Joint Committee of EU Supervisors Sets 2027 Cross-Sector Work Programme

The Joint Committee of the European Supervisory Authorities (EBA, EIOPA and ESMA) published its Annual Work Programme for 2027 on 13 October 2026, the European Securities and Markets Authority announced. The programme sets out “its priorities for addressing cross-sectoral risks and strengthening coordination across the European Union’s financial sector,” with key areas including digital operational resilience, technological innovation, sustainable finance, securitisation and cross-sectoral risk monitoring.

The Joint Committee is a forum established to strengthen cooperation between the European Banking Authority, the European Insurance and Occupational Pensions Authority and the European Securities and Markets Authority. The European Commission and the European Systemic Risk Board participate in its work, alongside national competent authorities through dedicated sub-structures. The programme document, reference JC 2026 21, states that the committee will implement its 2027 activities, deliverables and coordination mechanisms within the context of simplification and burden reduction, against what it describes as a backdrop of continued heightened geopolitical tensions and uncertainty. The announcement adds that the programme supports the European Commission’s objectives to build an efficient Savings and Investment Union and to advance a simplification agenda aimed at reducing unnecessary regulatory burdens.

Digital Operational Resilience

Under the Digital Operational Resilience Act (DORA), the authorities will continue oversight activities relating to critical ICT third-party providers (CTPPs). Through the Oversight Forum, they will update the list of CTPPs at Union level, conduct risk assessments, carry out annual and multi-annual planning of activities, perform the planned examinations of each designated CTPP and follow up on any potential recommendations issued in 2026.

The programme also tasks the authorities, working with national competent authorities under the steering of the Oversight Forum, with analysing the ICT cyber-threat landscape, including information drawn from major ICT incidents, and with identifying areas where greater convergence of supervisory practices in the implementation and supervision of DORA is needed. They will support the European Commission in preparing a potential legislative proposal in the context of the DORA review. Expected outputs include an annual report on oversight activities in 2026, an annual report on major ICT-related incidents and a feasibility study on the collection of Master Data for registers of information.

Work under the pan-European Systemic Cyber Incident Coordination Framework (EU-SCICF) will prioritise testing, exercising and member capacity-building in 2027, following foundational design work on the framework, its tools and procedures in 2025 and 2026. A further priority is formalising strategic linkages with complementary frameworks, including EU-CyCLONE and the G7 Cyber Expert Group.

On consumer protection, the authorities expect in 2027 to draft regulatory and implementing technical standards based on empowerments in the proposed amendments to the PRIIPs Regulation under the Commission’s Retail Investment Strategy. The work, which includes consumer testing and public consultation, is intended to streamline and simplify the Key Information Document (KID), particularly its performance and cost sections; the programme notes the deadline for the standards may fall in 2028, subject to the Retail Investment Strategy legislative process. The authorities will also report on administrative sanctions or measures imposed under the PRIIPs Regulation during 2026, based on information submitted by national competent authorities, and will assess the impact of consumer factsheets, leaflets and a repository of national education initiatives in a post-implementation review. The 14th Joint Consumer Protection Day will be organised in 2027.

In sustainable finance, the authorities will monitor the ongoing review of the Level 1 text on sustainability-related disclosures in the financial services sector (SFDR), provide clarifications where necessary on the existing framework and, if required, deliver technical standards or technical advice, possibly including consumer testing of changes coming from the revised framework. On risk assessment, they will jointly analyse key cross-sectoral trends and vulnerabilities to financial stability, present findings to the Council through the Economic and Financial Committee and Financial Stability Table meetings, and publish twice-yearly risk updates on risks and vulnerabilities.

Securitisation, Conglomerates and Innovation

The programme recaps the securitisation reform timeline: the Commission published a package in June 2025 proposing amendments to the Securitisation Regulation, the Capital Requirements Regulation, the Liquidity Coverage Ratio and the Solvency II framework; the Council reached its general approach in December 2025; the European Parliament adopted its final position in May 2026; and trilogues commenced in June 2026, with implementation currently expected in the first or second quarter of 2027. The JCSC conducted follow-up technical work during 2026 on the Joint Committee report published in March 2025 and initiated preparatory work on the regulatory and implementing technical standard mandates on transparency requirements stemming from the proposal. Planned 2027 work includes analysis of concrete supervisory cases presented by national competent authorities, market monitoring of NBFI involvement in securitisation markets, notably developments in third-party risk financing for CLOs, taking into account the findings of the 2025 Joint Committee report under Article 44 of the Securitisation Regulation, and monitoring of regulatory developments in third countries, particularly the United States and the United Kingdom, to identify potential divergence risks. The JCSC will also start preparatory work on the data collection necessary for the review report under the EU Green Bond Standard, which is expected in December 2028.

On financial conglomerates, the authorities will contribute to the annual update and publication of the list of identified financial conglomerates under the Financial Conglomerates Directive, continue guidance on reporting templates for intra-group transactions and risk concentrations, launch a public consultation on capital adequacy reporting templates in the first quarter of 2027 and finalise that technical standard by the end of 2027. A mapping exercise will inform an analytical note on stress-testing practices for financial conglomerates, aimed at identifying potential gaps that may arise when conducting stress tests on a sectoral basis.

Through the European Forum for Innovation Facilitators, the authorities will run a third data collection exercise on BigTechs and Mixed Activity Groups providing financial services in the EU, with a special 2027 focus on artificial intelligence and tokenisation, and will support coordination and cooperation between existing financial-sector regulatory sandboxes and the AI regulatory sandboxes that member states must establish under the AI Act. The document records that in 2026 the authorities noticed an increase in innovation-hub enquiries concerning smart contracts, distributed ledger technology and tokenisation use cases that was not accompanied by a rise in crypto-asset issuance and offering activity, which it states may suggest a shift towards tokenisation to be explored further in 2027.

The authorities will continue regulatory work on External Credit Assessment Institutions under the Joint Committee mandate in Article 136 of the Capital Requirements Regulation and Article 109a(1) of Solvency II, producing mappings for newly registered credit assessment institutions and monitoring existing mappings. In work carried out in close cooperation outside the Joint Committee remit, they will also support ESMA’s implementation of the European Single Access Point based on Joint Committee implementing technical standards published in 2024, and will discuss issues linked to the implementation of phase 1 and phase 2 with an eye to the following phase 3.