Looking back to navigate forward: What the EU supervisors’ 2025 Annual Reports reveal for 2026

EU RegCORE Client Alert | Banking Union, Capital Markets Union + Savings and Investment Union, Insurance Union

QuickTake

Between March and July 2026, the EU’s principal financial supervisory authorities published their 2025 annual reports. Publications from the Joint Committee of the European Supervisory Authorities (ESAs), the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA), the European Insurance and Occupational Pensions Authority (EIOPA) and, in the Banking Union context, the European Central Bank (ECB) in its Single Supervisory Mechanism (SSM) role and the Single Resolution Board (SRB) in its Single Resolution Mechanism role, reveal a system in which framework development and active supervision increasingly coexist, with the balance shifting toward implementation monitoring and enforcement. National competent authorities’ (NCAs) activities are steered by EU-level priorities, though supervisory intensity and legal powers vary significantly across sectors. The centre of gravity is moving from constructing rules to demonstrating that rules work consistently, operationally and measurably across the EU—while significant rulemaking continues, particularly for newer frameworks such as AMLA and MiCAR 2.0.

This Client Alert consolidates findings across all published reports, identifies thirteen cross-cutting themes shaping supervisory expectations through 2026 and beyond and should be read with Navigating 2026.

Annual reports do not themselves create new legal obligations. Their relevance lies in showing how authorities prioritise supervisory resources, what data and outcomes will be compared, where inspection, enforcement and remediation activity will concentrate and how existing requirements will be applied. The reports demonstrate an operational supervisory phase characterised by: (i) intensified data-driven supervision; (ii) systematic DORA monitoring; (iii) accelerating ESG integration; (iv) enhanced retail investor protection; and (v) deepening cross-sectoral coordination.

Key developments in the annual reports: (a) the EBA’s substantial delivery of the core Basel III/CRR III package (82% on-time delivery), notwithstanding a number of deferred or rescheduled technical mandates; (b) ESMA’s completion of the first consolidated tape provider (CTP) selections and launch of simplification projects; (c) EIOPA’s technical input on IORP II and PEPP reviews addressing the EU pensions gap; (d) the ECB-SSM’s “next-level supervision” digitalisation project; and (e) the SRB’s tenth SRM anniversary with the Single Resolution Fund (SRF) reaching EUR 81 billion.

Bottom line on the annual reports

EU financial supervision is shifting from framework development toward operational enforcement, though both phases coexist and the pace varies by sector. Firms will increasingly be judged on demonstrable, peer-comparable outcomes and not documentation volume. The question is progressively becoming not whether rules have been implemented, but whether controls work consistently across the EU. However, for newer regimes (notably AMLA and aspects of DORA), rulemaking and institutional capacity-building remain ongoing, and supervisory expectations are still being calibrated.

Six cross-cutting trends stand out when the reports are readAcross more than 700 pages across 13 relevant documents reviewed hereinShow Footnote together, developed below into thirteen more granular themes (further below):

1. Operational execution over framework design. All authorities report pivoting from legislative mandates to implementation monitoring, enforcement readiness and operational delivery.
2. Data as supervisory infrastructure. Data quality, reporting simplification and data-driven supervision are now operational priorities across all ESAs.
3. DORA and operational resilience. The Digital Operational Resilience Act (DORA) applied from 17 January 2025. The ESAs jointly designated an initial list of 19 critical ICT third-party service providers (CTPPs)See coverage here.Show Footnote and appointed Lead Overseers under DORA’s allocation criteria. This initial designation is subject to periodic review as the oversight framework matures. The ESAs exercise direct CTPP oversight; competent authorities supervise financial entities’ DORA compliance. No enforcement action against CTPPs has yet been taken, and the real test of the framework will come when Lead Overseers issue recommendations requiring contractual re-papering across the financial sector.
4. Retail investor and consumer protection. ESMA’s reports revealed EU retail investment costs remain high internationally. EIOPA’s first EU-coordinated mystery shopping exercise assessed in-surance-based investment product sales across eight Member States—a supervisory convergence tool generating insights for NCA supervision rather than a direct enforcement mechanism. Value for money remains a supervisory priority across the securities and insurance sectors.
5. ESG integration and sustainable finance. The EU sustainable finance rulebook underwent significant simplification under the Omnibus proposals. ESMA’s fund names guidelines prompted 64% of affected funds to change their names, frequently removing sustainability-related terminology. EIOPA focused on natural catastrophe risks and climate-related insurance gaps.
6. AML/CFT transition to AMLA. On 1 January 2026, stand-alone AML/CFT powers transferred from the EBA to the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA).See extensive coverage on AMLA from our EU RegCORE under the AML/CTF & AMLA tab.Show Footnote In July 2025, the ESAs concluded a multilateral MoU with AMLA for information sharing and policy coordination.

Significant work deferred into 2026 includes certain CRR III reporting mandates and Climate Transition Plan frameworks. The Joint Guidelines on ESG stress testing were finalised in January 2026; implementation continues. Compliance planning should account for both completed deliverables and deferred items.

The convergence of priorities around operational resilience, data quality and ESG integration signals a European regulatory operating model transcending sectoral boundaries.