The European Securities and Markets Authority (ESMA) has unveiled its 2027 Work Programme, focusing on infrastructure rather than another regulatory framework. ESMA is developing a Data Platform, deploying AI-based supervisory tools, and shifting from policy development to operational delivery in areas like consolidated tape providers, ESG rating supervision, and Digital Operational Resilience Act (DORA) oversight.
For CISOs managing EU-regulated entities or third-party service providers, this shift isn't just background noise. ESMA's technological pivot changes what regulators can see, how quickly they'll spot control gaps, and which organizations will face enhanced scrutiny.
What Changed
ESMA's 2027 programme marks a move from preparation to execution. The authority will enhance its data capabilities and innovate the supervisory process through its Data Platform and AI tools. It will also continue monitoring and promoting compliance with DORA across all supervisory mandates.
The programme advances supervision of consolidated tape providers, external reviewers of European Green Bonds, and ESG rating providers while adapting to expanded responsibilities for benchmark administrators. ESMA will oversee Critical ICT Third-Party Service Providers alongside other European Supervisory Authorities.
Four simplification initiatives covering transaction reporting, funds reporting, the retail investor journey, and risk-based supervision are entering a new phase. These aim to reduce administrative burdens, improve regulatory data usability, and make supervision more effective.
Key Findings
Data-driven supervision becomes operational. ESMA isn't just collecting more data. It's building analytical infrastructure to process regulatory filings, transaction reports, and supervisory returns at scale. When regulators deploy pattern-matching algorithms across your control evidence, inconsistencies that previously required manual audits will trigger automated inquiries.
DORA oversight extends beyond direct supervision. ESMA will monitor DORA compliance across all its supervisory mandates, not just for entities it directly supervises. If you're a fund manager, benchmark administrator, or clearing house, your ICT-related incident reporting, resilience testing, and third-party risk management fall under ESMA's monitoring scope even if your primary regulator is a National Competent Authority.
Supervisory convergence intensifies for crypto-asset service providers. ESMA is strengthening cooperation with NCAs on supervision of CASPs under the Markets in Crypto-Assets Regulation. This means supervisory expectations for digital operational resilience, custody controls, and incident disclosure will harmonize faster than typical EU regulatory implementation.
Risk-based supervision gets algorithmic support. ESMA's simplification initiative on risk-based supervision pairs with its AI deployment. Regulators will use data analytics to identify which entities warrant intensive examination based on control maturity signals, incident frequency, and operational complexity metrics visible in your regulatory filings.
T+1 settlement transition demands infrastructure readiness. ESMA will support the transition to next-day settlement cycles. For organizations managing cross-border transactions, this compresses your operational risk window and requires real-time reconciliation capabilities that many current systems can't deliver.
What This Means for Your Team
Your control evidence will face algorithmic review before human examination. When ESMA's Data Platform ingests your DORA ICT-related incident reports, resilience testing results, and third-party risk assessments, inconsistencies between what you report and what peer organizations report for similar operational profiles will generate supervisory questions.
This changes your evidence collection requirements. Generic narrative descriptions of controls won't satisfy pattern-matching algorithms looking for specific implementation details. Your incident classification must align with ESMA's taxonomy. Your resilience testing programme documentation needs structured data fields, not prose.
If you're a Critical ICT Third-Party Service Provider, you're entering joint oversight by multiple European Supervisory Authorities. Your control attestations and audit reports will circulate across supervisory bodies with different risk appetites and examination priorities. Inconsistent control descriptions between SOC 2 reports and DORA compliance documentation will create friction.
For organizations operating across multiple EU jurisdictions, supervisory convergence reduces regulatory arbitrage opportunities. You can't rely on lighter-touch supervision from one NCA when ESMA is coordinating examination standards and sharing supervisory findings across member states.
Action Items by Priority
Immediate: Audit your DORA compliance documentation for data structure. Review your ICT-related incident reports, resilience testing results, and third-party risk registers. Can you extract structured data fields that algorithms can parse? If your documentation is narrative-heavy, start building data dictionaries that map your control evidence to ESMA's reporting taxonomies.
Q2 2027: Assess your supervisory data footprint. Catalog every regulatory filing, transaction report, and supervisory return your organization submits to ESMA or NCAs. Identify inconsistencies in how you describe the same controls across different filings. Regulators with data platforms will spot these discrepancies faster than manual reviews ever could.
Q3 2027: Prepare for T+1 settlement infrastructure requirements. If you clear or settle cross-border transactions, map your current reconciliation processes. Identify manual steps that can't execute within a next-day cycle. Budget for real-time data feeds and automated exception handling before the transition deadline.
Q4 2027: Strengthen your NCA relationship if you're a CASP. Supervisory convergence means your primary regulator is coordinating with ESMA on examination standards. Request clarity on how your NCA interprets DORA's resilience testing requirements and incident materiality thresholds. Document any supervisory guidance you receive.
Ongoing: Monitor ESMA's technical standards development. ESMA will deliver technical standards and advice across its remit throughout 2027. Subscribe to ESMA's consultation pipeline. Technical standards define the specific data fields, reporting formats, and control implementation details that supervisory algorithms will evaluate.
