European Banking Authority (EBA)

Does the EBA supervise anyone directly?

Yes, in two narrow places. Under MiCA, the EBA takes over supervision of issuers of significant asset-referenced tokens from the home national authority, and supervises significant e-money token issuers jointly with national authorities, chairing a supervisory college for each. Under DORA, the EBA is one of three Lead Overseers of critical ICT third-party providers; the three authorities jointly designated the first list of critical providers on 18 November 2025.

Everything else runs through national competent authorities and, for euro-area banks that meet the SSM significance threshold, the ECB.

The AML handover is the change most often missed: if you are working from EBA AML guidance, it is still valid, but its author has changed and its successor will come from Frankfurt.

What does the EBA publish, and how often?

Consultation papers, final draft technical standards, guidelines, opinions and Q&As appear continuously. The Risk Dashboard is quarterly: the Q1 2026 edition was published in June 2026, with the Q2 2026 edition due 17 September 2026, and an ESG Risk Dashboard runs alongside it (latest 6 August 2026). The Work Programme and Annual Report are annual. Reporting frameworks are released in numbered versions, each with its own application date. The EU-wide stress test is biennial; the next is 2027, with draft methodology and templates already published on 11 June 2026.

Two searchable tools carry most of the practical value: the Single Rulebook Q&A, showing more than two thousand published answers, and the Interactive Single Rulebook, indexing 3,561 documents across thirteen legal acts (both counted on 17 August 2026).

Can the EBA fine anyone?

Not banks. The EBA has no power to fine a credit institution, payment institution or e-money institution. Its instrument against supervisors is the breach of Union law procedure under Article 17 of Regulation 1093/2010: it investigates whether a national authority or the ECB has failed to apply EU law, issues a recommendation, and can escalate to the European Commission. It can also impose binding mediation between national authorities. The one exception is DORA, where as Lead Overseer it can impose periodic penalty payments directly on designated critical ICT third-party providers.

This distinction is practically important when reading EBA output: a guideline is not enforced by the EBA, it is enforced by DNB, BaFin or the FMA, and how strictly can differ between them.

What changes for a mid-sized institution?

Proportionality in EBA output runs through the CRR category of small and non-complex institutions, defined in Article 4(1)(145) of Regulation 575/2013. EBA guidelines routinely scale requirements to that category, and the 2026 reporting-simplification consultation is explicitly aimed at reducing the reporting burden on smaller firms. The 2025 EU-wide stress test covered 64 banks, about three quarters of EU banking assets, which is to say, if you are mid-sized, you are outside the exercise but inside the standards it produces.