Banking and Finance in Portugal in 2026: Digital Resilience, “New Generation” AML, Open Finance and the Return of Structured Finance

Introduction

The Portuguese banking and financial sector is going through a period of unprecedented regulatory intensity and structural transformation, and this trend is likely to persist. In 2026–2027, a wave of EU legislation on digital resilience, cybersecurity, anti-money laundering, open finance, sustainability and artificial intelligence will reconfigure the operational framework of financial institutions. At the same time, a pipeline of mega-infrastructures and the continued digitalisation of financial services create new opportunities for structured finance and innovation.

Therefore, the flagships that will mark this sector in 2026 include the personalisation and integration of banking and financial services, with a focus on the consumer experience, the reinforcement of digital trust and security, and the efficiency of the financial ecosystem.

The macroeconomic context, although generally favourable, is more complex than it was a year ago, due to the geopolitical shock that ended up having tangible consequences for the European – and Portuguese – economy. According to the Economic Bulletin of the Bank of Portugal (March 2026), GDP growth is expected to be 1.8% in 2026, 1.6% in 2027 and 1.8% in 2028, with inflation rising to 2.8% in 2026, then falling to 2.3% in 2027 and 2.0% in 2028. These projections reflect the deterioration of the external environment following the military offensive launched by the United States and Israel against Iran in late February 2026, which led to a sharp rise in energy commodity prices and increased volatility in financial markets. Expectations for short-term interest rates have been revised upwards, with the three-month EURIBOR now expected to average 2.3% in 2026, rising to 2.6% in 2027 and 2.7% in 2028 – significantly higher than the assumptions made just three months earlier.

Despite these headwinds, the Portuguese economy continues to outperform the eurozone average, and the growth differential is expected to remain positive over the entire projection horizon, largely motivated by the implementation of the European recovery funds and by the confidence generated by compliance with the regulatory framework being implemented.

DORA – digital operational resilience in practice

The Digital Operational Resilience Act (DORA), applicable since January 2025, is one of the most relevant regulatory developments for the financial sector in terms of operational risk.

The obligations imposed by DORA are comprehensive and demanding, and in 2026 the auditable demonstration of compliance with the regulation will prevail. Financial entities should implement robust ICT risk management frameworks, establish procedures for reporting major cyber incidents to competent authorities, conduct periodic penetration and resilience tests of their systems, and ensure strict management of third-party IT providers, including cloud providers.

The practical impact of DORA on the Portuguese market is considerable. We are witnessing a massive renegotiation of contracts with technology suppliers, with the introduction of specific contractual clauses that reflect the requirements of the regulation. In M&A transactions in the financial sector, due diligence now includes an in-depth analysis of DORA compliance and the maturity of the target entities’ ICT risk management systems.

A new anti-money laundering architecture – AMLR, AMLD6 and AMLA

Financial entities are increasingly investing in techniques and tools that help them fight money laundering. From this perspective, quantum computing will be a great ally in terms of identifying complex fraud patterns, often associated with “money mules”, which is difficult for traditional systems, as has been seen by entities that already use this technology, such as Lloyds Bank. The new European anti-money laundering package has emerged with the aim of mitigating and preventing this type of crime, representing the most profound reform in this area in decades. It consists of three key instruments that together completely redesign the European prevention and combat architecture.

• The Anti-Money Laundering Regulation (AMLR) introduces rules that are directly applicable in all member states, putting an end to the fragmentation resulting from successive national transpositions of previous directives.
• The Sixth Anti-Money Laundering Directive (AMLD6) complements the Regulation with provisions that require national transposition, particularly regarding the powers of Financial Intelligence Units and co-operation between authorities.
• Perhaps the most notable structuring change is the creation of the European Anti-Money Laundering Authority (AMLA), based in Frankfurt. AMLA will have direct supervisory powers over the riskiest financial entities, ensuring consistent application of the rules across the Union. AMLA became operational in 2025, with full implementation of the package expected in 2027.

For Portuguese financial institutions, this new framework requires:

• a comprehensive review of know-your-customer (KYC) and anti-money laundering policies;
• new beneficial ownership identification (know-your-business, or KYB) requirements;
• greater “friction” in onboarding and certain transactions (especially cross-border, crypto, complex structures and sensitive sectors); and
• preparation for significantly more severe penalties in case of non-compliance.

The move from a directive-based to a regulation-based model implies that Portuguese legislation will largely be replaced by directly applicable EU rules, reducing the margin for national interpretation, but at the same time requiring a high degree of operational readiness on the part of the entities concerned.

It should be noted that transparency regarding beneficial ownership is not without tension with fundamental rights: in the judgment of the Court of Justice (Grand Chamber) of 22 November 2022, in Joined Cases C-37/20 and C-601/20, WM and Sovim SA v Luxembourg Business Registers, the CJEU ruled on the validity of general public access to beneficial ownership information in light of Articles 7 and 8 of the Charter (right to private life and data protection), a well-known example of the practical conflict between AML transparency requirements and data protection, which directly influences the design of compliance solutions, registers and onboarding processes.

PSD3, PSR and the transition to open finance

The Third Payment Services Directive (PSD3) and the new Payment Services Regulation (PSR) will replace the current PSD2 framework, marking the transition from open banking to the broader concept of open finance.

This regulatory development extends the principle of access to data far beyond payment accounts, encompassing data relating to insurance, pensions, investments and other financial products. The aim is to create a truly integrated ecosystem for financial data sharing, fostering innovation, interoperability and competition for the benefit of consumers.

The new framework also strengthens protection against fraud by clarifying and extending the liability of payment service providers. The implementation of these legal regimes is planned for 2026–2027. In this context, case law has already provided important clarifications on payment services regulation: the CJEU Judgment of 11 November 2020, in Case C-287/19, DenizBank AG v Verein für Konsumenteninformation, addressed, inter alia, the concept of a “payment instrument”, the contactless (NFC) functionality, information duties, the alteration of conditions with tacit consent, and derogations applicable to low-value instruments. The ruling illustrates how case law has been clarifying the discipline of payments (PSD2) precisely at a time when the legislator intends to “close gaps” with PSD3/PSR and move towards a broader framework for data sharing in the financial sector.

Portuguese financial institutions must prepare to adapt their systems and processes to this new paradigm of data sharing. The transition to open finance will accelerate competition from fintechs and technology companies, while opening up new opportunities for traditional banks to effectively leverage data and develop innovative product offerings.

The digital euro – preparing for a Central Bank digital currency

The digital euro continues to be one of the most strategic topics, especially at a time of growth in tokenised markets – and, at the same time, is more subject to calendar uncertainty and final design. Banco de Portugal describes the project as being in the preparation phase and frames it as a retail payment instrument, complementary to cash, with particular attention to risks of bank disintermediation (outflow of deposits from banks to the central bank), with holding limits per user being mentioned as mitigation.

The ECB’s final decision on the launch of the digital euro is expected in 2026, with availability to the public potentially by 2029. Notwithstanding, in March 2026 the ECB moved into a new phase of development of the digital euro by seeking experts to define operational rules for the digital euro, with a focus on ATMs and payment terminals used in commerce.

Therefore, the current concerns regarding this European project include:

• banks’ role in distribution and user experience;
• potential pressure on funding and deposits (and adjustments in pricing and products);
• integration with instant payments and pan-European solutions; and
• privacy, compliance and fraud prevention requirements.

While the ECB develops its proposal, the European financial sector is also moving. A consortium of 12 banks, including BBVA, ING and BNP Paribas, is developing the Qivais project, which foresees the launch of a stablecoin pegged to the euro as early as the second half of 2026. This initiative aims to offer blockchain-based payments without resorting to digital currencies associated with the dollar, introducing a private alternative to the digital euro. The same movements are taking place in Switzerland, where six Swiss banks (UBS, PostFinance, Sygnum, Raiffeisen, ZKB and BCV) have joined forces to test the creation of a stablecoin pegged to the Swiss franc, in a sandbox environment, with implementation scheduled for 2026.

Tokenisation and distributed ledger technology (DLT)

The DLT Pilot Regime, established by European regulation, allows the issuance and trading of tokenised financial instruments in a controlled regulatory environment. This development paves the way for innovation in the structuring and trading of securities.

In parallel, the MiCA Regulation is in full application for crypto-assets that do not qualify as financial instruments, establishing a comprehensive regulatory framework for this market. The potential for the issuance of tokenised bonds and security tokens is significant, allowing for efficiency gains in the issuance, custody and settlement of financial instruments.

The ECB and other central banks are exploring central bank money settlement solutions using DLT, which could accelerate market uptake of these innovations. Although still in its early stages, this convergence between traditional finance and digital asset infrastructure has the potential to reconfigure capital markets in the medium term.

Basel III endgame – final implementation through CRR III and CRD VI

The final implementation of the Basel III framework in the European Union, through CRR III and CRD VI, is ongoing and has been occurring since January 2025, introducing significant changes to banks’ capital requirements.

The methodologies for calculating credit risk, market risk and operational risk are being revised, with a direct impact on risk-weighted assets. The topic may seem distant from the client, but it directly affects the cost and availability of financing, especially in portfolios that are more sensitive to risk weights. In the context of supervision and sanctions under this regime, it is worth mentioning the judgment of the General Court of 8 July 2020, in Case T-203/18, VQ v European Central Bank, which addressed the imposition (and publication rules) of an administrative fine applied by the ECB for infringement of Regulation (EU) No 575/2013 (CRR) – an example of how the supervisory and sanctioning framework can materialise at the European level.

The 72.5% output floor (which limits the reduction in capital requirements that banks can achieve through internal models) will be introduced in a phased manner by 2030. In 2026, the challenge is to manage the transition period, with a potential impact on:

• credit pricing and trade finance;
• appetite for certain segments (more “consuming” exposures of capital);
• the structuring of guarantees and collateral; and
• the use of securitisation and risk mitigation techniques.

Sustainability as a legal obligation – CSRD and CSDDD

The integration of sustainability considerations into the regulatory framework of the financial sector has gone from being an emerging trend to becoming a structured legal obligation.

The Corporate Sustainability Reporting Directive (CSRD) sets out sustainability reporting obligations in accordance with the European Sustainability Reporting Standards (ESRS). Large companies have been subject to these obligations since 2024, while listed small and medium-sized companies will be covered from 2026.

The Corporate Sustainability Due Diligence Directive (CSDDD) goes further by imposing due diligence obligations on human rights and environmental impacts along the entire value chain of companies. The implementation will be phased between 2027 and 2029, depending on the size of the company.

The impact on funding is direct and significant:

• credit agreements increasingly include ESG clauses;
• sustainability-linked loans with mandatory key performance indicators are increasingly common; and
• project finance operations require increasingly sophisticated ESG due diligence processes.

For lawyers advising on banking and finance transactions, sustainability has moved from being a soft law layer to a hard law compliance requirement that must be incorporated into documentation, risk assessment and ongoing reporting.

Artificial intelligence in financial services – the AI Act

The Artificial Intelligence Regulation (AI Act) establishes a risk-based regulatory framework with particular relevance to the financial sector. Credit scoring systems and risk assessment tools in insurance are classified as high-risk systems, subject to enhanced obligations.

These obligations include transparency requirements on the functioning of algorithms, guarantees of explainability of automated decisions and the maintenance of adequate human oversight. The implementation of the AI Act is phased between 2024 and 2027, with high-risk systems becoming fully subject to the regulation in August 2026. It is worth noting that the regulation of AI in the financial sector does not appear in a vacuum: the CJEU judgment of 7 December 2023, in Case C-634/21, SCHUFA Holding (Scoring), addressed “scoring” within the framework of Article 22 of the GDPR (automated individual decision-making) and the way in which these practices are scrutinised in light of data protection rules, reinforcing the case law and regulatory trend that has been tightening transparency and control requirements in automated decisions.

Financial institutions that use AI systems in their operations should prepare to demonstrate compliance with these new requirements. This involves auditing existing AI models, establishing governance frameworks for algorithmic decision-making, and ensuring that automated customer-facing decisions can be effectively explained and challenged.

Securitisation and NPLs – perspectives of a new cycle

After a prolonged period of high interest rates, the market is anticipating relevant developments in securitisation and non-performing loans (NPLs). There is an expectation of a potential increase in NPLs in certain market segments, as the effects of tighter financing conditions manifest themselves in the repayment capacity of some borrowers.

This dynamic may translate into greater activity in the secondary market for NPLs in Portugal. The European securitisation framework – STS (Simple, Transparent and Standardised) – provides a favourable environment for portfolio securitisation transactions, allowing financial institutions to manage their balance sheets more efficiently. A potential revitalisation of this market is anticipated in the coming years, with the entry into force of the new legal regime for the assignment and management of non-performing loans in December 2025, aimed at protecting depositors and the stability of the banking system.

The current macroeconomic environment – with the three-month EURIBOR remaining above 2% over the entire projection horizon and inflationary pressures from energy sources weighing on household and corporate finances – reinforces the expectation that asset quality pressures may arise, particularly in the sectors most exposed to rising production costs and tighter credit conditions.

Project finance – national megaprojects

Portugal has a set of large-scale infrastructure projects in the pipeline that will require significant amounts of financing and complex legal structures.

• The new Lisbon Airport, to be built in Alcochete, represents an estimated investment of EUR8–10 billion.
• The High-Speed Line connecting Lisbon, Porto and Vigo will involve an investment of EUR4–5 billion for the Portuguese segment alone.
• The Eastern Lisbon Hospital has an estimated cost of more than EUR1 billion.
• Investments in the energy transition – namely, offshore wind and green hydrogen – total several billion euros.

These projects will involve sophisticated structures, including:

• public-private partnerships with complex risk allocation;
• the issuance of project bonds for access to financing in the capital market;
• mobilising European funding through the Recovery and Resilience Plan and InvestEU; and
• significant participation of commercial banks in syndicated financing.

The Portuguese project finance market is therefore expected to register considerable dynamism in 2026–2027. For legal professionals, these transactions present a unique combination of commercial opportunity and regulatory complexity, encompassing public procurement law, environmental licensing, energy regulation and financial structuring.

The energy transition remains a central driver. Portugal’s ambitious renewable energy targets, combined with decarbonisation incentives at the European level, continue to generate a pipeline of bankable projects in solar, onshore wind, offshore wind and green hydrogen. Offshore wind, in particular, represents the next frontier, with the government designating offshore areas for development, and significant capacity auctions planned in the coming years.

Conclusion

The 2026–2027 biennium presents itself as a period of intense regulatory activity and structural transformation for the Portuguese financial sector. The convergence of digital resilience requirements, sustainability obligations, anti-money laundering reform and technological innovation requires financial institutions and their legal advisers to be able to adapt and anticipate an unprecedented capacity.

The macroeconomic environment, while resilient by European standards, is marked by heightened geopolitical uncertainty and the return of energy-related inflationary pressures. Short-term interest rates have been revised upwards, financing conditions are expected to tighten and the external environment has deteriorated.

At the same time, the pipeline of national mega-infrastructures – from Lisbon’s new airport to high-speed rail, hospital construction and offshore wind – offers significant opportunities for structured finance operations of considerable complexity and sophistication.

The main challenge for market participants will be to navigate this regulatory density while taking advantage of the commercial opportunities arising from Portugal’s strategic investments, its integration into European financial markets and its continued attractiveness as a destination for national and international capital. Regulatory clarity, speed in licensing and a stable institutional framework will be essential to maintain the momentum of the sector.