In recent months, supervisory authorities in the Netherlands – AFM and DNB –and the EU – ECB, EBA, ESMA and EIOPA – have published their priorities and agendas for 2026. These publications signal the direction of regulatory rulemaking and supervisory focus in the coming year. Against this backdrop, our Financial Markets & Regulation team has identified key trends and developments that will shape the European financial sector in 2026.

Key challenges

Two connected key challenges stand out: geopolitical uncertainty and the need to strengthen the EU's competitiveness. Recent tariff measures and growing cyber-attacks highlight the importance of thorough risk assessment and risk management frameworks at financial institutions. DNB has emphasised the need for adaptability to geopolitical risks, and the AFM has stated its commitment to strengthening market resilience.

These plans broadly align with those of European supervisors. Dependencies on foreign nations and increasing cyberthreats demand higher levels of cybersecurity and careful consideration of AI use. Financial institutions will be required to continue their efforts to minimise dependencies on non-EEA counterparties via stress testing, tightening business continuity plans and detailing exit plans.

At the same time, the European Commission is bolstering simplification and harmonisation efforts to enhance the EU's competitive position by reducing regulatory burdens and enabling the EEA internal financial market to operate as a single market instead of as a fragmented one. This is much needed, as the International Monetary Fund (IMF) recently calculated that non-harmonised services within the EEA face significant implicit costs that are equivalent to a 110% tariff. The Commission has announced a number of proposed measures to address this challenge, including (i) de-prioritisation of Level 2 Acts and (ii) the Market Integration Package legislative proposal. This latter proposal was published in December 2025 and effectively aims to harmonise the EEA internal markets for the trade, post-trade and asset management industry by removing cross-border service provision barriers and placing ESMA in a more central role to promote supervisory convergence and limit regulatory arbitrage.

Digital strategies and operational resilience

Digitalisation has evolved from a supervisory sub-topic to an integral part of supervision in 2026.

Operational resilience and cyberthreats

We expect that geopolitical turmoil will push operational resilience to the forefront of supervisory priorities. DORA has now moved from implementation to supervision and enforcement. Supply-chain dependencies and concentration risk in third-party arrangements are expected to be main focus areas for financial sector entities and supervisors alike. For non-ICT services provided by third-party service providers outside DORA's scope, the EBA draft guidelines on the sound management of third-party risk, once finalised, will introduce similar requirements.

Artificial intelligence

We expect supervisors to increase their focus on AI in 2026. Initial efforts will examine current and potential use cases. While AI is expanding from customer-facing and operational purposes to core financial decision-making, regulators – including DNB and the AFM – are highlighting associated risks. These include increased dependencies and adverse consumer outcomes from hyperpersonalisation.

Supervisors are debating how to regulate AI at the EU level. Options include integrating AI oversight into existing frameworks like DORA or creating stand-alone rules. DNB and the AFM currently assess AI through existing frameworks. They acknowledge that clearer regulatory guidance may be needed. The European Parliament has called for regulating AI within existing frameworks.

Regulating AI involves inherent tension between consumer protection, competitiveness and regulatory simplification. The proposed Digital Omnibus would delay application of the AI Act to high-risk financial sector use cases until December 2027.

Increasing AI use requires institutions to reinforce data quality efforts, as data and algorithms underpin most AI technologies. In the context of risk data aggregation and risk reporting (RDARR), we expect more supervisory interventions and enforcement. The ECB has warned that persistent RDARR gaps will "not be tolerated".

Fintech

Fintech is prevalent throughout the financial sector. For 2026, we will highlight three sub-markets: payments and electronic money, crypto-assets and consumer credit. In our key trends for these sub-markets, three recurring themes emerge: scope of regulation, level playing field considerations, and client interests.

Payments and electronic money

PSD3 and PSR are expected to be transposed in late 2027 or early 2028. A significant development is the narrowing of the commercial agent exemption. This extends the scope of the regulation to several platform companies. Changes in laws and regulations to further stimulate open banking and open finance, enhance a regulatory level playing field for banks and payment institutions.

In terms of client interests, PSD3 and PSR focus on tackling fraud and introduce increasing responsibilities and liabilities for payment service providers. Another expected key trend for 2026 is the development of pan-European payment solutions, with iDeal becoming Wero as a prominent example.

Crypto-assets

MiCAR has been in force since 30 December 2024. There is significant crossover with other regulatory frameworks, including PSD, MiFID and AIFMD. One example that poses challenges in practice is the fact that electronic money tokens also qualify as electronic money. Consequently, many crypto-asset service providers (CASPs) will apply for additional licences in 2026.

From a level playing field perspective, concerns around regulatory arbitrage, and ultimately the protection of consumer interests, persist in the EU and on a global level as different jurisdictions take varying approaches.

As part of the Savings and Investment Union Package (see below), the possibility of ESMA directly supervising EU CASPs is introduced. This suggests further supervisory consolidation at the EU level. Another trend we see is the formation of partnerships between CASPs and investment firms, creating new hybrid business models to meet client demands and capture synergies.

Consumer credit

CCD2 is expected to be transposed by 20 November 2026. The scope will extend to buy-now-pay-later services, impacting both providers and parties that may qualify as intermediaries. Partly due to this extension, trends for 2026 will include i) new regulated market entrants, and ii) a further increase in white labelling (licence-as-a-service), which allows companies to integrate consumer credit in their product offering without obtaining their own licence. The AFM indicates it is prioritising protecting consumers in this changing market and avoiding excessive lending.

Savings and Investment Union

In November 2024, Enrico Letta called for the establishment of a Savings and Investment Union (SIU) to finance common EU objectives such as investments in climate change, technology and defence. The financing need in these areas is high, while traditional bank financing is not always available due to both the overall volume of financing that is needed and the nature of the higher risk-bearing parties that need the financing. The European Commission responded in March 2025 with its SIU strategy, aiming to connect the EU's investment and saving needs. Key initiatives include the establishment of EU-wide savings and investment accounts, the encouragement of equity capital investments, and the convergence of supervision. A variety of measures have been and will be undertaken as part of this strategy:

• The Pan-European Personal Pension Product (PEPP) Regulation and the Institution for Occupational Retirement Provision II (IORP II) Directive were presented on 20 November 2025.
• The Market Integration Package was proposed in December 2025.
• A review of the Regulation on European venture capital funds is likely to be published in Q3 of 2026.
• A review of the Shareholder Rights Directive is likely to be published in Q4 of 2026.

• In Q2 of 2027, the Commission will publish a review of its overall progress in achieving a Savings and Investment Union.

Market integration package: asset management reforms

The role of ESMA has expanded with the introduction of the Market Integration Package. It is proposed that ESMA have direct supervision over pan-European market operators, significant trading platforms and crypto-asset service providers licensed under MiCAR. Moreover, ESMA is proposed to get a broader mandate to ensure that legislation is consistently applied in the EU asset management and trade sectors.

The Market Integration Package further proposes several changes for asset managers:

• Licensing and passporting requirements will be harmonised: procedural requirements for licensing and passporting to an AIFM's home state will be delegated, limiting cross-border barriers as much as possible.
• There will be full cost transparency regarding cross-border offerings and connected regulatory fees and ESMA reasonableness tests.
• Intra-group activities performed for an AIFM will no longer to be classified as outsourcing, subject to certain conditions being met. This item is particularly relevant as this would signal a departure from the current and relatively stringently applied viewpoint that intragroup outsourcing must satisfy the same requirements as those for outsourcing with a third party (subject to proportional application of those requirements).
• AIFMs or groups of AIFMs with more than EUR 300 billion assets under management and established or active in at least two member states, will receive additional supervision from ESMA. The “active” test requires further clarification, as the current proposal suggests that the sole marketing of a fund in more than one member state would already be sufficient to satisfy this requirement. In addition, while it is emphasized that ESMA is not meant to gain direct supervisory powers over such large groups, the practical effect of the proposal may be similar. This is because ESMA may instruct national competent authorities to take certain measures in respect of governance, structuring of services, etc.

Trilogues and final adoption by the European Parliament and Council are expected from Q4 2026 to Q1 2027, meaning that actual implementation is still some time away. However, if implemented as proposed, some of the measures in the Market Integration Package are expected to have significant impact on market participants. Companies should closely monitor developments in this area.

AIFMD II

EU member states have to implement the revised AIFMD by 16 April 2026. Several jurisdictions, including the Netherlands, have already published draft implementing legislation, but no final version is available as of yet. With the implementation deadline approaching, the following two developments are particularly relevant for AIFMs to keep in mind.

Depositary passporting

Currently, AIFMs are required to appoint a depositary established in the member state in which the fund is located. This framework is subject to several changes:

• AIFMD II allows the appointment of a depositary from another member state, subject to certain conditions being met, as a member state option. The background is to make sure that relevant depositary services are also available in less developed or smaller markets, or in markets where the full suite of depositary services is not offered,

• The Dutch implementation act suggests that the Netherlands intends to implement this option (Article 4:62o.a Financial Supervision Act).
• However, the depositary market in the Netherlands significantly exceeds the size requirement for making use of the depositary appointment option in another member state, namely: the total size of assets kept in custody in the relevant market cannot exceed EUR 50 billion. As the Dutch depositary market is estimated at EUR 600-800 billion, it is not yet clear if and how this option may be used in the Netherlands.
• With the proposed change in the Market Integration Package, a full depositary passport is proposed, with AIFMs being allowed to appoint a depositary in any member state. This enables fund managers to appoint a single depositary across multiple jurisdictions.

Full-time requirement

The revised AIFMD requires AIFMs to have at least two daily policymakers working full-time. Under Dutch law, full-time is defined as at least 36 hours per week. Ancillary roles will likely be allowed since the threshold appears to be designed to establish a minimum standard, not an exclusivity requirement. This interpretation is in keeping with time commitment requirements that apply to other types of regulated entities such as banks and insurers.

Pensions

The Commission has proposed a revision of the IORP II Directive and PEPP Regulation to boost both the demand and supply side of supplementary pensions. Initiatives in the package respect competences of member states to organise and design their national pension systems.

IORP II review

The revision of IORP II was proposed by the European Commission to strengthen and modernise the framework. Key changes include:

• a refined prudent person principle that restricts the ability of member states to impose detailed investment rules, particularly for schemes where members and beneficiaries bear the investment risk;
• additional information requirements;
• the introduction of a mandatory compliance function; and
• the obligation to appoint a depositary.

PEPP review

PEPP is a personal pension product (pillar three), and independent from existing state-based pensions (pillar one) and from occupational pension systems (pillar three). Since its introduction in 2022, PEPPs have proven to be unpopular. A revision of the PEPP Regulation aims to rectify this and remove identified barriers.

Looking ahead

The proposals to amend the IORP II Directive and PEPP Regulation will now need to be negotiated and agreed on by the European Parliament and Council. Implementation will require amendments to Dutch legislation. Signals from the Dutch government suggest that the current proposals would require Dutch pension funds to make significant adjustment, except for the depositary provision.

Variable remuneration: Dutch legislation under review

Bonus caps in review

The current strict bonus policy for financial institutions has resulted in a shortage of specialised employees.​ A recent proposal by a member of parliament aims to resolve this shortage by relaxing the bonus rules for specialised personnel, particularly IT specialists.

Financial institutions, specifically fintech startups, are unable to compete with Big Tech and other non-financial companies that are not subject to the bonus caps. This undermines their competitive position in the Netherlands. ​The relaxation proposed in the amendment aims to apply the bonus cap only to "natural persons whose activities materially affect the company's risk profile". This is also more in line with European rules, which link restrictions on bonuses in a similar way.

Specific reasons

The specific reasons for the relaxation can be divided into: (i) competitiveness, (ii) reducing regulatory burden and reversing extra national rules, and (iii) safeguarding essential digital infrastructure.​

In the Netherlands, the bonus cap is set at 20% of fixed salary, compared with 100% allowed under European rules. Furthermore, the national cap has an extensive vertical effect, as it applies to all employees rather than only those who can influence the institution’s risk profile. This is detrimental to competitiveness, and in parliamentary debate, reference has been made to both the Draghi report and the Wennink report.​

By reversing this broad vertical effect, the business climate in the Netherlands for fintech startups, and for financial institutions in general, is expected to improve. Deregulation therefore strengthens competitiveness and enhances the business environment by reducing regulatory constraint.​

Last, the relaxation ensures that financial institutions can attract enough IT specialists, thereby safeguarding the stability and security of payment systems.
The relaxation is deliberately limited to specialists whose activities do not materially affect the institution’s risk profile, to avoid a return to practices before the 2007/2008 crisis.​ In this context, it is also argued that the current rules create risks because, in practice, financial institutions increase fixed salaries to attract specialists. This leads to a lack of cost flexibility during economic downturns.

Timeline

On 27 January 2026, the majority of the House of Representatives voted in favor of the proposal. The proposal has now been referred to the Senate for further review.