On 12 August 2025, the European Systemic Risk Board (ESRB) published a report that provides a compliance assessment on sub-recommendation A(1) of the ESRB recommendation of 2 December 2021.
Overview
On 2 December 2021, the General Board of the ESRB adopted Recommendation ESRB/2021/7 (Recommendation) on a pan-European systemic cyber incident coordination
On 16 July 2025, the European Central Bank (ECB) published a guide on outsourcing cloud services to cloud service providers.
The publication of the guide follows an earlier public consultation and the ECB has also published a feedback statement which provides an overview of the comments received and the ECB’s assessment of them.
On 14 May 2025, the European Parliament’s Economic and Monetary Affairs Committee published a draft report on the impact of artificial intelligence (AI) on the financial sector.
The report examines the use and impact of AI in the EU’s financial services sector and the regulatory landscape. The Rapporteur provides policy recommendations to enable
On 15 May 2025, there was published in the Official Journal of the EU a Corrigendum to Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework. The Corrigendum amends
On 29 April 2025, the European Commission adopted a Delegated Regulation supplementing the Regulation on markets in crypto-assets (MiCA) with regard to regulatory technical standards (RTS) specifying the arrangements, systems and procedures to prevent, detect and report market abuse, the templates to be used for reporting suspected market abuse, and the coordination procedures
On 15 April 2025, the Financial Stability Board (FSB) published its finalised Format for Incident Reporting Exchange (FIRE), a global standardised format aimed at streamlining cyber and operational incident reporting and enhancing cross-border cooperation.
FIRE is a common framework that financial firms can use to report operational incidents, including cyber
On 11 April 2025 the European Commission (“the Commission”) launched a public consultation on the review of Regulation (EU) 2019/881 on the European Union Agency for Cybersecurity (ENISA) and on information and communications technology cybersecurity certification (Cybersecurity Act). The consultation forms part of the Commission’s simplification agenda, which is a key
On 9 April 2025 the European Commission (the Commission) launched a public consultation on the proposal for a Cloud and AI Development Act. The initiative forms part of the Commission’s AI Continent Action Plan that was published the same day. In the accompanying Call for Evidence, the Commission sets out background to its proposed
We have published a new online briefing note which discusses the draft Financial Data Access Regulation.
Our briefing note is here.
On 24 March 2025, the European Commission adopted a draft Delegated Regulation supplementing the Regulation on digital operational resilience for the financial sector (DORA) with regard to regulatory technical standards specifying the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions.
The draft