EBA Internal Governance Guidelines: Proportionality Without Exemptions

On 5 November 2026 the European Banking Authority published EBA/GL/2026/10, the revised EBA internal governance guidelines under Directive 2013/36/EU, the Capital Requirements Directive (CRD). Once applicable, EBA/GL/2026/10 will replace EBA/GL/2021/05. The revised text reflects CRD VI, Directive (EU) 2024/1619. It sets expectations for the mapping of duties and the individual statements of roles and duties that Article 88(3) CRD now requires, adds a section on the internal governance of third-country branches, and introduces measures for a former CEO who moves into the chair. The EBA presents the package as part of its simplification work, with a more proportionate and risk-based approach and a less prescriptive text than its August 2025 consultation.

None of it applies yet. The final report leaves the application date, the repeal date of EBA/GL/2021/05 and the competent authorities’ notification deadline as placeholders, and the EBA lists the guidelines as final and awaiting translation into the EU official languages. The Level 1 duties behind them run on a different clock: CRD VI required Member States to apply their transposition measures from 11 January 2026, so the Article 88(3) documentation duty already applies wherever national transposition is complete.

For governance secretariats, compliance officers and heads of internal control, the useful work sits in that gap: deciding which proportionality choices the final text supports, recording the reasons, and drafting the mapping and statements a supervisor can ask to see.

Related reading: ESMA/EBA Suitability Assessment Guidelines: What the 2026 Consultation Means for Luxembourg Boards

Key dates for the EBA internal governance guidelines

The calendar mixes fixed Level 1 dates with Level 2 dates the EBA has not yet set.

Status and legal basis of EBA/GL/2026/10

The EBA issues the guidelines under Article 74(3) CRD, which mandates it to further harmonise institutions’ governance arrangements, processes and mechanisms, and under Article 48g(9) CRD for the internal governance of third-country branches. They are guidelines within the meaning of Article 16 of Regulation (EU) No 1093/2010, the EBA Regulation. Under Article 16(3), competent authorities and financial institutions must make every effort to comply, and each competent authority notifies the EBA whether it complies or intends to comply, or gives its reasons for not complying. The EBA publishes those notifications.

Competent authorities comply by building the guidelines into their own practice, for example by amending their legal framework or supervisory processes, even where the text is aimed mainly at institutions. In its feedback table the EBA describes the ECB’s Single Supervisory Mechanism as subject to the same comply-or-explain process and as a participant in drafting the guidelines, so for banks supervised directly by the ECB, the ECB’s own notification is the one to read once the EBA publishes the notifications on its website.

The date of application is the detail that trips up planning. Paragraph 15 of the final text reads “These guidelines apply from XX/XX/XXXX”, and paragraph 16 repeals EBA/GL/2021/05 with effect from a date that is also blank. When respondents asked for a clear date and enough time to implement, the EBA answered that the guidelines will only enter into force after the CRD VI transposition deadline, that each set of EBA guidelines carries its own date of application, and that the CRD contains no grandfathering or transitional period on these matters. Until the repeal takes effect, EBA/GL/2021/05 is the version in place.

Who the revised guidelines reach, and at which level

The addressees are competent authorities and four groups of firms: institutions within the CRD definition, including central bodies referred to in Article 10 of Regulation (EU) No 575/2013 (CRR); investment firms subject to Title VII CRD through Article 1(2) and (5) of Regulation (EU) 2019/2033 (IFR); financial holding companies and mixed financial holding companies approved under Article 21a(1) CRD; and third-country branches, for the limited scope covered further down. The reference to central bodies was added after consultation responses asked for it.

The investment firm limb is narrower than it looks. Only firms that the IFR routes into Title VII CRD under Article 1(2) and (5) are addressees, so an investment firm outside that route does not pick up these guidelines through this text.

Institutions apply the guidelines on an individual, sub-consolidated and consolidated basis, following Article 109 CRD. At group level, the consolidating institution is expected to carry governance arrangements into subsidiaries that are not themselves subject to the CRD, including those in third countries and offshore financial centres, unless the EU parent can show that doing so is unlawful under the third country’s law. Where an EU subsidiary of a non-EU parent is the consolidating institution, the scope of prudential consolidation excludes the third-country parent and that parent’s other direct subsidiaries, and the parent’s group-wide policy is taken into account only insofar as it does not conflict with EU law.

One definitional point changes the size of every inventory that follows. Where the management body delegates executive functions to a CEO or an executive committee, paragraph 10 treats those persons as the management body in its management function for the purposes of the guidelines, even if national company law never appointed them as formal board members. Respondents asked the EBA to keep this delegation wording, and the final text retains it. A CEO who sits outside the statutory board is still inside the population the guidelines address.

What the 2026 revision changes against EBA/GL/2021/05

The EBA’s impact assessment names three aims for the 2026 amendments: specifying the Article 48g CRD governance requirements for third-country branches, giving effect to the Article 88(3) individual statements and mapping of duties, and delivering the simplification and burden-reduction objectives of the action plan its Board of Supervisors endorsed in December 2025 (TFE Recommendation 2.2). Combined with the feedback table, that account shows the 2026 revision adding or redrafting:

• a new Section 7.2 on third-country branches’ internal governance arrangements;
• paragraphs 71 to 76 on the mapping of duties and individual statements, with an optional template in the Annex;
• redrafted provisions reflecting the EBA’s benchmarking of diversity practices and gender-neutral remuneration policies, ESG risks over the short, medium and long term under Article 87a CRD (with a long-term horizon of at least 10 years in the risk management framework), and the Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554;
• conflict-of-interest measures for a former CEO who becomes chair and for a CEO who holds supervisory seats elsewhere in the group; and
• references to the AMLR alongside the existing references to Directive (EU) 2015/849.

Between consultation and final text, the EBA’s press release lists four main changes: less detail for the mapping of duties and individual statements, more proportionality for third-country branches, clearer and simpler conflict-of-interest provisions, and less granularity in diversity and inclusion monitoring. The feedback table and impact assessment show what that meant line by line.

Mapping of duties and individual statements under Article 88(3)

Article 88(3) CRD, inserted by CRD VI, requires Member States to ensure that institutions draw up, maintain and update individual statements setting out the roles and duties of all members of the management body in its management function, of senior management and of key function holders, together with a mapping of duties that records reporting lines, lines of responsibility and the persons who are part of the governance arrangements under Article 74(1). Both must be available at all times and communicated to competent authorities on request, including for authorisation under Article 8. The obligation sits in the Directive. Paragraphs 71 to 76 of the guidelines shape how it is met.

The group trap sits in paragraph 75(b). A person holding several roles within one institution needs one statement; a person holding roles in more than one institution, including within the same group, needs a statement for each institution. A respondent asked for a group exemption and the EBA refused, noting that the requirement applies at individual and at consolidated or sub-consolidated level and that guidelines cannot derogate from the CRD. The same answer went to a respondent whose board members are appointed by regional or local elected bodies under Article 91(14) CRD: no derogation from Article 88(3).

Individual statements leave collective responsibility intact. Paragraph 75(b) states that allocating roles and duties to an individual does not exempt any member of the management body in its management function from the collective roles and duties of the body. The populations also differ between the two documents: read with Article 88(3), a non-executive director appears in the mapping without needing an individual statement under that Article.

The Annex template is optional. The EBA had already considered and rejected both a no-template option and a mandatory template in the consultation paper’s impact assessment, and when respondents warned that a detailed annex risked being read as binding, it kept the annex as a non-mandatory template. The template asks for personal identification details, a roles table (level of the position, role description, time commitment) and a duties table with four columns: a duty number, the duty, its effective date and details of any sharing arrangement, with a shared duty recorded the same way in each statement involved.

Article 88(3) asks for the documents “in due time, upon request”. The EBA declined to define that, saying competent authorities will specify expected timelines in line with supervisory practice.

Title I proportionality: the criteria and their limits

Title I anchors proportionality in Article 74(2) CRD. Institutions take into account their size and internal organisation and the nature, scale and complexity of their activities; significant institutions should have more sophisticated arrangements, while small and less complex institutions may implement simpler ones. Paragraph 18 adds a caution: size or systemic importance may not, by itself, show how far an institution is exposed to risk.

Paragraph 19 lists fifteen criteria that institutions and competent authorities should both take into account. Two turn on formal classifications that also drive other CRR and CRD requirements: whether the institution is a small and non-complex institution or a large institution under points 145 and 146 of Article 4(1) CRR, and, for branches, whether the branch is class 1 or class 2 under Article 48a CRD. The other thirteen are judgement factors, ranging from balance-sheet total and listing status to the use of internal models, third-party service providers and ICT systems. Separately, the definition of significant institutions (G-SIIs, O-SIIs and other institutions so determined by the competent authority or national law) drives the committee rules in Title II.

The EBA was explicit about the limit of all this. Responding to requests for broader application, it wrote that proportionality applies to all provisions and all entities within scope, but that it “does not create any derogations/exemptions from CRD provisions”. Respondents also asked for clearer criteria, such as size or complexity, to trigger simplified requirements, and the final text adds none. No balance-sheet figure in Title I switches a paragraph off.

My reading is that the shared list is the operative point. Because competent authorities weigh the same criteria, a proportionality choice is something a supervisor can test against the institution’s own facts, and several paragraphs make the record explicit: the reasons for combining committees (paragraph 68), the decision to combine the risk management and compliance functions (paragraph 192) and, for third-country branches, the justification for not appointing separate heads (paragraph 102).

Where the final text lets smaller institutions scale down

The levers are specific, each comes with a condition, and two rules do not scale at all.

The combination route deserves a closer read. In its feedback table the EBA reads the third subparagraph of Article 76(6) CRD as making heads of internal control functions independent senior managers while allowing, under certain conditions, another “senior person” to carry the risk management or compliance responsibilities, and it notes that this senior person need not be a member of senior management. It adds that the two functions may be combined under one senior person, including a member of the management body in its management function, and says the European Commission confirmed that a management body member may also head a control function. Where a member of the management body in its management function heads a control function, paragraph 187 asks for safeguards against conflicts, such as an independent mindset and appropriate key performance indicators, including objective appraisal and remuneration determination.

Two rules hold whatever the institution’s size. Where the CRD or national law requires a committee, it should have at least three members (paragraph 49). And in all institutions, the chair of the risk committee should be neither the chair of the management body nor the chair of any other committee (paragraph 56). G-SIIs and O-SIIs carry stricter composition rules on top, including a majority of independent members on the risk committee and independent chairs for the risk and nomination committees.

Conflicts of interest: the chair, the CEO and the two-year window

Article 88(1)(e) CRD, as replaced by CRD VI, prohibits the chair of the management body in its supervisory function from exercising the functions of a CEO within the same institution at the same time. Paragraph 38 restates this and adds the general principle that the chair should be a non-executive member. Where the chair is permitted to take executive functions, including in another group entity, the institution should identify, assess and mitigate any adverse impact on its checks and balances, for example by designating a senior or lead independent board member or keeping a sufficiently strong non-executive presence on the board.

Two group scenarios get their own paragraphs. A CEO who also sits in the supervisory function, including as chair, of other institutions in the same group triggers an assessment of potential conflicts and documented mitigation (paragraph 122). A former CEO who becomes chair of the same entity within two years of the end of the executive mandate triggers paragraphs 123 and 124: the potential conflicts should be identified, managed and mitigated, and without a two-year cooling-off the institution should put measures in place, which may include the following illustrative actions, without prejudice to national law:

• the former CEO does not chair the discussion of an item identified as a conflict of interest;
• the other members of the supervisory function may ask the chair to abstain from voting on such items;
• the chair takes no part in the discussion or vote where the item evaluates their own performance as CEO or concerns remuneration resolutions for that former role.

The two-year window works as a trigger for measures. Read literally, paragraphs 123 and 124 allow the move within two years provided mitigation is in place, and national law may go further. The consultation draft was stricter: the Banking Stakeholder Group objected to a proposed three-year cooling-off and to tighter rules on combining roles within groups, and the EBA says it narrowed the scope to the CEO and chair and shortened the period.

The conflict-of-interest policy for staff, a term the guidelines define to include management body members, should set a timeframe for reporting conflicts arising from past relationships, cover other employment and previous employment within the recent past (the text gives five years as an example), and treat shareholdings, private accounts or loans with the institution as no conflict where they stay within an appropriate de minimis threshold. For loans and other transactions with management body members and their related parties, the management body sets thresholds above which its own approval is always required, and paragraph 146 lists the data each loan record should hold, from the debtor’s status to yes/no flags on whether market conditions or all-staff conditions applied.

Credit lines get a specific rule. Paragraph 144 treats the initial decision on an overdraft or similar facility, and any amendment to it, as decisions to document, while drawings within the agreed limit are not new decisions; an amendment that is material under the institution’s own policy needs a fresh assessment and decision. For a loan above EUR 200,000 to a management body member or related party, the institution should be able to give the competent authority, on request, the share of the loan and of all outstanding loans to the same debtor in Tier 1 plus Tier 2 capital and in CET1, whether the loan forms part of a large exposure, and the debtor’s weight within all outstanding loans to management body members and their related parties.

Third-country branches: which parts of the guidelines apply

Paragraph 12 sets the scope for third-country branches: Title I, Section 2 of Title II, Section 7.2 of Title III, Sections 8, 9 and 13 of Title IV, Title V, and Title VII except paragraphs 244 and 245. A footnote adds that competent authorities or national law may apply further sections. Read literally, the list leaves out, among others, the committee and chair provisions, Section 6 (which carries the mapping of duties and individual statements), Sections 10 to 12 on conflicts of interest and internal alert procedures, and Title VI on business continuity, although Section 7.2 brings DORA in directly for the branch’s ICT risk.

The EBA’s feedback table explains the design. A branch has no legal personality, so the guidelines require neither a management body in its supervisory function at the branch nor the head undertaking’s management body in its management function to run the branch day to day. They apply Article 48g CRD instead: at least two persons located in the relevant Member State must effectively direct the branch, subject to prior approval by the competent authority under Article 48g(1). Those persons must be of good repute, possess sufficient knowledge, skills and experience, and commit sufficient time to their duties. The guidelines adapt the management-function duties under paragraphs 28 to 32 to the branch.

Class 1 branches may set up, or be required by the competent authority to set up, a local management committee, which then follows the open-discussion and documentation rules that apply to committees. Persons directing the branch should commit sufficient time even where they hold equivalent roles at the head undertaking, be sufficiently present in the Member State and at the branch’s premises, and have conflicts from those dual roles avoided or managed. Where the conditions in Article 91(3) and (4) CRD are met, the branch position counts as an executive directorship.

The class split matters most for control functions. In Class 1 branches, and in Class 2 branches where the competent authority requires it under Article 48g(3), the heads of risk management, compliance and audit should not be removed without prior approval of the supervisory function of the third-country head undertaking. For Class 2 branches, the final report reads Article 48g(3) as requiring effective internal control functions without necessarily separating risk management from compliance and without that prior-approval rule, while letting competent authorities require more depending on size, complexity and risk profile. Paragraph 102 covers branches that have to apply the third subparagraph of Article 76(6) CRD: every Class 1 branch, and any Class 2 branch that the competent authority has required to appoint heads of internal control functions under Article 48g(3). Where such a branch combines the head of risk management or compliance with other functions under one senior person, it should be able to show that its activities do not justify a separate appointment and that the conflict-of-interest assessment has been performed, and should document the decision.

Substance rules close the section. Branches should keep enough substance to avoid becoming “empty shells” or “letter-box entities”, including when they rely on intragroup or third-country service providers for critical or important functions; they should manage ICT risk under Article 48g CRD and DORA and, without prejudice to Article 48g(2) and (3), comply with the remuneration principles in Articles 92, 94 and 95 CRD. On back-to-back booking, transactions with an EU nexus should at a minimum be risk-managed from the EU, with the associated business run in the Member State. A respondent argued that the consultation wording, under which such transactions should be neither systematically nor substantially back-to-backed, went beyond CRD VI, and the final text was clarified to the risk-management formulation.

The new CRD VI third-country branch regime applies from 11 January 2027, except the Article 48k and 48l reporting requirements, which apply from 11 January 2026. The 11 January 2027 date does not defer DORA, which has applied generally since 17 January 2025. The European Commission confirmed on 17 December 2025, in DORA Q&A 102, that DORA also applies to third-country branches whose head office would be in scope in its home jurisdiction, and the CSSF set out the treatment of Luxembourg third-country branches in Circular CSSF 26/915 of 27 August 2026. Our guide to CRD6 third-country branch authorisation under the EBA guidelines covers the authorisation file, and our article on EBA reporting framework 4.3 and third-country branch reporting covers the new branch returns.

Internal control functions and the AMLR hand-over

Title V keeps the three internal control functions required by Article 76(5) CRD: risk management, compliance and internal audit, with risk management and compliance themselves subject to internal audit review. Paragraph 184 adds that the control functions’ responsibilities include ensuring compliance with AML/CTF requirements.

Two AML references now sit side by side. Paragraph 32 keeps the rule that the management body identifies one of its members, in line with Article 46(4) of Directive (EU) 2015/849, as responsible for AML compliance, without prejudice to national transposition. Paragraph 186 adds the AMLR route: institutions should assign responsibility for compliance with Regulation (EU) 2024/1624 to a member of the management body in its management function under Article 11(1) AMLR, and the person responsible for day-to-day AML/CFT policies, procedures and controls under Article 11(2) and (5) should be able to report directly to the supervisory function. A footnote records that the AMLR applies from 10 July 2027.

My reading is that the two references describe consecutive regimes. If EBA/GL/2026/10 starts to apply before 10 July 2027, the Directive route governs the board-member designation in the meantime and the AMLR route takes over from that date, which turns the hand-over into a dated change to the mapping of duties and to the statements of the persons concerned.

Paragraph 189 contains an event-driven notification. Institutions should have documented processes for assigning the head of an internal control function and withdrawing their responsibilities; under Article 76(6) CRD, a head cannot be removed without prior approval of the management body in its supervisory function; and in significant institutions, competent authorities should be informed promptly about the approval and the main reasons for the removal. Paragraph 188 adds that each head’s direct access to the supervisory function belongs in the mapping of duties and in that head’s individual statement.

For the compliance function itself, paragraph 218 frames the task around compliance risk, the risk stemming from non-compliance events. Respondents objected to drafting that blurred compliance with the legal function, and the EBA says it reviewed that interplay. The compliance function gives a documented prior opinion on new products or significant changes to existing ones (paragraph 181), verifies with the risk management function and the legal unit that new products, systems and procedures comply with current law and known forthcoming changes (paragraph 223), while subsidiaries and branches should tell the head of compliance of the consolidating institution when local law hampers stricter group procedures or blocks information exchange (paragraph 225).

Supervisory touchpoints in the revised guidelines

The revised guidelines themselves do not prescribe a periodic institutional return, and their only annexed template is the optional individual statement form. From 11 January 2027, Article 48g(8) CRD separately requires competent authorities to require regular independent third-party assessments of a third-country branch’s compliance with the Article 48g requirements, with the findings and conclusions reported to the competent authority. Article 48h(3) CRD also requires an independent written and reasoned opinion on compliance with the branch booking requirements to be regularly prepared and addressed to the competent authority. Neither provision fixes a cadence. Additional touchpoints under the governance guidelines include information supplied on request or following specified events:

• the mapping of duties and individual statements, in due time on request;
• complete, updated documentation of loans to management body members and their related parties, in an appropriate format on request without undue delay, with the extra analysis for loans above EUR 200,000;
• the justification for decisions on complex structures (paragraph 85), and information on non-standard or non-transparent activities and their risks, reported to the competent authority that granted authorisation (paragraph 86);
• prompt information on the removal of a head of an internal control function in significant institutions;
• where a competent authority requires it under Article 106(2) CRD, an annual publication of the group’s legal, governance and organisational structure covering the items in paragraph 245.

On the authority side, Section 13 asks competent authorities to run channels for staff to report potential or actual breaches of regulatory requirements, including those of the CRR and national CRD provisions, and allows them to encourage staff to try internal alert procedures first. The background section also says the guidelines should be read with other EBA guidelines, including those on third-party risk, suitability, remuneration, ESG risks and the supervisory review and evaluation process (SREP); our article on the revised EBA SREP guidelines covers the last of these.

Building the gap analysis before the application date

Most of what the guidelines expect takes the form of documents and recorded decisions, so the gap analysis is largely a documentation exercise. One sequence that follows the paragraphs above:

1. Confirm the national text. Check how the relevant Member State transposed Article 88(1)(e), Article 88(3) and Article 76(6) CRD; Luxembourg’s Law of 5 May 2026, covered in our CRD VI Luxembourg transposition article, is one example of the national layer the guidelines sit on.
2. Build the role inventory: every management body member in both functions, every senior manager and key function holder, and any CEO or executive committee member who counts as the management function under paragraph 10. Mark split and shared roles.
3. Draft the mapping, as a repository if that suits the group, record reporting lines including group lines, obtain management body approval, and agree in advance what counts as a limited or minor update.
4. Issue individual statements per person and per institution, signed, with a review cycle tied to the mapping.
5. Open a proportionality file recording each choice and its reasons: committees not established or combined, risk management and compliance combined, control-function tasks performed by a third party, internal diversity indicators chosen.
6. Update the conflict-of-interest policies for the chair and CEO rules, group seats, CEO-to-chair moves within two years, the past-relationship timeframe, the de minimis threshold and the loan approval thresholds.
7. For third-country branches, map the paragraph 12 scope, decide or confirm the Class 1 local management committee, and keep evidence of the presence of the persons directing the branch.

Frequently Asked Questions

Can the mapping of duties name roles instead of individuals?

Yes. A respondent argued that naming individuals adds complexity and dates quickly, and the EBA accommodated the comment, with one condition: the institution should still be able to give the competent authority the names of all members of the management body, senior management and key function holders. A role-based mapping therefore needs a current name register behind it.

Our group keeps governance documents in a central system. Does each subsidiary still need its own mapping?

Each institution needs a mapping available at individual level, plus consolidated and sub-consolidated mappings where applicable (paragraph 72). The same paragraph lets a group hold the information in central systems, provided each subsidiary can access the information relevant to it. Central storage therefore meets paragraph 72 only where access rights reach each subsidiary’s own information.

Does every change to the mapping need fresh management body approval?

No. In its feedback table the EBA says the mapping should be updated where needed, for example to align with changes in individual statements, and that such updates do not require a full new approval process where the changes are limited or minor. The guidelines do not define “limited or minor”, so the institution’s own update protocol has to draw that line.

We use the EBA’s optional template for individual statements. Is anything missing?

Possibly a signature. Paragraph 75(c) expects each statement to be signed by the individual it applies to, and the Annex template as printed in the final report contains identification fields, a roles table and a duties table but no signature block. The EBA defended the signature point in its feedback, saying it is hard to see why a statement should not be validated by the signature of the person making it. Adding a dated signature line to the template closes the gap.

A director has two loans of EUR 150,000 each from the institution. Does the EUR 200,000 analysis apply?

Paragraph 148 is drafted per loan: the additional information is due “for a loan” above EUR 200,000, and the aggregate of all outstanding loans to the same debtor only enters the calculation once that trigger is met. Read literally, two loans of EUR 150,000 each do not trigger it, although both still need the full paragraph 146 record. My reading is that splitting one facility into several loans to stay under the trigger sits badly with paragraph 139, which asks for objective, arm’s-length decisions on such loans, and paragraph 147 lets the competent authority request the complete loan documentation whatever the amount.

National law already imposes a longer cooling-off for a former CEO. Which rule wins?

Paragraphs 123 and 124 apply “without prejudice to national law”, and the illustrative mitigation measures are stated the same way. On that wording, where national law sets a longer cooling-off or bars the move outright, that rule governs; the guidelines’ measures fill the space where national law permits the transition.

We have a two-tier board. Who is the management body in its management function?

The guidelines are neutral on board structure. The terms “management function” and “supervisory function” apply to whichever bodies or members carry those functions under national law, so in a two-tier model where national law gives the management board the executive role and the supervisory board the oversight role, those are the two functions; competent authorities may specify the allocation when they implement the guidelines (paragraph 9). Where national law lets shareholders, members or owners exercise some responsibilities directly, paragraph 11 asks institutions to align those decisions as far as possible with the guidelines for the management body.

Related Articles

• ESMA/EBA Suitability Assessment Guidelines: What the 2026 Consultation Means for Luxembourg Boards: the February 2026 joint consultation on revised suitability rules for management body members and key function holders under CRD VI.
• CRD6 Third-Country Branch Authorisation: The 11 January 2027 Deadline: what non-EU banks file for third-country branch authorisation under the EBA’s final guidelines.
• CRD VI Luxembourg Transposition: What the Law of 5 May 2026 Changes for Credit Institutions: how one Member State moved CRD VI governance and fit-and-proper rules into national law.
• EBA Revised SREP Guidelines: What EU Banks Must Review in ICAAP, ILAAP and Pillar 2 Capital: the revised SREP guidelines that the internal governance guidelines are meant to be read alongside.
• CSSF Fit and Proper Declaration: Revised Forms Apply From 15 October: the CSSF’s revised declaration forms and appointment procedure for management body members and key function holders.

Key Takeaways

• Plan against two clocks: national CRD VI law for the Article 88(3) documents now, and EBA/GL/2026/10 from an application date the EBA has not yet published.
• Budget one individual statement per person per institution; group officers with roles in several entities multiply the count.
• Ask the competent authority what “in due time” will mean for Article 88(3) requests; the EBA left that timeline to supervisors.
• Keep internal audit standalone in every scenario; merge risk management and compliance only with the paragraph 192 demonstration, conflict assessment and documented decision.
• Treat any CEO-to-chair move inside two years as a documented conflict case, with the paragraph 124 measures written into the board’s procedures.
• For Class 2 third-country branches, confirm with the competent authority before 11 January 2027 whether separate risk and compliance heads will be required.
• Date-stamp the AML board designation: the Directive (EU) 2015/849 route until 10 July 2027, Article 11 AMLR from then.

Sources and References

• EBA press release, “The EBA publishes revised Guidelines on internal governance, delivering greater proportionality and simplification for banks” (5 November 2026): eba.europa.eu
• EBA, Final report on Guidelines on internal governance under Directive 2013/36/EU, EBA/GL/2026/10 (5 November 2026): Final report (PDF)
• EBA, Guidelines on internal governance under CRD, activity page (status and versions): eba.europa.eu
• EBA, Consultation Paper on draft revised Guidelines on internal governance, EBA/CP/2025/20 (7 August 2025): Consultation paper (PDF)
• Directive (EU) 2024/1619 (CRD VI), including Article 2 on transposition and application: EUR-Lex
• Directive 2013/36/EU (CRD), Articles 48a, 48g, 48h, 74, 76, 88, 91 and 109 (Articles 48a, 48g and 48h introduced, and Articles 74, 76, 88 and 91 amended, by Directive (EU) 2024/1619): EUR-Lex
• Regulation (EU) No 1093/2010 (EBA Regulation), Article 16: EUR-Lex
• Regulation (EU) No 575/2013 (CRR), Article 4(1), points 145 and 146: EUR-Lex
• Regulation (EU) 2019/2033 (IFR), Article 1(2) and (5): EUR-Lex
• Regulation (EU) 2024/1624 (AMLR), Article 11: EUR-Lex
• Directive (EU) 2015/849 (AMLD), Article 46(4): EUR-Lex
• Directive (EU) 2024/1640, Article 77, repealing Directive (EU) 2015/849 with effect from 10 July 2027: EUR-Lex
• Regulation (EU) 2022/2554 (DORA): EUR-Lex
• CSSF, Application of DORA to third-country branches in Luxembourg (27 August 2026): CSSF
• EBA Final report, Guidelines on the sound management of third-party risk regarding non-ICT services, EBA/GL/2026/09 (18 September 2026): EBA (PDF)
• EBA, Final Report on Guidelines on the authorisation of third-country branches (July 2026), for the 11 January 2027 application of the branch regime: Final report (PDF)

Next checkpoint for EBA/GL/2026/10: the translated versions

The next date to watch is the EBA’s publication of the guidelines in the EU official languages. The EBA treats guidelines as formally issued only at that point, which starts the two-month period in which competent authorities notify whether they comply; the application date and the repeal date for EBA/GL/2021/05 stay blank until the EBA publishes them. The artifact to have ready by then is a management-body-approved mapping of duties, backed by signed individual statements for every member of the management function, senior manager and key function holder, and a proportionality file that records why each simplification was taken.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.