EU Banking Supervision Simplification | Revised SREP: Why banks must start preparing now

The European Banking Authority (EBA) is revising its Guidelines on the Supervisory Review and Evaluation Process (SREP) and supervisory stress testing to make EU banking supervision simpler, better proportioned and more effective. While the revised framework streamlines supervisory processes, it also reinforces expectations around resilience, governance and risk management.

The proposals implement new CRD VI mandates, strengthen the assessment of interest-rate risk in the banking book (IRRBB) and credit spread risk in the banking book (CSRBB), further embed operational resilience and ESG risks, and establish a clearer link between supervisory findings and supervisory actions.¹ They also closely support the ECB’s Supervisory Priorities 2026–2028, which focus on strengthening financial resilience, operational resilience, governance and risk data capabilities across the banking sector.²

Simplification without lighter supervision

While the revised guidelines introduce new supervisory expectations, they are also part of the EBA simplification agenda. The objective is to reduce duplication by integrating existing frameworks, align supervisory practices across the EU and apply greater proportionality, particularly for smaller and less complex institutions. Simplification should not, however, be mistaken for lighter accountability.

Selection of key revision topics

From compliance to continuous supervision

The revised SREP reflects a shift from periodic supervisory reviews towards a more continuous, evidence-based assessment of a bank's resilience. Supervisors will increasingly expect institutions to demonstrate not only that risks are identified, but also that governance, controls, capital, liquidity and management actions remain effective under stressed conditions.

A key change is the integration of the Digital Operational Resilience Act (DORA) into SREP, replacing the standalone ICT-risk assessment Guidelines. This confirms that cyber resilience, outsourcing, third-party risk and technology governance are now core prudential concerns rather than separate specialist topics.

Stress testing also becomes more central to supervisory assessment. Rather than serving primarily as a regulatory exercise supporting ICAAP, supervisors will increasingly expect stress-testing outcomes to inform capital and liquidity planning, recovery planning, risk appetite and strategic decision-making. Banks should be able to demonstrate that stress-testing results influence board discussions and management actions, providing tangible evidence of resilience rather than simply meeting reporting requirements.

Reliable risk data will also get a key overall SREP assessment criteria. The ECB's 2024 Guidelines on Risk Data Aggregation and Risk Reporting (RDAAR) provide the foundation for the revised SREP by strengthening expectations around data governance, risk reporting and management information.³ High-quality, consistent risk data enables credible stress testing, informed decision-making and more effective supervisory engagement.

The opportunity for banks

The revised SREP framework is not one-size-fits-all. Banks eligible for simplifications should use the more proportionate approach to reduce unnecessary supervisory process and focus resources on the risks that matter most. However, simplification does not remove the need for sound governance, credible stress testing, effective ICAAP and ILAAP, or demonstrable operational resilience. Eligible banks should ensure their evidence is targeted, reliable and clearly aligned to their risk profile.

Tier 1 banks face a different challenge. Given their scale, complexity and supervisory significance, they should expect a more intensive and integrated assessment. Their priority should be to strengthen the integration between risk, finance, treasury and technology functions; enhance RDAAR capabilities; and ensure that stress testing, capital and liquidity planning, and management actions form one coherent supervisory narrative.

The revised SREP Guidelines show how the EBA intends to deliver the ECB’s Supervisory Priorities 2026–2028 through more connected, data-driven and action-oriented supervision. For banks eligible for simplifications, the opportunity is to make continuous regulatory compliance more efficient by also streamlining end-to-end regulatory change processes embedded in an effective Internal Control System. For Tier 1 banks, it is to use stronger data, resilience and decision-making capabilities as a strategic advantage.

How Capco Can Help

Preparing for the revised SREP requires more than implementing regulatory changes. It requires connecting governance, risk, finance, data and technology into a coherent supervisory framework. Capco helps banks assess their readiness through targeted gap assessments, strengthen ICAAP, ILAAP and stress-testing capabilities, enhance RDAAR and data governance, and embed DORA requirements within broader risk management frameworks. By combining regulatory expertise with deep transformation experience, we support institutions in meeting the evolving supervisory expectations while improving resilience, decision-making and operational effectiveness.

To understand what the revised SREP means for your institution, Capco can support a targeted assessment of readiness, identify priority gaps across governance, stress testing, RDAAR, DORA and ESG risk integration, and translate supervisory expectations into practical remediation actions. We would welcome the opportunity to discuss how these changes may affect your firm and where a more connected, data-driven and proportionate supervisory response can create value.

References
¹ Guidelines for common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing | European Banking Authority
² Supervisory priorities 2026-28
³ European Central Bank, Guidelines on Risk Data Aggregation and Risk Reporting (RDAAR), 2024