EBA Publishes Final Guidelines on ICT and Security Risk Management for EU Banks
The European Banking Authority (EBA) has issued final guidelines on ICT and security risk management, setting out requirements for banks to strengthen their resilience against cyber threats and operational disruptions. The guidelines, effective from 1 January 2027, mandate enhanced governance, risk assessment, and incident reporting frameworks.
Related updates
EBA E-mail Alert 16 July 2026: Key Regulatory Updates
The European Banking Authority (EBA) issued its e-mail alert on 16 July 2026, summarizing recent regulatory developments. The alert covers new guidelines, consultations, and other updates relevant to compliance officers in the financial sector.
16 Jul 2026
EBA publishes its 2027 Work Programme
The EBA published its 2027 Work Programme on 30 September 2026, setting out its priority areas and deliverables for the year. The programme is built on three drivers — improving efficiency, fostering resilience and supporting transformation — and marks a first step towards a broader medium-term strategy. Key workstreams include completing the 2024 banking package, preparing the new payment services framework, crisis management and deposit insurance reforms, and continued implementation support for DORA, MiCA and EMIR. The programme contains no new binding requirements for institutions.
30 Sep 2026
EBA sets out priorities for the European Commission's MiCA review
The EBA has published its response to the European Commission's targeted consultation on the review of MiCA, recommending that the Commission prioritise several areas. These include strengthening the framework for third-country multi-issuer stablecoin schemes, reviewing reserve requirements, clarifying the scope and definitions of MiCA, regulating crypto-asset lending including DeFi-linked activities, and reviewing issuer and CASP reporting. The EBA considers existing ART and EMT requirements broadly appropriate but sees scope for targeted changes.
24 Sep 2026