ESMA sets its 2027 supervisory agenda

EU RegCORE Client Alert | Capital Markets Union + Savings and Investment Union

QuickTake

On 28 September 2026, the European Securities and Markets Authority (ESMA) published its Annual Work Programme for 2027 (AWP 2027)  Available hereShow Footnote and its report on simplification and burden reduction (SBR).Available here.Show Footnote Together with the refreshed Union Strategic Supervisory Priorities (USSPs),Available hereShow Footnote the programme signals a more operational phase of European capital-markets supervision. The central question for firms is increasingly whether their governance, technology, data and contractual arrangements produce the outcomes represented to clients and supervisors. 

ESMA’s 2027 publications bring three decisions into focus for affected firms: (i) completing T+1 readiness, (ii) demonstrating how client-facing innovation and critical dependencies are controlled, and (iii) preparing for reporting reform while maintaining current obligations. The new innovation USSP and the continuing resilience priority give those decisions a clearer supervisory context.

For crypto-asset service providers, the most immediate decision arises from ESMA’s 8 October opinion on non-MiCAR-compliant asset-referenced and e-money tokens: which services and tokens require restriction, remediation or a permitted orderly exit. ESMA expects identified legacy exposures to be remediated as soon as possible and no later than three months after publication.

That is a supervisory expectation rather than a new legislative application date, and any residual services remain subject to strict conditions. Separately, operators of trading platforms face a MiCAR deadline of 31 December 2027 for white papers on certain legacy crypto-assets.

Simplification offers a future opportunity to reduce duplicated reporting, but it does not provide present relief from the regimes being redesigned. Firms should distinguish binding application dates from ESMA delivery targets and test whether their contracts, systems and operating model can support the services they intend to provide.

This Client Alert identifies the principal milestones and the legal decisions that should inform 2027 planning. It builds on our earlier analyses of ESMA’s Programming Document 2026–2028 and AWP 2026.See: ESMA publishes its Programming Document 2026–2028 and ESMA publishes its Annual Work Programme 2026.Show Footnote Those publications traced the expansion of supervisory responsibilities and the growing role of common data, convergence and the Savings and Investments Union (SIU). The 2027 agenda carries those themes forward with more specific supervisory exercises and delivery milestones.

What each publication does:

• The multi-year context is ESMA’s 2027–2029 Programming Document (SPD), dated 29 January and published on 5 February 2026. It supplies the longer planning and resource horizon; the September AWP updates the earlier annual plan with the latest 2027 outputs. These are successive stages of planning, rather than documents issued together in September.
• The USSP factsheet of 23 September provides the clearest indication of where supervisory attention will concentrate. Innovation with investor safeguards starts in 2027, initially addressing technology used in core activities affecting clients, including artificial intelligence (AI) and tokenisation. Cyber and operational resilience continues, with wider coverage and deeper checks. The environmental, social and governance (ESG) disclosures priority closes in 2026, while the underlying supervisory work continues.
• ESMA’s Activities Snapshot, prepared for the September 2026 hearing of the European Parliament’s Committee on Economic and Monetary Affairs (ECON), supplies a further part of the picture: evidence of implementation, supervisory findings and enforcement already informing the next cycle. 

Read together, the documents connect strategic ambition, annual delivery, national supervisory priorities and the results of work already performed.

For boards, legal teams and control functions, the practical response is to organise 2027 preparation around affected services and dependencies. AI governance, product approval, custody, outsourcing, reporting and settlement cannot be treated as wholly separate implementation files where the same client service depends on all of them.