Cyber oversight and simpler rules lead 2027 supervisory agenda
On October 13, 2026, the European Banking Authority, European Insurance and Occupational Pensions Authority and European Securities and Markets Authority set their joint 2027 priorities. These combine cyber oversight, simpler rules and cross-sectoral risk monitoring.
Cyber resilience moves to testing
The European Supervisory Authorities (ESAs) will update the list of critical ICT third-party providers, conduct examinations and follow up on recommendations issued in 2026.
They will report on 2026 oversight and major ICT incidents, support the European Commission's potential Digital Operational Resilience Act review and promote consistent supervision.
After framework development in 2025–2026, systemic cyber coordination will focus on exercises and capacity-building, with links to EU-CyCLONe and the G7 Cyber Expert Group.
Financial conglomerate capital-reporting templates will enter consultation in Q1 2027, with technical standards finalised by year-end.
The ESAs will also update the conglomerates list and examine stress-testing gaps involving interconnectivity.
Simplification spans products and markets
PRIIPs disclosure work will target simpler performance and cost information; standards may be due in 2028, depending on legislation.
The ESAs will report 2026 sanctions, review financial education and prepare for revised sustainability disclosures.
Securitisation reforms have a projected Q1/Q2 2027 implementation window; work includes transparency templates and EU Green Bond Standard review preparations for December 2028.
Other tasks include twice-yearly risk updates, a third BigTech data collection, AI and tokenisation monitoring, credit-rating mappings and the 14th Joint Consumer Protection Day.
Mandates before implementation
The programme places burden reduction alongside supervisory convergence rather than replacing oversight with deregulation.
Several disclosure and securitisation deliverables depend on legislative outcomes, limiting certainty over timing.
Its implementation therefore combines scheduled operational work with conditional rulemaking.