Estonia adopts EBA ESG product-governance rules from January 2027

Manufacturers and distributors of retail banking products sold in Estonia face a new supervisory expectation from 11 January 2027.FI Finantsinspektsioon has issued the EBA amending guidelines on product oversight and governance (POG) arrangements for retail banking products — EBA/GL/2026/07 of 30 June 2026, amending EBA/GL/2015/18 — as its own recommendatory guideline, with Estonian and English texts and the board decision attached. From that date, ESG and greenwashing requirements apply inside the product-governance framework for retail banking products offered to consumers.FI

The substance of the new duties comes from the EBA final report behind the guideline. The POG framework, in place unchanged since 2016, covers mortgages, personal loans, deposits, payment accounts, payment services and electronic money, and requires manufacturers and distributors to design products around the target market's interests, objectives and characteristics, with product testing, disclosure, monitoring and distribution controls. Its legal footing was confirmed by the Court of Justice in case C-911/19 as principles for the internal control mechanisms of Article 74(1) of the Capital Requirements Directive. The amendment adjusts only a limited set of requirements rather than rewriting that framework.

The headline change is ESG. Where products with environmental, social and governance features are offered or sold to consumers, the manufacturer's management body must put in place sound processes to identify and prevent greenwashing practices and to manage and monitor the resulting risksFI, using wording kept consistent with the EBA guidelines on the management of ESG risks (MESGR). Manufacturers must give distributors sustainability-related information and claims that meet the same greenwashing-risk expectations, so that distributors can judge for whom an ESG-featured product is suitable. The guidelines are to be read together with the MESGR guidelines for institutions in their scope, a cross-reference the EBA added for legal certainty.

The scope also widens to consumer credit from non-bank creditors. Following the 2020 extension of the EBA's remit to consumer credit, the guidelines now reach the Consumer Credit Directive 2023/2225 as transposed in each Member State — a formulation chosen because national transpositions leave Member States options on entity and product scope, so no uniform EU-wide capture is possible. Competent authorities keep their existing power to apply the guidelines to further entities and products inside their own remit.

What the amendment does not do matters too. The consultation draft's new chapter on outsourcing and third-party arrangements was deleted after respondents warned it would broaden the third-party definition and duplicate the EBA guidelines on sound management of third-party risk for non-ICT services; a general cross-reference remains instead. And the application date moved from the proposed 1 December 2026 to 11 January 2027FI, aligning it with the MESGR application date for small and non-complex institutions so smaller firms get realistic adaptation time.

The guidelines are issued under Article 16 of Regulation (EU) No 1093/2010: competent authorities and financial institutions must make every effort to comply, competent authorities notify the EBA whether they comply within two months of the publication of the translations, and the guidelines apply from 11 January 2027FI.

Legal basis: EBA/GL/2026/07 amending EBA/GL/2015/18 on product oversight and governance arrangements for retail banking products, issued as a Finantsinspektsioon recommendatory guideline; Article 16 of Regulation (EU) No 1093/2010; Article 74(1) CRD as interpreted in C-911/19.