Roadmap 2026–2028
All deadlines from SREP, DORA, NISG, AI Act, CRR III, AMLR, MiCAR and Solvency II on one timeline – with status: applicable law, agreed or announced.
To the roadmapEditorially reviewed: 22 October 2026 · Legal status checked up to: 22 October 2026. Time-bound statements are dated; legal acts that are announced but not yet published are marked as such.
For whom: Banks (SI) Banks (LSI) Insurers Reporting service providers Each topic page is marked by target group; SREP and BCBS 239 concern banks, Solvency II and DORA the insurers, the data core both.
Five deadlines converge on the same capability. The revised SREP Guidelines (EBA/GL/2026/06) place ICT systems, risk data aggregation and risk reporting in one assessment block from 2027 – for all institutions, not only significant ones. The Anti-Money Laundering Regulation applies from 10 July 2027. FRTB capital requirements start on 1 January 2027, the revised Solvency II framework on 30 January 2027, the high-risk obligations of the AI Act on 2 December 2027. Whoever runs these as five projects collects the same data five times.
Where is regulatory reporting moving?
Regulatory reporting is moving from the report to data capability. Validation rules remain important, but they answer only part of the question supervisors and auditors will ask from 2027: where does the figure come from, who owns it, and how quickly can it be reassembled when circumstances change? The answer is the same in every rulebook – a complete inventory, lineage down to attribute level and a data quality framework with named owners. Austrian institutions already hold part of that substance through the common reporting data model (GMD); what they rarely hold is the evidence.
Who these pages are written for
Heads and specialists of regulatory reporting in Austrian credit institutions; insurers that will deliver revised Solvency II reports from 2027; and reporting service providers preparing their platforms for the 2027 assessment logic. Every page names the legal basis, the deadline, the addressee and the source.
The topic pages
SREP 2027: data capability is assessed
Section 5.7 of the revised SREP Guidelines brings ICT, risk data aggregation and reporting together – what the FMA and OeNB assess from 1 January 2027, and what section 39 BWG and the KI-RMV already require today.
To the topic pageRDARR and BCBS 239 for LSIs
The ECB guide applies to significant institutions. What is binding for less significant institutions in Austria, what is not – and why the lever arrives in 2027 anyway.
To the topic pageThe data core
One inventory for Art. 8 DORA, the register of information, the NISG perimeter, SREP data capability and Art. 10 AI Act. Six building blocks built once and used several times.
To the topic pageAI in regulatory reporting: detector, not calculator
Three gaps in validation rules, six use cases for AI, one red line – and the regime that already carries today: DORA, RDARR and BCBS 239; the AI Act adds to it but does not replace it.
To the topic pageReporting crypto-assets
What the MiCAR CASP Reporting Regulation (Federal Law Gazette II No 71/2026) requires, why banks report only annually and why Art. 501d CRR is a transitional regime without an expiry date.
To the topic pageThe 2027 break: Travel Rule, section 11a FM-GwG, AMLR and AMLA
From 10 July 2027 the Anti-Money Laundering Regulation applies directly; in 2028 AMLA's direct supervision begins. What actually changes for transfers to self-hosted addresses – and what does not.
To the topic pageDigital euro: who sees the payment
The twelve parts of the LinkedIn series at a glance: 15 euros paid six ways, four theses – and what follows for banks' regulatory reporting and payments, from the sub-ledger to the DORA report.
To the series overviewHow can the reporting topics be grouped?
The topics fall into four groups. The first is the supervisory roadmap: SREP data capability, RDARR and the data core. The second is reporting and AI: where AI closes validation gaps and where it has no place. The third is crypto-assets and payments: a new reporting regime next to the old one, with its own deadlines. The fourth is own funds, disclosure and insurance: output floor, FRTB, the securitisation reform and Solvency II – pages that follow in the next build stage. All of them share the foundation: holding data with verified provenance, complete and explainable.
| Deadline | What applies | For whom |
|---|---|---|
| 01.01.2027 | EBA/GL/2026/06: ICT systems, risk data aggregation and risk reporting in one SREP section (5.7) | all institutions, via FMA and OeNB |
| 01.01.2027 | CRR III: output floor at 60 % of standardised RWA; FRTB capital requirements (reporting only since 2025) | banks |
| 30.01.2027 | Solvency II review: revised QRTs, taxonomy 2.10.0 from Q1 2027 | insurers |
| 10.07.2027 | Anti-Money Laundering Regulation (AMLR) applicable; AMLA guidelines on self-hosted addresses due | banks, CASPs, insurers |
| 02.12.2027 | AI Act: high-risk obligations for Annex III systems (credit scoring of natural persons) | banks |
| 2028 | AMLA direct supervision starts; Annex I obligations of the AI Act from 02.08.2028; first NISG evidence requests from 01.10.2028 | selected obliged entities, group companies |
What does Mag. Eiler & Partner contribute to regulatory reporting?
Mag. Eiler & Partner has worked in Austrian regulatory reporting for more than twenty years – business analysis between reporting, accounting and IT, ABACUS/GMP, OeNB reports, AnaCredit, FINREP and COREP. Our offers are limited initial engagements with a tangible result and a clearly stated limit:
| Offer | Tangible result | What it is not |
|---|---|---|
| Regulatory reporting data check | Inventory of reporting chains, prioritised gaps, named owners – against section 5.7 of the SREP Guidelines | no guarantee of full SREP compliance |
| Lineage pilot | Documented provenance for a delimited reporting area (e.g. one Smart Cube), from source to reporting position | not a complete group data catalogue |
| AI use case check | Purpose, classification under the AI Act and DORA, data release and control concept for one concrete use case in the reporting process | no blanket legal clearance |
| Reporting change check | Impact matrix for 2027: reference periods, submission deadlines, implementation needs per report | no commitment to a finished production migration |
Frequently asked questions
What changes in regulatory reporting on 1 January 2027?
The EBA's revised SREP Guidelines (EBA/GL/2026/06) become applicable. Their new section 5.7 assesses ICT systems, risk data aggregation and risk reporting together – addressed to the competent authorities, in Austria the FMA and OeNB, and therefore regardless of whether an institution is significant.
Does the ECB guide on risk data aggregation apply to Austrian regional banks?
Formally, no. The guide of 3 May 2024 addresses significant institutions under direct ECB supervision; less significant institutions are not mentioned, and neither the FMA nor the OeNB has published an equivalent. In practice, data capability will be assessed from 2027 through the SREP Guidelines; the national basis remains section 39 BWG with section 3(4) and (6) KI-RMV.
Will AI calculate the report in future?
In our view it should not. The reported value remains deterministic, rule-based and reproducible. AI works upstream on data quality and downstream on analysis and commentary – as detector and explainer, not as calculator. That is an advisory position, not a legal prohibition.
Which 2027 deadlines apply to crypto-assets?
The Anti-Money Laundering Regulation applies from 10 July 2027; by then AMLA must issue guidelines on self-hosted addresses and correspondent relationships. The MiCAR CASP Reporting Regulation has applied since 15 June 2026 – authorised providers report semi-annually, financial entities under Art. 60 MiCAR annually as at 31 December.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).