organises its work around three cross-cutting drivers: (i) fostering resilience, (ii) improving efficiency and (iii) supporting transformation. Across seven activities, the programme identifies 251 deliverables, of which 131 are ongoing and 120 have deadlines or delivery targets. These are the EBA’s outputs, not 251 new obligations for firms operating in the EU.

Our Client Alert on the 2026 AWPSee our earlier Client Alert here.Show Footnote examined simplification of the Single Rulebook, stronger risk-assessment capacity and technological innovation, alongside the expansion of the EBA’s operational responsibilities. The 2027 programme takes those themes forward, but its most consequential development is a more explicit shift from designing requirements in advance to assessing how they are implemented in practice.

That shift is clearest in Annex IV, which combines the EBA’s supervisory-convergence priorities, the Union Strategic Supervisory Priorities (USSPs) applicable in 2027 and the European Resolution Examination Programme (EREP). Read with the activity tables and the simplification mapping in Annex III, it explains both what the EBA intends to produce and where supervisory and resolution authorities are expected to concentrate their attention.

Annex IV also places geopolitical risk within prudential supervisory judgement. Supervisors are expected to connect stress assumptions, expected-credit-loss overlays, sectoral concentrations, business-model resilience and executable recovery arrangements, rather than assess those issues in isolation. A standalone geopolitical-risk assessment offers limited assurance if it cannot be reconciled with capital and liquidity planning or the institution’s proposed management actions.AWP 2027, Annex IV pp 38–42, especially pp 39–40 (geopolitical risks, ECL models, recovery dry-runs and business models).Show Footnote

For firms, the resulting decisions are concrete: how to substantiate capital and liquidity treatment across jurisdictions; whether payments and intermediary-account arrangements can support both safeguarding and depositor identification; how to control artificial intelligence (AI) providers and changing financial-service value chains; and which data investments will serve reporting, stress testing and supervisory challenge together. The opportunity is not merely to anticipate more scrutiny. It is to use evidence of sound controls and unnecessary duplication to support a defensible case for proportionate treatment.

This Client Alert follows the programme’s seven activities, then examines its supervisory annex, the changes from our 2026 analysis and the decisions relevant to 2027 planning. Programme delivery dates, legislative assumptions and bank-specific requirements must be kept separate. Where a later official publication updates the September programme, or the programme contains a material qualification, that distinction is identified expressly.

Three actions for Q1 2027

1. Check which January 2027 dates apply to you. Several rules start in January 2027, separately from the EBA’s work programme: the 60% output-floor step for banks (1 January), the new rules for non-EU banks serving EU clients through branches (11 January), updated guidelines on retail product design and sale (11 January) and ESG-risk guidelines for smaller banks (by 11 January). Ask each business line to confirm in writing whether it is affected and who owns the work.
2. Start preparing for the 2027 EU-wide stress test now. The exercise runs around mid-2027 and includes a new climate element. Make sure finance, risk and treasury can explain how their starting figures, climate exposures and planned management actions fit together. Fewer data fields does not mean less preparation.
3. Keep one simple tracker of what is planned versus what is binding. Many Q1 2027 items, such as the new suitability guidelines, reporting changes and the Commission’s expected banking proposal, are plans or drafts, not rules you must follow yet. List each item, the entity affected, its current status and an owner, and update it as items are finalised. Do not cut budgets or controls on the strength of promised simplification until it is actually in force.