Compliance with the European Banking Authority, commonly shortened to EBA compliance, is the ongoing work of meeting the harmonised prudential rules, reporting obligations, and supervisory expectations the EBA sets for financial institutions operating in the EU. The rules themselves live in what the EBA calls the Single Rulebook, and enforcement runs through national regulators in each member state. Falling short can bring fines, capital add-ons, or restrictions on business activities, and the scope of what “compliance” covers has widened considerably going into 2026 with new obligations on digital resilience, crypto-assets, and environmental risk sitting on top of the existing capital and reporting regime.
Who Has to Comply
Credit institutions sit at the center of the EBA’s scope. The Capital Requirements Regulation defines these as undertakings that take deposits or other repayable funds from the public and grant credit for their own account.1European Banking Authority. Credit Institutions Register Investment firms subject to the Capital Requirements Directive and payment institutions that process electronic transactions also fall under EBA authority.2European Banking Authority. Registers and Other List of Institutions
Day-to-day supervision doesn’t happen at the EBA. National regulators, known as competent authorities, act as the primary enforcement bodies within each member state. They apply EBA standards locally, run examinations, and impose penalties. The setup lets national supervisors account for local market conditions while enforcing a uniform standard across the EU.
The list of entities under EBA oversight has grown. Under the Markets in Crypto-Assets Regulation, the EBA now directly supervises issuers of asset-referenced tokens and electronic money tokens classified as “significant” under criteria set out in Commission Delegated Regulation 2024/1506. For significant asset-referenced tokens, the EBA takes over supervision entirely from the home competent authority. For significant electronic money tokens issued by e-money institutions, the EBA and national regulator share responsibility. Crypto-asset service providers also file quarterly reports under MiCA.3European Banking Authority. The EBA’s Supervisory Role Under MiCA
The Single Rulebook and How Its Layers Bind You
The Single Rulebook is the EBA’s central product: a harmonised set of prudential rules every institution across the EU must follow.4European Banking Authority. The Single Rulebook The layers of the Rulebook don’t all carry the same weight, and the consequences of ignoring them differ.
Binding Technical Standards
Regulatory Technical Standards and Implementing Technical Standards are EU law. The EBA drafts them and the European Commission adopts them as regulations or decisions. Once adopted, they apply directly in every member state, and national governments cannot modify them. They fill in the technical detail of major EU legislation including the Capital Requirements Regulation, the Capital Requirements Directive, the Bank Recovery and Resolution Directive, and the Deposit Guarantee Schemes Directive.4European Banking Authority. The Single Rulebook Ignoring a Binding Technical Standard is a straightforward breach of EU law.
Guidelines and Recommendations
Guidelines carry less force than Binding Technical Standards but are far from optional. Under Article 16 of the EBA’s founding regulation, both competent authorities and financial institutions must make “every effort” to comply. Within two months of a guideline being issued, each national competent authority has to confirm whether it complies or intends to comply. If it doesn’t, the authority must explain why, and the EBA publishes that non-compliance.5European Banking Authority. Compliance With EBA Regulatory Products Financial institutions themselves can also be required to report whether they comply with specific guidelines. In practice, most competent authorities adopt EBA guidelines, so the “explain” route is narrow and comes with real reputational cost.
Reporting: COREP, FINREP, and EUCLID
The EBA’s reporting framework is where compliance gets granular. Two main frameworks govern the data institutions must produce.
COREP covers the prudential data regulators need to assess whether an institution can absorb financial shocks. Institutions report on their own funds, capital adequacy ratios, leverage ratios, and liquidity coverage.6European Banking Authority. Reporting Frameworks The templates contain hundreds of data points, each completed according to detailed technical instructions on how to calculate ratios and which assets qualify for which categories. Small errors in reported own funds or risk exposures can trigger a supervisory inquiry.
FINREP focuses on financial statement data: balance sheets, income statements, comprehensive income, and off-balance-sheet activities.6European Banking Authority. Reporting Frameworks It applies to credit institutions and investment firms under the Capital Requirements Directive, particularly those reporting under International Financial Reporting Standards. FINREP also captures data on non-performing and forborne exposures, giving regulators a view into credit quality trends.
Institutions submit completed reports to their national competent authority, which acts as the first collection point. National regulators have discretion over the exact format they require at that first level; some mandate XBRL, others accept different formats. The EBA publishes XBRL taxonomies for onward transmission of supervisory data between competent authorities and the EBA.6European Banking Authority. Reporting Frameworks After receiving and verifying institution data, national regulators feed it into EUCLID, the European Centralised Infrastructure for Supervisory Data. EUCLID is the EBA’s primary repository, powering public registers, risk dashboards, and cross-sectoral analyses.7European Banking Authority. Data Missing a submission deadline typically brings immediate follow-up from the national supervisor, and repeated failures raise questions about operational soundness.
Supervisory Review and Evaluation
SREP is where regulators move from reading your reports to judging how the institution is actually run. National competent authorities assess each institution across four elements: business model and profitability, internal governance and risk management, risks to capital, and risks to liquidity and funding.8European Banking Authority. Guidelines for Common Procedures and Methodologies for the Supervisory Review and Evaluation Process (SREP) and Supervisory Stress Testing
Based on SREP results, supervisors can require an institution to hold capital above the regulatory minimum, impose specific liquidity requirements such as a higher-than-standard liquidity coverage ratio, or impose qualitative measures like restricting dividend distributions or limiting certain business lines.9European Central Bank. Supervisory Methodology 2024 An institution can file perfect reports and still receive a poor SREP outcome if the underlying risk management is weak.
Digital Operational Resilience (DORA)
Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has been in force since January 2025 and significantly widens what compliance means for financial institutions.10EUR-Lex. Regulation (EU) 2022-2554 – DORA DORA sets uniform requirements for the security of network and information systems supporting financial services, covering:
- ICT risk management, with an internal governance and control framework proportionate to the institution’s size and complexity.
- Incident reporting, requiring notification of major ICT-related incidents to competent authorities, with voluntary notification encouraged for significant cyber threats.
- Digital resilience testing to identify vulnerabilities in ICT systems.
- Third-party risk management, with prescribed content for contractual arrangements with ICT service providers. The EBA takes part in oversight of critical third-party providers deemed systemically important.
The EBA has updated its ICT and security risk management guidelines to align with DORA, targeting credit institutions, payment institutions, and account information service providers covered by the regulation.11ECIIA. EBA Updates ICT and Security Risk Management Guidelines to Align With DORA Entities not covered by DORA, such as credit unions and post-office giro institutions, continue to be governed by the older PSD2 security rules.
ESG Risk Management From January 2026
Starting 11 January 2026, institutions must comply with the EBA’s Guidelines on the management of Environmental, Social and Governance risks.12European Banking Authority. Guidelines on the Management of ESG Risks Institutions must build processes for identifying, measuring, managing, and monitoring ESG risks across their operations. They also need transition plans addressing risks arising from the shift toward an EU climate-neutral economy, covering short, medium, and long term horizons.
ESG risk management involves forward-looking assessments of how climate change, social factors, and governance weaknesses could affect a portfolio and business model over decades. The guidelines signal that supervisors will weigh ESG preparedness in SREP.
Anti-Money Laundering: the AMLA Handover
Effective 31 December 2025, the EBA’s anti-money laundering and counter-terrorist financing powers were formally transferred to the new Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), established by Regulation (EU) 2024/1620.13European Banking Authority. EBA-AMLA AML/CFT Transition Factsheet
For institutions, the immediate practical impact is limited. All existing EBA AML/CFT guidelines and standards stay in force until AMLA replaces them, and AMLA must provide suitable transition periods when introducing new rules.13European Banking Authority. EBA-AMLA AML/CFT Transition Factsheet The EBA still integrates money laundering and terrorist financing risks into prudential regulation, including licensing, fit and proper assessments, and governance frameworks. Track AMLA developments, but don’t discard existing EBA-aligned AML programs.
Outsourcing Arrangements
The EBA’s Guidelines on outsourcing arrangements apply to credit institutions, investment firms, and payment institutions. When an institution outsources critical or important functions, stricter rules kick in. The contract must grant the institution and its competent authority full access to the service provider’s premises, systems, and data, along with unrestricted audit rights. It must also include termination rights covering situations like breach of law, material changes to the arrangement, or weaknesses in how the provider handles confidential data.
Outsourcing can never leave an institution as an “empty shell” lacking the substance to remain authorised, and the management body’s responsibility for the institution cannot be outsourced. Institutions must maintain an outsourcing policy, document all arrangements in a register, and notify their competent authority when outsourcing critical functions. The rules apply whether the service provider is a traditional vendor or a cloud platform.
Fit and Proper Assessments
Before anyone joins an institution’s management body, they must pass a suitability assessment covering knowledge, skills, experience, and reputation. The joint EBA-ESMA guidelines require these assessments to include the individual’s ability to identify, manage, and mitigate money laundering and terrorist financing risks.14European Banking Authority. EBA and ESMA Publish Final Guidance on Fit and Proper Requirements Institutions must respect the principle of equal opportunities for any gender and take measures toward a more gender-balanced management body.
Assessments aren’t a one-time checkbox. They apply to newly appointed members and become relevant again during early intervention measures and resolution under the Bank Recovery and Resolution Directive.14European Banking Authority. EBA and ESMA Publish Final Guidance on Fit and Proper Requirements Competent authorities can reject candidates who lack relevant expertise or present conflicts of interest, and appointing someone without a proper assessment invites supervisory trouble.
Resolution Planning and MREL
Beyond going-concern requirements, institutions must prepare for the possibility of failure. The Minimum Requirement for own funds and Eligible Liabilities (MREL) ensures institutions hold enough loss-absorbing capacity to be resolved in an orderly way without taxpayer bailouts.15European Banking Authority. Implementing Technical Standards on Disclosure and Reporting of MREL and TLAC The EBA has developed Implementing Technical Standards that integrate MREL disclosure and reporting so regulators and market participants can assess resolution readiness.
MREL targets are institution-specific, calibrated by the Single Resolution Board using resolution planning data reported through the EBA framework. Commission Implementing Regulation (EU) 2025/2303 updated the reporting templates for resolution planning, so verify you’re working with the latest specifications.16Single Resolution Board. 2026 Resolution Reporting Missing MREL targets can restrict an institution’s ability to distribute dividends or make payments on certain instruments, giving this area direct financial consequences.