European Banking Authority (EBA)

The European Banking Authority (EBA) is an agency of the European Union responsible for harmonizing the regulation and supervision of banking across the member states. It drafts the detailed technical rules that sit beneath European legislation on bank capital, liquidity, resolution, payments and electronic money, issues guidelines to national supervisors and firms, and runs the Union's bank stress tests. It is based in Paris.

The EBA does not itself license or supervise banks. Day-to-day supervision is carried out by national authorities and, for significant banks in the euro area, by the European Central Bank. The EBA's task is to make sure that those supervisors apply one set of rules in a consistent way, a body of law and standards known as the Single Rulebook.

The authority was established on 1 January 2011 as part of the European System of Financial Supervision, created in response to the financial crisis of 2008. It replaced the Committee of European Banking Supervisors, an advisory body without binding powers. Sister agencies were set up at the same time for securities markets and for insurance and pensions.

The EBA was originally located in London. After the United Kingdom voted to leave the European Union, member states chose Paris as the new seat, and the agency moved there in 2019.

The main decision-making body is the Board of Supervisors, made up of the heads of the national banking supervisors of each member state, with representatives of the European Central Bank, the European Commission and other European bodies attending without a vote. A smaller Management Board oversees the work programme and budget. A full-time Chairperson represents the authority, which is accountable to the European Parliament and the Council.

• Technical standards. Where European legislation gives it a mandate, the EBA drafts regulatory and implementing technical standards. Once adopted by the European Commission, these are directly binding throughout the Union.
• Guidelines and recommendations. These set out how supervisors and firms should apply the law. National authorities must state whether they comply, and explain if they do not.
• Opinions and reports. The EBA advises the Commission, Parliament and Council on proposed legislation and publishes regular risk assessments of the banking sector.
• Stress tests and transparency exercises. It coordinates Union-wide stress tests of large banks, generally every two years, and publishes bank-level data.
• Convergence and mediation. It reviews national supervisory practices, can investigate alleged breaches of Union law by a national authority, and can mediate disputes between supervisors.

Much of the output concerns the capital and liquidity framework that implements Basel III in the European Union. It has produced standards and guidelines on the definition of capital, risk models, large exposures, remuneration, internal governance, recovery and resolution planning, and the annual supervisory review and evaluation process. It also designs the common reporting templates that banks submit to supervisors.

The Second Payment Services Directive gave the EBA an extensive role in payments. Its best-known product is the set of regulatory technical standards on strong customer authentication and secure communication, which took effect in September 2019. These standards define when two-factor authentication is required for electronic payments, list the exemptions, and oblige banks to give licensed third parties access to customer accounts through secure interfaces, the technical foundation of open banking in Europe.

The authority has also issued guidelines on the information required in applications for authorisation as a payment institution or electronic money institution, on security and operational risk, on fraud reporting, on incident notification and on outsourcing, which shape the outsourcing oversight expected of regulated firms. It maintains a central public register that combines the national registers of payment and electronic money institutions and their agents, including those providing services across borders by passporting. Under the proposed Payment Services Regulation, it is expected to receive further mandates.

The Markets in Crypto-Assets Regulation extended the EBA's remit to stablecoins. It drafted many of the technical standards on reserves, redemption, own funds and governance for issuers of asset-referenced tokens and e-money tokens, and it has direct supervisory responsibilities, exercised with national authorities, over issuers of tokens classified as significant. This was the first time the authority acquired a supervisory role over individual firms.

From 2020 the EBA held a mandate to lead, coordinate and monitor the fight against money laundering and terrorist financing across the Union's financial sector, issuing guidelines on risk factors and running a database of serious weaknesses identified at individual institutions. The European Union subsequently created a dedicated Anti-Money Laundering Authority, based in Frankfurt, which began operating in 2025 and has taken over these functions.

The EBA's influence depends largely on persuasion. Guidelines are not legally binding in the way regulations are, and the authority has rarely used its power to find a national supervisor in breach of Union law, a reluctance attributed to the fact that its governing board consists of those same supervisors. Its handling of money laundering failures at European banks in the late 2010s drew criticism on this point. Market participants have at times complained that the volume and timing of technical standards and questions-and-answers make compliance difficult, as during the introduction of strong customer authentication, when enforcement had to be delayed for card payments online.

• European Banking Authority