EBA Ongoing Compliance

Credit institutions must continuously monitor all relevant EBA guidelines, regulatory technical standards (RTS) and implementing technical standards (ITS). The most important include the governance guidelines (EBA/GL/2021/05), outsourcing guidelines, ESG risk guidelines (mandatory from January

2026 for large institutions), guidelines on loan origination and monitoring, and DORA-related ICT standards. The EBA publishes over

30 new or updated regulatory documents annually, all of which must be assessed for relevance and implemented where applicable.

Regulatory change management for EBA requirements comprises four stages: (1) Monitoring – systematic capture of new EBA consultations, guidelines and standards through official EBA channels and industry trackers. (2) Relevance assessment – evaluation of which new requirements affect the institution, based on business model and proportionality principle. (3) Gap analysis – comparison of new requirements with current state and identification of action items. (4) Implementation planning – creation of an action plan with deadlines, responsibilities and resources. Institutions that start this process proactively from the consultation phase significantly reduce implementation effort when requirements enter into force.

In the SREP (Supervisory Review and Evaluation Process), the supervisor examines compliance with relevant EBA guidelines and standards. Core areas include: implementation of the governance guidelines (EBA/GL/2021/05), the internal capital adequacy assessment process (ICAAP) and internal liquidity adequacy assessment process (ILAAP), compliance with outsourcing guidelines, implementation of remediation items from previous examinations, and adaptation to new regulatory requirements. Structured ongoing compliance ensures all examination areas are documented and up to date.

EBA guidelines typically follow this timeline: consultation phase (

3 months), evaluation and finalisation (3–12 months), publication with implementation deadline (usually 6–12 months after publication). Specific current deadlines: ESG risk guidelines – January

2026 for large institutions, January

2027 for smaller ones. Revised governance guidelines (CRD VI adaptation) – expected 2027. CRR III / CRD VI package – phased implementation from January 2025. National competent authorities publish comply-or-explain statements for each EBA guideline.

Initial implementation of an EBA guideline is a one-time project with defined scope and deadline. EBA ongoing compliance, by contrast, is a continuous process ensuring that (1) existing implementations remain current and do not erode through organisational changes, (2) new or updated EBA requirements are identified and implemented in time, (3) the effectiveness of compliance measures is regularly reviewed, and (4) documentation is kept examination-ready. Without ongoing compliance, initial implementations typically become outdated within 12–18 months.

The EBA plays a central role in shaping DORA (Digital Operational Resilience Act) and ESG regulation. In the DORA area, the EBA develops regulatory technical standards jointly with the other ESAs for ICT risk management, incident reporting and the information register for ICT third-party providers. In the ESG area, the EBA has published guidelines on ESG risk management applicable from January

2026 for large institutions. Both areas require ongoing monitoring as the EBA continuously publishes new specifications, Q&As and implementation guidance.

EBA compliance monitoring can be automated in several areas: (1) Regulatory monitoring – automatic capture of new EBA publications via RSS feeds and API interfaces from the EBA website. (2) Gap tracking – specialised legal change management tools filter relevant changes by institution. (3) Control testing – automated sampling and threshold checks within the ICS. (4) Reporting – automatic generation of compliance dashboards with status per guideline. Automation reduces manual effort for the compliance team and increases responsiveness to regulatory changes.