Regulatory Readiness, Late 2026: When the Rulebook Starts Choosing Your Suppliers
Four separate rulebook moments landed in European financial regulation during the first half of October 2026. The final PSD3 and Payment Services Regulation compromise texts, agreed in the autumn trilogue, were published and are now moving through Council and Parliament formalities. The European Supervisory Authorities finished aggregating the second annual DORA Register of Information submission and advanced their roadmap for designating the first wave of Critical Third-Party ICT Providers. ESMA renewed its public pressure on CASPs and payment institutions to delist stablecoins that have not completed authorisation under Titles III and IV of MiCA. And the FIDA trilogue, written off by several observers earlier this year, produced a measurable step forward that opened a credible path to adoption in 2027.
Taken one at a time, each is a compliance headline. Taken together, they shift what regulatory readiness means inside a European bank, insurer, asset manager or payment institution. It is no longer about preparing to pass an audit on a known date. It is about reading the calendar as a signal of which supplier choices will still be viable in eighteen months, and which have just become harder to defend to the supervisor, to procurement, and to the board.
The problem
The policy press treats these as separate stories because they come from separate directorates with separate deadlines. Inside a financial institution they are the same story: a slow, cumulative narrowing of the ICT and partner landscape by the regulator rather than by the market.
The problem for the innovation office, head of transformation, CIO office and strategy team is that this narrowing shows up at exactly the wrong time. Delivery pressure has not eased. Boards are still asking why the last three vendor pilots did not scale. The procurement team is still trying to drive down the number of material outsourcing contracts. The DORA Register of Information submitted in April still has data-quality issues the EBA, ESMA and EIOPA will push back on. Legal counsel is tracking at least five parallel rulebooks, most of which were drafted on the assumption that the others would not land in the same quarter. The ECB has started asking SREP questions about third-party concentration that were not in the questionnaire a year ago.
Senior teams typically read regulation in two speeds: the compliance team reads it word by word, and everyone else waits for the one-page summary from legal. Neither speed is useful when the regulation starts picking winners. By the time the one-page summary says 'this is now a buying trigger', the window to run a credible discovery process on alternatives has already closed. By the time the full legal analysis is done, the peer who moved first is six months ahead on their reference deployment and the vendor's roadmap has shifted around them.
Common approaches and their trade-offs
There are four approaches most financial institutions use to turn the regulatory calendar into adoption decisions, and each has a familiar failure mode.
The first is legal-first filtering. Every incoming innovator is scored for compliance risk by second line before any business owner can engage. It is defensible, it protects the institution, and it is the slowest way to miss a market cycle. By the time an innovator clears, two of its peers have been bought by larger platforms, and the surviving options look thinner than the market really is.
The second is the regulatory horizon calendar. Produced by risk, often as a thorough slide pack, read by almost no one outside risk. It names deadlines but rarely names decisions. It never says 'this is why we should buy', because that is not what risk functions are set up to say.
The third is vendor-led decoding. The innovator explains the regulation as it pertains to its own product. This works for the specific question the vendor has solved. It fails on everything else, because the vendor sees only its own slice of the rulebook, which means the bank sees a correspondingly narrow view of what is coming. The bank then over-indexes on that slice because it is the only part explained in business language.
The fourth is peer whispering. A senior leader rings a counterpart in another market, asks how they are reading PSD3 or DORA, and listens. This is the most useful signal of the four. It is also episodic, confidential, and tilted toward people who have time to pick up the phone. Supervisory colleges and SREP cycles make honest answers harder to give over time, not easier.
The common failure across all four is the same: the regulation is read as a compliance input, not as a market signal. In 2026 that is a mistake with a cost.
A smarter route
The route that works pairs the regulatory calendar directly with the adoption pipeline, and treats each rulebook moment as a question about which buying decisions it forces, when, and who else at a comparable institution is being forced to make the same one. The question stops being 'when must we comply' and becomes 'what does each milestone narrow or widen in the vendor landscape, and what do we therefore shortlist, pilot, or pause this quarter'.
That reframe makes a different kind of discovery valuable. A Discovery Innovation Meeting that puts an innovation team in a short, focused session with the four or five innovators that most directly intersect a specific rulebook moment, pre-filtered by alignment with the institution's actual constraints, closes a gap no amount of legal briefing closes on its own.
A Peer Forum that puts the innovation leads of six comparable European banks or insurers in the same room for an afternoon, under good discussion rules, produces the honest peer read that the SREP cycle makes harder to get in a corridor. A Roundtable that gathers heads of transformation across markets to compare how they are sequencing DORA remediation against PSD3 adoption against MiCA grandfathering gives senior teams the cross-market pattern that no single-market view yields. Finance X Magazine serves the same job in editorial form for the weeks between those sessions: a curated read on where the rulebooks are moving the vendor landscape, written for the buyer rather than the seller.
The Connector exists to run those formats because the market does not run them well on its own. The point is not the format. The point is that the discovery mechanism has to match the question, and the question has changed.
Alongside that, the internal operating model needs one small change. The innovation office, strategy team and transformation director should own the translation of every regulatory moment into a 'what does this change in our shortlist' note, one page, within two weeks of the moment, dated. Legal reviews it. Risk notes residual exposure. The CIO office acts. The note becomes the artefact that is actually read in the room where buying decisions are made, rather than the long compliance brief that is not.
Why this matters right now
Four things are true in late 2026 that were not true a year ago.
The second DORA Register of Information gives the supervisor a cross-sector view of ICT concentration that no single institution can reconstruct. The ESAs are using it to prepare CTPP designations, which is a buying trigger: if a vendor currently in a shortlist is about to be designated, oversight obligations and timelines around them change, and the window to agree remediation with them in the normal commercial posture is closing.
PSD3 and the Payment Services Regulation now have final compromise texts. The sequencing of SCA changes, access to accounts, fraud liability and prudential rules can be modelled against a real document rather than against trilogue summaries, and vendor roadmaps can be interrogated against that document rather than against the vendor's own interpretation.
ESMA's renewed stance on unauthorised stablecoins turns the second half of 2026 into a hard filter on crypto-asset service providers and the firms that use them. For an institution evaluating tokenised payment or settlement partners, the authorised list is now narrowing fast enough to matter to a procurement cycle.
FIDA has moved from 'unclear if it survives' to 'credible path to 2027'. For data access, account aggregation and open finance innovators, the roadmap just got more concrete, and the institutions that assumed the file was dead will have to catch up.
Any one of these is reason enough to revisit the vendor shortlist. In combination they argue for doing so now, not in Q1.
Closing thought
The reasons a European financial institution used to save time by waiting on regulation have changed. The rulebooks are no longer an abstract horizon event. They are starting to pick, in effect, which vendors will still look sensible to the supervisor, to the board and to procurement in eighteen months. The teams that are reading them as market signals, with the discovery mechanisms matched to the question, are already shortening the gap between a regulatory milestone and a buying decision. The teams that are reading them as compliance inputs will spend the first half of 2027 explaining to the board why the vendor they chose last year is no longer the obvious choice.
That is the quiet shift under the headlines. It is worth planning around.
