EU: EBA finalises its guidelines on product oversight and governance to address greenwashing risks in ESG retail banking products

The European Banking Authority (EBA) has published its final report on revised Guidelines on product oversight and governance (POG) arrangements for retail banking products. The revised Guidelines, published on 30 June 2026, make targeted amendments to make ESG and greenwashing considerations more explicit throughout the product lifecycle, particularly when the products are marketed to consumers. 

Background

The EBA first issued its POG Guidelines in 2016 to address conduct risks and strengthen consumer protection in retail banking. In July 2025, the EBA consulted on proposals to amend the Guidelines to emphasise that POG arrangements for products with ESG features are essential to address greenwashing and also to align the framework with CRD VI/CRR III and other regulatory developments.

Changes made since the consultation paper

Following the consultation, the EBA has made changes in five areas: 

• Scope of application and definition of other forms of credit for consumers: The EBA had originally proposed extending the POG Guidelines to all retail banking products in the EBA’s remit, including consumer credits provided by non-bank creditors under the Consumer Credit Directive. However, following the consultation, the EBA has recognised that Member States have significant discretion in transposing the CCD, creating divergences that prevent a uniform inclusion. Accordingly, the EBA has amended paragraph 6 to add the phrase "Directive as transposed in the respective Member States” rather than applying the CCD uniformly. Two consequential non-substantive changes follow: "other products" was added to paragraph 7 to preserve NCA supervisory powers, and an explicit reference to the CCD in point (h) in paragraph 13 was deleted as no longer required.

• Manufacturers’ internal control functions for the prevention of greenwashing practices: The CP proposed that the manufacturer's management body should put in place sound processes to "identify, monitor, prevent and manage risks resulting from greenwashing or perceived greenwashing practices". Two post-consultation changes have been made:

  • Wording on prevention vs. risk management: Respondents raised concern that the CP wording focused on risks after greenwashing occurs rather than preventing it. The EBA agree and has amended Guideline 2.1a to require that the manufacturer’s management body should put in place sound processes to "identify, and prevent greenwashing practices" whilst retaining the obligation to "manage and monitor risks resulting from greenwashing or perceived greenwashing practices".

  • Reference to the MESGR Guidelines: To address concerns that a reference to the EBA Guidelines on the management of ESG risks (MESGR) might create additional prudential requirements, the EBA has amended the wording from "consistent with" the MESGR Guidelines to "also set out" in those Guidelines, making clear the reference is limited to greenwashing-risk related requirements. The EBA has also amended paragraph 9 to specify that the POG Guidelines should be read in conjunction with the MESGR Guidelines for the financial institutions within their scope.

• Information for distributors: The CP proposed to introduce a new paragraph 8.3(c) requiring sustainability-related communications and claims to be consistent with the EBA Guidelines on MESGR, where products with ESG features are offered or sold to consumers. Following respondents' concerns about the risk of misinterpretation and the scope of the MESGR reference, the EBA has refined Guideline 8.3(c) to make clear that alignment with the MESGR Guidelines applies only to governance and communication expectations aimed at preventing greenwashing in the context of products with ESG features being offered or marketed. As with Guideline 2.1a, the EBA has replaced "consistent with" with "also set out in" the MESGR Guidelines' greenwashing-risk related requirements.

• Third-party arrangement: The CP proposed amending Chapter 6 on outsourcing by replacing it with a new chapter on "third-party arrangements", cross-referencing the EBA Guidelines on SMTPR and addressing DORA and BCBS principles. Respondents raised concerns that this would excessively broaden the "third-party" definition, create complexity, and that the SMTPR Guidelines' scope of application may not align precisely with the broader POG Guidelines audience. The EBA agree. As a result, the EBA has deleted Chapter 6 entirely (both the existing outsourcing chapter and the CP's proposed replacement) and has instead inserted a general cross-reference to the EBA Guidelines on SMTPR in paragraph 9 on scope of application, with the aim of bringing clarity and legal certainty without expanding substantive obligations.

• Extension of the application date: The CP proposed an application date of 1 December 2026, in alignment with the application date of the revised CCD. Following responses which highlighted that the EBA Guidelines on MESGR do not apply to small and non-complex institutions until January 2027, the EBA agree that small institutions will require more time to adopt. The application date has therefore been extended to 11 January 2027, aligned with the MESGR application date for SNCI.

Consequential amendments have also been made to reflect changes to the EBA Founding Regulation, revised internal governance guidelines, and the removal of the outdated outsourcing chapter.

Next steps

The Guidelines will be translated into the official EU languages and published on the EBA website. The deadline for competent authorities to report compliance will be two months after publication of the translations. The Guidelines apply from 11 January 2027.

The EBA press release is available here.