Regulatory roadmap for banks: dates from 2026 to 2028

A deadline becomes useful for planning once its scope is clear. Banks face dates from different legal instruments: some concern their organisation, others a particular report or AI use. This overview connects selected dates to their sources and distinguishes fixed application dates from announced plans.

What already applies? The stock until end-2025 (selection)

Law that already applies is no longer an upcoming deadline but an ongoing obligation: the regulatory roadmap therefore lists these legal acts as a compact stock with their date of application, while the annual tables below contain only the open dates. For German banks, the following have been in effect since early 2025 in particular:

Deadlines 2026: Which regulatory deadlines apply to German banks?

2026 brings German banks three heavyweights: the rise of the output floor to 55% on 1 January 2026 (Art. 465 CRR III), the entry into force of the 9th MaRisk amendment on 30 June 2026 (Circular 06/2026 (BA)) and the full repeal of the BAIT as of 31 December 2026. The table distinguishes changes already in effect from future application dates. The linked legal acts and supervisory publications remain authoritative for the stated review date.

Deadlines 2027: Which deadlines are coming up for banks?

Several changes fall in 2027. The FRTB application date for own funds requirements is 1 January 2027. Commission act C(2026) 3647, adopted in June 2026, adds targeted relief for 2027 to 2029; its entry into force requires separate attention. The output floor rises to 60 percent. The transition for additional requirements arising in individual cases under the ninth MaRisk amendment also ends, and further institutions become subject to DORA through the FinmadiG. The AMLR generally becomes directly applicable from 10 July 2027. Commission: delegated acts and status

The MaRisk transition period ending 1 January 2027 is documented verbatim. BaFin's cover letter to the new MaRisk version of 30 June 2026 (ref. BA 54-FR 2210/00067#00005) states in the section “Übergangsfrist” (transition period):

Deadlines 2028 and beyond: What applies from 2028?

The AMLA (EU anti-money laundering authority) is expected to take over direct supervision of selected high-risk obliged entities in the course of 2028: the AMLA Regulation (Regulation (EU) 2024/1620) does not set a fixed start date but has supervision begin six months after publication of the selection list (Art. 13(4)); the first selection procedure will be initiated by 1 July 2027 and completed within six months. Art. 13(4), fourth sentence, states verbatim: “The Authority shall commence direct supervision of the selected obliged entities six months after the publication of the list.” The widespread formula “up to 40 obliged entities” is also imprecise: where more than 40 high-risk obliged entities are identified, the AMLA may limit the selection to a number “higher than 40” (Art. 13(2)); 40 is thus the lower bound of that cap, not an upper limit. In addition, the CRR III output floor reaches 65% on 1 January 2028; the path runs via 70% (from 1 January 2029) to a final 72.5% on 1 January 2030. In reporting, IReF brings the next structural overhaul ( subject to adoption of the IReF regulation).

From when does Basel IV apply and how does the output floor rise?

Delegated Regulation (EU) 2025/1496 sets 1 January 2027 as the application date for the deferred FRTB own funds requirements. On 4 June 2026 the Commission adopted C(2026) 3647 with targeted operational relief and multipliers for 2027 through the end of 2029. Its overview still lists the act as not in force. This is not a blanket postponement of all FRTB obligations until 2030. The Bundesbank also explains the EBA no-action letter of 3 August 2026 concerning the trading-book boundary during the transition. C(2026) 3647: adopted FRTB delegated act. Commission: delegated acts and status. Bundesbank: FRTB and the EBA no-action letter

The output floor rises in steps under Art. 465 CRR III: 50% since 1 January 2025, 55% from 1 January 2026, 60% from 1 January 2027, 65% from 1 January 2028, 70% from 1 January 2029 and finally 72.5% from 1 January 2030; individual transitional rules run until 2032.

When do the BAIT end and what applies afterwards?

The BAIT are fully repealed as of 31 December 2026; BaFin announced this step in its announcement of 9 January 2025, and DORA institutions have already been removed from the BAIT scope since 17 January 2025. From 1 January 2027, further institutions become subject to DORA via the FinmadiG; IT supervision then follows the DORA framework throughout. At the same time, on 1 January 2027 the transition period of the 9th MaRisk amendment for additional requirements of Circular 06/2026 (BA) arising in individual cases ends; the overall framework is explained on the page MaRisk (BaFin).

The division of labour between MaRisk and DORA has been regulated verbatim since 30 June 2026. The explanatory note on AT 9 para. 1 of Circular 06/2026 (BA) clarifies under the heading “DORA (Regulation (EU) 2022/2554)”:

When is the next DORA register of information due?

The next submission deadline follows BaFin’s current request. Changes to contracts and provider data should be recorded in the maintained register meanwhile; an expected year does not establish a supervisory deadline. For ICT third-party providers that are legal persons established in the EU, the register permits an LEI or EUID. Equivalent providers outside the EU must use an LEI. Separate template rules govern identifiers for natural persons acting in a business capacity. BaFin: Informationsregister und Anzeigepflichten Implementing Regulation (EU) 2024/2956, register templates Corrigendum to Implementing Regulation (EU) 2024/2956

The European Supervisory Authorities reported 3,383 major ICT-related incidents under DORA for 2025. Around one third involved third-party providers. These figures come from their first annual report, published on 3 June 2026. ESAs: first DORA report on major ICT-related incidents

Which recurring reporting dates are there?

Alongside one-off implementation dates, institutions face periodic reporting and event-triggered duties. COREP, FINREP and many statistical returns use reference dates and submission deadlines. ICT incidents and money laundering suspicion instead depend on the relevant legal trigger. Do not assume that weekends extend a deadline: Article 5(5) of Delegated Regulation (EU) 2025/301 excludes that relief for credit institutions’ initial and intermediate DORA reports. The main reference points:

Which consultation and participation windows are currently open?

Closed consultations are not open implementation deadlines. New consultation opportunities and changes to reporting requirements should be checked against the relevant supervisor’s current publications.

Other published changes to include in planning

A political target in an unfinished legislative procedure is not an implementation deadline. The following published changes should be reflected in current planning. Scope is assessed for each institution.

1. 01German AI implementation law

   Germany’s AI Market Surveillance and Innovation Promotion Act has been in force since 29 July 2026. For financial entities, responsibility for a particular AI use must be determined under the sectoral supervisory framework and Article 74 of the AI Act.

2. 02CSRD scope

   Directive (EU) 2026/470 changed the CSRD reporting scope. The EU rules generally target undertakings or groups with more than 1,000 employees and more than EUR450 million in net turnover. The previous separate reporting wave for listed SMEs was removed. National implementing provisions must also be checked.

3. 03WpI MaRisk

   BaFin published the WpI MaRisk on 24 August 2026. They apply to small and medium-sized investment firms from 1 January 2027. Until then, the banking MaRisk remain the basis; large investment firms continue to apply the banking MaRisk.

Related topics

• The DORA Regulation at a glance: applicable since 17 January 2025, the framework of obligations and all DORA milestones.
• 9th MaRisk amendment (Circular 06/2026): the changes in detail and the transition period ending 1 January 2027.
• MaRisk (BaFin): overall framework, AT/BT structure and amendment history.
• The DORA register of information in detail: deadlines, templates and MVP submission.

Frequently asked questions about the regulatory roadmap

An offer from T-NEX GmbH

Discuss the project with T-NEX

A roadmap becomes useful when dates translate into owned work packages. Connect the assessment of regulatory changes with a project portfolio and clear prioritisation decisions.