ECB On-Site Inspections 2026: Faster Reviews, Fewer Open Measures

ByRegReportingDesk

On 12 August 2026, ECB Banking Supervision published two linked newsletter articles: one reported shorter and more targeted on-site investigations, while the other reported a reduction in the stock of outstanding supervisory measures across significant institutions. The average on-site investigation, measured from kick-off to issuance of the final report, has already fallen from 33 weeks in 2025 to 29 weeks in 2026, about 10 per cent faster. A companion article reported that outstanding supervisory measures across significant institutions had reached around 12,000 by the end of 2025, an average of roughly 100 per bank, and confirmed a “refocusing exercise” starting in October 2026 to work through that backlog.

For reporting and remediation teams inside SSM banks, the two articles concern supervisory processes rather than changes to regulatory-reporting templates. The on-site article reports shorter average investigation timelines and says more targeted scoping can in several cases reduce data requests. The remediation article simplifies follow-up for low-severity findings while maintaining banks’ responsibility to remediate them. Neither article creates a new data return or amends a COREP or FINREP template.

The approximately 12,000 outstanding-measures figure expressly covers significant institutions. The 29-week figure is reported as an ECB Banking Supervision average for on-site investigations; the newsletter does not state an SI/LSI split. Less significant institutions are generally supervised by national competent authorities, although Article 6(5) of the SSM Regulation preserves defined ECB direct-supervision powers over less significant institutions.

Related reading: our guide to the ECB SREP 2026 priorities.

Key dates in the August 2026 supervisory package

  • 12 August 2026: the ECB publishes the two linked supervision newsletter articles, “More risk-focused and effective on-site investigations” and “Timely remediation for more resilient banks”.
  • During 2025: the ECB introduces a “tiered approach” to follow-up for low-severity findings, and its SREP decisions begin to focus on the most severe findings and key supervisory concerns.
  • End of 2025: the stock of outstanding supervisory measures across significant institutions stands at around 12,000; over the year, the ECB closed 1,200 more measures than it created.
  • During 2026: average on-site investigation duration falls from 33 to 29 weeks; the stock of outstanding measures drops by a further 600.
  • October 2026: the ECB launches the “refocusing exercise”, a critical review of accumulated measures by severity, age, prudential relevance, remediation status and the likelihood that further supervisory intervention is required.

What the 2026 on-site inspection reforms actually change

Article 12 of the SSM Regulation empowers the ECB to conduct necessary on-site inspections at the business premises of legal persons within its scope. The September 2018 Guide applies to significant institutions and, in defined cases, less significant institutions and other legal entities; inspections are conducted within a predefined scope and timeframe. The August 2026 article reports how the ECB is running the reviews differently, leaving the legal basis intact.

Three operational shifts stand out. In planning the 2027 programme, the ECB says it will make greater use of shorter, more targeted investigations that allow findings to be presented more quickly; intense investigations are already limited to more material and complex risks or broader-scope reviews. Cooperation between inspection teams and Joint Supervisory Teams has been tightened, with more systematic interactions across the investigation cycle and JST members joining investigations. And the final reports themselves have been trimmed: compared with 2025, they are 20 per cent shorter on average, which the ECB states it has achieved while maintaining quality standards.

The single detail most relevant to a credit risk reporting function is sampling. The ECB now gives its investigation teams guidance on sample sizes for credit risk investigations that involve a credit file review, calibrated to the scope of the investigation and the complexity of the portfolios under review. A bank that expects the same file-pull volume regardless of portfolio mix will misread how a 2026 inspection is scoped.

Model-approval teams should not assume that the 29-week average applies to internal model investigations. The September 2018 Guide covers on-site inspections and internal model investigations within a common inspection framework, and Decision (EU) 2023/672 delegates specified decision-making powers for both. But the August 2026 on-site article reports the 33-to-29-week metric only for on-site investigations, while the ECB’s next-level programme lists risk-based internal-model approvals and more efficient and targeted on-site investigations as separate workstreams. The primary sources reviewed do not establish a common 29-week cadence for internal model investigations.

The on-site investigation phase still typically runs between 4 and 16 weeks. The ECB attributes shorter end-to-end timelines to streamlined processes, closer JST coordination and more targeted investigations, and says the more risk-based approach can in several cases reduce data requests. It also states that report quality standards have been maintained. The newsletter does not state that banks’ evidence-submission windows have been shortened or that the evidentiary standard has changed.

The 12,000 open measures behind the numbers

The ECB distinguishes a finding, meaning an identified prudential weakness, from a measure, meaning remedial action requested from the bank to address it. Supervisory communications can include non-binding requests or recommendations as well as binding requirements, depending on their legal form. The companion article put a number on the accumulated stock: by the end of 2025 it had gradually risen to around 12,000 across significant institutions, an average of about 100 per significant bank, ranging in severity.

The direction has now reversed. In 2025 the ECB closed 1,200 more measures than it created, and in 2026 the stock has already fallen by a further 600. The October 2026 refocusing exercise is the mechanism the ECB describes for continuing that reduction: a critical review of the accumulated measures that weighs their severity, age, prudential relevance, remediation status and the likelihood that further supervisory intervention may be required. The newsletter, quoting Sharon Donnery, frames timely remediation by banks as one of ECB Banking Supervision’s key priorities.

The trap in the backlog story is treating a falling stock as a softening stance. The ECB says the refocusing exercise may discontinue or simplify supervisory follow-up for findings with limited prudential relevance, while banks remain responsible for remedying all identified findings on a timely basis. Where remediation is inadequate or late, supervisors may consider escalation, for example through binding requirements or enforcement measures. Fewer open measures at the system level can coexist with sharper consequences on the individual measures that remain.

The tiered approach and what banks no longer have to file

The most concrete reporting change sits in how the ECB now handles low-severity findings. Under the tiered approach introduced during 2025, the ECB operates a simplified follow-up process for low-severity findings arising from any supervisory activity, and it withdraws the obligation on banks to provide documentation evidencing remediation of those items. In parallel, and consistent with the SREP reform described in the ECB’s 2025 supervisory methodology, SREP decisions now focus on the most severe findings and key supervisory concerns, so measures driven by low-severity findings are not generally expected to appear in those decisions.

This is genuine administrative relief, but it does not remove the bank’s responsibility to remedy low-severity findings. For F1 and F2 findings, banks may close the finding autonomously once all necessary actions have been implemented. They do not need to deliver the remediation evidence to the JST, but they must keep evidence demonstrating how the issue was properly addressed available for five years, and supervisors will perform sample checks from time to time.

The distinction between the instruments matters here too. The ECB’s supervisory methodology separates a binding SREP decision, adopted by the decision-making bodies, from an operational act, which is a written communication from the JST conveying non-binding requests or recommendations. Under the 2025 supervisory methodology, institutions with low and stable risk profiles, defined as a stable combined score of 3+ or better, may receive the SREP outcome through an operational letter rather than a SREP decision, but only where no new own-funds, institution-specific quantitative liquidity or other qualitative supervisory requirements are issued. Previously issued requirements remain applicable unless remediated in the meantime. A bank that files against the letter it received, without checking whether earlier binding requirements are still open, can close the wrong loop.

How remediation feeds SREP, JST follow-up and escalation

The newsletter sits inside a supervisory model the ECB calls “risk identification-risk remediation”. The supervisor reviews and benchmarks practices, assesses the findings for materiality, and asks the bank to address them according to modalities and timelines agreed with the supervisors. Where deviations occur, the ECB may take binding measures and, where legally available, use enforcement measures or sanctions to secure timely remediation. Administrative pecuniary penalties under Article 18 of the SSM Regulation apply only where the statutory breach conditions are met; late remediation of a supervisory finding is not, by itself, an Article 18 penalty trigger.

The faster cadence is the visible end of a longer reform. An independent expert group that reviewed the ECB’s SREP in 2023 found a decision timeline that could span up to 14 months and recommended shortening it and making it more efficient, alongside stronger links between supervisory scores and the management actions banks are expected to take. The 2026 inspection and remediation reforms are consistent with that direction: the ECB reports shorter on-site investigation timelines and continues to prioritise timely remediation.

Operationally, the JST is the node that gathers the outcomes of on-site inspections, horizontal reviews and model investigations and communicates the remediation measures to the bank, feeding them into the annual SREP where relevant. For significant banks, outstanding supervisory measures are managed through the SSM Portal, which has replaced the IMAS Portal and supports the submission of supervisory-process information, status tracking and exchanges with supervisors. The ECB sources reviewed do not establish a general requirement that every remediation submission be reconciled to COREP or FINREP figures. Areas the ECB has flagged for targeted follow-up, such as IT security and cyber resilience, illustrate the pattern: banks with material shortcomings receive focused attention until the weakness is closed. Our note on DORA threat-led penetration testing covers one channel through which those resilience findings now surface.

The capital-planning documents are part of the same loop. Internal capital and liquidity adequacy assessments form part of ongoing supervision and the SREP. The ECB’s 2026-28 priorities state that supervisors will review banks’ internal capital and liquidity adequacy statements and related planning processes, while findings from supervisory activities may inform the annual SREP or other supervisory activities. Our explainer on the ECB ICAAP and ILAAP package sets out where those assessments connect to the measures a bank is expected to clear.

What significant institutions can tighten now

None of this requires a new template build, which is precisely why it can be under-resourced. The work is in the management information that tracks findings, not in a return with a remittance date. A remediation function that can produce, on a JST’s request, a clean list of open measures with severity, source activity, agreed deadline and current status is in a far stronger position for the October 2026 refocusing exercise than one that reconstructs the picture from email threads.

Three preparations follow from the newsletter. First, map the bank’s own stock of open measures against the ECB’s refocusing criteria of severity, age, prudential relevance and remediation status, so the items most likely to attract further intervention are visibly progressing. Second, hold the evidence for low-severity findings even where the tiered approach has withdrawn the obligation to file it, because the finding and the supervisor’s discretion to revisit it both survive. Third, treat a compressed inspection as a data-readiness test: the faster an inspection reaches findings, the more a bank depends on being able to pull reconciled credit files and reported figures without a scramble. Consistency between what a bank tells inspectors and what it has reported is the point where the two August 2026 articles meet. Our overview of the ECB supervisory data quality dashboard shows how that consistency is measured off-site.

Frequently Asked Questions

Do the 12,000 outstanding measures and the shorter inspection times apply to less significant institutions?

The approximately 12,000 outstanding-measures figure expressly relates to significant institutions. The 29-week figure is reported for ECB Banking Supervision’s on-site investigations without an SI/LSI breakdown in the newsletter. Less significant institutions are generally supervised by their national competent authorities, although the SSM Regulation preserves defined ECB powers in relation to LSIs.

If a finding is closed in the October 2026 refocusing exercise, does the bank still have to remediate it?

The Newsletter is explicit: supervisors may discontinue or simplify follow-up for findings with limited prudential relevance, yet banks remain responsible for remedying all identified findings on a timely basis. A reduction in supervisory follow-up activity carries no permission to leave an underlying weakness unaddressed.

Under the tiered approach, can the bank stop documenting low-severity remediation entirely?

For F1 and F2 findings, banks do not need to deliver evidence of remediation to the JST and may close the finding autonomously once all necessary actions have been implemented. They must, however, keep evidence demonstrating how the issue was properly addressed available for five years, and supervisors will perform sample checks from time to time.

What is the difference between a SREP decision and an operational letter for remediation tracking?

A SREP decision is adopted through the ECB’s decision-making procedure and may contain binding requirements. Under the 2025 methodology, a SREP operational letter may instead communicate the outcome for institutions with low and stable risk profiles, defined as a stable combined score of 3+ or better, provided no new own-funds, institution-specific quantitative liquidity or other qualitative supervisory requirements are issued. Previously issued requirements remain applicable unless they have been remediated.

Does a faster on-site inspection reduce the evidence a bank has to provide?

Not necessarily. The ECB says more targeted scoping can in several cases reduce data requests, while the quality standards applied to final reports have been maintained. It does not state that evidentiary requirements are unchanged in every investigation. For credit-risk investigations involving credit-file reviews, sample-size guidance takes account of the investigation’s scope and portfolio complexity and allows tailoring to underlying risk.

Can the ECB still impose penalties if the measure backlog is falling?

Yes. The system-level reduction in outstanding measures does not prevent supervisors from escalating individual findings through binding requirements and, where legally available, enforcement measures or sanctions. Administrative pecuniary penalties under Article 18 are subject to the breach conditions set out in that Article and are not triggered by late remediation as such.

Where does a bank submit remediation evidence to the ECB?

The SSM Portal has replaced the IMAS Portal. For significant banks it includes the supervisory-measures process and allows supervised banks to submit information related to supervisory processes, track status and exchange information with supervisors. This process should not be described as the channel for the bank’s regular COREP or FINREP reporting.

Key Takeaways

  • Average ECB on-site investigation duration fell from 33 weeks in 2025 to 29 weeks in 2026, about 10 per cent faster, with final reports 20 per cent shorter.
  • Outstanding supervisory measures across significant institutions reached around 12,000 by end-2025, roughly 100 per bank; the ECB closed 1,200 more than it created in 2025 and cut a further 600 in 2026.
  • The October 2026 refocusing exercise reviews measures by severity, age, prudential relevance and remediation status, so keep the items most likely to draw further intervention visibly progressing.
  • The tiered approach withdraws the obligation to file documentation for low-severity findings but not banks’ obligation to remedy them on a timely basis, so retain evidence for the five-year period the ECB requires.
  • Since the 2025 SREP, an outcome may arrive as an operational letter for institutions with low and stable risk profiles; earlier binding requirements stay in force until remediated, so track both instruments.
  • Escalation remains available on individual findings, including binding requirements and, where the applicable legal conditions are met, enforcement measures or sanctions; Article 18 administrative pecuniary penalties are not triggered by late remediation as such.
  • A shorter, more targeted inspection compresses the window to pull reconciled credit files and reported figures, so treat inspection readiness as a data-consistency exercise.

Sources and References

  • European Central Bank, “More risk-focused and effective on-site investigations”, Supervision Newsletter, 12 August 2026: bankingsupervision.europa.eu
  • European Central Bank, “Timely remediation for more resilient banks”, Supervision Newsletter, 12 August 2026: bankingsupervision.europa.eu
  • European Central Bank, “Supervisory priorities 2026-28”: bankingsupervision.europa.eu
  • European Central Bank, “Supervisory methodology 2025”: bankingsupervision.europa.eu
  • Assessment of the ECB’s Supervisory Review and Evaluation Process, report by the Expert Group to the Chair of the Supervisory Board, April 2023: bankingsupervision.europa.eu
  • Council Regulation (EU) No 1024/2013 (SSM Regulation), Article 12 (on-site inspections) and Article 18 (administrative penalties): eur-lex.europa.eu
  • Regulation (EU) No 468/2014 (SSM Framework Regulation): eur-lex.europa.eu
  • European Central Bank, “Guide to on-site inspections and internal model investigations”, September 2018: bankingsupervision.europa.eu

Preparing for the October 2026 refocusing

The two newsletter articles are a supervisory signal, not a reporting instrument, but they name a date a reporting officer can plan against. Before the ECB begins its refocusing exercise in October 2026, the useful step is to produce the bank’s own list of open measures scored on the same axes the ECB will use, with the evidence for each attached and reconciled to the returns it supports. A bank should not treat 29 weeks as an inspection deadline: it is the 2026 average from kick-off to final report, and individual durations depend on scope and complexity, the severity of issues identified and the bank’s level of cooperation. Separately, evidence supporting the remediation of F1 and F2 findings must be kept available for five years.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.

Similar Posts