30 July 2026 · Banking · approx. 6 min read

ECB Supervisory Priorities 2026–2028: What Changes?

The ECB agenda for 2026–2028 concentrates on two axes: resilience to macro-financial shocks, and operational and ICT resilience. Lending standards and CRR III implementation stand out in particular.

Executive note: Supervisory priorities are not simply a list for the compliance function. They touch credit policy, pricing, capital planning, IT investment, data architecture and the board agenda all at once.

ECB Banking Supervision has set two main priorities for the 2026–2028 period: strengthening banks' resilience to geopolitical and macro-financial uncertainty, and improving operational resilience and ICT capability. That framework is a strong road map for understanding where supervisory teams will press hardest in 2026 and which investments banks should bring forward.

Priority 1: resilience to geopolitical and macro-financial uncertainty

The ECB approach focuses on three concrete vulnerabilities: prudent lending standards, consistent implementation of CRR III, and management of climate and nature-related risks. Underwriting standards and risk-based pricing on new lending in particular are prominent headings in the 2026 supervisory programme.

Why are lending standards back at the centre?

Even where credit quality looks strong today, rapid growth, competitive pressure or target pressure can loosen standards on new production. That is why the ECB is looking at samples of new lending, credit decision logic, repayment capacity and whether pricing reflects the risk.

CRR III: calculation accuracy is a management issue

CRR III has changed the credit and operational risk calculations under the standardised approach. The supervisory focus is not only on whether the technical formula works correctly; the reliability of the data source, the consistency of classification, the explainability of RWA movements and their integration into the capital plan all matter as well.

Priority 2: operational resilience, ICT and data

Since DORA came into application at the start of 2025 ICT third-party risk, incident management, business continuity and testing capability have become far more concrete supervisory territory. The ECB also continues to track the remediation of risk data aggregation and risk reporting (RDARR) weaknesses in the 2026–2028 programme.

AI is now a strategy and governance question

In its medium to long-term agenda the ECB puts particular emphasis on banks' artificial intelligence strategies, governance and risk controls. That calls for a broader framework than model risk management confined to credit scoring: data quality, explainability, human oversight, dependence on third-party models and change management have to be handled together.

Management area	Supervisory question for 2026–2028	Example of good practice
Credit	Are standards loosening on new production?	Performance tracking by vintage and risk segment
Capital	Is the CRR III effect accurate and explainable?	RWA bridge plus data lineage plus scenario analysis
ICT	Is dependence on critical third parties being managed?	Exit plan, tested business continuity, incident classification
Data	Are risk reports timely and reliable?	Single data ownership, data quality thresholds, lineage
AI	Are model decisions under governance?	Model inventory, validation, human oversight, change log

A five-question checklist for the board

Is there a measurable link between credit growth targets and risk appetite?
Do we understand how capital consumption after CRR III varies by product, segment and country?
If one of our most critical ICT third parties were out of action for 48 hours, which customer processes would stop?
Where is manual adjustment and dependence on Excel still high in risk reporting?
For every critical decision process using AI, are ownership, validation and points of human intervention defined?

Treating the supervisory agenda as “work to be done for the regulator” is an expensive mistake. Applied properly, these headings also reduce credit losses, use capital more efficiently, limit operational disruption and raise the quality of management decisions.

Official sources and further reading

This article is intended as general information and professional analysis. Financing, investment, tax, accounting and legal decisions should be assessed separately against the institution's own circumstances and the rules in force. Because call conditions and deadlines in EU programmes can change, the official Funding & Tenders Portal and the relevant programme documents should be checked before applying.

Request a Free Introductory Call
Book a call →

← Insights