Guide · Supervisor
Guidelines (revised) on common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing: final report
The EBA brings the SREP into a single, simpler, risk-based framework that incorporates ICT risk assessment, ESG factors and the output floor.
- Organization
- European Banking Authority (EBA)
- Document date
- 26 June 2026
- Type
- Guide
- Language
- English
- Scope
- European Union
- Length
- 290 pages
What it contains
The final report on the EBA’s revised guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing, EBA/GL/2026/06, was published on 26 June 2026. The SREP is the core supervisory process that consolidates the findings of all supervisory activities into a comprehensive assessment of each institution. This is the third review of the guidelines (the first version dates from 2014 and applied from 2016; there were updates in 2018 and 2021) and responds to the changes in Directive (EU) 2024/1619 (CRD VI), Regulation (EU) 2024/1623 (CRR III) and DORA, and to almost ten years of supervisory experience.
The revision consolidates all SREP provisions into a single framework and simplifies the text to focus on the core assessment: references to outdated rules or to assessments already set out in other legal acts are removed and listed in a separate document. Environmental, social and governance (ESG) factors and operational resilience are integrated into the existing elements, the standalone guidelines on ICT risk assessment (EBA/GL/2017/05) are repealed and that assessment moves into operational risk, a title for third-country branches is added and the interaction between Pillar 1 and Pillar 2 requirements, including the output floor, is clarified. Proportionality, sequencing and effectiveness of the process also improve, taking into account each institution’s track record in addressing deficiencies.
The guidelines are addressed to competent authorities. They apply from 1 January 2027, although authorities are encouraged to adopt their elements earlier, and will replace the 2022 SREP guidelines (EBA/GL/2022/03) and the guidelines on ICT risk assessment under the SREP (EBA/GL/2017/05). The deadline for authorities to report whether they comply expires two months after the translations are published. The document runs to about 290 pages, with the background and rationale and the titles of the guidelines.
Why it matters for risk management
It shows what a reference supervisor will assess when rating a bank (business model, governance, capital, liquidity, operational and ICT risk) and helps compare the internal self-assessment, the ICAAP and stress tests against that standard. It is addressed to European supervisors; for the Dominican Republic it works as a comparative reference.
Summary prepared by the Dominican Republic Risk Management Club from a reading of the original document, with the source verified on 12 October 2026. It does not replace reading the official text and is not advice.
Connect with our networks