EBA’s Revised Internal Governance Guidelines: Key Changes and What They Mean for banking sector

On 5 November 2026, the European Banking Authority (EBA) published its revised Guidelines on internal governance under the Capital Requirements Directive (EBA/GL/2026/10).

The revision reflects changes introduced by CRD VI, strengthens the connection between governance and operational resilience, and introduces more detailed expectations for individual accountability and third-country branches. It also simplifies certain requirements and removes duplication with other regulatory frameworks.

For institutions within scope, the practical task is to identify where existing governance arrangements need to be strengthened, documented more clearly or aligned with the revised requirements.

Who is affected

The Guidelines concern institutions within the CRD governance framework, including credit institutions, relevant approved financial holding companies and mixed financial holding companies, and investment firms subject to CRD Title VII under Article 1(2) or (5) of the Investment Firms Regulation. They also introduce a defined scope of application for EU branches of third-country credit institutions.

For Cyprus Investment Firms, prudential classification remains essential. These CRD Guidelines should not automatically be treated as replacing the separate internal governance framework applicable to investment firms under the Investment Firms Directive.

The Guidelines are final, but not yet applicable. As at 7 November 2026, the EBA identifies the Guidelines as final, awaiting translation and not yet applicable.

The latest published report specifies application two months after publication in all EU official languages. A definitive calendar date has not yet been stated, and the repeal provision for EBA/GL/2021/05 still contains a date placeholder.

Institutions should therefore monitor the definitive dates and relevant supervisory communications. Existing obligations under CRD VI, DORA and other applicable legislation must also be considered separately.

1. Individual accountability becomes more explicit

One of the most significant developments is the requirement to maintain a mapping of duties, supported by individual statements of roles and responsibilities.

The mapping should explain how governance operates, identify reporting lines and shared responsibilities, and help reveal gaps in the allocation of duties. It requires management-body approval and must be available to competent authorities upon request.

Individual statements are required for executive members of the management body, members of senior management and key function holders. They should be sufficiently clear, kept updated and signed by the individuals concerned.

The distinction matters: the overall mapping includes the roles of all management-body members, while the express individual-statement requirement has a narrower population.

The EBA provides an optional template. Institutions may use another suitable format, but the underlying requirement to maintain the statements remains.

In practice, institutions should reconcile their organisation charts, committee mandates, job descriptions, reporting lines and delegated authorities.

2. Board conflicts and leadership arrangements require closer attention

The revised Guidelines remove the previous exception permitting the supervisory Chair and CEO roles to be combined within the same institution with competent-authority authorisation.

They also address conflicts where a CEO holds a supervisory-board position, including as Chair, in another institution within the same group.

Specific safeguards apply where a former CEO becomes Chair within two years of leaving the executive role. These address the risk of overseeing earlier decisions, performance or remuneration.

This is not an unconditional two-year appointment ban. The Guidelines require appropriate identification and management of the resulting conflicts, without prejudice to national law.

Institutions should review succession arrangements, intragroup appointments, recusal procedures and the evidence recorded in board minutes.

3. Internal control functions retain independence, with clearer safeguards

The revised framework reinforces the authority, independence and direct access of Risk Management, Compliance and Internal Audit to the management body in its supervisory function.

Prior supervisory-board approval before removal is expressly required for the heads of internal control functions.

Combining Risk Management and Compliance remains possible under proportionality. However, institutions should be able to demonstrate why separate appointments are not justified, assess and mitigate conflicts, document the decision, and establish that the responsible person has sufficient suitability and time. Internal Audit remains separate.

For institutions operating combined roles, the practical question is whether the arrangement is supported by a current, documented assessment of independence, capacity and effectiveness.

4. ESG and operational resilience are more firmly embedded in governance

ESG risks were already addressed in the 2021 Guidelines. The revised framework strengthens their integration into board responsibilities, risk management and remuneration.

The risk management framework expressly addresses ESG risks over short- and medium-term periods and a long-term horizon of at least ten years.

The Risk Committee should also provide input on relevant ESG factors, targets and performance indicators for remuneration. Operational resilience receives greater emphasis through explicit links to DORA, the continuity of critical or important functions, and coordinated preparedness across functions, resources and third-party arrangements.

Business continuity provisions also expressly address internal audit review and reporting of testing results to the management body. Institutions should assess whether their board reporting connects these risks to decisions, resources and remedial action.

5. Third-country branches receive a dedicated governance framework

The Guidelines introduce specific provisions addressing:

• Local management, sufficient time commitment and effective presence.

• Clear responsibilities and management of conflicts arising from multiple roles.

• Internal control arrangements and safeguards over control-function heads.

• Adequate substance, resources and oversight of third-party dependencies.

• ICT risk management and remuneration requirements.

• Risk management of back-to-back and remote booking arrangements.

The approach differentiates between branch categories and recognises proportionality. Institutions should assess the provisions applicable to their branch structure rather than assume that every requirement for an EU-incorporated bank applies identically.

6. Simplification does not mean that underlying controls disappear

The standalone outsourcing-policy section and the previous governance-policy checklist annex are removed. This does not remove responsibility for third-party risk management. Relevant expectations remain within the revised governance text and dedicated regulatory frameworks, including DORA.

There are also targeted changes to committee composition. For nomination committees of global and other systemically important institutions, the requirement for a majority of independent members becomes a sufficient number, while an independent Chair remains required. The independent-majority requirement for their risk committees is retained.

Institutions should distinguish genuine changes from requirements that have simply been relocated or consolidated.

7. Equality and inclusion expectations are strengthened

The revised text expressly addresses an organisational culture of equality, diversity and inclusion, together with the prevention of harassment.

It also strengthens expectations concerning recruitment panels, gender-neutral policies and internal monitoring of representation and equal treatment.

Although the final Guidelines reduce the detail proposed during consultation, institutions still need a proportionate approach to monitoring and responding to the results.

What should institutions do now?

A focused preparation exercise should:

• Confirm applicability, including the relevant entities, consolidation levels and branch arrangements.

• Map the changes against existing policies, separating additions from relocations and simplifications.

• Prepare or update duties maps and individual statements, ensuring consistency with actual decision-making.

• Review board conflicts, succession and committee arrangements.

• Reassess control-function independence and combined roles.

• Align governance reporting with ESG, operational resilience and third-party risks.

• Assign responsibilities and a realistic implementation timetable, informed by the definitive application date.

ENAH Services Ltd can assist with applicability and gap assessments, governance-policy reviews, duties mapping, internal control arrangements and tailored training for boards, senior management and control functions.