What the joint programme covers
The Joint Committee of the European Supervisory Authorities published its 2027 work programme on 13 October. The EBA, EIOPA and ESMA identified digital operational resilience, technological innovation, sustainable finance, securitisation and cross-sector risk monitoring as priorities requiring coordinated supervision across the EU financial system.
Operational resilience and technology
Under the Digital Operational Resilience Act, the authorities plan to continue oversight of critical ICT third-party service providers and strengthen preparedness for cyber threats. They will also examine the implications of expanding artificial-intelligence use and other digital innovations. Consumer protection remains part of the programme, alongside work intended to support consistent supervision and the EU’s Savings and Investment Union. The announcement sets a supervisory agenda; it does not itself create new merchant obligations or replace existing DORA requirements.
What it means for merchants
Merchants and payment firms serving the EU should keep an auditable register of critical technology vendors, test incident and recovery procedures, and document AI governance. Provider contracts should clearly cover outage escalation, data access, subcontractors and regulatory cooperation.
Read the original announcement
European Banking Authority · 13 Oct 2026This brief summarizes the linked primary source. Claims and reported figures have not been independently audited by Payment Guide.