Authorities
The supervisors and authorities these rules are enforced by, and what each one is responsible for.
De Nederlandsche Bank (DNB)
De Nederlandsche Bank is the Dutch central bank and the prudential supervisor of banks, insurers, pension funds, payment and e-money institutions, trust offices and crypto-asset service providers. It supervises whether an institution is financially sound and run with integrity. Conduct towards customers and markets is supervised separately, by the AFM.
NextTransition report due, insurers and premium pension institutions, Q3 2026Checked
Anti-Money Laundering Authority (AMLA)
AMLA is the EU's anti-money-laundering authority, based in Frankfurt. Since 1 January 2026 it has held the EU-level AML rule-making mandate that used to sit with the EBA. From 2028 it will directly supervise around forty of the riskiest cross-border financial institutions. Everyone else stays with their national supervisor, under rules AMLA writes.
NextConsultation closes: guidelines on ongoing monitoring (AMLR Article 26(5))Checked
Rijksinspectie Digitale Infrastructuur (RDI)
The RDI is the Dutch supervisor for digital infrastructure, trust services, telecom and radio equipment, and one of the supervisors under the Cyberbeveiligingswet, the Dutch implementation of NIS2, in force since 15 August 2026. Most licensed financial institutions are not supervised by the RDI: DORA takes precedence, and banking and financial market infrastructure sit with DNB and the AFM.
NextCyber Resilience Act incident-reporting duties startChecked
European Banking Authority (EBA)
The EBA writes the technical rules that national supervisors apply. It does not supervise your bank, your payment institution or your e-money institution, with two exceptions: significant token issuers under MiCA, and critical ICT third-party providers under DORA, which it oversees jointly with ESMA and EIOPA. Its deadlines reach you through reporting frameworks and technical standards.
NextQ2 2026 Risk Dashboard publishedChecked
European Securities and Markets Authority (ESMA)
ESMA writes the securities rulebook that national authorities such as the AFM apply, and directly supervises a small set of market infrastructure: credit rating agencies, trade repositories, securitisation repositories, benchmark administrators, data reporting service providers and third-country central counterparties. For an investment firm or fund manager, ESMA is where your obligations are drafted, not where they are enforced.
NextEnd of EuroCTP's transition period as consolidated tape providerChecked
European Insurance and Occupational Pensions Authority (EIOPA)
EIOPA writes the technical rules for insurers and occupational pension funds, maintains the EU registers of both, and publishes the risk-free interest rate term structure every month, a data release that feeds directly into every Solvency II balance sheet. It does not supervise individual undertakings; DNB, BaFin and the FMA do that.
NextIRRD valuation technical standards consultation closesChecked
Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)
BaFin is Germany's integrated financial supervisor: banking, insurance and securities in one authority, plus the national resolution authority since 2018. It supervises 1,089 of Germany's less significant banks directly, while the ECB supervises the significant ones. It is also the designated market surveillance authority for AI used in regulated financial activity, in force since 29 July 2026.
NextThe EU anti-money-laundering regulation (AMLR) starts to applyChecked
Autoriteit Financiële Markten (AFM)
The AFM is the Dutch conduct supervisor. It supervises how financial firms behave towards their customers and towards the market: investment firms, asset managers, intermediaries, crypto-asset service providers, audit firms, trading venues and listed issuers. Whether those firms are financially sound is DNB's question, not the AFM's.
NextThe EU anti-money-laundering regulation (AMLR) starts to applyChecked
Autoriteit Persoonsgegevens (AP)
The Autoriteit Persoonsgegevens is the Dutch data protection authority. For a licensed financial institution it matters in three places: personal data processing under the GDPR, the 72-hour breach notification that runs alongside DORA incident reporting, and anti-money-laundering monitoring, where the AP has taken a public position against large-scale transaction surveillance.
NextAnnex III high-risk AI obligations applyChecked
Finanzmarktaufsicht (FMA) - Austria
The FMA is Austria's integrated financial supervisor: banking, insurance, securities and pensions in one authority, supervising 838 entities as at the end of 2025. Banking supervision is shared with the Oesterreichische Nationalbank: the OeNB analyses and inspects, the FMA decides.
No dates aheadChecked
EU AI Office
The European AI Office is a body inside the European Commission, not an EU agency. It directly supervises general-purpose AI models. It does not supervise the AI systems inside your bank or insurer: those are supervised by your existing financial regulator, and their compliance date moved from August 2026 to 2 December 2027.
No dates aheadChecked
ECB Banking Supervision (SSM)
ECB Banking Supervision or Single Supervisory Mechanism (SSM) directly supervises the euro area's largest banks, 110 significant institutions as at 1 May 2026, and oversees national supervisors for the smaller ones. If your bank is below the significance thresholds, your direct supervisor is DNB, BaFin or the FMA, working inside a framework the ECB sets.
No dates aheadChecked