In Greece, the Bank of Greece (ΒοG), pursuant to art. 55A of its Statute in conjunction with art. 4 para.1 of Greek law 4261/2014, as in force, serves, inter alia, as the primary national competent authority (NCA) responsible for the prudential regulation and supervision of credit institutions, aiming to safeguard the financial stability and the proper functioning of the financial system. In carrying out these responsibilities, BoG expressly cooperates with the European Central Bank within the Single Supervisory Mechanism (SSM).

Bank resolution is likewise exercised at national level by the BoG, acting as the national resolution authority under the Greek implementation of the Bank Recovery and Resolution Directive (BRRD), notably Greek law 4335/2015, as in force. Within the Banking Union bank resolution operates under the Single Resolution Mechanism (SRM) where the Single Resolution Board (SRB) adopts resolution schemes for significant institutions and cross-border groups, with domestic implementation by the national authority.

Separately, deposit protection is administered by the Hellenic Deposit and Investment Guarantee Fund (HDGIF), under Law 4370/2016, as in force, and where extraordinary public financial support is contemplated, coordination may also be required with the Ministry of Finance (Greece) and the Hellenic Financial Stability Fund.

In accordance with article 9 of Greek law 4261/2014, as in force, a banking licence requirement arises when an undertaking intends to carry out the core business of a credit institution, namely a) accepting deposits or other repayable funds from the public and b) granting credit for its own account. As a rule, the professional granting of loans or other credit is prohibited unless a specific authorisation is granted by the BoG, with limited exemptions mainly for intra-group lending and supplier credit (credit granted for the purchase of the lender’s own goods or services).

No. In Greece, authorisation as a credit institution (banking licence) is generally universal, i.e once an institution is licensed under Greek law 4261/2014, as in force, it may perform core banking business and the additional activities permitted to credit institutions, without needing separate banking licences for each service (subject to compliance with the applicable rules for each activity). Separate sector-specific authorisations apply mainly to non-bank providers of particular financial services (such as payment institutions or electronic money institutions), and they do not constitute additional banking licences for credit institutions.

In Greece, a banking licence allows credit institutions to provide the financial activities listed under article 11 of Greek law 4261/2014, as in force, without requiring separate authorisation, as long as they comply with the applicable regulatory frameworks. Specifically, credit institutions may offer investment services (broker-dealer activities) under the CRD/CRR framework while following MiFID II organisational and con-duct requirements, provide payment services under PSD2 without a separate licence, and issue e-money under the E-Money Directive, all subject to prudential and regulatory rules, whereas separate licences are necessary for non-bank providers.

Υes, a supervisory Regulatory Sandbox operates in Greece through the BoG, providing financial tech-nology firms (FinTechs) a controlled environment to test their innovative financial propositions for a speci-fied period. However, it is expressly clarified that participation neither constitutes a “ licence light”, nor constitutes an authorisation, and does not waive any applicable legal or licensing requirements.

In Greece, banks that issue crypto assets, hold them in custody, or provide crypto asset services are primarily regulated under MiCA (Regulation (EU) 2023/1114), as implemented by Greek Law 5193/2025, with supervisory responsibilities allocated between the BoG and the Hellenic Capital Market Commission (HCMC) depending on the activity.

For crypto asset services, including custody, banks may generally rely on the MiCA Article 60 notification regime, which allows credit institutions to provide crypto asset services without obtaining a separate CASP authorisation, subject to prior notification and compliance with MiCA’s conduct, prudential, and organisational requirements.

For issuance, the applicable regime depends on the type of token:

• Asset Referenced Tokens (ARTs): issuance is subject to the notification and approval process under Article 17 MiCA, including publication of a white paper and compliance with governance, reserve, and stabilisation requirements.
• E Money Tokens (EMTs): issuance falls under MiCA Title IV, requiring authorisation as a credit institution or e money institution, together with advance notification and strict prudential and redemption obligations.

Banks must also comply with AML/CFT obligations, including the transfer of funds “travel rule”, and with enhanced ICT and cybersecurity requirements under DORA (Regulation (EU) 2022/2554).

Finally, where a “digital asset” qualifies as a financial instrument, MiCA does not apply; instead, the bank must comply with the existing EU and Greek securities framework, including MiFID II/MiFIR and related rules.

Cryptoassets are generally not considered as deposits, and therefore do not benefit from Greek deposi-tor protection (HDGIF). However, cryptoassets can still benefit from “client asset safeguard-ing/segregation” rules when they are held in custody. If a bank (acting as a MiCA crypto-asset service provider) provides custody, MiCA requires arrangements to safeguard clients’ rights and protect client cryptoassets, especially in insolvency. Finally, if the “digital asset” is actually a financial instrument (e.g a security token), then it falls outside MiCA and the relevant protection is the MiFID II client-asset safe-guarding regime.

If a licensed EU/Greece bank holds cryptoassets on its own balance sheet, the main (transitional)capital rules are set out in article 501d of CRR3 (until the EU adopts a dedicated prudential framework for crypto exposures);

• Tokenised traditional assets; treated like the underlying traditional asset and receive the normal CRR risk weight.
• Qualifying ART exposures: 250% risk weight.
• Other cryptoasset exposures;1,250% risk weight.
• Εxposures in the ‘’other cryptoassets” category must be ≤ 1% of Tier 1 capital.

In Greece, a banking licence application is handled within the SSM. Specifically the applicant submits the file electronically through the IMAS portal, BoG as NCA conducts the initial assessment and prepares the supervisory file, and the ECB adopts the final decision to grant or refuse authorisation.

The applicable requirements derive from Greek law 4261/2014, as in force, and are further specified in BoG Executive Committee Act (PEE) 244/3/25.07.2025, which sets out the submission process and the information to be provided. In practice, the application shall include, inter alia, the programme of operations and business model, details of the proposed organisational and capital structure, governance arrangements and internal controls systems, ownership and shareholder information (including qualifying holdings), fit-and-proper documentation for board members and key function holders, and evidence of the full paying-up of initial capital sufficient to support projected requirements during the first years of operation.

As regards timing, article 16 para.2 of Greek law 4261/2014, as in force provides that the decision must be taken within six (6) months of receipt of a complete application (or within six months after missing information is provided) and, in any event, within twelve (12) months of receipt; It is clarified that receipt means the final submission of a fully completed application in IMAS.

As provided under article 38 para. 3 of Greek law 4621/2014, as in force, banks authorised in another European Economic Area (ΕΕΑ) state may provide cross-border banking services into Greece without establishing a local presence and without obtaining a separate Greek authorisation, provided that the competent authorities of the credit institution’s home Member State notify the BoG in advance of the services to be carried out; in that case, the bank operates on a services-only basis and remains subject to Greek rules of general application adopted for public-interest reasons (e.g AML, consumer protection). Ιn contrast, pursuant to article 36 para.1 of the aforementioned law, banks authorised in third countries cannot benefit from the European passporting regime and they must obtain an authorization by the BoG to establish and operate a branch in Greece.

In Greece, a bank can operate either as a Greek-established bank or as a branch of a foreign bank. Greek-established banks may be licensed only in certain legal forms under Law 4261/2014, as in force (notably a Societe Anonyme under Law 4548/2018, a Pure Credit Cooperative, a European Society (SE) under Council Regulation (EC) No 2157/2001or a European Cooperative Society (SCE) under Council Regulation (EC) No 1435/2003). A bank from a country within the European Economic Area (EEA) may operate in Greece through a branch, benefiting from the European passporting regime, while for a non-EEA bank the establishment and operation of a branch in Greece is subject to prior authorisation by the BoG.

In Greece, no formal standalone structural separation or ring-fencing requirements exist for banks. Greek credit institutions instead operate under the EU prudential and supervisory framework, namely Regulation (EU) No 575/2013 (CRR), as in force and Directive 2013/36/EU (CRD IV), as amended by Directive 2019/878/EU (CRD V), which has been implemented in Greece by Greek law 4799/2021.

However, a number of EU prudential and resolution requirements can produce indirect ring-fencing ef-fects in practice, as they constrain the free movement of capital, liquidity and exposures within a group (e.g., own funds and liquidity requirements, large exposure constraints and resolution planning require-ments such as Minimum Requirement for own funds and Eligible Liabilities- MREL).

Banks in Greece must comply with the EU banking governance framework, i.e Directive 2013/36/EU (CRD IV), as amended by Directive 2019/878/EU (CRD V),as well as with the European Banking Authority’s (EBA) Guidelines on internal governance and the BoG’s supervisory framework on internal control systems.

Specifically, banks are expected to maintain a clear organisational structure for all management and control tasks, while they shall also have risk management and internal control policies in place. In addition, they shall have internal control teams, which must be independent and able to directly report to the Board of Directors (BoD).

Furthermore, the BoD bears overall responsibility for governance and oversight and must collectively have adequate knowledge, skills and experience to understand the institution’s activities and risks. The BoD should cover a broad range of expertise for effective oversight, act with integrity and independence, and challenge management when needed.

For significant institutions, it is a core expectation that a Risk Committee made up of non-executive members is in place to support the board on risk strategy, and that remuneration oversight is organised through a Remuneration Committee of non-executive members. Audit committee arrangements apply where required under the applicable audit/corporate framework, with proportionality for smaller or less complex institutions.

Finally, Banks are expected to promote an effective risk culture and ensure ongoing induction and training for board members and staff.

Greek banks’ operational resilience is primarily shaped by the Digital Operational Resilience Act (Regulation (EU) 2022/2554- DORA), which requires strong Information and Communication Technology (ICT) risk management, incident reporting, resilience testing controls and controls over critical ICT third-party providers.

Banks are also expected to identify services and processes that are critical to their operations and to define acceptable disruption levels through appropriate business continuity and recovery objectives, sup-ported by tested response and contingency arrangements.

In practice, these requirements are reinforced through Banking Union supervision, with the ECB continuing to prioritise the remediation of weaknesses in ICT risk management and third-party risk controls.

Outsourcing by Greek banks mainly follows EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02). The guidelines set out specific provisions for these financial institutions’ governance frameworks with regard to their outsourcing arrangements and the related supervisory expectations and processes. The respective compliance is supervised by BoG (as NCA) within the SSM framework.

For banks in Greece, ESG and climate-related requirements mainly require institutions to integrate cli-mate and environmental risks into their governance and risk management and to publish standardised information on their exposures and the way they manage those risks. Within the Banking Union, the ECB, working together with the NCAs, reviews these disclosures, reconciles them with supervisory reporting, and may require banks to correct or improve the disclosed information where gaps or inconsistencies are identified.

Under Greek law 4261/2014, as in force, banks’ remuneration policies should be in line with binding pru-dential requirements. In general, banks should adopt remuneration policies and practices that are con-sistent with sound and effective risk management, while variable remuneration is subject to specific con-straints, including a cap (generally up to 100% of fixed remuneration, and up to 200% only with share-holder approval), deferral of a significant portion of variable pay (at least 40% deferred for 3–5 years and at least 60% for particularly high amounts), and malus and clawback mechanisms allowing variable re-muneration to be reduced or recovered, potentially up to 100% of the award, based on specific criteria. In addition, significant institutions must establish a remuneration committee with defined responsibilities in preparing remuneration decisions and ensuring consistency with the bank’s risk profile and its capital- liquidity position.

Yes. Ιn Greece the Basel III regulatory capital framework applies directly under the Regulation (EU) 2024/1623 (CRR III). The accompanying directive framework, is implemented in Greece mainly through Law 4261/2014, which expressly transposes Directive 2013/36/EU (CRD IV) and it has been updated to reflect later EU amendments, including Directive (EU) 2019/878 (CRD V), which Greece implemented via Law 4799/2021. Taking into consideration that the rules are the same for all EU countries, generally no major deviations can be noticed in Greece.

Yes. In Greece, banks must maintain a minimum leverage ratio of 3% as set out in the EU capital rules (CRR, as amended). The ratio is calculated as the relevant capital measure divided by the institution’s total exposure measure under the CRR methodology and banks must report leverage ratio information to the competent authority. In practice, compliance is monitored through Banking Union prudential supervision (ECB/BoG, depending on the institution).

In Greece, Basel III liquidity requirements apply through directly applicable EU law. As for the LCR (Li-quidity Coverage Ratio), a bank must hold enough high-quality liquid assets (HQLA) to cover net cash outflows over thirty (30) days, and the ratio must be at least 100%, as provided in art. 412 para.1 of CRR, as in force, implemented by art. 4 para.1 of Commission Delegated Regulation (EU) 2015/61. On the other hand, pursuant to Article 428b of the CRR (as in force), institutions must maintain a Net Stable Funding Ratio (NSFR) of at least 100%, meaning that available stable funding must be no less than re-quired stable funding. The NSFR is intended to promote a sound funding structure over a one-year horizon.

In Greece, banks can borrow money by BoG (under the ECB framework) through three main channels; Regular refinancing (Main Refinancing Operations-MROs and Longer-term refinancing operations- LTROs), i.e., standard Eurosystem central bank borrowing against eligible collateral, is provided for in articles 6 and 7 respectively of Guideline (EU) 2015/510 (ECB/2014/60). Overnight borrowing via the marginal lending facility, i.e., overnight central bank credit against collateral, is provided for in articles 17 and 18 of the said guideline. Finally, Emergency Liquidity Assistance (ELA), i.e., exceptional central bank liquidity that may be granted to solvent banks facing temporary liquidity problems outside normal monetary policy operations, is linked to Article 14.4 of the Statute of the European System of Central Banks (ESCB) and of the ECB.

Pursuant to article 149 para.1 of Greek law 4548/2018, as in force, Greek banks (as Greek sociétés anonymes) must publish their annual financial statements under the general company-law publication rules, i.e the duly approved annual financial statements, the management report and (where required) the statutory auditor’s opinion must be filed and published in the General Commercial Registry (GEMI) within twenty (20) days from their approval by the ordinary general meeting.

For Greek banks whose shares are listed in the regulated market, there is also interim reporting under the EU transparency framework. Specifically, pursuant to the provisions of Greek law 3556/2007, as amended and in force, they are obliged to publish an annual financial report within four (4) months after year-end, a half-yearly financial report within three (3) months after the half-year end, and quarterly financial statements for Q1 and Q3 within three (3) months after the end of each relevant quarter.

Yes, pursuant to the CRR (as in force) and Greek law 4261/2014 as in force, the principle of prudential supervision on a consolidated basis is established regarding the Greek credit institutions.

In particular, key prudential requirements must be met on a consolidated basis (e.g., capital and other prudential requirements within the CRR consolidation perimeter), meaning the group’s risks, exposures, and buffers are calculated and monitored across the whole group. The framework also designates a “consolidating supervisor” responsible for coordinating consolidated supervision across relevant authori-ties. In Greece, for significant banking groups this role is exercised directly by the ECB (through the SSM), while the BoG is involved especially for less significant institutions under the SSM allocation of tasks, as set out at article 6 para. 4 of Regulation (EU) No 1024/2013, as in force.

In accordance with the BoG Executive Committee Act 142/11.6.2018, as currently applicable, a proposed acquirer (a natural or legal person, alone or acting in concert) must notify the BoG in writing and submit the relevant BoG fit and proper questionnaires and documentation when there is a plan to; (i) acquire directly or indirectly a qualifying holding (i.e. 10%); (ii) increase an existing qualifying holding so that voting rights-capital reach or exceed 20%, 1/3, or 50%, or the bank becomes its subsidiary; (iii) obtain control through arrangements/acting in concert.

Relevant data and submission of the assessment questionnaire may be required by the BoG on a discretionary basis even for less significant changes in the institution’s holdings (e.g. where the acquired holding exceeds 1% of the credit institution’s share capital).

Ιn any event, an intended acquisition or increase reaching 5% must be pre-notified and triggers a further filing if the BoG finds significant influence within five working days from the notification.

Yes. In Greece, the regulatory regime imposes suitability conditions for any person seeking to acquire or increase a qualifying holding in a bank, i.e direct or indirect holding of 10% or more of the capital or voting rights, or a holding that otherwise allows the exercise of significant influence over the bank’s management and such acquisitions are subject to a prior supervisory assessment by the BoG.

Pursuant to article 23 of Greek law 4261/2014, as in force, the BoG must assess both the suitability of the proposed acquirer and the financial soundness of the proposed acquisition, in the light of the following criteria; (a) the proposed acquirer’s and any potential BoD members’ reputation, (b) the reputation, knowledge, skills, experience of the persons who will direct the bank after the acquisition, (c) the pro-posed acquirer’s financial soundness, (d) the bank’s (and, where relevant, the group’s) ability to comply on an ongoing basis with prudential requirements, and (e) any reasonable grounds to suspect that the proposed acquisition bears significant AML/CFT risks.

In Greece, there are no bank-specific restrictions on foreign shareholdings in banks as foreign investors are generally treated the same as domestic investors. Any foreign investor acquiring or increasing a qualifying holding/control must follow the standard prior notification and prudential assessment process al-ready described.

Separately, Greece has introduced a broader Foreign Direct Investments (FDI) screening mechanism for critical sectors on certain security/public-order sensitive sectors, including banks (Greek law 5202/2025, implementing EU Regulation 2019/452). In such cases, non EU investors—and EU investors ultimately controlled by non EU persons—are subject to a mandatory and suspensory review, prohibiting comple-tion of the transaction until clearance is granted. The FDI mechanism therefore constitutes an additional, standalone layer of scrutiny for foreign investments in Greece, separate from the regulatory assess-ments conducted by the BoG and the ECB in relation to bank shareholdings.

Yes. In Greece there is a special regime for systemically important banks, implemented under EU law.

Greece applies the O-SII regime; each year the competent authority can designate certain banks as “Οther Systemically Important Institutions” and require an extra CET1 capital buffer (the O-SII buffer) under Article 131 of CRD IV. In practice, the BoG has designated the main four (4) Greek banks as O-SIIs and set their O-SII buffer rates for 2026, with effect from January, 1st, 2026. The methodology applied by the BoG for identifying other systemically important institutions (O-SIIs) and setting O-SII buffer rates is described in Executive Committee Act 221/1/17.10.2023.

As regards global systemically important institutions (G-SIIs), the BoG expressly notes that there are no G-SIIs in Greece.

In Greece, in case of non-compliance with the banking regulations, the ΒοG, as supervisor, may impose (alternatively or cumulatively) a range of administrative sanctions and supervisory measures on super-vised entities, which may, inter alia, include; (i) a public statement of the violation, (ii) an order to cease the unlawful conduct and refrain from repeating it; (iii) administrative fines for legal persons of up to 10% of the previous year’s total net turnover and for natural persons of up to EUR 5,000,000; and (iv) fines of up to twice the benefit gained from the breach (where measurable).

In addition, if key persons do not comply with the BoG’s corrective directions, the BoG may proceed with (i) removal of the relevant persons from the board and/or any managerial position (temporarily or permanently); (ii) suspension of the voting rights attached to their shares (directly or indirectly held) until the underlying conditions cease; (iii) prohibition of any new transactions between the bank and those persons (or entities they control); and (iv) where a voting-right suspension is breached, any potential vote is ineffective and the BoG may additionally impose a fine of up to 10% of the value of the shares held (and, where applicable, also impose removal).

Finally, it shall be noted that under Greek Law 4261/2014, as in force, carrying out the core banking activities (i.e deposit-taking and/or lending to the public) in violation of the required authorisation constitutes a criminal offence.

In Greece, enforcement against credit institutions is active. The ΒοG confirms that, in the exercise of its supervisory powers, it may impose administrative penalties and other administrative measures on supervised entities (including credit institutions) for non-compliance with the applicable legal and regulatory framework, and that pecuniary penalties are imposed as fines in favour of the Greek State.

A recent (as of 2020) observable trend is the systematic public disclosure of enforcement outcomes, as the BoG publishes a year-by-year overview of penalties imposed on credit institutions, showing ongoing supervisory follow-up.

In Greece, clients’ cash deposits (and, where applicable, certain investor-client assets) are protected through HDIGF, under Law 4370/2016 (transposing Directive 2014/49/EU). HDIGF (i) compensates depositors when a credit institution is unable to meet its obligations, (ii) compensates investor-clients where a credit institution cannot meet its obligations in respect of covered investment services, and (iii) contributes to the financing of bank resolution measures.

All credit institutions licensed and operating in Greece must participate in the Deposit Guarantee Scheme (DGS) operated by HDIGF, with the sole exception of the Deposits and Loans Fund. Accordingly, HDIGF also covers deposits held with branches of Greek banks established in other EU Member States or in third countries. Participation in the DGS also entails participation in HDIGF’s Resolution Branch and the relevant contributions.

Deposit coverage is up to €100,000 per depositor per credit institution, while investor compensation is up to €30,000 per investor-client per participating credit institution (for covered investment services).

Moreover, in a resolution scenario, client-owned assets are safeguarded through segregation, as pursuant to article 145 of Greek law Law 4261/2014, as in force, customer assets of the institution under resolution that can be duly verified (including the contents of safe-deposit boxes) are kept separate from the institution’s own assets and do not form part of its insolvent estate.

In Greece banks must have recovery plans and are also subject to resolution planning under the EU BRRD/SRM framework.

Specifically, they must draw up, maintain and update a recovery plan and submit it to the competent authority for review. The competent authority (ΕCB for significant institutions- BoG for less significant institutions) within six (6) months following the submission, reviews and assesses the plan and may re-quire amendments or additional information. In particular, the assessment examines whether the plan’s arrangements and options are reasonably likely to restore or maintain viability and can be implemented quickly and effectively under stress, while avoiding to the maximum extent possible significant adverse effects on the financial system, and it also considers whether the bank’s capital and funding structure is appropriate to its organisational complexity and risk profile. Where material deficiencies are identified, the authority may require a revised plan within a set deadline, direct specific changes, and, if deficiencies persist, require business changes and order proportionate measures (e.g. risk reduction, funding strategy changes, timely recapitalisation measures, or governance changes).

In parallel, banks are subject to resolution planning; the resolution authority (SRB in close coordination with BoG) draws up and periodically updates a resolution plan for each institution (and, where relevant, the group) and conducts a resolvability assessment to evaluate whether resolution is feasible while achieving the resolution objectives, including avoiding significant adverse effects on the financial system. If the resolvability assessment finds obstacles, the resolution authority can require the bank to take spe-cific steps to remove them. For groups, the group resolution plan is prepared and coordinated in the resolution college, is reviewed at least annually (and after major changes), and is adopted by a joint deci-sion of the relevant resolution authorities.

Yes. In Greece, a bail-in tool is available in bank resolution under the EU BRRD framework (as trans-posed into Greek law, notably Law 4335/2015, as in force). Under article 44 of the BRRD, bail-in may in principle be applied to all liabilities not expressly excluded. The main exclusions include, in particular, covered deposits, secured liabilities to the extent of the security (including covered bonds), liabilities relating to client assets or client money held in custody/fiduciary capacity, certain very short-term interbank liabilities (with original maturity under 7 days), certain very short-term liabilities to payment/settlement systems, their participants, or CCPs; and certain other protected claims (e.g., specific employee-related claims, certain critical supplier/trade claims, certain preferred tax/social-security claims, and certain intra-group liabilities).

Bail-in does not apply in a mere liquidity crisis (e.g., a standalone LCR breach) as it is a resolution tool and becomes relevant only once the conditions for resolution are met under article 32 of the BRRD, i.e., the bank is failing or likely to fail (FOLTF), there is no reasonable alternative, and the resolution is in the public interest. A liquidity crisis may nevertheless lead to bail-in if it supports a FOLTF determination, in particular where the institution is (or is likely soon to be) unable to pay its debts or other liabilities as they fall due.

In Greece, banks are mainly required to hold MREL rather than “Total Loss-Absorbing Capacity’’ (TLAC). MREL is set case-by-case for each bank by the competent resolution authority, whereas, TLAC, stricto sensu, is an EU minimum requirement that applies only to G-SIIs under the CRR (article 92a). Thus, unless a bank in Greece is designated a G-SII, it shall follow MREL.

Bank managers in Greece are subject to general corporate law duties (care and loyalty), regulatory obli-gations under Greek banking law and the EU prudential framework, and may incur civil, administrative, and criminal liability for breaches. The BoG may impose personal administrative sanctions, including fines, removal from office, and restrictions on future management roles, while misconduct may also af-fect a manager’s fit and proper status. Criminal liability may arise for offences such as breach of trust, AML/CTF violations, or market abuse infringements. Although Greece does not operate a standalone “Senior Managers Regime,” the combined corporate, regulatory, and criminal frameworks create a strict and multifaceted personal liability regime for bank managers.

In Greece, the main developments likely to shape the banking sector over the next 12–18 months could be summarized as follows;

• implementation of the EU Basel III banking package (CRR3/CRD6) with continued adjustment to the new prudential framework, with CRR3 largely applying from 1 January 2025 and CRD6 ex-pected to apply from early 2026 following national transposition. The reform is built around four key pillars: (i) stronger risk-based capital requirements, (ii) deeper integration of ESG risks into prudential supervision, (iii) further harmonisation of supervisory powers and tools, and (iv) re-duced disclosure-related administrative burden through improved access to supervisory data;
• more intensive ECB/SSM supervisory focus with stronger attention to banks’ risk management and resilience in the context of geopolitical and macro-financial uncertainty, alongside expecta-tions for robust operational resilience and ICT capabilities;
• operational resilience and cyber security under DORA, especially regarding ICT outsourcing/third-party risk management and the maintenance of the mandatory register of ICT services/providers;
• new EU AML architecture (AMLR/AMLA) with banks continuing to strenghten their AML/CFT governance, data quality and controls, preparing for the rollout of the directly applicable AMLR and the gradual operational build-up of AMLA (with key milestones in 2027–2028), which is ex-pected to make AML requirements more consistent and supervision more intensive across the EU.