The European Supervisory Authorities (EBA, EIOPA, and ESMA) published their Autumn 2026 risk update on 23 September 2026. The update identifies external dependencies, emerging technologies, and private credit as key vulnerabilities in the EU financial system, requiring firms to review their risk management frameworks.
The authorities rely on their collective mandate to ensure financial stability and consumer protection. The update does not cite a specific article or section but emphasizes the need for vigilance regarding the identified vulnerabilities.
The update applies to all regulated entities operating within the EU financial sector, particularly those involved in crypto-assets and payment services.
The update does not specify a deadline for compliance but encourages firms to integrate the insights into their operational resilience strategies and risk assessments.