What Changed
- CERT-EU alerted organisations on 21 October 2026 to two critical software security flaws affecting the EBA website.
- The EBA took its website offline from 21 October 2026 at 13:00 CEST until 22 October 2026 at 14:00 CEST to apply patches, detecting no breach or compromised data.
- The submission deadline for four public consultations, including the MiCA fine methodology consultation, was extended to 26 October 2026.
The European Banking Authority (EBA) has extended the submission deadlines for four public consultations to 26 October 2026 after taking its website offline for essential security maintenance. Financial institutions, regulatory professionals, crypto-asset service providers, and other market participants operating in the European Union who wish to submit feedback on these regulatory drafts are directly affected by the revised timeline.
On 21 October 2026, CERT-EU, the cybersecurity service for EU institutions, bodies, and agencies, alerted organisations to two critical security flaws in software used across many websites, including the EBA portal. As a precautionary measure, the EBA removed its website from service on Wednesday, 21 October 2026, at 13:00 CEST to apply necessary security updates. The portal was successfully restored on Thursday, 22 October 2026, at 14:00 CEST. The EBA confirmed that no breach was detected and no data was compromised during the incident.
To ensure stakeholders have adequate time to prepare and submit their input following the website's temporary unavailability, the EBA extended the deadlines for four active consultations:
- Consultation on Guidelines on investment of available financial means (EBA/CP/2026/12);
- Consultation on Implementing Technical Standards on information exchange (EBA/CP/2026/14);
- Consultation on Implementing Technical Standards on depositor information (EBA/CP/2026/13); and
- Consultation on methodology for setting fines under MiCA (EBA/CP/2026/02/10).
Stakeholders can submit their responses through the relevant consultation pages on the official EBA website until the extended deadline of 26 October 2026. The EBA expressed apologies for any inconvenience caused by the temporary service interruption.
Who May Be Affected
Stakeholders, financial market entities, credit institutions, deposit guarantee schemes, and crypto-asset service providers responding to EBA public consultations.
Cross-Border Context
Applies across the European Union to entities subject to EBA regulatory technical standards and guidelines, including cross-border firms subject to MiCA fine setting rules.
What to check next
- Visit the relevant consultation pages on the EBA website to review consultation texts and submit responses by 26 October 2026.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.