The European Banking Authority has published updated Supervisory Review and Evaluation Process guidelines, revising the framework used by competent authorities, including the ECB, to assess banks in line with the reforms introduced by the Banking Package, known as CRR3 and CRD VI. The revision is the third major update of the SREP framework since 2014.
The updated SREP guidelines, released on 26 June 2026, are accompanied by a list of legal acts intended to help competent authorities carry out their SREP assessments consistently across the European Union.
SCOPE OF THE UPDATED FRAMEWORK
The revised guidelines support competent authorities in their assessments of banks' business models, internal governance, capital and liquidity risks, giving supervisors a common methodology to evaluate the resilience of institutions across the EU.
The guidelines incorporate new CRD VI mandates, including on third-country branches and the operationalisation of the output floor, and clarify the interaction between Pillar 1 and Pillar 2 requirements. The EBA said the revision introduces targeted rationalisation measures, including a 30% reduction in the overall page count, while preserving the core structure and objectives of the SREP.
The EBA said the revised guidelines pave the way for "a more risk-focused, efficient, proportionate and forward-looking framework for supervisors across the EU", with supervisory assessments calibrated in scope, depth and intensity to institutions' risk profiles.
SUPPORTING TOOLS FOR SUPERVISORS
Alongside the updated guidelines, the EBA published a list of legal acts facilitating SREP assessments.
The revised guidelines also broaden the identification of risks, with more focus on emerging or materially evolving risk drivers including ICT, ESG and credit spread risk from non-trading book activities (CSRBB), and incorporate DORA into the treatment of ICT risk.
The guidelines apply from 1 January 2027, when they replace the 2022 SREP guidelines and the 2017 ICT risk-assessment guidelines; competent authorities must report whether they comply or intend to comply within two months of publication of the translations.