ESMA Makes Cyber Risk a Union Strategic Supervisory Priority: What It Means for 2026

On October 24, 2025, the European Securities and Markets Authority (ESMA) took a step that the financial technology community had been anticipating: the designation of cyber risk as a Union Strategic Supervisory Priority (USSP). As reported by Global Regulation Tomorrow, this elevation places cyber resilience alongside market conduct and sustainable finance disclosures as one of ESMA's top-tier supervisory focuses for the period ahead.

The USSP designation is not symbolic. It triggers concrete supervisory actions: coordinated examination priorities across all 27 National Competent Authorities (NCAs), common supervisory expectations, specific data collection initiatives, and potentially a Common Supervisory Action (CSA) — a synchronized examination of a specific topic across multiple Member States.

For investment firms, trading venues, central counterparties, and other securities market participants regulated under DORA, the USSP designation means that cyber resilience is no longer one supervisory topic among many. It is a strategic priority with dedicated resources and coordinated enforcement.

What the USSP Designation Triggers

ESMA's Union Strategic Supervisory Priorities are the mechanism through which the authority drives supervisory convergence across the EU. When a topic is designated as a USSP, ESMA coordinates NCAs to ensure consistent supervisory attention regardless of the Member State.

The most impactful mechanism for supervised entities is the Common Supervisory Action. In previous CSAs (on costs and charges disclosure, on sustainability claims), ESMA and NCAs jointly examined a sample of entities across multiple Member States using a common methodology. The findings were published in aggregate, providing both a benchmark and a baseline for enforcement.

A CSA on cyber resilience would likely examine:

• DORA compliance status across Articles 5-16 (ICT risk management framework)
• Incident reporting readiness under Article 19
• Third-party register completeness under Article 28
• Resilience testing maturity under Articles 24-27

Why Now: The Confluence of Threats and Regulation

ESMA's timing reflects a confluence of factors that made the USSP designation unavoidable:

DORA application: DORA took effect on January 17, 2025, creating for the first time a binding operational resilience framework for the securities sector. Before DORA, cyber resilience for investment firms was addressed through ESMA guidelines (2020 cloud outsourcing guidelines, MiFID II organizational requirements) that lacked the prescriptive force of a regulation.

Threat landscape escalation: The 2024-2025 period saw a marked increase in cyber threats targeting securities markets. Destructive attacks on financial institutions surged 13%, with trading platforms and market infrastructure increasingly targeted.

Supervisory experience gap: ESMA's peer review of NCA supervisory practices revealed significant variation in how NCAs approached cyber resilience supervision. Some NCAs had dedicated ICT risk examination teams; others had minimal capability. The USSP designation is partly a mechanism to close this gap.

Market infrastructure concentration: The European securities market depends on a small number of critical infrastructure providers — Euronext, DTCC, Euroclear, SWIFT — whose resilience has systemic implications. ESMA recognized that supervisory attention to individual firms is insufficient without a systemic view of infrastructure concentration.

Impact on Different Entity Categories

The USSP designation affects ESMA's full supervisory scope, but the practical impact varies by entity type:

Trading Venues

Trading venues (regulated markets, MTFs, OTFs) face the highest supervisory intensity under the USSP. Their market infrastructure role means that a cyber incident can disrupt price discovery, settlement, and market integrity for all participants.

ESMA will expect trading venues to demonstrate:

• Real-time threat detection and incident response capabilities
• Tested failover to backup trading systems
• Comprehensive third-party register covering all technology providers in the trading stack
• Board-level governance of cyber risk with documented decision-making

Investment Firms

Investment firms, particularly those involved in algorithmic trading or high-frequency trading, face heightened scrutiny on the resilience of their trading technology. The specific concern is that a cyber incident affecting a firm's algorithmic trading systems could generate erroneous orders that disrupt market orderliness.

ESMA will expect investment firms to demonstrate:

• Resilience testing of trading algorithms under adversarial conditions
• Kill switch procedures that can halt algorithmic trading within defined timeframes
• Incident reporting procedures specifically adapted for market-impacting events

Central Counterparties and CSDs

CCPs and CSDs are already subject to enhanced DORA requirements as financial market infrastructure. The USSP adds a market-wide supervisory lens on top of entity-level supervision, ensuring that the interconnections between CCPs, CSDs, and their participants are assessed for systemic cyber risk.

Intersection with ECB and EBA Priorities

The ESMA USSP designation is part of a broader supervisory convergence on digital resilience across all three European supervisory authorities:

The ECB's supervisory priorities for 2026-28 focus on significant banks, while ESMA's USSP focuses on securities market participants. Together with the EBA's coordination role on DORA implementation, the three authorities are creating a comprehensive supervisory approach that covers the entire financial sector.

For conglomerate groups that include both banking and securities operations, this convergence means that DORA compliance will be assessed from multiple supervisory angles simultaneously. A group's banking subsidiary will be examined by the ECB/NCA, while its investment firm subsidiary will be examined under ESMA's USSP. Inconsistencies in DORA implementation across the group will be identified.

Practical Implications for Securities Market Participants

Immediate Actions

1. Anticipate a Common Supervisory Action. If ESMA follows its standard USSP playbook, a CSA on DORA compliance is likely in H2 2026 or H1 2027. Entities should prepare by conducting internal DORA compliance assessments using the assessment methodology that NCAs are likely to adopt.

1. Upgrade incident reporting readiness. ESMA will test whether securities firms can classify and report major ICT incidents within the DORA timeframes. Market-impacting incidents have additional urgency: ESMA will expect immediate notification if a cyber incident could affect market orderliness.

1. Complete your third-party register. The register of information is the most easily verifiable compliance artifact. NCAs will review registers early in any examination cycle. Ensure completeness, including sub-contracting chains and geographic mapping.

1. Document board governance. ESMA will assess board-level engagement with cyber risk. Minutes of board discussions on ICT risk, evidence of board challenges to management, and documented risk appetite statements for cyber risk are essential.

Strategic Positioning

1. Invest in resilience testing capability. The USSP designation signals that ESMA views testing as the key differentiator between paper compliance and genuine resilience. Entities that can demonstrate tested, documented resilience capabilities will receive lighter supervisory scrutiny.

1. Engage with information sharing. DORA Article 45 encourages information sharing arrangements. ESMA's USSP creates an incentive for participation: entities that contribute to and benefit from sector intelligence sharing demonstrate maturity that supervisors value.

1. Prepare for ENISA coordination. ESMA's USSP will involve coordination with ENISA on threat intelligence and cyber risk assessment methodologies. Financial entities should monitor ENISA publications and integrate relevant threat intelligence into their risk assessments.

Conclusion

ESMA's designation of cyber risk as a Union Strategic Supervisory Priority marks a watershed in the European approach to financial sector digital resilience. For the first time, cyber risk receives the same supervisory attention as market conduct and sustainable finance — the topics that have dominated ESMA's agenda for the past decade.

For securities market participants, the message is clear: DORA compliance is not a one-time project to be completed and filed. It is an ongoing operational capability that will be tested, examined, and benchmarked across the EU. The USSP designation ensures that this examination will be coordinated, consistent, and thorough.

The institutions that began investing in genuine operational resilience in 2024-2025 will find the USSP examination manageable. Those that treated DORA as a documentation exercise will find it revealing.

---

Voir aussi: ECB Supervisory Priorities 2026-28 | DORA Enforcement Outlook 2026 | Destructive Attacks Surge 13%

---

Resume en francais

Le 24 octobre 2025, l'ESMA a designe le risque cyber comme priorite strategique supervisorale de l'Union (USSP), placant la resilience cyber aux cotes de la conduite de marche et de la finance durable comme priorite de premier rang. La designation declenche des actions concretes : action de supervision commune (CSA) coordonnee entre les 27 ANCs, briefings de supervision aux ANCs, collecte de donnees standardisee, et revues par les pairs. L'impact varie selon le type d'entite : les plates-formes de negociation font face a la plus forte intensite supervisorale, les societes d'investissement algorithmiques a un examen accru de la technologie de trading, et les CCP/DTC a une evaluation de la resilience systemique. La convergence avec les priorites de la BCE (2026-28) et la coordination de l'ABE cree une approche supervisorale complete couvrant l'ensemble du secteur financier. Les actions pratiques incluent la preparation a une CSA probable en H2 2026, l'amelioration de la capacite de signalement des incidents, la completion du registre des tiers, et la documentation de la gouvernance du conseil.