How to monitor EU financial regulation without a dedicated legal team

The compliance monitoring problem at smaller firms

Large financial institutions have dedicated regulatory intelligence functions: teams whose entire job is to track what is moving through the EU legislative pipeline, translate it into firm-specific obligations, and brief internal stakeholders before deadlines arrive. For a firm with ten people, or one person wearing the compliance hat alongside three other roles, that model does not exist.

The problem is not access to information. EUR-Lex publishes the full text of every EU legal instrument. The European Banking Authority (EBA), the European Securities and Markets Authority (ESMA), and the European Insurance and Occupational Pensions Authority (EIOPA) all publish consultation papers, final technical standards, and supervisory guidance on their websites, for free. The raw material is available to anyone.

The problem is volume, structure, and lead time. EU financial regulation produces a continuous stream of legislative instruments, delegated acts, regulatory technical standards, implementing technical standards, supervisory guidelines, Q&A documents, and enforcement decisions across dozens of active regulatory files simultaneously. No individual can monitor this at volume manually and still do their actual job. The firms that stay ahead are not necessarily the ones with the best lawyers. They are the ones with the most systematic approach to filtering what matters from what does not.

This article sets out a practical monitoring system for firms that do not have a dedicated legal team, built around the free sources that are already available, structured to create lead time rather than just awareness.

For a broader discussion of what regulatory horizon scanning is and why it is distinct from compliance management, see what is regulatory horizon scanning and why compliance teams need it.

This article is for informational purposes only and does not constitute legal advice. Consult a qualified legal professional for advice specific to your situation.

Step one: define your regulatory perimeter

Before setting up any monitoring system, the first question is what you are monitoring for. EU financial regulation is not monolithic. A payment institution authorised under PSD2 has a different regulatory perimeter than a crypto-asset service provider authorised under the Markets in Crypto-Assets Regulation (MiCA), an alternative investment fund manager under the Alternative Investment Fund Managers Directive (AIFMD), or an insurance firm under Solvency II. The regulations that are relevant to your firm are determined by your authorisation type, the products you offer, the jurisdictions you operate in, and the types of counterparties you deal with.

A useful way to frame this is to think in three layers. The first layer is the regulations you are already subject to and actively complying with. These are your core monitoring obligations: you need to track implementation guidance, technical standards, supervisory Q&As, and enforcement developments as they emerge. The second layer is the regulations that are on a trajectory to become relevant: proposals that have passed the commission stage, are moving through trilogue, or have been published but have implementation dates still ahead of you. These require less intensive monitoring but should be on your radar before they reach the third layer. The third layer is early-stage proposals and consultation papers that may or may not affect you depending on how the final text develops. These warrant awareness, not action.

Write this down as a list, assign each active regulation to one of the three layers, and review it at least quarterly. The list changes as your authorisations change, as new regulations come into force, and as early-stage proposals mature.

Step two: use EUR-Lex as your primary source

EUR-Lex at eur-lex.europa.eu is the official database of EU law. It contains the full text of every regulation, directive, decision, and recommendation published in the Official Journal of the European Union, as well as draft legislative texts, preparatory acts, and documents from the legislative process. It is free, authoritative, and comprehensive.

For regulatory monitoring purposes, EUR-Lex is useful in several ways. The search function allows you to filter by document type, issuing institution, legal basis, date range, and subject matter. If you know the CELEX identifier for a regulation you are tracking, you can use it to find all amending acts, delegated acts, and implementing acts associated with that parent regulation.

EUR-Lex also provides an alert service. You can set up email alerts for searches you define, which will notify you when new documents matching your criteria are published. This is not a sophisticated system: it is essentially a saved search that triggers an email. But for monitoring the Official Journal for publications related to specific regulations, it is a free and reliable baseline.

The limitation of EUR-Lex for horizon scanning purposes is that it captures what has been formally published. It does not surface consultation papers that are still open, draft technical standards that are under development, or legislative proposals that are in early committee stage. For those, you need the supervisory authority feeds.

Step three: monitor EBA, ESMA, and EIOPA directly

The three European Supervisory Authorities produce the bulk of the detailed technical content that determines what compliance actually looks like in practice. The headline regulation tells you that you need an ICT risk management framework; the regulatory technical standard developed by EBA specifies what that framework must contain. Monitoring the supervisory authority publications is not optional if you want to understand your actual obligations rather than just their broad outlines.

Each authority publishes a news and publications feed on its website. EBA is at eba.europa.eu, ESMA at esma.europa.eu, and EIOPA at eiopa.europa.eu. Each publishes consultation papers, draft technical standards, final technical standards, guidelines, opinions, and Q&A updates. These can be filtered by topic area or regulation.

For a small compliance team, the most practical approach is to bookmark the relevant topic pages for each regulation you are actively monitoring and check them on a fixed schedule, typically weekly. This is more reliable than relying on the general news feed, which covers everything across all sectors and produces significant noise if your regulatory perimeter is narrow.

Consultation papers deserve particular attention. When a supervisory authority publishes a consultation paper on a draft technical standard, it is inviting comment on requirements that are not yet final. This is the point at which the detail of your future obligations is visible before it is locked in. Even if you do not intend to submit a formal response, reading the consultation paper tells you what the standard is likely to require and gives you maximum lead time to prepare.

For a detailed explanation of how regulatory technical standards relate to the parent regulations they implement, and why they often matter more than the headline legislation, see what are regulatory technical standards and why do they matter more than the regulation itself.

Step four: track your national competent authority

EU financial regulation is implemented at the national level by national competent authorities (NCAs). Your NCA is the body that authorised your firm, supervises your ongoing compliance, and is your primary enforcement contact. For many EU financial regulations, the NCA publishes its own guidance, Q&As, and supervisory priorities that supplement the ESA-level material.

NCAs vary significantly in how actively they communicate. Some publish detailed implementation guidance, FAQs specific to their jurisdiction, and regular supervisory letters that give clear signals about enforcement priorities. Others publish relatively little beyond formal notices. Knowing your NCA’s communication style and publication schedule is part of setting up an effective monitoring system.

The NCA is also the first point of contact when you have a genuine interpretive question that cannot be resolved from the published text. Most NCAs have a mechanism for submitting questions, though response times vary. Building a relationship with your NCA before a compliance deadline arrives is preferable to reaching out in the weeks before a hard date.

For firms operating across multiple EU member states, each relevant NCA needs to be on the monitoring list separately. NIS2, for example, is implemented differently across member states because it is a directive rather than a regulation. The variation in national implementation can be material. For a discussion of the interaction between DORA and NIS2 and why national implementation matters, see DORA vs NIS2: understanding the overlap for financial firms.

Step five: build a simple regulatory calendar

Monitoring is only useful if it creates lead time. A regulatory calendar translates what you are tracking into a forward-looking schedule of dates that require action or decision, visible far enough ahead to be useful.

The calendar should contain, at minimum: the implementation dates for regulations you are actively subject to, the deadlines for any consultations you are tracking, the publication dates for final technical standards where these have been announced, and any supervisory assessment or submission deadlines that apply to your firm.

For a structured reference of current and upcoming EU financial regulation dates, see EU financial regulation calendar 2025 to 2026.

The format matters less than the discipline of maintaining it. A shared spreadsheet updated weekly is sufficient if it is actually updated. The failure mode in small compliance teams is not usually the absence of a calendar; it is a calendar that was set up once and then not maintained as dates moved and new obligations emerged.

Review the calendar in every weekly monitoring session. When you identify a new development from EUR-Lex, an ESA publication, or your NCA, the first question should be whether it generates a new date or changes an existing one.

What free monitoring cannot do

The approach described above is free, systematic, and significantly better than informal monitoring. It is also limited in ways that are worth being explicit about.

Manual monitoring at volume does not scale. If your regulatory perimeter covers more than three or four active regulations simultaneously, the time required to check EUR-Lex, three ESA websites, and one or more NCA sites on a weekly basis becomes a significant overhead. The volume of material is large enough that relevant publications can be missed even by a diligent reader.

Free monitoring tools provide no relevance filtering. EUR-Lex alerts notify you when documents matching your search criteria are published; they do not assess whether a given document is relevant to your firm’s specific authorisation type or business model. The filtering is entirely manual.

Free sources do not provide analysis. A consultation paper from EBA may run to two hundred pages. Understanding its implications for your firm requires reading it carefully, interpreting the technical language, and mapping the proposed requirements to your current systems and processes. The source material is available; the interpretation is not.

For firms whose regulatory perimeter is narrow and relatively stable, manual monitoring is a reasonable approach. For firms tracking multiple active regulations across multiple jurisdictions, or firms where a missed regulatory development could have material consequences, the gap between what manual monitoring provides and what systematic monitoring requires is the gap that purpose-built regulatory intelligence tools are designed to fill.

The manual approach above covers both adopted legislation and draft instruments. Forseti, our regulatory intelligence platform, currently covers only the former (EUR-Lex). We built the EUR-Lex pipeline first because regulations are where binding obligations ultimately land. ESA feeds are a separate build, and we will announce when they are added.

The signal-to-noise problem

The practical challenge in manual monitoring is not the absence of information but the ratio of relevant to irrelevant material. EUR-Lex publishes hundreds of documents per week across all areas of EU law. EBA, ESMA, and EIOPA together publish dozens of documents per month across all the regulations they oversee. A payment institution monitoring PSD3 development does not need to read ESMA’s latest guidelines on UCITS fund classification. But both will appear in a general feed.

The solution at a manual level is disciplined perimeter definition. If you have a clear, written regulatory perimeter, you can filter publications quickly against it. A document that does not touch any regulation in your perimeter can be dismissed in seconds. A document that does requires reading and assessment.

The solution at a systematic level is relevance filtering built into the monitoring layer: a system that understands your firm’s authorisation type, jurisdiction, and regulatory perimeter, and surfaces only the developments that are genuinely relevant. This is what enterprise regulatory intelligence platforms attempt to do, and what makes them valuable despite their cost. It is also, at a more affordable price point, what well-designed purpose-built tools for smaller firms should provide.

For smaller firms, the interim answer is to be ruthlessly explicit about what you are and are not monitoring. A regulatory perimeter list that is honest about its boundaries is more useful than an aspiration to monitor everything. Know what you are tracking, know what you are not, and accept the risk that comes with the gaps. That is a more defensible position than pretending to monitor broadly while actually covering very little systematically.

Forseti monitors adopted EU financial legislation continuously, delivering personalised regulatory intelligence anchored to verified EUR-Lex sources with full CELEX traceability. ESA consultation papers and draft technical standards are not yet covered — we will announce when those feeds are added. Start for free.