EBA Revises Banking Governance Guidelines for ESG and Operational Risks

The European Banking Authority (EBA) has published revised internal governance guidelines that strengthen how EU banks manage environmental, social and governance (ESG) risks, management accountability, and operational resilience. Released on 5 November 2026, the 104-page report aligns supervisory expectations with the revised Capital Requirements Directive (CRD VI) and the Digital Operational Resilience Act (DORA). It introduces more detailed guidance on management responsibilities and third-country banking operations while simplifying compliance requirements following industry consultation.

The revised framework addresses governance challenges arising from climate risks, digitalization, artificial intelligence and increasingly complex financial institutions. It also reinforces the principle of proportionality, allowing governance arrangements to reflect an institution's size, business model and risk exposure. The guidelines are final but not yet applicable, with implementation dates pending confirmation.

 

ESG Risk Management Extends to Long-Term Banking Decisions

 

The guidelines reinforce requirements for banks to incorporate ESG factors into their overall risk management frameworks, covering short-, medium- and long-term risks over a horizon of at least 10 years. Institutions are expected to consider how environmental and social developments could affect traditional financial risks, including credit, market, operational and reputational exposures. Particular attention is given to physical climate risks, such as extreme weather, and transition risks arising from changes in regulation, technology and economic activity.

Rather than treating ESG as a separate compliance exercise, the EBA expects these considerations to inform risk strategies, internal controls and management decisions. Banks must maintain processes to identify, assess, monitor and mitigate material exposures, with risk management functions contributing to strategic decisions. The guidelines also address the role of risk committees in evaluating ESG-related indicators and remuneration incentives. These provisions clarify how to apply requirements introduced through CRD VI and the EBA's existing ESG risk management framework.

 

Read more: Thailand SEC Introduces Mandatory ISSB Sustainability Reporting Rules Starting 2027

 

Management Accountability and Board Responsibilities Receive Greater Scrutiny

 

A central element of the revised guidelines concerns documenting individual responsibilities within financial institutions. Under CRD VI, banks must maintain a mapping of duties for members of the management body, senior management, and key function holders, identifying reporting relationships and the allocation of responsibilities. Individual statements must also document the specific roles and duties of executive management body members, senior executives and key function holders. These records are intended to help supervisors identify accountability gaps and understand how decisions are made within complex banking organizations.

The EBA has simplified the documentation requirements following concerns that the original proposals were excessively detailed. Institutions may use existing governance repositories, while a template for individual responsibility statements remains optional. The guidelines also clarify how to manage conflicts of interest, including situations where a former chief executive becomes chair within two years of leaving the executive role. Rather than imposing a blanket prohibition, the framework focuses on identifying conflicts and implementing appropriate safeguards.

 

Third-Country Bank Branches Face Clearer Governance Expectations

 

The revised guidelines specify governance requirements for branches of non-EU banks operating within the European Union. Under CRD VI, third-country branches must have at least two individuals located in the relevant member state who effectively direct their business. These individuals must have sufficient authority, experience and local presence to manage operations and associated risks. Branches must also maintain appropriate internal controls, transparent reporting structures and adequate operational resources.

The EBA distinguishes requirements by third-country branch class, reflecting differences in size, complexity, and risk. Class 1 branches face more extensive governance expectations, while certain requirements for Class 2 branches can be applied proportionately. The framework also addresses risks associated with outsourcing and transactions booked between branches and parent institutions. Branches are expected to maintain sufficient local operational substance rather than functioning primarily as administrative entities with limited oversight capabilities.

 

Explore OneStop ESG Marketplace: ESG risk & compliance management

 

Operational Resilience, AI and Internal Controls Gain Attention

 

Digitalization and technological dependence have expanded the range of risks requiring management oversight. The revised guidelines align governance expectations with DORA, particularly regarding information and communication technology, cybersecurity, third-party service providers and business continuity. Banks are expected to assess risks associated with emerging technologies, including artificial intelligence, and maintain arrangements that support the continued operation of critical functions during disruptions.

The framework retains the three-lines-of-defense model, under which business units manage operational risks, risk management and compliance functions provide oversight, and internal audit independently evaluates governance effectiveness. The EBA permits combining risk management and compliance functions under specified conditions, particularly where an institution's size and complexity justify the arrangement. Internal audit must remain independent. Institutions must also maintain procedures to escalate risk concerns, report regulatory breaches, and address weaknesses identified through internal reviews.

 

Simplification Measures Aim to Reduce Compliance Burdens

 

The final guidelines incorporate feedback from a three-month public consultation that concluded in November 2025 and received 24 responses. Industry stakeholders raised concerns about documentation requirements, governance flexibility, conflicts of interest, and overlap with existing regulations. In response, the EBA reduced the detail required for responsibility mapping, simplified diversity and inclusion monitoring expectations, and adopted a more principles-based approach to several governance provisions.

The EBA expects these changes to limit implementation costs because many requirements already exist under CRD VI or other regulatory frameworks. The revised guidance gives institutions greater flexibility to demonstrate compliance while maintaining supervisory expectations for effective governance and risk management. Its practical impact will depend on how national supervisors apply proportionality and how banks integrate the clarified requirements into their existing systems.

The guidelines will replace the EBA's 2021 internal governance guidance once the new framework becomes applicable. As of 9 November 2026, the final report remains awaiting translation into EU official languages, and the application date has not been confirmed. Banks will therefore need to distinguish between obligations already established under CRD VI and the additional supervisory clarifications provided by the revised guidelines.

 

Source: EUROPEAN BANKING AUTHORITY