Achieving the 2023 core priorities

In 2023, the European Banking Authority (EBA) demonstrated unwavering commitment to its mandate. It executed 95% of the approximately 280 tasks outlined in its 2023 WP. The postponement of or delay in a small number of tasks was largely due to the need to carry out additional tasks not initially envisaged, though this did not compromise legal deadlines. The EBA indeed had to deal with an additional 20% of tasks not included in its agreed WP – whether unforeseen or previously unconfirmed – which added to the complexity of managing priorities and timelines. On the whole, the EBA’s deliverables primarily encompassed reports, technical standards (regulatory technical standards (RTS) and implementing technical standards (ITS)), guidelines, responses to Calls for Advice and peer reviews, thus highlighting the institution’s multifaceted role within the European Union’s regulatory framework.

The following headings and subheadings break down in further detail the EBA’s main tasks and deliverables over the past 12 months. Detailed tables also feature throughout, illustrating how the EBA executed the WP, broken down by product category.

The 2023 Annual Report offers insights into the breadth and depth of the EBA’s activities, highlighting the EBA’s unwavering commitment to its regulatory responsibilities and its vital role in ensuring stability and integrity within the European banking sector.

Figure 1: Achievements in 2023 in numbers

Figure 2: Breakdown of deliverables by category

NB: These deliverables do not include the c 175 tasks that are of an ongoing nature.

Finalising the implementation of Basel III in the EU

The banking package that was agreed on by co-legislators in 2023, i.e. Capital Requirements Regulation (CRR) III and Capital Requirements Directive (CRD) VI, will implement the Basel III framework in the EU.

To provide clarity to the industry on how the Authority will contribute to the implementation of the new legislation, in December 2023 the EBA published a roadmap detailing its approach to, and sequencing of, the work in the different areas in line with the legal deadlines set out by the co-legislators. Alongside the publication of the roadmap, a first batch of Consultation Papers (CPs) was published relating to the reporting/disclosure requirements and to market risk.

In the area of market risk, the EBA published draft RTS on the assessment methodology for the internal models approach to the fundamental review of the trading book (FRTB-IMA), which will provide clarification to supervisors and banks on the details relating to implementing internal models under the FRTB as well as to the report on the impact and relative calibration of the standardised approach for counterparty credit risk (SA-CCR).

Figure 3: Overview of mandates by area

With respect to investment firms, the EBA’s work had two aims in 2023. Firstly, the EBA was focused on finalising the implementation of the technical details of the Investment Firms Regulation (IFR) and Investment Firms Directive (IFD) introduced in 2019. The delivery of the draft RTS on prudential consolidation for investment firm groups thus constituted the final EBA deliverable under the Investment Firms Roadmap. Secondly, on 1 February 2023 the EBA, along with the European Securities and Markets Authority (ESMA), received a Call for Advice (CfA) from the Commission on the implementation review for the IFR/IFD framework, and they then started on the work associated with this CfA. Additionally, on 25 July 2023 the EBA published the guidelines for consultation on the application of the group capital test for investment firms, which are due to be published before the end of Q2 2024.

In the fields of securitisation and covered bonds, the EBA finalised the RTS setting out homogeneity criteria for STS on-balance-sheet (or synthetic) securitisation transactions under the simple, transparent and standardised (STS) framework set out in the Securitisation Regulation, as well as the draft RTS on the exposure value of synthetic excess spread, set out in the CRR respectively.

The Authority continued to give significant attention to benchmarking activities in both credit and market risk models (inclusive of IFRS 9-related considerations) in order to support competent authorities (CAs) with the assessment of internal approaches used for the calculation of own funds requirements and for remuneration practices.

On the liabilities side, the EBA continued to monitor Common Equity Tier 1 (CET1) issuances and to follow developments relating to capital and capital issuances (Additional Tier 1 (AT1), Tier 2 and total loss-absorbing capacity / minimum requirement for own funds and eligible liabilities (TLAC/MREL) instruments in particular). This led to a combined update on TLAC/MREL and AT1 instruments published in July 2023, which evidenced further convergence and standardisation in terms of the drafting of the notes and programmes.

Furthermore, the EBA continued its follow-up work on the implementation of the EBA Opinion on legacy instruments (including in the context of the CRR II grandfathering provisions) and, after providing guidance on one specific issuance of legacy Tier 2 instruments in January 2023, addressed a second case in January 2024. The analysis of interactions among loss absorbency requirements (i.e. capital and TLAC-MREL stacking order, MDA and buffers, and output floors) will continue into 2024.

Given the economic circumstances, the EBA also embarked on work to monitor the impact of the interest rate environment on own funds and eligible liabilities aspects (e.g. on the valuation of non-equity instruments or on accounting-related aspects).

Furthermore, with respect to work regarding interest rate risk in the banking book (IRRBB), the EBA issued an opinion in Q2 2023 on changes that the Commission intended to apply to the draft RTS on supervisory outlier tests of net interest income (NII) as proposed by the Authority.

In the area of liquidity, the EBA continued to review ways in which institutions and CAs have implemented the regulatory provisions, for example as regards notifications, use of national options and discretion, and monitoring of implementation in practice. This led the Authority to publish several (updated) monitoring reports, including the potential impact on liquidity coverage ratio (LCR) and net stable funding ratio (NSFR) levels of the upcoming central bank funding repayment (mainly repayments under the targeted longer-term refinancing operations) as well as of a potential scenario of higher liquidity risks.

In terms of market access, the EBA continued to monitor the regulatory perimeter and authorisation practices as well as reports on the establishment of third-country branches and the intermediate parent undertaking framework, with a view among other things to facilitating cross-border cooperation between CAs supervising subsidiaries and branches of third-country groups. The EBA also started to examine the requirements imposed on various types of market players for access to the EU market, focusing in particular on access to the EU market under MiCAR by issuers of asset-referenced tokens (ARTs).

With regard to the authorisation of credit institutions and qualifying holdings, the EBA concluded the follow-up report on the related peer review, identifying solid improvements in particular with respect to assessment of the financial soundness of proposed acquirers and to suspicions of money laundering / terrorist financing issues.

As concerns supervisory convergence, the EBA performed the yearly European Supervisory Examination Programme and started its preparatory work for the future review of the guidelines on the Supervisory Review and Evaluation Process (SREP), looking at the supervisory measures, including capital add-on and liquidity measures, set by CAs throughout the European Union and launching a peer review devoted to proportionality in the SREP. The EBA also updated the regulatory products governing the functioning of Supervisory Colleges; this update was delivered in late Q4 and included an amendment to improve the sharing of information among authorities in the context of adverse economic events.

In matters of governance and remuneration, the EBA continued to monitor and benchmark diversity and remuneration practices at EU level, with findings published in Q1 in the latest editions of its recurring reports. At the same time it worked on the streamlining and effectiveness of related data collections.

An additional focus will be to assess whether specific parts of the rulebook should be updated, streamlined or simplified. Ease of access to the consolidated rulebook and its user-friendliness are also to be improved.

KPI

See Annex I for details. Source of information: EBA WP monitoring tool and annual report.

Running an enhanced EU-wide stress test

In 2023, the EBA ran its EU-wide stress test to allow supervisors to assess the resilience of EU banks over a three-year horizon under a baseline and an adverse scenario. As in previous years, it built on the experience of and lessons learned by the EBA and its members from the previous exercises carried out since 2011. The sample was enlarged compared to previous exercises from 50 to 70 banks (from 16 EU and EEA countries covering 75% of EU banking sector assets). While the methodology still relied on a constrained bottom-up approach, following a decision taken by the Authority to move to a hybrid framework on a step-by-step basis projections for net fee and commission income (NFCI) were provided to banks based on supervisory top-down models. The 2023 exercise included, for the first time, granular information about the sectoral allocation of banks’ credit losses, in order to better assess the heterogeneous impact of what had become a highly uncertain macroeconomic and geopolitical environment.

Figure 4: 2023 stress test macro financial scenario

The results of the 2023 EU-wide stress test showed that European banks remain resilient under an adverse scenario, which combines a severe EU and global recession, high and persistent inflation, increasing interest rates and higher credit spreads.

Table 2: Summary of key results

KPIs

See Annex I for details. Source of information: EBA WP monitoring tool and annual report.

Putting data at the service of stakeholders

The EBA further rolled out its Data Strategy, aiming to improve the way regulatory data is acquired, compiled, used and disseminated to relevant stakeholders. It strengthened its analytical capabilities, with a focus in 2023 on enabling the Authority to share data and insights with internal stakeholders and the whole data ecosystem. Leveraging its European Centralised Infrastructure for Supervisory Data (EUCLID) platform allowed for data flows between diverse endpoints and provided internal and external stakeholders with access to high-quality, curated data and insights. This further improved risk analysis and facilitated greater dissemination and disclosure of bank data, including those covered by Pillar 3. It enhanced the EBA’s assessment of the impact of regulatory reforms, improved proportionality and boosted the EBA’s ability to analyse the effects on specific business models, while significantly reducing the need for ad hoc data collection. It also facilitated evidence-based policy analysis in the context of EU-wide debates on regulatory and supervisory matters.

One key target was the collection and dissemination of critical data assets, insights and analytics policies, with priority given to the implementation of the Pillar 3 data hub envisaged by the Level 1 legislation which is currently under development. A discussion paper was published in December explaining the processes and the main challenges that might potentially arise and providing an opportunity for stakeholders to provide input and to take part in a pilot to test the system. The hub will ultimately be connected to the European single access point (ESAP).

EUCLID greatly facilitated preparations for the 2023 transparency exercise published in December 2023, together with the 2023 Risk Assessment Report (RAR). As an integral part of the EBA’s ongoing efforts to foster transparency and market discipline in the EU financial market, and complementing banks’ own Pillar 3 disclosures, as laid down in the CRR, the transparency exercise provided over 1.2 million data points, with on average more than 10,000 data points per bank, and was based on the supervisory data submitted to the EBA via EUCLID.

In 2023 the EBA finalised a Data Point Model (DPM) Refit to ensure that the EBA data dictionary is fit for future challenges of reporting and digital processing. A DPM 2.0 standard was published in 2023 and will be implemented during a transitional period of 2024-2025. As part of this effort, the EBA completed the first phase of the migration to the Digital Regulatory Reporting (DRR) tool, DPM Studio, which will support a continuous reporting framework development process, including DPM releases, a full validation rules lifecycle, support for data calculations and creation of eXtensible Business Reporting Language (XBRL) taxonomy packages. Both the DPM Refit and DPM Studio are EBA-EIOPA joint projects.

In the context of its work on reporting and transparency, the EBA continued to map disclosure and reporting frameworks and to consider further proportionality measures in reporting and disclosure in order to achieve a reduction in the reporting burden and in the cost of compliance. These considerations and the Advisory Committee on Proportionality (ACP) recommendations (e.g. introducing simplified reporting for small and non-complex institutions in the new IRRBB reporting and launching a signposting tool for reporting requirements) were also reflected in the different components that the EBA delivered in the course of 2023 in order to complete and update these frameworks, as well as in the work embarked on to address necessary revisions to reporting and disclosure requirements stemming from CRR III and CRD VI.

Work also continued on exploring an integrated reporting framework, thereby contributing to a more consistent and integrated system for collecting statistical, resolution and prudential data with a view to achieving efficiency gains and reducing reporting costs for institutions’ data. The EBA, together with the ECB and national authorities, prepared to establish a Joint Bank Reporting Committee to work together to integrate reporting frameworks and to build a common data dictionary.

The enhancement of the EBA data infrastructure and the improvement of the EU-wide reporting framework leverage input from various stakeholders, in particular from the CAs and the industry, with wide coverage in terms of size and business model. Moreover, the EBA benefits from the latest technological innovations, supporting its work in these areas and helping it to improve its regulatory landscape so as to develop innovative regulatory technology (RegTech) solutions.

DPM 2.0 and the path towards a common data dictionary What is the DPM Standard? The DPM Standard is a key component of the data dictionary used by the EBA and EIOPA to define concepts for the harmonised regulatory data requirements (in the case of the EBA supervisory and resolution reporting) applicable to financial institutions in the EEA. In that sense, the DPM Standard supports experts preparing or using regulatory reporting data by providing a structured representation of the information, identifying all the business concepts and their relations, as well as validation and calculation rules. The EBA and EIOPA have developed the DPM Standard as a public good and as a means to promoting full digital processing of the reporting frameworks. DPM Standard 1.0 has underpinned the reporting frameworks under the remits of both authorities from the beginning and is scalable to further reporting frameworks. Moving from DPM Standard 1.0 to 2.0 In the last decade, the DPM methodology has successfully supported the EBA and EIOPA in integrating their respective regulatory frameworks. After all these years, DPM Standard 1.0 required enhancements in order to remain fit the purpose in terms of responding to changes and reducing costs. DPM Refit is the joint response to the challenge of the increased volume, granularity and complexity of the data, and aims to reap the benefits of closer collaboration and a higher degree of harmonisation. As such, experts from both European supervisory authorities (ESAs) have been working on the DPM Refit project to upgrade DPM Standard 1.0 to DPM Standard 2.0, which provides common data definition standards and tools. What is next? In the longer term, the DPM Standard will play a key role in enabling semantic integration of a single cross-sectoral dictionary for the whole financial sector. As far as the banking sector is concerned, DPM Standard 2.0 should become the single methodology for defining not only the supervisory and resolution reporting already supported by the standard, but also the statistical reporting under the European System of Central Banks statistical integrated reporting framework.

KPIs

See Annex I for details. Source of information: KPI A: launch of the portal for use by EBA users and CAs; KPI B: publication of DPM Standard 2.0 in June and publication of implementation plan in October 2023; KPI C: launch of DPM Studio in late 2023.

Delivering on digital finance and MiCAR/DORA mandates

The Digital Operational Resilience Act (DORA) entered into force on 16 January 2023 and it will apply from 17 January 2025. The Markets in Crypto-Assets Regulation (MiCAR) entered into force on 29 June 2023 with the date of application ranging from 12 months from entry into force (in the case of issuers of asset-referenced tokens (ARTs) and electronic money tokens (EMTs)) to 18 months following entry into force for other types of activity under MiCAR.

Both legal acts are part of an EU Digital Finance Strategy that aims to ensure that the current legal framework does not pose obstacles to the use of new technologies and products and, at the same time, ensures that such new technologies and products fall within the scope of EU financial regulation and operational risk management arrangements of financial entities. The key priority for the EBA in 2023 was the development of the related policy mandates to supplement the new legal acts.

In relation to DORA, the three ESAs are mandated to jointly deliver 13 legal products by January 2025. Following the groundwork and public consultations carried out in 2023, in January 2024 they published a first series of policies in the areas of information and communication technology (ICT) risk management, ICT third-party risk management and incident reporting. This took into account feedback received from a public consultation, the European supervisory authorities’ (ESAs’) stakeholder groups and the ESAs’ Advisory Proportionality Committee. The ESAs also delivered an interim report in relation to the upcoming implementation of a pan-European systemic cyber incident coordination framework (EU-SCICF).

Policy development for DORA continued with the launch of a second public consultation on policy products in December 2023 in the areas of incident reporting, digital operational resilience testing, ICT third-party risk management and oversight over critical ICT third-party providers (TPPs) (four sets of draft RTS, one set of draft ITS and two sets of guidelines). Publication of the final documents is scheduled for 17 July 2024.

In parallel with policy development, the ESAs also started preparing for the upcoming implementation of the pan-European oversight framework of ICT third-party service providers designated as critical (CTPPs). Among other things this includes:

• ongoing and enhanced engagement with relevant stakeholders carried on throughout the year, such as EU and third-country supervisory and oversight authorities as well as EU financial entities and ICT service providers;
• the establishment of a High-Level Group on DORA Oversight  in December 2023 which involves CAs in the design of the oversight framework and the establishment of procedures, methodologies and governance documents;
• data collection on the ICT TPP landscape in the EU – the results of the exercise were published by the ESAs on 27 September 2023;
• the development of necessary IT tools to support the oversight activities as well as the ICT-related incident framework.

In September 2023, the ESAs published technical advice on the criticality criteria for the designation of CTPPs and on the oversight fees as a response to the Commission’s CfA.

Figure 5: Regulatory products and reports under the DORA mandate

For MiCAR, the EBA is responsible for delivering 20 technical standards and guidelines in all but one case within 12 months from entry into force (i.e. by the end of June 2024). Two of the mandates are joint with ESMA, and one is joint with ESMA and EIOPA. Again, substantial preparatory steps were taken to meet this challenge and the EBA launched Consultation Papers on the vast majority of its draft technical standards and guidelines in 2023:

• in July, the EBA issued its first consultation package on EU market access for issuers of ARTs and on complaints handling procedures;
• in October, the EBA issued its second consultation package on the procedure for the approval of white papers of ARTs issued by credit institutions, governance arrangements under the remuneration policy, internal governance arrangements, and on joint EBA-ESMA guidelines on suitability assessments of the management body and holders of qualifying holdings;
• in November and December, the EBA issued its third consultation package on supervisory colleges, reporting of transactions in ARTs and EMTs denominated in a non-EU currency, recovery plans for issuers of ARTs and EMTs, own funds requirements and stress testing of issuers under MiCAR, liquidity requirements and on stress testing of relevant issuers, on the requirements for policies and procedures on conflicts of interest for issuers of ARTs;
• in September 2023, the EBA also responded to the Commission’s CfA on significance criteria for ARTs and EMTs and supervisory fees to be charged to issuers.

As required in connection with the preparatory steps for the supervision tasks assigned to the EBA (with respect to significant ARTs and significant EMTs), the EBA started to develop supervisory models, policies and procedures, as well as templates for the exchange of information between all relevant parties (including issuers, national competent authorities (NCAs), the ECB and other relevant central banks). In addition, an EBA Crypto Supervision Coordination Group was established, which brings together high-level representatives from EEA NCAs, the ECB and ESMA to discuss practical issues regarding the supervision of issuers of ARTs/EMTs and to foster convergence of supervisory practices in view of MiCAR applying to ART/EMT issuers from June 2024.

Finally, in view of the fast-approaching application date, and the finalisation of the associated technical standards and guidelines, the EBA stepped up its actions to encourage the industry and supervisors to sharpen their focus on consistent and timely implementation. In particular, in July 2023 the EBA published a statement with ‘guiding principles’ to which issuers of ARTs and EMTs are encouraged to pay due regard by the application date. The principles are intended to facilitate early alignment with the rules established by MiCAR, for instance as regards the fair treatment of potential acquirers and holders of ARTs and EMTs, and sound governance and effective risk management.

The EBA also continued to monitor financial innovation and to identify areas where a further regulatory or supervisory response may be needed. Crypto-assets, tokenisation, decentralised finance, digital identity management and the application of artificial intelligence / machine learning, as well as digital platforms, supervisory and regulatory technologies (SupTech and RegTech) are examples of innovative applications on which the EBA focused during the year. As Chair of the European Forum for Innovation Facilitators (EFIF) in 2023, the EBA coordinated the delivery of the EFIF WP, including thematic publications on innovation facilitators and BigTechs which also contain related recommendations. In particular, the joint ESAs Report on innovation facilitators published in December 2023 recommends steps to improve the activities of innovation facilitators, such as innovation hubs and regulatory sandboxes, while the report on the 2023 stocktake on BigTech direct financial services provision in the EU, published in early February 2024, recommends steps to enhance the monitoring of these activities.

Finally, the EBA, together with ESMA and EIOPA, guided and steered development of the EU Supervisory Digital Finance Academy (SDFA) training curriculum to ensure it is tailored to the CAs’ needs and contributes to the SDFA’s aim to strengthen supervisory capacity in innovative digital finance.

KPIs

See Annex I for further details. Source of information: KPI A, B: and D: EBA WP monitoring tool and publications, KPI C: DORA /MiCAR milestones tracker, KPI E: internal ESA report to DG Reform.

Enhancing capacity to fight money laundering and terrorist financing in the EU

In 2023, the EBA continued to lead, coordinate and monitor the EU financial sector’s fight against money laundering/terrorist financing (ML/TF) in line with its legal mandate, by setting common standards, fostering cooperation and supporting the implementation of robust approaches to tackling financial crime risks across the EU.

The EBA built on its comprehensive regulatory framework to address emerging risks by issuing new guidelines, updating existing guidelines and contributing to a holistic approach to anti-money laundering and countering the financing of terrorism (AML/CFT) to ensure that ML/TF risks are considered across all areas of supervision. In 2023, tackling unwarranted de-risking, ensuring compliance with restrictive measures and building robust approaches to AML/CFT for crypto-asset service providers (CASPs) and their CAs were particular areas of focus.

Tackling ML/TF risk can have unintended consequences. For example, it can make access to financial services difficult for vulnerable customers who are unable to provide standard forms of identification. This is why, in March 2023, the EBA published two guidelines on how institutions can manage ML/TF risk effectively, rather than de-risk, in situations where access by customers to financial products and services should be safeguarded. These guidelines build on the EBA’s 2022 Opinion on de-risking, the EBA’s 2016 Opinion on the application of customer due diligence measures to customers who are asylum seekers from higher-risk third countries or territories and on the statement the EBA issued in April 2022 in the context of the war in Ukraine. The EBA also published a factsheet, together with the Commission, to help not-for-profit organisations understand what information they might have to provide to open an account or to carry out a specific transaction.

The war in Ukraine highlighted the challenges associated with divergent approaches to complying with EU restrictive measures. The EBA found that significant differences exist in relation to the quality of institutions’ systems and controls to comply with restrictive measures and supervisors’ expectations of those systems and controls. Together, these differences undermine the effectiveness of the EU’s restrictive measures or regimes and affect the stability and integrity of the EU’s financial system. To address this, the EBA used provisions in Regulation (EU) 2023/1113, the CRD and the PSD to propose two new guidelines. One set of draft guidelines sets common, regulatory expectations regarding the role of senior management, internal governance arrangements and risk management systems in the restrictive measures context. A second set of draft guidelines sets out what payment service providers (PSPs) and CASPs should do to be able to comply with restrictive measures when performing transfers of funds and crypto-assets and focus on know-your-customer, screening and due diligence measures.

Throughout 2023, the EBA supported the development of common approaches to tackling ML/TF risks associated with CASPs and other entities under the MiCAR framework. This included guidance on the AML/CFT supervision of CASPs; guidance to CASPs and financial institutions that service CASP customers on assessing ML/TF risks and putting in place commensurate and risk-sensitive measures to manage those risks; and setting common expectations on managing ML/TF risks at market entry and throughout a MiCAR institution’s life cycle. The EBA also consulted on revisions to its Transfer of Funds (‘Travel Rule’) Guidelines, which it amended and extended to apply to transfers of crypto-assets going forward. The public consultation on these guidelines closed in February 2024.

The EBA continued to foster supervisory cooperation by supporting information exchange and by continuing to develop the AML/CFT colleges framework.

By December 2023, more than 260 AML/CFT colleges had been set up. The EBA staff actively monitored 18 of these colleges and supported their effective functioning through contributions, feedback and the negotiation of draft terms of participation with key third-country observers. A report summarising the EBA’s observations was published in August 2023 and found that CAs had taken important steps to improve the functioning of AML/CFT colleges, although many colleges had not reached full maturity. The report further identified good practices that will be useful for CAs to improve the effectiveness of AML/CFT colleges and consequently, of supervisory outcomes. In December 2023, the EBA staff launched the latest round of thematic college monitoring, focusing on neobanks and payment or electronic money institutions with a similar business model.

In addition to its college work, the EBA brought together CAs to share information and establish cooperation gateways in situations where cross-border ML/TF risks had crystallised but no AML/CFT college existed. This was the case, for example, in relation to a number of CASPs.

Throughout 2023, the EBA continued to support the implementation of robust approaches to tackling financial crime risks across the EU by identifying and disseminating information on ML/TF risks, by monitoring the implementation of its standards by CAs and issuing recommendations for improvements as necessary, and by contributing to the effective design of the EU’s new legal and institutional AML/CFT framework.

In July 2023, the EBA published the fourth Opinion on the risks of money laundering and terrorist financing affecting the European Union’s financial sector. The EBA issued this opinion against the background of a changed risk landscape, which had impacted institutions’ AML/CFT compliance efforts and CAs’ approaches to AML/CFT supervision. The war in Ukraine and the growth in CASP activity stood out in particular. For the first time, the EBA used data from its new central database on anti-money laundering and countering the financing of terrorism (EuReCA) to inform its analysis.

Data from EuReCA also informed the EBA’s analysis of ML/TF risks associated with payment institutions. The EBA found that these risks were not assessed or managed effectively in all cases and that AML/CFT internal controls in payment institutions were often insufficient to mitigate inherent ML/TF risks, which were often high. The EBA’s findings also suggest that not all CAs were doing enough to supervise the sector effectively. To address this, the EBA hosted discussions and roundtables with industry representatives and supervisors to identify a way forward, and provided technical advice to the Commission and co-legislators to inform the nascent payment services framework.

EuReCA   EuReCA is the EBA’s AML/CFT database on serious AML/CFT deficiencies in individual financial institutions in the EU, which was launched in 2022. Between January and December 2023, the majority of reports related to credit institutions, followed by payment institutions. CAs found the largest number of deficiencies in respect of institutions’ Customer Due Diligence measures. Figure 6: areas where material weaknesses occur Figure 7: Key EuReCA numbers The EBA has used EuReCA data to support different AML/CFT work streams, namely the AML/CFT implementation reviews and the monitoring of AML/CFT colleges, to inform different AML/CFT deliverables, including the Opinion on ML/TF risks affecting the EU financial sector and the EBA Report on ML/TF risks associated with payment institutions, and to feed into the EBA's periodical Risk Dashboard and the EBA's Risk Assessment Report. The EBA staff have also shared information from EuReCA with other CAs, either at their request or at the EBA’s initiative; with ESMA and EIOPA, on a monthly basis, where information concerns entities under their scope; and with the lead supervisor of an AML/CFT college, where information concerns entities within the group. Figure 8: top 5 sectors where material weaknesses are identified Figure 9: top 5 types of measures

The EBA continued its staff-led, in-depth assessments of CAs’ approaches to AML/CFT supervision. It published a report on aggregate findings and a summary of recommendations issued during its third round of reviews in July 2023, and concluded that supervisors were making progress in the fight against money laundering and terrorist financing, but most needed to do more to ensure that their approach was effective and enabled them to tackle ML/TF risks in their sector. The EBA launched its fourth, and final, round of reviews in 2023. Over the course of that year, staff assessed and provided comprehensive feedback to 11 CAs from 5 Member States. By the end of 2024, all CAs that are responsible for tackling ML/TF risk in the EU’s banking sector will have been assessed.

Finally, throughout 2023, the EBA contributed to shaping the new AML/CFT framework. As part of this, the EBA provided technical advice to the Commission and the co-legislators as necessary. It also worked to prepare a smooth hand-over of those aspects of its work that relate exclusively to AML/CFT compliance and supervision to the Anti-Money Laundering Authority (AMLA) that has been set up.

KPIs

See Annex I for further details. Source of information: KPI C, D and E: EBA WP monitoring tool and publications, KPI F: internal project plan.

Implementing the ESG roadmap

As a horizontal priority, the EBA paid particular attention to aspects relating to environmental, social and governance (ESG) matters being reflected in its work in accordance with the roadmap on sustainable finance published in December 2022.

Figure 10: The roadmap explains the EBA’s sequenced and comprehensive approach over the next three years to integrating ESG risk considerations into the banking framework and supporting the EU’s efforts to achieve the transition to a more sustainable economy.

In 2023, the Authority continued to deliver on mandates included in the CRD, CRR, IFD, IFR, EBA Founding Regulation and those stemming from the Commission’s action plan and Communication Strategy for Financing the Transition to a Sustainable Economy, and pursued its contributions to European and international work (particularly via the Platform on Sustainable Finance, Basel Committee, Network for Greening the Financial System, European Systemic Risk Board (ESRB)).

In line with the EBA’s ESG roadmap, the Authority continued the investigation and potential review of the current framework for the prudential treatment of exposures to capture environmental and social risks. The EBA follows a sequenced approach, in accordance with its legal mandates. To mark the completion of the first phase of this work the EBA published a report in October 2023 on the role of environmental and social risks in the prudential framework for credit institutions and investment firms. Taking a risk-based approach, the report assesses how the current prudential framework captures environmental and social risks and puts forward targeted enhancements to accelerate the integration of environmental and social risks across Pillar 1. The proposed enhancements aim to support the transition towards a more sustainable economy, while contributing to the stability, resilience and orderly functioning of the financial system.

In the report the EBA also puts forward recommendations for short-term actions to be taken over a three-year horizon as part of the implementation of the revised Capital Requirements Regulation and Capital Requirements Directive (CRR III / CRD VI). Taking a medium-to-long-term perspective, the report also presents possible revisions to the Pillar 1 framework – subject to monitoring and further assessment – reflecting the growing importance of environmental and social risks. Alongside other policy initiatives outside the prudential framework, the EBA continues to consolidate the integration of environmental and social risks across all pillars of the regulatory framework.

With regard to Pillar 2 requirements, the EBA continued its efforts to incorporate ESG considerations into risk management and supervisory guidance in a proportionate and gradual manner.

In January 2024 the EBA published a Consultation Paper on draft guidelines on the management of ESG risks with due consideration of the ACP recommendations. The draft guidelines, which are expected to be finalised in the course of 2024, set out requirements for institutions for the identification, measurement, management and monitoring of ESG risks, including through plans aimed at addressing the risks arising from the transition towards a climate-neutral EU economy.

In terms of disclosures and transparency, the ESAs also embarked on work to review principal adverse impact (PAI) indicators and financial disclosures in the Sustainable Finance Disclosure Regulation (SFDR), in response to a request from the Commission. Overall, the draft RTS proposes the extension of the list of social indicators for principal adverse impacts, refinement of the content of several of the other indicators for adverse impacts and their respective definitions, applicable methodologies, metrics and presentation, and amendments regarding decarbonisation targets. Further proposed changes, based on stakeholder Q&As and observations, cover the Do No Significant Harm disclosure design options and the simplification of the templates, among other technical changes.

Further assistance to the Commission in its next comprehensive assessment of the SFDR was provided in the ESAs’ second annual report, published in September 2023, on the extent of voluntary disclosure of principal adverse impacts under the Article 18 of the SFDR. In a similar way to the previous publication in 2022, the report presented the findings from a survey of NCAs in order to assess the state of entity-level and product-level voluntary PAI disclosures under the SFDR. The report also includes a preliminary, indicative and non-exhaustive overview of good practice and of areas offering room for improvement.

Also in the context of disclosures, the set of draft RTS were published by the ESAs in May 2023 on the ESG impact disclosure for simple, transparent and standardised (STS) securitisations under the Securitisation Regulation, which aims to help market participants make informed decisions about the sustainability impact of their investments on sustainability disclosures on STS securitisation.

As a further contribution to the EU’s wider objectives in sustainable finance, the EBA, ESMA and EIOPA published separate progress reports in June 2023 on greenwashing in their respective remits in the financial sector. In these reports, the ESAs put forward a common high-level understanding of the greenwashing applicable to market participants across their respective remits – financial markets, banking, and insurance and pensions.

The EBA progress report, more specifically, provides an overview of the greenwashing phenomenon in the banking sector and its impact on credit institutions, investment firms and payment service providers. The outcome of the quantitative analysis of the greenwashing phenomenon shows a clear increase in the total number of potential cases of greenwashing across all sectors, including for EU banks. It also indicates rising climate accountability: increased public attention directed towards climate change has led companies to be held more accountable for their environmental policies, climate impact and disclosures.

These progress reports came as an initial response to the Commission’s request for input on the topic.

The final reports are expected to be delivered in May 2024 and will put forward recommendations, possibly along with suggestions for changes to the EU regulatory framework.

As another piece contributing to the ESG roadmap, the EBA responded to the Commission’s CfA on green loans and mortgages. The report (and opinion) published in December 2023 advises the Commission to consider introducing a voluntary EU label for green loans based on a common EU definition, as well as the integration of the concept of green mortgages and their key sustainability features into the Mortgage Credit Directive (MCD). The EBA’s response includes an overview of green lending and associated practices in the EU banking sector, and outlines issues identified in the green loans market.

Furthermore, the EBA devoted substantial resources in 2023 to preparing for the one-off Fit-for-55 climate risk scenario analysis, to be conducted jointly by the ESAs, the ECB and the ESRB in accordance with the Commission request of 8 March 2023 and in line with the Commission Communication Strategy for Financing the Transition to a Sustainable Economy. The scenario analysis aims to assess the resilience of the financial sector in line with the Fit-for-55 package, and to gain insights into the capacity of the financial system to support the transition to a lower-carbon economy under conditions of stress.

One milestone to note here, after a public consultation in July 2023 on draft templates, is the launch of a data collection exercise (at the beginning of December) for gathering climate-related data from EU banks for the Fit-for-55 exercise. The data collection exercise seeks to gather climate-related and financial information on credit risk, market risk and real estate risks, at aggregated and counterparty level, as of December 2022. While aggregated data will provide information on the climate-related risks of the banking sector more broadly, counterparty-level data will enable the assessment of concentration risk for large climate exposures, capturing amplification mechanisms and assessing second-round effects.

The EBA is also considering developing a regular climate stress testing framework, with a focus at first on the development of methodologies, data and scenarios. A dedicated subgroup will work on this task.

Similarly, work on a framework to allow for effective monitoring of ESG risks in the banking sector and the green financial market is envisaged, but this had to be deprioritised owing to resource constraints. Ideally, such a framework could benefit from a gradual increase in external ESG risk-relevant data, with a focus on climate change-related risks.

KPIs

See Annex I for further details. Source of information: KPI A and KPI B: EBA WP monitoring tool and publications.

NB: KPI B was adopted after the finalisation of the 2023 Work programme.

Additional achievements in 2023

Risk assessment

Along with the stress tests, the EBA has a responsibility to identify and analyse trends, potential risks and vulnerabilities in the banking sector. This not only helps ensure the orderly functioning and integrity of financial markets, but also contributes to the stability of the financial system in the EU.

Following on from 2022, the EBA continued to pay particular attention to risks stemming from the Russian invasion of Ukraine and the crisis in the Middle East, the jitters in the financial markets in early 2023, mainly in the US banking sector and in Switzerland, high inflation, lacklustre economic growth and increasing interest rates, all of which posed challenges not only for the banking sector, but also for households and corporates. The deterioration in the macroeconomic outlook gave rise to uncertainty, requiring the EBA, in conjunction with CAs and other EU institutions, to adjust its focus for 2023. The Authority addressed topics such as unrealised losses on EU/EEA banks’ bond portfolios held at amortised cost, the impact of rising rates on EU/EEA banks and leveraging banks’ IRRBB data.

Findings from the above and many other findings were reflected accordingly in various deliverables such as the quarterly risk dashboard and the Joint Committee (JC) spring and autumn risk reports. In December 2023, the EBA published the results of the 2023 EU-wide transparency exercise and its annual RAR.

In June 2023 the EBA published a report assessing the potential impact on LCR and NSFR levels of the upcoming central bank funding repayment, as well as a potential scenario of higher liquidity risk, particularly affecting government bonds, derivatives and repo markets in the context of a higher interest rate environment, inflation and recession risks. The EBA also continued monitoring banks’ asset encumbrance and funding plans situation and published two thematic reports in July. The Asset Encumbrance Report highlighted further limited use of central bank funding in 2022 and an overall lower encumbrance ratio (decreased by 3.3 percentage points to 25.8% in December 2022). The Funding Plans Report showed that banks plan to issue more debt instruments to counterbalance an expected further decline in central bank funding.

In January 2024 the EBA published its heat map following scrutiny of the IRRBB. It contains specific short, medium and long-term targets for the EBA in terms of monitoring the impact on institutions from increases in interest rates and developments regarding institutions’ ability to manage the risks.

Recovery and resolution

The EBA continued to work on strengthening the effectiveness of the framework by further developing two guidelines: one aiming to ensure that a minimum level of harmonised information is made public by authorities with regard to the mechanics underpinning the execution of the bail-in tool, a second on resolvability testing, amending the existing resolvability guidelines, aiming at a framework which, appropriately embedding proportionality, is able to ensure that resolvability capabilities are fit for purpose and effectively maintained by institutions and resolution authorities.

In early July 2023 the EBA also published the final guidelines on overall recovery capacity (ORC), aimed at establishing a consistent framework for the determination of the ORC by institutions in their recovery plans and the respective assessment by CAs. The main objective here was to harmonise, with appropriate consideration of proportionality aspects, the observed practices for ORC determination and assessment, to improve the usability of recovery plans and to make crisis preparedness more effective.

In the context of crisis preparedness, the EBA monitored evolving practices in relation to recovery planning, focusing in particular on improving the usability and the operationalisation of plans, which was included as a key priority in the European Supervisory Programme for the year 2024 with an enhanced focus on liquidity recovery options in order to cater for the macroeconomic trends that materialised in 2023.

On the topic of resolution, the EBA continued to monitor convergence in the implementation of identified issues within the resolution framework through the European Resolution Examination Programme (EREP) exercise. Monitoring the build-up of MREL resources in the European banking sector continued following the latest report published in early 2023, and it covered with increased frequency the relevant trends in the context of the quarterly MREL dashboard.

Payment services

In the course of 2023, the EBA continued to help make retail payments across the EU efficient, secure and easy to use, by contributing to the common interpretation, application and supervision of relevant EU directives and EBA technical standards and guidelines.

The peer review published in early 2023 of the authorisation of payment institutions and e-money institutions under the revised Payment Services Directive (PSD2) was a key deliverable in that respect. Following 10 months of analysis, the review concluded that there is increased transparency and consistency of the information required in the authorisation process as a result of the directive and the guidelines that the EBA issued in support. However, the review also identified significant divergences in CAs’ assessment and the degree of scrutiny applied to the applications received. The review report therefore set out a series of measures addressed to CAs, to address such divergences, to level out the supervisory playing field, and to mitigate against ‘forum shopping’.

Following the delivery of the EBA’s response in June 2022 to the Commission’s CfA regarding the review of PSD2, the EBA did not publish any additional legal instruments under PSD2, but instead continued to support the Commission in the run-up to the publication in June 2023 of its proposals for a revised Payment Services Directive (PSD3), a new Payment Services Regulation, and a new Regulation on Open Finance (Financial Data Access (FIDA)). The proposals envisage around 35 mandates to be conferred on the EBA for estimated delivery between 2025 and 2027.

As a follow-up to a discussion paper that the EBA published in February 2022, the EBA also continued to assess payment fraud data that more than 6,000 payment service providers initially submitted to their NCAs in compliance with Article 96(6) of PSD2 and the supporting EBA guidelines (EBA/GL/2018/05), which then submitted aggregations of the data to the EBA. Analysis of such data is key to understanding the extent to which the security requirements the EBA developed in previous years, in particular strong customer authentication (SCA), have achieved the envisaged aim of reducing payment fraud. However, the EBA is of the view that the quality of the data remains insufficient for publication and instead established measures to enhance the quality so as to publish an improved set of data in mid-2024.

Consumer and depositor protection

During 2023, the EBA continued its efforts to enhance the supervision of financial institutions’ retail conduct across its regulatory and supervisory remit and to apply its depositor protection expertise to topical questions raised by the Commission and legislators.

With regard to the former, the Authority fulfilled for the first time the new ESA mandate to coordinate mystery shopping activities of NCAs; the findings were published in August 2023. The exercise, which focused on personal loans and payment accounts, confirmed that mystery shopping is a tool that adds value to the supervision of financial institutions by NCAs. It is complementary to other more conventional tools or approaches, and delivers first-hand information about, and insights into, the conduct of financial institutions towards consumers.

To allow for a robust identification of causes of potential harm to consumers, the EBA also developed for the first time a set of ‘retail risk indicators’, which were published in March 2023. The indicators cover a wide variety of different types of products within the EBA’s remit (e.g. mortgage credit, consumer credit, deposits, payment accounts and payment services). They aim to show possible risks to consumers arising from the misconduct of financial institutions offering retail banking products in the EU, and from wider economic conditions, and will complement other sources of information that the EBA already uses to decide on its consumer protection priorities.

As part of the Authority’s role in promoting transparency, simplicity and fairness in the market for consumer financial products or services across the internal market, the EBA also coordinates financial literacy and education initiatives undertaken by national authorities. To that end, the EBA, in conjunction with the other ESAs, published factsheets on inflation and the rise in interest rates (published in May 2023) and on financial education and sustainable finance (published in November 2023). The factsheets were developed in easy-to-understand language, translated into all official EU languages, and reproduced by national authorities on their respective websites.

In April 2023, the Authority also published the eighth edition of its biennial Consumer Trends Report (CTR), in which it summarised trends observed for the products and services under the EBA’s consumer protection mandate and identified two issues that consumers are currently facing and that will shape the EBA’s consumer protection priorities over the subsequent two years: fraud in retail payments, and over-indebtedness and arrears.

As regards the development of regulatory mandates and products, two public consultations in the context of the Credit Servicers Directive (CSD) are noteworthy.

• In July 2023, draft guidelines on the establishment and maintenance of national lists or registers of credit servicers, specifying the types of information that the national lists or registers have to include, in order to enhance transparency for credit purchasers and borrowers and to bring about a level playing field across the Union.
• Also in July 2023, draft RTS on complaints handling procedures for issuers of ARTs under the MiCAR, which the EBA developed in close cooperation with ESMA.
• In November 2023, draft guidelines on complaints handling by credit servicers, which extend to credit servicers the same requirements under the existing Joint Committee guidelines on complaints handling that applied for nearly a decade to tens of thousands of financial institutions in the banking, investment and insurance sectors. The requirements pertain to firms’ complaints management policy, their complaints management function, registration, reporting, internal follow-up and the provision of information, and procedures for responding to complaints.
• Finally, in response to the European Commission’s proposed amendments to the draft Technical Standards on crowdfunding service providers, the EBA issued an Opinion noting the importance of ensuring that crowdfunding service providers can access historical data to improve the assessment of creditworthiness and the performance of their scoring models.

Within the remit of ensuring the consistency and effectiveness of supervisory actions and outcomes, in 2023 the EBA undertook its first peer review on conduct and consumer protection issues, and more specifically on the supervision of creditors’ treatment of mortgage borrowers in arrears under the MCD. The peer review report was developed against the economic conditions and high interest rate environment at the time, published in December 2023, and found that CAs’ supervision is effective overall and has been adapted to reflect said interest rate environment.

However, the review also found differences in the level of scrutiny that CAs apply to mortgage creditors, including the identification of risks that borrowers are facing. The report sets out some follow-up measures, both for individual and named CAs and for CAs more generally, to ensure that supervisory measures to mitigate consumer detriment are taken before the detriment materialises. The report also sets out some examples of best practice in this area that will be of benefit for other CAs to adopt.

As part of its responsibilities in the field of depositor protection, the EBA continued to contribute to the enhancement of the rulebook, among other things, by way of the February 2023 revision of its guidelines on methods for calculating contributions to deposit guarantee schemes (DGSs). The revised guidelines further strengthen the link between the riskiness of a credit institution and how much it needs to contribute to the DGS funds that will be used to reimburse depositors in the event that their bank fails.

Furthermore, in order to contribute to the review of the existing DGSD in response to a CfA from the Commission, in December 2023 the EBA published a report on the deposit coverage level and coverage of public authorities’ deposits. Based on a quantitative analysis and simulation, the report concludes that a potential change to the current coverage level of EUR 100,000 would have a positive but limited impact on financial stability and depositor protection, while being costly and having a somewhat negative impact on moral hazard. The analysis also revealed that the extension of coverage to public authorities’ deposits would have a limited impact on the industry, mainly because there are relatively few public authorities in comparison to the overall number of depositors across the EU.

Acting as a hub for DGS data collection and analysis, the EBA regularly publishes data on DGS across the EEA, and in April 2023 it provided its most recent update. The data covered two key concepts and indicators, namely available financial means and covered deposits, and indicated that, in the period from 2021 to 2022:

• the number of deposits protected by EU DGS increased by 2.5%, while the amount of funds available to protect those deposits in the event of bank failures increased by 7.4%;
• DGS are gradually increasing their available funds raised from the industry with the aim of reaching the harmonised minimum target level of 0.8% of deposits covered by the DGS by July 2024;
• half of the 36 DGS in the EEA have already reached the minimum target level ahead of the deadline.

Equivalence

In the context of its work on third-country equivalence, the EBA is assessing the regulatory and supervisory frameworks of third countries and their equivalence with the EU framework by providing opinions to the Commission.

In line with a roadmap on equivalence work developed in 2022, the EBA established a Network on Equivalence that supports the assessments of individual third countries and furthermore assists in the overhaul of the EBA’s monitoring methodology.

At the same time, the Authority, in conjunction with the Commission, monitored the ongoing equivalence of countries covered by the Commission’s decisions and reported back to the EU institutions.

Supervisory convergence and independence

Mediation between the Spanish and the Belgian deposit guarantee schemes

The EBA was requested to settle a disagreement between two DGS about the contributions to be transferred between the DGS following the cross-border merger of a credit institution. Following a conciliation process which did not lead to the parties agreeing on a solution, the EBA adopted a decision specifying the contributions to be transferred between the DGS and requiring them to review their internal systems in order to explore potential enhancements to their risk management and communication processes in order to reduce the scope for similar future disagreements.

Joint ESAs criteria on the independence of CAs

Since 2020, the EBA has had the task of fostering and monitoring supervisory independence and has reported on the independence of prudential, conduct and AML/CFT supervisors, resolution authorities and deposit guarantee scheme designated authorities.

On 25 October 2023, the joint ESAs criteria on the independence of CAs (the Joint Criteria) were published on the three ESAs’ websites.

As different criteria have been adopted at the international level for each sector while the substance of the underlying principles is largely consistent, the aim of the Joint Criteria is to establish a single set of independence criteria for all CAs under the ESAs’ remit.

The Joint Criteria will be used by the ESAs for future common assessment work, as well as providing a useful European reference point that can be used as a tool by CAs, including in their interactions with legislators, to support and enhance their independence.

The Joint Criteria are non-binding, principle-based and outcome based, and organised around four areas of CAs’ governance: operational independence, financial independence, personal independence, and accountability and transparency.

Peer reviews

The EBA has made some changes to how it carries out peer reviews, undertaking more peer reviews – three peer reviews were launched in 2023 plus our first follow-up peer review following the 2020 ESAs review. In addition, the EBA peer review work plan for 2023 to 2024 was designed to support the EBA’s priorities and address current risks (e.g. a 2023 peer review looking at the treatment of mortgage borrowers in arrears, reflecting potential consumer detriment arising from the changing interest risk environment). In 2023, the following peer review reports were published:

• peer review report on authorisation under PSD2;
• peer review report on excluding transactions with non-financial counterparties established in a third country from credit valuation adjustment (CVA) risk;
• peer review report on supervision of creditors’ treatment of mortgage borrowers in arrears under the MCD.
  1. Engaging with stakeholders

The first follow-up peer review, on the joint ESAs guidelines on the prudential assessment of qualifying holdings, was started in spring 2023 and was published in early 2024. Work began in 2023 on the peer reviews on the definition of default and the application of proportionality under the SREP. Both are targeted peer reviews, and it is anticipated that the self-assessment questionnaires will be published in the summer of 2024. In addition, work is commencing on the tax integrity and dividend arbitrage trading schemes (Cum-Ex) peer review.

Engaging with stakeholders 

The EBA continued to liaise closely with all relevant EU institutions and bodies, such as the Council of the EU, the European Parliament, the other ESAs and other EU institutions. In its mission, the EBA is accountable to the European Parliament, the Council and the Commission. In addition, we maintain an open institutional and proactive dialogue with our European partners. This dialogue remains a key pillar in the development of our products and in fostering awareness on current and future regulatory and supervisory challenges. In addition, the EBA maintains strong links with the supervisory community internationally. Through its active role at the Basel Committee on Banking Supervision (BCBS), the EBA contributes to discussions on global financial stability and international financial regulatory reforms, if and as appropriate.

The EBA’s participation in European and international forums ensures close and continuous collaboration with its counterparts around the world. It benefits from expertise and input from these stakeholders, while also sharing its knowledge with them.

To ensure proactive and effective engagement with all its stakeholders, the EBA made use of all its channels and tools, including seminars, workshops, public hearings, bilateral meetings and similar methods (most of them in hybrid format). In addition, the EBA engaged with industry, consumer associations, academics and students through speaking engagements and visits.

In addition, the EBA also continued answering stakeholders’ questions about the single rulebook submitted via the Q&A tool. In 2023, 287 were submitted and 190 were answered.

Figure 12: Stakeholder engagement in figures

Mapping deliverables by activity against the WP

This mapping of deliverables is based on the tables (Section 2) on the EBA 2023 WP with the main outputs for each activity, and compares planned against actual outcomes.

Policy and convergence

+ Tasks marked with a + were possible candidates to be postponed, cancelled or undertaken with less intensive resource input.

* When updating the AT1 report, the EBA incorporated the TLAC-MREL monitoring report for simplicity in one publication. For CET1 issues no update was deemed necessary in 2023.

** Guidelines and report were postponed given the impact of the revised CRR (CRR III) and the aim now is to cover them as part of phase 2 of the EBA roadmap.

*** Update of the RTS was not deemed necessary at this stage.

+ Tasks marked with a + were possible candidates to be postponed, cancelled or undertaken with less intensive resource input.

* It was not deemed necessary to proceed with a report on the cases of interdependent inflows and outflows in the LCR.

+ Tasks marked with a + were possible candidates to be postponed, cancelled or undertaken with less intensive resource input.

* The ITS update was delivered in Q2 2023 (and in the WP should have referred to 2024 portfolios).

** Later delivery due to challenging legal deadline and resource constraints. The EBA requested delay to March 2023 (by letter to Commission of 2 February 2022) but then was able to close this in Q1.

*** Work not subject to legal deadline. Original planned delivery target had to be updated from Q2 to Q4.

**** Work not subject to legal deadline and had to be deprioritised.

*****There are limited market issuances, which does not allow for a sufficient sample of transactions to have a meaningful report.

* The ITS update was delivered in Q2 2023 (and in the WP should have referred to 2024 portfolios).

** Work not subject to legal deadline. Original planned delivery target had to be updated from Q2 to Q4.

*** Product was postponed due to no-action letter published by EBA on the FRTB boundary framework. The mandate has consequently been postponed as past of the CRR 3 legislative process.

+ Tasks marked with a + were possible candidates to be postponed, cancelled or undertaken with less intensive resource input.

* Work not subject to legal deadline. Original planned delivery target had to be updated from Q2 to Q4.

** Work not subject to legal deadline. Timeline had to be reviewed to give priority to other work. Original planned delivery target had to be updated from Q2 to Q4.

*** Timeline had to be reconsidered with the Commission, due to the fact that data availability did not allow the original delivery target to be met.

**** Timeline had to be reviewed due to reprioritisation and data quality issues.

***** Timeline had to be reviewed to group the release of IFD and CRD reports, while giving priority to other work.

* Decision to deliver handbook instead of initially envisaged RTS. Deadline had to be reconsidered in view of the new scope of the work.

** Timeline had to be reviewed owing to expanded scope of work coupled with resource constraints.

* Joint ESAs work with ESMA in the lead. Timeline had to be reviewed to Q1 2023 (from Q3 2022) due to discussions (including with the Commission) on concerns around the scope of the mandate.

** Timeline had to be reviewed given later-than-anticipated finalisation of CRD VI, but the work is being carried out in advance of the proposed legal deadline. CP was published in January 2024.

* Output related to ongoing activities around EFIF and thematic publications related to financial innovation.

* Target quarters in the WP 2023 were for CPs, which were delivered on or ahead of time. In most cases it was also possible to publish final deliverables in early Q1 2024.

* Delivery of work from mandates was revised compared to original planned delivery target to reflect later finalisation of MiCAR.

** Work not subject to legal deadline. Original planned delivery target was revised and CP published in Q1 2024.

*** Joint ESAs work. Timeline given in WP 2023 was indicative (as MiCAR had not yet been finalised) and had to be reviewed and agreed between the ESAs. CP expected to be published in Q2 2024.

+ Tasks marked with a + were possible candidates to be postponed, cancelled or undertaken with less intensive resource input.

+ Tasks marked with a + were possible candidates to be postponed, cancelled or undertaken with less intensive resource input.

* Q4 target for delivery was indicative and revised after later-than-planned finalisation of the source regulation.

Risk assessment and data

+ Tasks marked with a + were possible candidates to be postponed, cancelled or undertaken with less intensive resource input.

* Timeline had to be updated from Q1 to Q4 due to resource constraints. Final draft RTS was delivered in early January 2024.

** Timeline had to be updated from Q2 to 2024 due to resource constraints. Draft CP was delivered in early Q2 2023.

* Even though the JC spring risk report was published in early Q2 2023, it had been submitted to the EFC-FST by the end of Q1.

** Delivery targets indicated in WP should have corresponded to actual delivery.

Coordination and support

* When updating the EBA’s peer review work plan it was decided not to carry out this peer review – which had until then been subject to confirmation. [TO BE CHECKED]

Setting key priorities for 2024

In a spirit of continuity the EBA has only slightly adjusted the strategic priorities for its WP for 2024:

Finalising the implementation of Basel III in the EU and enhancing the Single Rulebook

The EBA will prioritise its contribution to the timely and faithful implementation of the outstanding Basel III reforms in the EU to ensure banks can withstand future crises and to safeguard the proper functioning of the European and global financial systems. This reform will strengthen the regulatory framework by introducing more risk-sensitive approaches for determining capital requirements and also address shortcomings in the existing framework, including through an ‘output floor’ which will serve as a backstop for the use of internal models. At the same time, this will contribute to completing the Single Rulebook in banking.

The negotiations on the CRR III / CRD VI package were completed in 2023, and the revised framework includes just over 140 mandates for the EBA to develop regulatory standards and guidelines, many of which will be prepared in 2024, either in the form of CPs or possibly even as final (draft) deliverables. Following the finalisation of the negotiations and ahead of the formal adoption of the final legislative framework, the EBA’s Roadmap – the full list of mandates can be found in Annex III – sets out the sequencing of the mandates in line with the deadlines set out by the co-legislators and explains the EBA’s approach to the mandates as per major areas.

In the context of the CRR/CRD package the EBA will take into consideration the recommendation of the ACP so as to ensure that the regulatory products and guidance it delivers are drafted in a way that is consistent with and uphold the principle of proportionality, and reduce compliance costs without jeopardising the prudential objectives. The ACP is of the view that the development of RTS, ITS, guidelines and Q&As could reflect proportionality by (i) setting different scopes; (ii) aiming for less complex regulation; (iii) using simple language; and (iv) bearing in mind the impact of implementation for small and medium-sized banks. In particular the ACP recommended that the EBA further addresses proportionality in the credit risk framework given its relevance for banks’ balance sheets regardless of size, range of activity and level of complexity.

The Commission’s renewed Sustainable Finance Strategy, announced in July 2021 as part of the European Green Deal, and the banking package confer a number of regulatory ESG-related mandates on the EBA: ESG risk management and supervision, prudential treatment of exposures, disclosures, supervisory reporting, stress testing, standards and labels, including sustainable bonds, loans and securitisations, as well as development of a framework for systemic monitoring of ESG risks. For 2024 the work on prudential treatment of exposures and ESG risk management will remain the main focal points.

As noted, the EBA is expected to collaborate with the Commission on reports on the performance of the covered bond framework, which are mandated in Article 31 of the Covered Bonds Directive to be submitted by 2024/2025. Also in that context, the EBA will deliver its responses on two Calls for Advice: one to support the revision of the Covered Bond Directive, and another on insolvency benchmarking.

For the development of the Single Rulebook, in all areas, the ACP also recommended that the EBA ensure that proportionality considerations remain at the core of impact assessments that accompany the regulatory products and guidance.

Monitoring financial stability and sustainability in a context of increased interest rates and uncertainty

Within the context of this priority, an increased focus has been put on the impact of higher interest rates on the real economy in general and the banking sector in particular. Although inflation in most jurisdictions has retreated considerably, on average it still remains above target levels. Although the European economy has not fallen into recession, economic activity remains subdued. In view of this macroeconomic uncertainty banks have tightened their credit standards. With the current unstable geopolitical and economic circumstances, heightened efforts to track developments in and challenges to the financial sector (which also include cyber-resilience) may need to be sustained for the foreseeable future.

Based on the EU-wide stress test run in 2023, the EBA will continue to monitor risks in order to inform supervisory priorities. Following the 2023 exercise and the lessons learned, including from the introduction of top-down elements for NFCI, the EBA will assess the need for changes to its methodology for the 2025 exercise. The ACP recommended in this context that the EBA consider introducing supplementary proportionality considerations in its stress test work. The EBA will also start developing a regular climate stress test framework through a dedicated subgroup, and will run a one-off system-wide climate scenario analysis in conjunction with other ESAs and the ECB.

Work on building the EBA’s ESG risk monitoring framework in order to be able to efficiently monitor ESG risks – transition and physical risks – in the financial sector as well as the development of the green financial market had to be postponed, but is now expected to resume (and to be completed in 2025). This envisages the gradual increase in the use of external ESG risk-relevant data with a focus on environmental risks.

The Authority will also continue to deliver on mandates included in the CRD, CRR, IFD, IFR and those stemming from the Commission’s action plan and renewed Sustainable Finance Strategy, and to pursue its contributions to European and international work.

Putting data infrastructure at the service of stakeholders

The implementation of the EBA’s Data Strategy will improve the way regulatory data is acquired, compiled, used and disseminated to relevant stakeholders, and will strengthen the Authority’s analytical capabilities. The EBA will continue to leverage its EUCLID platform to enable data flows between diverse endpoints and provide internal and external stakeholders with access to high-quality, curated data and insights by employing more advanced technical capabilities; to foster the accessibility and dissemination of critical data assets, insights and analytics policies; and to implement the Pillar 3 data hub requested by the Level 1 legislation.

In 2024 the EBA will also finalise implementation of an improved DPM and methodology (the DPM Refit) to ensure the EBA data dictionary is fit for the future challenges in reporting and digital processing. The EBA will start producing reporting frameworks, including the DPM releases, the full validation rules lifecycle, support for data calculations and the creation of XBRL taxonomy packages through the DRR tools. Both the DPM Standard 2.0 and DRR tools were developed jointly with EIOPA. In the context of its work on reporting and transparency, the EBA will duly consider the proposals that the ACP deems critical from the perspective of proportionality and with a view to reducing the reporting burden.

Developing oversight and supervisory capacity for DORA and MiCAR

Regarding DORA, given its cross-sectoral nature the ESAs will focus significant attention and effort on the set-up of the oversight function over critical TPPs. Therefore, in 2024 the EBA, ESMA and EIOPA, together with the supervisory community, will be focusing on the operational set-up of the oversight framework in order, in their capacity as lead overseers, to be ready to oversee these critical ICT TPPs from 2025 onwards. This includes several preparatory steps, such as i) the process for designation as critical ICT third-party providers; ii) the design of the relevant processes, methodologies and governance structures envisaged by DORA to conduct oversight activities; and iii) capacity building to equip the cross-ESAs oversight team. New IT tools will also need to be implemented to support the new oversight function in terms of CTPP designation and oversight collaboration, as well as with respect to ICT-related incidents. During 2024, with a view to building operational and ICT risk capacities internally during the execution phase of the implementation plan, the EBA will also offer in-house training sessions and leverage the EU SDFA and other available training provision in order to build skills for managing DORA-related activities for ESAs and CAs.

For MiCAR, the EBA is responsible for delivering 20 technical standards and guidelines in 2024 (two of which are joint with ESMA, and one is joint with ESMA and EIOPA). The policy mandates under MiCAR will expand on the single rulebook for crypto-asset issuance and service provision in the EU established by MiCAR, for example by further specifying capital requirements for issuers of ARTs. Importantly, the EBA will need to be ready from the end of Q4 2024 to supervise issuers of significant ARTs and EMTs, for which the EBA will need in 2023 and 2024 to develop supervisory and enforcement policies and procedures, forms and templates for the exchange of information between all relevant parties (including supervised issuers, NCAs, the ECB and other relevant central banks). IT capabilities will need to be developed to support the EBA’s supervisory function and a new Crypto-Assets Standing Committee will need to be established to facilitate the EBA in the performance of its supervision tasks. In 2024 the EBA will also place special emphasis on promoting supervisory convergence in the area of crypto and MiCAR authorisation and supervision across the authorities through a dedicated Coordination Group, and also on strengthening supervisory capacity building, in particular by further extending training for staff and by organising workshops with NCAs on techniques for the supervision of issuers of ARTs and EMTs.

More generally, the recruitment of fee-funded resources is linked to uncertainties around the number of entities subject to being charged fees and a related risk that the funds will be insufficient to cover all staff costs.

Increasing focus on innovation and consumers while preparing the transition to the new AML-CFT framework

In 2024, the EBA will further enhance the supervision of financial institutions’ conduct and strengthen CAs’ ability to tackle financial crime across their regulatory and supervisory remit. It will also contribute to ensuring that citizens have access to financial and banking services and focus on consumer protection mandates assigned by MiCAR and the Credit Servicers and Credit Purchasers Directive. The EBA will continue to monitor and assess market developments, including financial innovation, to achieve a coordinated approach to the regulatory and supervisory treatment of new or innovative financial activities, and to provide advice to the co-legislators where needed. In particular in 2024/2025 the EBA will focus on priority areas encompassing:

• crypto-assets;
• tokenisation in relation to new financial products, services and decentralised finance;
• application of artificial intelligence / machine learning in the financial sector;
• value chain evolution (incl. monitoring mixed activity groups and white labelling).

In addition, the EBA will continue with its broader horizontal innovation-related work, including but not limited to knowledge sharing on supervisory and regulatory technologies (SupTech and RegTech) and open finance, will contribute to work priorities envisaged by the EFIF in 2024, and will leverage dialogue with industry, CAs and other EU and international organisations to identify emerging risks and opportunities.

In 2024, the EBA together with ESMA, EIOPA and the Commission, will continue to support the activities of the EU SDFA, to strengthen supervisory capacity in innovative digital finance, and to support the objectives of the EU Digital Finance Strategy.

Throughout 2024, the EBA will work closely with CAs and the Commission to facilitate the transition to the EU’s new legal and institutional AML/CFT framework.

At the same time, the EBA will continue to foster the implementation of robust approaches to tackling ML/TF, sanctions and other financial crime risk across the EU, in line with its legal mandate and until AMLA begins fully to exercise its mandate and powers. AMLA is currently expected to be legally established in 2024, and fully operational in 2025. The EBA will adjust its WP as necessary, which may mean that planned deliverables will be re-prioritised.