Provides financial services, in the European Union

Directive 2013/36/EU, Article 74(1) · Read the law's page

• Have robust governance arrangements, which include a clear organizational structure with well-defined, transparent and consistent lines of responsibility (Article 74(1), point (a)).for a financial business
• Have effective processes to identify, manage, monitor and report the risks you are or might be exposed to, including ESG risks in the short, medium and long term (Article 74(1), point (b)).for a financial business
• Have adequate internal control mechanisms, including sound administration and accounting procedures (Article 74(1), point (c)).for a financial business
• Set up and manage your network and information systems in accordance with Regulation (EU) 2022/2554 (Article 74(1), point (d)).when it serves a financial business
• Have remuneration policies and practices that are consistent with and promote sound and effective risk management, including by taking into account your risk appetite in terms of ESG risks, and make them gender neutral (Article 74(1), point (e) and second subparagraph).for a financial business
• Make the arrangements, processes and mechanisms comprehensive and proportionate to the nature, scale and complexity of the risks inherent in your business model and activities, taking the technical criteria established in Articles 76 to 95 into account (Article 74(2)).for a financial business
• This Directive is addressed to the Member States (Article 165), which had to adopt and publish the measures necessary to comply with it by 31 December 2013 and apply them from 31 December 2013 (Article 162(1)), so an institution meets these rules through each Member State's national law; Article 74(1) in the wording that Directive (EU) 2024/1619 gave it applies from 11 January 2026 (Article 2(1) of that Directive).
• It reaches you if you are an institution, as defined in point (3) of Article 4(1) of Regulation (EU) No 575/2013 (Article 2(1) and Article 3(1), point (3)).

Directive (EU) 2015/849, Articles 33 and 39 · Read the law's page

• It reaches you if you are an obliged entity within Article 2(1), which lists credit institutions, financial institutions and the natural or legal persons acting in the exercise of their professional activities that the paragraph names: cooperate fully with the financial intelligence unit by promptly informing it, including by filing a report, on your own initiative, where you know, suspect or have reasonable grounds to suspect that funds, regardless of the amount involved, are the proceeds of criminal activity or are related to terrorist financing, and by promptly responding to its requests for additional information in such cases (Article 33(1), point (a)). A notary, other independent legal professional, auditor, external accountant or tax advisor is outside the obligations of Article 33(1) only to the strict extent that the information is received from, or obtained on, a client in the course of ascertaining the legal position of the client, or performing the task of defending or representing that client in, or concerning, judicial proceedings (Article 34(2)).when it serves a financial business
• Provide the financial intelligence unit directly, at its request, with all necessary information (Article 33(1), point (b), as replaced by Directive (EU) 2018/843, Article 1, point (21)).when it serves a financial business
• Report all suspicious transactions, including attempted transactions (Article 33(1)).when it serves a financial business
• Have the person appointed in accordance with Article 8(4), point (a), transmit the information to the financial intelligence unit of the Member State in whose territory you are established (Article 33(2)).when it serves a financial business
• Do not disclose to the customer concerned or to other third persons the fact that information is being, will be or has been transmitted to the financial intelligence unit in accordance with Article 33 or 34, or that a money laundering or terrorist financing analysis is being, or may be, carried out; the prohibition binds you and your directors and employees, subject to the exceptions of Article 39(2) to (6) (Article 39(1)).when it serves a financial business
• This Directive is addressed to the Member States (Article 69), which had to bring into force the laws, regulations and administrative provisions necessary to comply with it by 26 June 2017 (Article 67(1), as replaced by Directive (EU) 2018/843, Article 1, point (42)), so an obliged entity meets these rules through each Member State's national law; Article 77 of Directive (EU) 2024/1640 repeals this Directive with effect from 10 July 2027, and Annex VI to Regulation (EU) 2024/1624 correlates Article 33(1) with Article 69(1) and Article 39 with Article 73 of that Regulation.

Directive 2014/65/EU, Art. 16(7); Commission Delegated Regulation (EU) 2017/565, Art. 76 · Read the law's page

• It reaches you if you are an investment firm, meaning a legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis (Article 4(1), point (1), of the Directive): record the telephone conversations and electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission and execution of client orders, including those intended to result in such transactions or services even if they do not (Article 16(7)).when it serves a financial business
• Take all reasonable steps to record the relevant telephone conversations and electronic communications made with, sent from or received by equipment you provide to an employee or contractor, or whose use by an employee or contractor you have accepted or permitted, and all reasonable steps to prevent an employee or contractor from making, sending or receiving relevant conversations and communications on privately-owned equipment you are unable to record or copy (Article 16(7)).when it serves a financial business
• Notify new and existing clients that telephone communications or conversations between you and your clients that result or may result in transactions will be recorded. The notification may be made once, before you provide investment services to the client (Article 16(7)).when it serves a financial business
• Before you provide services relating to the reception, transmission and execution of orders to a new or existing client, inform the client that conversations and communications are being recorded and that a copy of the recording will be available on request for five years and, where the competent authority requests, for up to seven years, in the same language or languages as you use to provide investment services to clients (Article 76(8)).when it serves a financial business
• Do not provide, by telephone, investment services and activities relating to the reception, transmission and execution of client orders to a client who has not been notified in advance about the recording of the client's telephone communications or conversations. A client may place orders through other channels, but those communications must be made in a durable medium such as mails, faxes, emails or documentation of client orders made at meetings (Article 16(7)).when it serves a financial business
• Record in a durable medium all relevant information related to relevant face-to-face conversations with clients, including at least the date and time of the meeting, its location, the identity of the attendees, the initiator of the meeting and relevant information about the client order including the price, volume, type of order and when it is to be transmitted or executed (Article 76(9)).when it serves a financial business
• Provide the records to the client involved upon request and keep them for five years and, where the competent authority requests, for up to seven years, counted from the date the record is created (Article 16(7) of the Directive and Article 76(11)).when it serves a financial business
• Store the records in a durable medium that allows them to be replayed or copied, retain them in a format that does not allow the original record to be altered or deleted, keep them readily accessible and available to clients on request, and ensure the quality, accuracy and completeness of the records of all telephone recordings and electronic communications (Article 76(10)).when it serves a financial business
• Establish, implement and maintain a written policy on recording telephone conversations and electronic communications, appropriate to the size and organization of the firm and the nature, scale and complexity of its business, which identifies the conversations and communications subject to recording and sets out the procedures to follow where exceptional circumstances leave you unable to record on devices you issued, accepted or permitted, with the evidence of those circumstances retained and accessible to competent authorities (Article 76(1)).for a financial business
• Give the management body effective oversight and control over the recording policies and procedures, keep the arrangements technology-neutral and evaluate them periodically (adopting further measures at least when a new medium of communication is accepted or permitted), keep and regularly update a record of the individuals with firm devices or approved privately owned devices, train employees in the procedures, monitor the records of transactions and orders periodically on a risk-based and proportionate basis, and demonstrate the policies, procedures and management oversight to the competent authorities on request (Article 76(2) to (7)).for a financial business
• Directive 2014/65/EU is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by 3 July 2017 and apply them from 3 January 2018 (Article 93(1), as amended by Directive (EU) 2016/1034), so you meet its rules through each Member State's transposing law. Commission Delegated Regulation (EU) 2017/565 is directly applicable and applies from the same date (Article 91).

Directive 2014/65/EU, Article 16(6), with Regulation (EU) No 600/2014, Article 25(1) · Read the law's page

• It reaches you if you are an investment firm, meaning a legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis (Directive 2014/65/EU, Article 4(1), point (1)): arrange for records to be kept of all services, activities and transactions undertaken by you, sufficient to enable the competent authority to fulfil its supervisory tasks and to perform the enforcement actions under the Directive, Regulation (EU) No 600/2014, Directive 2014/57/EU and Regulation (EU) No 596/2014, and in particular to ascertain that you have complied with all obligations, including those with respect to clients or potential clients and to the integrity of the market (Article 16(6)).when it serves a financial business
• Keep at the disposal of the competent authority, for five years, the relevant data relating to all orders and all transactions in financial instruments which you have carried out, whether on own account or on behalf of a client (Regulation (EU) No 600/2014, Article 25(1)).when it serves a financial business
• For a transaction carried out on behalf of a client, make the records contain all the information and details of the identity of the client and the information required under Directive 2005/60/EC (Regulation (EU) No 600/2014, Article 25(1)).when it serves a financial business
• Give the European Securities and Markets Authority access to that information when it requests access under the procedure and conditions of Article 35 of Regulation (EU) No 1095/2010 (Regulation (EU) No 600/2014, Article 25(1)).when it serves a financial business
• This Directive is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by 3 July 2017 and apply them from 3 January 2018 (Article 93(1), as amended by Directive (EU) 2016/1034, Article 1, point (7)), so an investment firm meets Article 16(6) through each Member State's national law; Regulation (EU) No 600/2014 is binding in its entirety and directly applicable in all Member States and applies from 3 January 2018 (Article 55, as amended by Regulation (EU) 2016/1033, Article 1, point (14)).

Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589 · Read the law's page

• It reaches you if you are an investment firm that engages in algorithmic trading, meaning trading in financial instruments where a computer algorithm automatically determines individual parameters of orders such as whether to initiate the order, the timing, price or quantity of the order or how to manage the order after its submission, with limited or no human intervention; a system used only to route orders to one or more trading venues, to process orders involving no determination of any trading parameters, or to confirm orders or process executed transactions after the trade is outside that meaning (Directive 2014/65/EU, Article 4(1), point (39)). Have in place effective systems and risk controls suitable to the business you operate to ensure that your trading systems are resilient and have sufficient capacity, are subject to appropriate trading thresholds and limits, and prevent the sending of erroneous orders or the systems otherwise functioning in a way that may create or contribute to a disorderly market (Article 17(1)).when it serves a financial business
• Have in place effective systems and risk controls to ensure your trading systems cannot be used for any purpose that is contrary to Regulation (EU) No 596/2014 or to the rules of a trading venue to which you are connected, and effective business continuity arrangements to deal with any failure of your trading systems; ensure your systems are fully tested and properly monitored (Article 17(1)).when it serves a financial business
• Establish and monitor your trading systems and trading algorithms through a clear and formalized governance arrangement that sets out clear lines of accountability, including procedures to approve the development, deployment and subsequent updates of trading algorithms and to solve problems identified when monitoring them, effective procedures for the communication of information within the firm, and a separation of tasks and responsibilities of trading desks on the one hand and supporting functions, including risk control and compliance, on the other (Delegated Regulation (EU) 2017/589, Article 1).for a financial business
• Ensure that your compliance staff has at least a general understanding of how your algorithmic trading systems and trading algorithms operate and is in continuous contact with the persons within the firm who have detailed technical knowledge of them (Article 2(1)), and employ a sufficient number of staff with the necessary skills to manage those systems and algorithms, with sufficient technical knowledge of the systems and algorithms, their monitoring and testing, the trading strategies you deploy through them and your legal obligations (Article 3(1)).for a financial business
• Before deploying or substantially updating an algorithmic trading system, trading algorithm or algorithmic trading strategy, establish clearly delineated methodologies to develop and test it, have a person designated by senior management authorize the deployment or update, and design the methodologies to ensure that the system, algorithm or strategy does not behave in an unintended manner, complies with your obligations and the rules and systems of the trading venues you access, does not contribute to disorderly trading conditions and continues to work effectively in stressed market conditions; the authorization and the testing methodologies of Article 5(2) to (5) apply only to trading algorithms leading to order execution (Article 5(1), (2), (4) and (6)).for a financial business
• Test the conformance of your algorithmic trading systems and trading algorithms with the system of the trading venue when you access it as a member, when you connect to it through a sponsored access arrangement for the first time, when there is a material change of the venue's systems, and before you deploy or materially update the system, algorithm or strategy, and with the system of the direct market access provider when you first access the venue through direct market access, when there is a material change affecting its direct market access functionality, and before you deploy or materially update the system, algorithm or strategy (Article 6(1)); run the testing of the criteria in Article 5(4), points (a), (b) and (d), in an environment that is separated from your production environment (Article 7(1)); and before deploying a trading algorithm set predefined limits on the number of financial instruments being traded, the price, value and numbers of orders, the strategy positions and the number of trading venues to which orders are sent (Article 8).when it serves a financial business
• Keep records of any material change made to the software used for algorithmic trading, allowing you to determine when a change was made, the person that made it, the person that approved it and the nature of the change (Article 5(7)); have a person designated by senior management review any proposed material change to the production environment related to algorithmic trading before it is made, and communicate any change to the functionality of your systems to the traders in charge of the trading algorithm and to the compliance and risk management functions (Article 11).when it serves a financial business
• Perform a self-assessment and validation process annually and on that basis issue a validation report that reviews, evaluates and validates your algorithmic trading systems, trading algorithms and strategies, your governance, accountability and approval framework, your business continuity arrangement and your overall compliance with Article 17 of Directive 2014/65/EU; have the risk management function draw up the report, have the internal audit function audit it where one exists, obtain the approval of senior management, and remedy any deficiencies it identifies (Article 9). As part of that self-assessment, test that your algorithmic trading systems and the controls in Articles 12 to 18 can withstand increased order flows or market stresses, with high messaging volume tests and high trade volume tests using the highest volumes of the previous six months multiplied by two, carried out in a way that does not affect the production environment (Article 10).for a financial business
• Be able to cancel immediately, as an emergency measure, any or all of your unexecuted orders submitted to any or all trading venues to which you are connected, including orders originating from individual traders, trading desks or clients (kill functionality), and be able to identify which trading algorithm and which trader, trading desk or client is responsible for each order that has been sent to a trading venue (Article 12).when it serves a financial business
• Monitor all trading activity that takes place through your trading systems, including your clients' trading, for signs of potential market manipulation with an automated surveillance system that generates alerts and reports, covers the full range of your trading activities and all orders you submit, is reviewed at least once a year, and can generate operable alerts at the beginning of the following trading day or, where manual processes are involved, at the end of the following trading day (Article 13(1) to (3), (6) and (7)).when it serves a financial business
• Have business continuity arrangements for your algorithmic trading systems that are appropriate to the nature, scale and complexity of your business and documented in a durable medium, that deal with disruptive incidents and ensure a timely resumption of algorithmic trading, and review and test them annually (Article 14(1), (2) and (4)).for a financial business
• Carry out pre-trade controls on order entry for all financial instruments, namely price collars, maximum order values, maximum order volumes and maximum messages limits, immediately include all orders sent to a trading venue in the calculation of those limits, and have repeated automated execution throttles that disable the trading system after a pre-determined number of repeated executions until a designated staff member re-enables it (Article 15(1) to (3)); set market and credit risk limits based on your capital base, clearing arrangements, trading strategy, risk tolerance, experience and certain variables (Article 15(4)).when it serves a financial business
• Monitor in real time, during the hours you are sending orders to trading venues, all algorithmic trading activity that takes place under your trading code, including that of your clients, for signs of disorderly trading, have the trader in charge of the algorithm and the risk management function or an independent risk control function carry out that monitoring, generate real-time alerts within five seconds after the relevant event, and take remedial action as soon as possible after an alert (Article 16(1), (2) and (5)). Continuously operate your post-trade controls, take appropriate action when one is triggered, keep complete, accurate and consistent records of trade and account information, and reconcile your own electronic trading logs with the information provided by trading venues, brokers, DEA providers, clearing members, central counterparties and data providers (Article 17(1) and (3)).when it serves a financial business
• Implement an IT strategy and arrangements for physical and electronic security that minimize the risks of attacks against your information systems, promptly inform the competent authority of any material breaches of your physical and electronic security measures with an incident report on the nature of the incident, the measures taken and the initiatives to avoid similar incidents, and annually undertake penetration tests and vulnerability scans (Article 18(1) to (4)).when it serves a financial business
• Notify the competent authorities of your home Member State and of the trading venue at which you engage in algorithmic trading as a member or participant that you engage in algorithmic trading in a Member State, and on request provide a description of the nature of your algorithmic trading strategies, details of the trading parameters or limits to which the system is subject, the key compliance and risk controls you have in place and details of the testing of your systems (Directive 2014/65/EU, Article 17(2)).when it serves a financial business
• Arrange for records to be kept in relation to those matters, sufficient to enable your competent authority to monitor compliance with the requirements of the Directive (Article 17(2)). If you engage in a high-frequency algorithmic trading technique, meaning a technique characterized by infrastructure intended to minimize network and other latencies, system-determination of order initiation, generation, routing or execution without human intervention for individual trades or orders, and high message intraday rates (Article 4(1), point (40)), store in an approved form accurate and time sequenced records of all your placed orders, including cancellations of orders, executed orders and quotations on trading venues, and make them available to the competent authority upon request (Article 17(2)); record the details of each submitted order immediately after submission in the format set out in tables 2 and 3 of Annex II and keep the records for five years from the date of the submission of the order (Delegated Regulation (EU) 2017/589, Article 28).when it serves a financial business
• If your algorithmic trading pursues a market making strategy, carry out that market making continuously during a specified proportion of the trading venue's trading hours, except under exceptional circumstances, enter into a binding written agreement with the trading venue that specifies your obligations, and have in place effective systems and controls to ensure that you fulfil your obligations under the agreement at all times (Directive 2014/65/EU, Article 17(3)). You are considered to pursue a market making strategy when, as a member or participant of one or more trading venues, your strategy, when dealing on own account, involves posting firm, simultaneous two-way quotes of comparable size and at competitive prices relating to one or more financial instruments on a single trading venue or across different trading venues, with the result of providing liquidity on a regular and frequent basis to the overall market (Article 17(4)).when it serves a financial business
• If you provide direct electronic access to a trading venue, have in place effective systems and controls that ensure a proper assessment and review of the suitability of clients using the service, that those clients are prevented from exceeding appropriate pre-set trading and credit thresholds, that their trading is properly monitored, and that appropriate risk controls prevent trading that may create risks to you or contribute to a disorderly market; direct electronic access without such controls is prohibited (Directive 2014/65/EU, Article 17(5)). Apply the controls of Articles 13, 15 and 17 and the real-time monitoring of Article 16 of Delegated Regulation (EU) 2017/589 to the order flow of each of your direct electronic access clients, conduct a due diligence assessment of prospective clients, and review your due diligence assessment processes and reassess your clients' systems and controls annually (Articles 20, 22 and 23).when it serves a financial business
• If you act as a general clearing member for other persons, have in place effective systems and controls to ensure clearing services are only applied to persons who are suitable and meet clear criteria, and a binding written agreement with each such person on the essential rights and obligations arising from the service (Directive 2014/65/EU, Article 17(6)); subject the systems you use to support your clearing services to appropriate due diligence assessments, controls and monitoring (Delegated Regulation (EU) 2017/589, Article 24).when it serves a financial business
• This Directive is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by 3 July 2017 and apply them from 3 January 2018 (Article 93(1), as amended by Directive (EU) 2016/1034, Article 1, point (7)), so an investment firm meets Article 17 through each Member State's national law; Delegated Regulation (EU) 2017/589 is binding in its entirety and directly applicable in all Member States and applies from 3 January 2018 (Article 29).

Directive 2014/65/EU, Article 25(2), supplemented by Commission Delegated Regulation (EU) 2017/565, Article 54 · Read the law's page

• It reaches you if you are an investment firm, meaning a legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis (Directive 2014/65/EU, Article 4(1), point (1)), that provides investment advice or portfolio management: obtain the necessary information regarding the client's or potential client's knowledge and experience in the investment field relevant to the specific type of product or service, financial situation including the ability to bear losses, and investment objectives including risk tolerance, so as to recommend the investment services and financial instruments that are suitable for the client and in particular are in accordance with the client's risk tolerance and ability to bear losses (Article 25(2)).when it serves a financial business
• Where you provide investment advice or portfolio management services in whole or in part through an automated or semi-automated system, keep the responsibility to undertake the suitability assessment with yourself as the investment firm providing the service; the use of an electronic system in making the personal recommendation or decision to trade does not reduce it (Delegated Regulation (EU) 2017/565, Article 54(1)).for a financial business
• Do not create any ambiguity or confusion about your responsibilities in the process when assessing suitability, and inform clients or potential clients, clearly and simply, that the reason for assessing suitability is to enable you to act in the client's best interest (Article 54(1)).when it serves a financial business
• Obtain from clients or potential clients such information as is necessary to understand the essential facts about the client and to have a reasonable basis for determining that the specific transaction to be recommended, or entered into in the course of providing a portfolio management service, meets the client's investment objectives, including risk tolerance and any sustainability preferences, is one the client is able financially to bear, and is one for which the client has the necessary experience and knowledge to understand the risks involved (Article 54(2), point (a) as replaced by Delegated Regulation (EU) 2021/1253, and points (b) and (c)).when it serves a financial business
• Take reasonable steps to ensure that the information collected about your clients is reliable, including by ensuring that all tools, such as risk assessment profiling tools or tools to assess a client's knowledge and experience, are fit-for-purpose and appropriately designed for use with your clients, with any limitations identified and actively mitigated through the suitability assessment process (Article 54(7), point (b)).when it serves a financial business
• Do not recommend investment services or financial instruments to a client or potential client if you do not obtain the information required under Article 25(2) of the Directive (Article 54(8)), and do not recommend or decide to trade where none of the services or instruments are suitable for the client (Article 54(10), as replaced by Delegated Regulation (EU) 2021/1253).when it serves a financial business
• Have in place, and be able to demonstrate that you have in place, adequate policies and procedures to ensure that you understand the nature and features, including costs and risks, of the investment services and financial instruments selected for your clients, including any sustainability factors, and assess, taking into account cost and complexity, whether equivalent investment services or financial instruments can meet the client's profile (Article 54(9), as replaced by Delegated Regulation (EU) 2021/1253).for a financial business
• Where you do not recommend a financial instrument as meeting a client's or potential client's sustainability preferences because it does not meet them, explain the reasons to the client or potential client and keep records of those reasons (Article 54(10), as replaced by Delegated Regulation (EU) 2021/1253).when it serves a financial business
• When providing investment advice, provide the client, before the transaction is made, with a statement on suitability in a durable medium specifying the advice given and how that advice meets the preferences, objectives and other characteristics of the retail client (Directive 2014/65/EU, Article 25(6)).when it serves a financial business
• When providing investment advice, provide a report to the retail client that includes an outline of the advice given and that explains how the recommendation provided is suitable for the retail client, including how it meets the client's investment objectives, personal circumstances with reference to the investment term required, knowledge and experience, attitude to risk, capacity to sustain losses and sustainability preferences (Delegated Regulation (EU) 2017/565, Article 54(12), as replaced by Delegated Regulation (EU) 2021/1253).when it serves a financial business
• If you provide a periodic suitability assessment, review the suitability of the recommendations you give at least annually (Delegated Regulation (EU) 2017/565, Article 54(13)).when it serves a financial business
• When providing investment advice or portfolio management that involves the switching of financial instruments, obtain the necessary information on the client's investment and analyze the costs and benefits of the switching, and when providing investment advice inform the client whether or not the benefits of the switching are greater than the costs involved (Directive 2014/65/EU, Article 25(2), third subparagraph, added by Directive (EU) 2021/338, which Member States apply from 28 February 2022).when it serves a financial business
• This Directive is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by 3 July 2017 and apply them from 3 January 2018 (Article 93(1), as amended by Directive (EU) 2016/1034, Article 1, point (7)), so an investment firm meets Article 25(2) through each Member State's national law; Delegated Regulation (EU) 2017/565 is binding in its entirety and directly applicable in all Member States and applies from the date that appears first in the second subparagraph of Article 93(1) of the Directive, which is 3 January 2018 (Article 91), and Delegated Regulation (EU) 2021/1253 changed its Article 54 with effect from 2 August 2022 (Article 2).

Directive 2014/65/EU, Articles 16(3) and 24(2), supplemented by Commission Delegated Directive (EU) 2017/593, Articles 9 and 10 · Read the law's page

• It reaches you if you are an investment firm, meaning a legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis (Directive 2014/65/EU, Article 4(1), point (1)), that manufactures financial instruments for sale to clients, or that offers or recommends financial instruments: maintain, operate and review a process for the approval of each financial instrument and significant adaptations of existing financial instruments before it is marketed or distributed to clients, specify in that process an identified target market of end clients within the relevant category of clients for each financial instrument, assess all relevant risks to that target market, and make sure the intended distribution strategy is consistent with it (Directive 2014/65/EU, Article 16(3)).for a financial business
• Regularly review the financial instruments you offer or market, taking into account any event that could materially affect the potential risk to the identified target market, to assess at least whether each remains consistent with the needs of the identified target market and whether the intended distribution strategy remains appropriate (Article 16(3)).for a financial business
• If you manufacture financial instruments for sale to clients, make available to any distributor all appropriate information on the financial instrument and the product approval process, including the identified target market (Article 16(3)), ensure that the instruments are designed to meet the needs of an identified target market of end clients, that the strategy for distribution is compatible with it, and take reasonable steps to ensure that the instrument is distributed to it (Article 24(2)).when it serves a financial business
• If you offer or recommend financial instruments that you do not manufacture, have in place adequate arrangements to obtain the information a manufacturer must make available and to understand the characteristics and identified target market of each financial instrument (Article 16(3)); understand the financial instruments you offer or recommend, assess the compatibility of the financial instruments with the needs of the clients to whom you provide investment services, also taking account of the identified target market, and ensure that financial instruments are offered or recommended only when this is in the interest of the client (Article 24(2)).for a financial business
• Ensure that the relevant staff involved in the manufacturing of financial instruments possess the necessary expertise to understand the characteristics and risks of the financial instruments you intend to manufacture (Delegated Directive (EU) 2017/593, Article 9(5)), and that the relevant staff involved in offering or recommending products possess the necessary expertise to understand the characteristics and risks of the products and services and the needs, characteristics and objectives of the identified target market (Article 10(7)).for a financial business
• If you manufacture financial instruments, identify at a sufficiently granular level the potential target market for each financial instrument and specify the type or types of client with whose needs, characteristics and objectives, including any sustainability related objectives, the financial instrument is compatible (Article 9(9), as replaced by Delegated Directive (EU) 2021/1269), undertake a scenario analysis that assesses the risks of poor outcomes for end clients posed by the product and in which circumstances they may occur (Article 9(10)), and give distributors information about the appropriate channels for distribution, the product approval process and the target market assessment that is of an adequate standard to enable them to understand and recommend or sell the financial instrument properly (Article 9(13)).when it serves a financial business
• If you distribute financial instruments, determine the target market for each financial instrument even if the manufacturer did not define it (Article 10(1)), and have in place adequate product governance arrangements to ensure that the products and services you intend to offer or recommend are compatible with the needs, characteristics and objectives, including any sustainability related objectives, of an identified target market and that the intended distribution strategy is consistent with it (Article 10(2), as replaced by Delegated Directive (EU) 2021/1269).for a financial business
• Ensure that the management body has effective control over your product governance process, that compliance reports to the management body systematically include information about the financial instruments you manufacture, and that the compliance function monitors the development and periodic review of your product governance arrangements; make the compliance reports available to the competent authority on request (Delegated Directive (EU) 2017/593, Article 9(6) and (7)).for a financial business
• Directive 2014/65/EU is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by 3 July 2017 and apply them from 3 January 2018 (Article 93(1), as amended by Directive (EU) 2016/1034, Article 1, point (7)); Delegated Directive (EU) 2017/593 is addressed to the Member States (Article 16), which had to adopt and publish the measures necessary to comply with it by 3 July 2017 and apply them from 3 January 2018 (Article 14(1)), and Delegated Directive (EU) 2021/1269 changed its Articles 9 and 10 for the measures that Member States apply from 22 November 2022 (Article 2(1)), so an investment firm meets these rules through each Member State's national law.

Directive (EU) 2015/2366, Articles 95 to 97 · Read the law's page

• Directive (EU) 2015/2366 reaches you if you are a payment service provider: a credit institution, an electronic money institution, a post office giro institution or a payment institution, including a payment initiation service provider or an account information service provider, which Article 97(4) names. A technical service provider that supports payment services without ever holding the funds to be transferred, such as one supplying data processing, authentication or terminals, is outside the Directive under Article 3(j), unless it provides payment initiation or account information services.
• Establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks of the payment services you provide, with effective incident management procedures that detect and classify major operational and security incidents (Article 95(1)). Where Regulation (EU) 2022/2554 applies to you, Article 95(1) applies without prejudice to Chapter II of that Regulation.
• Give your competent authority, every year or at the shorter interval it sets, an updated and comprehensive assessment of those risks and of whether your mitigation measures and control mechanisms are adequate (Article 95(2)).
• Notify the competent authority in your home Member State without undue delay of a major operational or security incident, and where the incident has or may have an impact on your users' financial interests, tell your users without undue delay of the incident and of the measures they can take to mitigate its adverse effects (Article 96(1)). This duty does not apply to a credit institution, an electronic money institution or a payment institution, to an account information service provider, or to an exempted payment institution or electronic money institution, which report major incidents under Regulation (EU) 2022/2554 (Article 96(7)).
• Give your competent authority statistical data on fraud relating to the different means of payment at least once a year (Article 96(6)).
• Apply strong customer authentication when the payer accesses a payment account online, initiates an electronic payment transaction, or carries out any action through a remote channel which may imply a risk of payment fraud or other abuses, and for an electronic remote payment use elements that dynamically link the transaction to a specific amount and a specific payee (Article 97(1) and (2)). Have adequate security measures in place to protect the confidentiality and integrity of your users' personalized security credentials (Article 97(3)).
• If you are an account servicing payment service provider, allow payment initiation service providers and account information service providers to rely on the authentication procedures you give your user (Article 97(5)).

Commission Delegated Regulation (EU) 2018/389, Arts. 2-9 and 22-36 · Read the law's page

• Have transaction monitoring mechanisms that detect unauthorized or fraudulent payment transactions by analyzing payment transactions against what is typical of the payment service user in the circumstances of a normal use of the personalized security credentials, and take into account at a minimum lists of compromised or stolen authentication elements, the amount of each payment transaction, known fraud scenarios, signs of malware infection in any session of the authentication procedure and, where you provide the access device or software, a log of its use and its abnormal use (Article 2).when it serves a financial business
• Document, periodically test, evaluate and audit the implementation of the security measures, through auditors with expertise in IT security and payments who are operationally independent, and make the entire audit report available to competent authorities on request. If you use the transaction risk analysis exemption of Article 18, have the methodology, the model and the reported fraud rates audited at least yearly, by an independent and qualified external auditor in the first year and at least every 3 years after that (Article 3).for a financial business
• When you apply strong customer authentication, base it on two or more elements categorized as knowledge, possession and inherence and generate an authentication code that you accept only once, from which no information on the elements can be derived, that cannot be generated from another code and that cannot be forged. Do not reveal which element was incorrect when authentication fails, do not allow more than five consecutive failed attempts within a given period of time before the action is blocked, protect communication sessions against the capture of authentication data, and do not allow more than 5 minutes without activity by the payer after authentication for online access to a payment account (Article 4).when it serves a financial business
• For an electronic remote payment transaction, make the payer aware of the amount and the payee, generate an authentication code that is specific to the amount and the payee the payer agreed to, accept only a code that corresponds to that amount and payee, invalidate the code if the amount or the payee changes, and protect the confidentiality, authenticity and integrity of the amount, the payee and the information displayed throughout all phases of the authentication (Article 5).when it serves a financial business
• Adopt measures that mitigate the risk that authentication elements categorized as knowledge are uncovered by or disclosed to unauthorized parties, that elements categorized as possession are used by or replicated for unauthorized parties, and that elements categorized as inherence and read by access devices and software are uncovered by unauthorized parties, with a very low probability of an unauthorized party being authenticated as the payer. Ensure that the breach of one element does not compromise the reliability of the others, and where an element is used through a multi-purpose device, use separated secure execution environments and mechanisms to ensure the software or device has not been altered (Articles 6 to 9).when it serves a financial business
• Ensure the confidentiality and integrity of the personalized security credentials of the payment service user, including authentication codes, during all phases of the authentication: mask them when displayed, do not store them or the related cryptographic material in plain text, protect secret cryptographic material from unauthorized disclosure, document the management of the cryptographic material, and process and route credentials and codes in secure environments in accordance with strong and widely recognized industry standards (Article 22).when it serves a financial business
• Create personalized security credentials in a secure environment and mitigate the risks of their unauthorized use following loss, theft or copying before delivery to the payer. Associate only the payment service user, in a secure manner, with the credentials, authentication devices and software, in secure environments under your responsibility, and use strong customer authentication when the association is made through a remote channel. Deliver them in a secure manner, with delivery mechanisms that ensure they reach the legitimate user, a means to verify the authenticity of authentication software delivered by means of the internet, and activation before first use. Apply the same procedures to renewal and re-activation, and have effective processes for the secure destruction, deactivation or revocation of credentials, devices and software and for the secure re-use of reusable devices and software (Articles 23 to 27).when it serves a financial business
• Ensure secure identification when communicating between the payer's device and the payee's acceptance devices for electronic payments, and effectively mitigate the risks of misdirection of communication to unauthorized parties in mobile applications and other interfaces offering electronic payment services. Have processes that make all payment transactions and other interactions traceable, with a unique identifier of each communication session, detailed logging of the transaction and timestamps synchronized according to an official time signal (Articles 28 and 29).when it serves a financial business
• If you are an account servicing payment service provider that offers a payment account accessible online, have in place at least one interface that lets account information service providers, payment initiation service providers and card-based payment instrument issuers identify themselves and communicate securely and lets them rely on the authentication procedures you provide to your users. Make the interface follow standards of communication issued by international or European standardization organizations, document its technical specification and make the documentation available free of charge on request to authorized providers and publish a summary on your website, make changes to the specification available not less than 3 months before they are implemented except in emergency situations, which you document, make the changes made to comply with Article 10a available not less than 2 months before they are implemented, and make a testing facility with support available for connection and functional testing (Articles 30 and 31).when it serves a financial business
• If you have a dedicated interface, ensure that it offers at all times the same level of availability and performance, including support, as the interfaces made available to your users, define transparent key performance indicators and service level targets at least as stringent, do not create obstacles to the provision of payment initiation and account information services, monitor the availability and performance of the interface and publish quarterly statistics on your website, and include in its design a strategy and plans for contingency measures with communication plans for payment service providers using the interface (Articles 32 and 33(1) and (2)).when it serves a financial business
• Report problems with a dedicated interface to your national competent authority without delay, whether you are the account servicing payment service provider or a provider referred to in Article 30(1) (Article 33(3)).when it serves a financial business
• For identification, rely on qualified certificates for electronic seals or for website authentication under Regulation (EU) No 910/2014 that include the additional attributes in Article 34(3) (Article 34). When exchanging data over the internet, apply secure encryption with strong and widely recognized encryption techniques throughout the communication session. If you issue card-based payment instruments or are an account information service provider or a payment initiation service provider, keep the access sessions offered by account servicing payment service providers as short as possible and terminate them as soon as the requested action is completed. Keep personalized security credentials and authentication codes unreadable, directly or indirectly, by any staff at any time, and inform the payment services user and the issuer of the credentials without undue delay of any loss of their confidentiality under your sphere of competence (Article 35).when it serves a financial business
• If you are an account servicing payment service provider, give account information service providers the same information from designated payment accounts and associated payment transactions that you make available to the user when the user requests it directly, excluding sensitive payment data, give payment initiation service providers immediately after receipt of the payment order the same information on the initiation and execution of the transaction, confirm immediately upon request in a simple yes or no format whether the amount necessary for a payment transaction is available, and notify the other provider of the reason for an unexpected event or error (Article 36(1) and (2)). If you are an account information service provider, prevent access to information other than from designated payment accounts and associated payment transactions in accordance with the user's explicit consent, and access the information only when the user is actively requesting it or otherwise no more than four times in a 24-hour period unless the account servicing payment service provider agrees a higher frequency with you, with the user's consent (Article 36(3) and (5)). If you are a payment initiation service provider, give the account servicing payment service provider the same information as requested from the user when initiating the payment transaction directly (Article 36(4)).when it serves a financial business
• This Regulation sets the requirements for the security measures behind Article 97 of Directive (EU) 2015/2366, so it reaches you if you are a payment service provider: an account servicing payment service provider, a payment initiation service provider, an account information service provider or a payment service provider issuing card-based payment instruments. The exemptions from strong customer authentication in Chapter III (Articles 10 to 21) lift the authentication duty in the cases and on the conditions they state, subject to compliance with Article 2.

Commission Delegated Regulation (EU) 2024/1772 · Read the law's page

• Classify an ICT-related incident as major where it has affected critical services, meaning it affects ICT services or network and information systems that support your critical or important functions, affects financial services that require authorization, registration or supervision, or is a successful, malicious and unauthorized access to your network and information systems, and either the data losses threshold of Article 9(5), point (b), is met or two or more of the other materiality thresholds of Article 9(1) to (6) are met (Articles 6 and 8(1)).when it serves a financial business
• Apply these materiality thresholds: for clients, financial counterparts and transactions, more than 10 % of all clients using the affected service, more than 100,000 affected clients, more than 30 % of the financial counterparts carrying out activities related to the affected service, more than 10 % of the daily average number of transactions or of their daily average value, or the affecting of clients or financial counterparts identified as relevant; for reputational impact, any condition of Article 2(1); for duration and service downtime, a duration longer than 24 hours or a service downtime longer than 2 hours for ICT services that support critical or important functions; for geographical spread, an impact in two or more Member States; for data losses, an adverse impact on your business objectives or your ability to meet regulatory requirements, or a successful, malicious and unauthorized access that may result in data losses; and for economic impact, costs and losses that have exceeded or are likely to exceed 100,000 euro (Article 9(1) to (6)).when it serves a financial business
• Count the affected clients, financial counterparts and transactions as Article 1 requires and estimate the numbers from comparable reference periods where the actual figures cannot be determined, measure the duration and the service downtime of the incident as Article 3 requires, assess data losses against the availability, authenticity, integrity and confidentiality of data as Article 5 requires, and add up the direct and indirect costs and losses listed in Article 7(1), without accounting for financial recoveries (Articles 1, 3, 5 and 7).when it serves a financial business
• Treat recurring incidents that individually are not major as one major incident where they have occurred at least twice within 6 months, have the same apparent root cause and together fulfill Article 8(1), and assess whether recurring incidents exist on a monthly basis. This does not apply if you are a microenterprise or an entity listed in Article 16(1) of Regulation (EU) 2022/2554 (Article 8(2)).when it serves a financial business
• This Regulation details the classification of incidents under Article 18 of Regulation (EU) 2022/2554, so it reaches you if you are a financial entity under Article 2(1), points (a) to (t), of that Regulation, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). Use these criteria to decide whether an ICT-related incident is a major incident that you must report under Article 19(1) of that Regulation.

Commission Delegated Regulation (EU) 2024/1774 · Read the law's page

• Embed your ICT security policies, information security and related procedures, protocols and tools in your ICT risk management framework, align them with the information security objectives of your digital operational resilience strategy, and indicate the date of their formal approval by the management body (Article 2).for a financial business
• Develop, document and implement ICT risk management policies and procedures that contain the approved risk tolerance level for ICT risk, a procedure and a methodology to conduct the ICT risk assessment, ICT risk treatment measures, and provisions on the review of accepted residual ICT risks at least once a year (Article 3).for a financial business
• Develop, document and implement vulnerability management procedures that identify trustworthy information resources, perform automated vulnerability scanning and assessments (at least weekly for the ICT assets supporting critical or important functions), verify that ICT third-party service providers handle vulnerabilities and report at least the critical ones, track third-party and open-source libraries used by ICT services supporting critical or important functions, establish procedures for the responsible disclosure of vulnerabilities to clients, counterparties and the public, and prioritize the deployment of patches (Article 10(1) and (2)). Develop, document and implement patch management procedures that identify emergency procedures and set deadlines for installing patches and updates with escalation procedures in case those deadlines cannot be met (Article 10(3) and (4)).when it serves a financial business
• Develop, document and implement logging procedures, protocols and tools that identify the events to be logged and the retention period (set it taking into account your business and information security objectives, the reason for recording the event in the logs and the results of your ICT risk assessment), log events related to access control, identity management, capacity management, change management, ICT operations and network traffic, protect logs against tampering, deletion and unauthorized access, detect failures of logging systems, and synchronize the clocks of your ICT systems to a documented reliable reference time source (Article 12).when it serves a financial business
• Develop, document and implement network security management policies that segregate and segment ICT systems and networks, document network connections and data flows, use a separate and dedicated network for the administration of ICT assets, apply network access controls, encrypt network connections, review the network architecture once a year (periodically if you are a microenterprise), and verify the adequacy of firewall rules and connection filters for ICT systems supporting critical or important functions at least every 6 months (Article 13).when it serves a financial business
• Update access rights where changes are necessary and at least once a year for all ICT systems other than those supporting critical or important functions, and at least every 6 months for ICT systems supporting critical or important functions (Article 21).when it serves a financial business
• Develop, document and implement an ICT-related incident policy that documents the incident management process, lists the relevant internal and external contacts, sets up mechanisms to support incident management, retains evidence relating to ICT-related incidents in a secure manner, and analyses significant or recurring incidents (Article 22). Set clear roles and responsibilities to detect and respond to ICT-related incidents and anomalous activities, collect, monitor and analyze logs, cyber threat information and incident notifications from ICT third-party service providers, implement tools that generate alerts at least for the ICT assets and information assets supporting critical or important functions, and log the date, time and type of each detected anomalous activity (Article 23).when it serves a financial business
• Include in the ICT business continuity policy the objectives, scope, timeframe, activation and deactivation criteria, governance and recovery objectives set out in Article 24(1). If you are a central counterparty, set a maximum recovery time for your critical functions of not longer than 2 hours. If you are a central securities depository, ensure a recovery time objective of not longer than 2 hours for your critical or important functions. If you are a trading venue, ensure that trading can be resumed within or close to 2 hours of a disruptive incident and that the maximum amount of data lost is close to zero (Article 24(2) to (4)). Test the plans on scenarios that simulate potential disruptions, including severe but plausible scenarios, include the ICT services provided by ICT third-party service providers where applicable, document the results, and report identified deficiencies to the management body (Article 25).for a financial business
• Submit the report on the review of the ICT risk management framework in a searchable electronic format and include the information that Article 27(2) lists (Article 27).when it serves a financial business
• If you are an entity referred to in Article 16(1) of Regulation (EU) 2022/2554, apply the simplified framework of Title III: have an internal governance and control framework with the management body responsibilities set out in Article 28, and meet Articles 29 to 41 on the information security policy, the classification of assets, ICT risk management, physical and environmental security, access control, ICT operations security, data, system and network security, ICT security testing, acquisition, development and maintenance, project and change management, the business continuity plan and the review report. Test your business continuity plans at least once every year for the back-up and restore procedures, or upon every major change of the plan (Article 40).for a financial business
• This Regulation details the ICT risk management duties of Regulation (EU) 2022/2554 (Articles 15 and 16(3)), so it reaches you if you are a financial entity under Article 2(1), points (a) to (t), of that Regulation. Title II applies to you unless you are an entity referred to in Article 16(1) of that Regulation, and Title III, the simplified framework, applies to you if you are. Take your size and overall risk profile, and the nature, scale and complexity of your services, activities and operations, into account when you develop and implement the policies, procedures, protocols and tools (Article 1).

Regulation (EU) 2022/2554, Article 17 · Read the law's page

• Define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents (Article 17(1)).when it serves a financial business
• Record all ICT-related incidents and significant cyber threats, and establish procedures and processes that ensure consistent and integrated monitoring, handling and follow-up of ICT-related incidents so that root causes are identified, documented and addressed (Article 17(2)).when it serves a financial business
• In the process, establish procedures to identify, track, log, categorize and classify ICT-related incidents according to their priority and severity and the criticality of the services impacted, in accordance with the criteria set out in Article 18(1) (Article 17(3)(b)).when it serves a financial business
• In the process, put in place early warning indicators, assign roles and responsibilities for different incident types and scenarios, set out plans for communication and internal escalation, make sure at least major ICT-related incidents are reported to relevant senior management and to the management body, and establish response procedures to mitigate impacts and make services operational and secure in a timely manner (Article 17(3)(a) and (c) to (f)).when it serves a financial business
• It reaches you if you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554, such as a credit institution, payment institution, electronic money institution, investment firm, crypto-asset service provider, central counterparty or trading venue, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). Article 16(1) disapplies Articles 5 to 15 for the small entities it names, and Article 17 is not among them. The duties apply from 17 January 2025 (Article 64).

Regulation (EU) 2022/2554, Article 19 · Read the law's page

• Report a major ICT-related incident to the competent authority your sector's Union law designates under Article 46, the European Central Bank through your national supervisor if you are a credit institution classified as significant, using the templates referred to in Article 20, and submit an initial notification as early as possible and in any case within four hours of classifying the incident as major, and no later than 24 hours from becoming aware of it.when it serves a financial business
• Where classification as major comes later than that, submit the initial notification within four hours of the classification instead.when it serves a financial business
• Submit an intermediate report within 72 hours of the initial notification, and submit an updated intermediate report without undue delay and in any case when you have recovered regular activities.when it serves a financial business
• Submit a final report no later than one month after the intermediate report, or your latest updated one, once you know the root cause and the actual impact figures.when it serves a financial business
• If you cannot meet one of those deadlines, tell the competent authority without undue delay and before the deadline lapses, explaining why. A deadline falling on a weekend or bank holiday moves to noon of the next working day, unless you are a credit institution, a central counterparty, a trading venue operator, or an entity your Member State has designated essential or important under the NIS2 Directive, none of which get that extension for an initial notification or intermediate report. Your competent authority may also decide, and notify you, that the extension does not apply to you if you are a financial entity that is significant or has a systemic character for the financial sector at national or Union level.when it serves a financial business
• Notifying a significant cyber threat under Article 19(2) is voluntary, only where you judge it relevant to the financial system, service users, or your clients. Where a major ICT-related incident affects your clients' financial interests, tell them without undue delay as soon as you become aware of it, describing the incident and the mitigation measures you took, and, for a significant cyber threat, tell a potentially affected client of protection measures it could take, where applicable.when it serves a financial business
• This duty reaches you where you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554: a credit institution, payment institution, electronic money institution, investment firm, crypto-asset service provider, central securities depository, central counterparty, trading venue, insurance or reinsurance undertaking, institution for occupational retirement provision, credit rating agency, crowdfunding service provider, or one of the Article's other listed categories, unless Article 2(3) takes you out of the Regulation (among others, insurance and reinsurance undertakings referred to in Article 4 of Directive 2009/138/EC, institutions for occupational retirement provision with no more than 15 members in total, insurance intermediaries that are microenterprises or small or medium-sized enterprises, and post office giro institutions) or your Member State has excluded you under Article 2(4). It does not reach you as an ICT third-party service provider merely because you serve one of those entities: Article 2(2) confines the term 'financial entities' to points (a) to (t), so you carry this duty only where a financial entity has outsourced its own Article 19 reporting task to you, or where your own contract for a critical or important ICT service separately obliges you to assist that financial entity when an ICT incident occurs.

Regulation (EU) 2022/2554, Arts. 24-27 · Read the law's page

• Unless you are a microenterprise, establish, maintain and review a sound and comprehensive digital operational resilience testing program as an integral part of your ICT risk-management framework, follow a risk-based approach that takes account of the evolving landscape of ICT risk and the criticality of your information assets and services, and ensure that tests are undertaken by independent parties, internal or external, with sufficient resources and no conflict of interest where the tester is internal (Article 24(1) to (4)).for a financial business
• Unless you are a microenterprise, establish procedures and policies to prioritize, classify and remedy all issues the tests reveal, set up internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed, and ensure at least yearly that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions (Article 24(5) and (6)).for a financial business
• Include in the program a range of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing (Article 25(1)). If you are a central securities depository or central counterparty, perform vulnerability assessments before any deployment or redeployment of applications and infrastructure components and of the ICT services supporting critical or important functions (Article 25(2)). If you are a microenterprise, combine a risk-based approach with strategic planning of ICT testing (Article 25(3)).for a financial business
• If your competent authority has identified you for threat-led penetration testing, carry out advanced testing by TLPT at least every 3 years, or at the frequency your competent authority sets, cover several or all critical or important functions on live production systems, assess which critical or important functions need to be covered, and have the scope validated by the competent authorities (Article 26(1) and (2)).for a financial business
• Take the necessary measures and safeguards to ensure the participation of any ICT third-party service provider in the scope of the test, keep full responsibility for compliance with the Regulation, and apply effective risk management controls to mitigate the risks of any impact on data, damage to assets and disruption to critical or important functions, services or operations (Article 26(3) and (5)).for a supplier to a financial business
• When the testing ends and reports and remediation plans are agreed, give the designated authority a summary of the relevant findings, the remediation plans and the documentation demonstrating that the TLPT was conducted in accordance with the requirements, and notify your competent authority of the attestation you receive, the summary and the remediation plans (Article 26(6) and (7)).when it serves a financial business
• Contract only testers that meet Article 27(1): of the highest suitability and reputability, with technical and organizational capabilities and specific expertise in threat intelligence, penetration testing and red team testing, certified by an accreditation body in a Member State or adhering to formal codes of conduct or ethical frameworks, able to provide an independent assurance or an audit report on the sound management of the risks of TLPT, and covered by professional indemnity insurance. Use internal testers only with the approval of your competent authority or the designated single public authority, contract external testers every three tests, use only external testers if you are a credit institution classified as significant under Regulation (EU) No 1024/2013, and ensure that the threat intelligence provider is external to you (Article 26(8) and Article 27(1) and (2)).for a supplier to a financial business
• Ensure that contracts with external testers require a sound management of the TLPT results and that any data processing, including generation, storage, aggregation, drafting, reporting, communication or destruction, does not create risks to you (Article 27(3)).for a supplier to a financial business
• It reaches you if you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). The testing program duties of Article 24 apply to you unless you are a microenterprise. The threat-led penetration testing duty of Article 26(1) applies to you only if your competent authority has identified you under Article 26(8) and you are neither a microenterprise nor an entity named in Article 16(1), first subparagraph. An ICT third-party service provider that is in the scope of a test takes part through the financial entity, which keeps full responsibility (Article 26(3)).

Regulation (EU) 2022/2554, Arts. 28-30 · Read the law's page

• Manage ICT third-party risk as an integral, proportionate component of your ICT risk management framework, and, unless you are a microenterprise or an entity covered by Article 16(1), adopt and regularly review a strategy on ICT third-party risk.for a financial business
• Maintain and update a register of all your ICT services contracts, distinguishing those supporting a critical or important function, report on it at least yearly to your competent authority, and produce it in full on the authority's request.when it serves a financial business
• Before entering into an ICT services contract, assess whether it supports a critical or important function, whether supervisory conditions for contracting are met, and the concentration risk under Article 29, including whether the provider is easily substitutable and whether you already rely on it, or a closely connected provider, for other critical functions.for a financial business
• Put every ICT services contract in writing in one document, covering at minimum the functions and locations involved, data-protection and access-on-termination provisions, service levels, the provider's duty to assist you on an incident and to cooperate with your regulators, termination rights, and your security-awareness programme.for a supplier to a financial business
• For a contract supporting a critical or important function, add quantitative service level targets, an unrestricted right to monitor, inspect and audit the provider, the provider's cooperation in your threat-led penetration testing, and an exit strategy with a mandatory transition period. If you are a microenterprise, you and the provider may agree that your access, inspection and audit rights are delegated to an independent third party the provider appoints.for a supplier to a financial business
• This duty binds you as the financial entity contracting for an ICT service, not the ICT third-party service provider directly, though the provider's own obligations enter through the contract terms Article 30 requires you to include; it reaches you where you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554, unless Article 2(3) takes you out of the Regulation (among others, insurance and reinsurance undertakings referred to in Article 4 of Directive 2009/138/EC, institutions for occupational retirement provision with no more than 15 members in total, insurance intermediaries that are microenterprises or small or medium-sized enterprises, and post office giro institutions) or your Member State has excluded you under Article 2(4).

Regulation (EU) 2022/2554, Arts. 31-44 · Read the law's page

• If you are part of a group, designate one legal person as the coordination point for adequate representation and communication with the Lead Overseer, and notify the financial entities to which you provide services of your designation as critical (Article 31(4) and (5)).for a supplier to a financial business
• If you are established in a third country, establish a subsidiary in the Union within the 12 months following your designation, because financial entities may use your services only if you have, and notify the Lead Overseer of any changes to the structure of the management of that subsidiary (Article 31(12) and (13)).for a supplier to a financial business
• Cooperate in good faith with the Lead Overseer and assist it in the fulfillment of its tasks (Article 35(5)). Provide the information the Lead Overseer requires by simple request or by decision, including business or operational documents, contracts, policies, documentation, ICT security audit reports, ICT-related incident reports and information on the parties to whom you have outsourced operational functions or activities, and do not supply incorrect or misleading information, since you remain fully responsible if the information is incomplete, incorrect or misleading (Article 37).for a supplier to a financial business
• Submit to the investigations and the on-site inspections that the Lead Overseer orders by decision, including the examination of records, data and procedures, explanations from your representatives, and entry to your business premises, land or property (Articles 38 and 39).for a supplier to a financial business
• Where the Lead Overseer examines a planned subcontracting arrangement with a subcontractor established in a third country that concerns critical or important functions of a financial entity, transmit the information regarding subcontracting to the Lead Overseer using the template referred to in Article 41(1), point (b) (Article 35(1), point (d)(iv)).for a supplier to a financial business
• Within 60 calendar days of receiving the Lead Overseer's recommendations, notify the Lead Overseer of your intention to follow them or give a reasoned explanation for not following them (Article 42(1)). If a competent authority requires financial entities to suspend or terminate their use of your service, cooperate fully with the financial entities affected, in particular in the suspension or termination of their contractual arrangements (Article 42(9)).for a supplier to a financial business
• It reaches you if you are an ICT third-party service provider that the European Supervisory Authorities designate as critical for financial entities under Article 31(1), point (a), after an assessment of the criteria in Article 31(2). It does not reach a financial entity providing ICT services to other financial entities, an ICT intra-group service provider, a provider subject to the oversight frameworks that support the tasks referred to in Article 127(2) of the Treaty on the Functioning of the European Union, or a provider that serves only financial entities active solely in one Member State from within that Member State (Article 31(8)). Your oversight duties run from the starting date notified with your designation, no later than one month after the notification (Article 31(5)), and the designation is not used until the Commission has adopted the delegated act specifying the criteria (Article 31(7)).

Regulation (EU) 2022/2554, Arts. 5-16 · Read the law's page

• Have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk. Have your management body define, approve, oversee and answer for all arrangements under the ICT risk management framework, bear the ultimate responsibility for managing ICT risk, set and approve the digital operational resilience strategy and risk tolerance level, and approve and review your ICT business continuity policy, response and recovery plans, ICT internal audit plans and policy on the use of ICT third-party services (Article 5(1) and (2)).for a financial business
• Keep the members of your management body up to date with sufficient knowledge and skills to understand and assess ICT risk, including through specific training on a regular basis. Unless you are a microenterprise, establish a role, or designate a member of senior management, to monitor the arrangements with ICT third-party service providers (Article 5(3) and (4)).for a financial business
• Maintain a sound, comprehensive and well-documented ICT risk management framework as part of your overall risk management system, with the strategies, policies, procedures, ICT protocols and tools needed to protect all information assets and ICT assets. Document and review it at least once a year (periodically if you are a microenterprise), after major ICT-related incidents, and after supervisory instructions or conclusions from testing or audit. Give your competent authority complete and updated information on ICT risk and a report on the review of the framework on request (Article 6(1) to (3) and (5)).for a financial business
• Unless you are a microenterprise, assign responsibility for managing and overseeing ICT risk to a control function with an appropriate level of independence, keep ICT risk management, control and internal audit functions segregated, have the framework audited internally on a regular basis by auditors with sufficient knowledge, skills and expertise in ICT risk, and establish a formal follow-up process for critical ICT audit findings (Article 6(4), (6) and (7)).for a financial business
• Include in the framework a digital operational resilience strategy that explains how the framework supports your business strategy, sets the risk tolerance level for ICT risk and the impact tolerance for ICT disruptions, sets information security objectives with key performance indicators and key risk metrics, describes the ICT reference architecture, outlines the mechanisms to detect and prevent the impact of ICT-related incidents, provides for digital operational resilience testing, and outlines a communication strategy for incident disclosure (Article 6(8)).for a financial business
• Use and maintain updated ICT systems, protocols and tools that are appropriate to the magnitude of your operations, reliable, equipped with sufficient capacity to process data accurately and deal with peak volumes, and technologically resilient under stressed conditions (Article 7).when it serves a financial business
• Identify, classify and document all ICT supported business functions, the information assets and ICT assets that support them and their dependencies, and review that classification at least yearly. Identify all sources of ICT risk on a continuous basis and review the risk scenarios that affect you at least yearly. Map the assets you consider critical, and identify the processes that depend on ICT third-party service providers. Unless you are a microenterprise, perform a risk assessment on each major change in your network and information system infrastructure and at least yearly on all legacy ICT systems (Article 8).when it serves a financial business
• Continuously monitor and control the security and functioning of your ICT systems and deploy ICT security policies, procedures, protocols and tools that keep data available, authentic, intact and confidential at rest, in use and in transit. Document an information security policy, policies that limit physical and logical access to what is needed, strong authentication mechanisms and protection of cryptographic keys, ICT change management, and policies for patches and updates, and design network connections so that they can be instantaneously severed or segmented (Article 9).when it serves a financial business
• Have mechanisms with multiple layers of control, alert thresholds and criteria that promptly detect anomalous activities, ICT network performance issues and ICT-related incidents and trigger incident response, test them regularly under Article 25, and devote sufficient resources to monitor user activity, ICT anomalies and ICT-related incidents. If you are a data reporting service provider, also have systems that check trade reports for completeness, identify omissions and obvious errors, and request re-transmission (Article 10).when it serves a financial business
• Put in place a comprehensive ICT business continuity policy and ICT response and recovery plans, and conduct a business impact analysis of your exposures to severe business disruptions. Test the continuity and the response and recovery plans at least yearly and on substantive changes to systems supporting critical or important functions, and test your crisis communication plans. Keep readily accessible records of activities before and during disruption events. Unless you are a microenterprise, include cyber-attack and switchover scenarios in the tests, have a crisis management function, and report to your competent authority on request an estimate of the aggregated annual costs and losses caused by major ICT-related incidents (Article 11).for a financial business
• Develop and document backup policies and procedures and restoration and recovery procedures and methods, set up backup systems and test them periodically, and restore backup data on ICT systems that are physically and logically segregated from the source system. Unless you are a microenterprise, maintain redundant ICT capacities adequate to your business needs. If you are a central securities depository, maintain a secondary processing site that meets Article 12(5) (Article 12).when it serves a financial business
• Have capabilities and staff to gather information on vulnerabilities, cyber threats and ICT-related incidents, run post-incident reviews after a major ICT-related incident disrupts your core activities, build the lessons from testing and real incidents into the ICT risk assessment, have senior ICT staff report at least yearly to the management body, and make ICT security awareness programs and digital operational resilience training compulsory modules for all employees and senior management (Article 13).for a financial business
• Have crisis communication plans that enable a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts and to the public, communication policies for staff and external stakeholders, and at least one person tasked with implementing the communication strategy and fulfilling the public and media function (Article 14).for a financial business
• If you are an entity named in Article 16(1), maintain a sound and documented ICT risk management framework, continuously monitor the security and functioning of all ICT systems, use sound, resilient and updated ICT systems, protocols and tools, promptly identify and detect sources of ICT risk and anomalies, identify key dependencies on ICT third-party service providers, ensure the continuity of critical or important functions through business continuity plans and response and recovery measures that include back-up and restoration, and test those plans and the controls regularly. Document and review the framework periodically and after major ICT-related incidents, and give the competent authority a report on the review on request (Article 16(1) and (2)).when it serves a financial business
• It reaches you if you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554, such as a credit institution, payment institution, electronic money institution, investment firm, crypto-asset service provider, central counterparty or trading venue, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). If you are an entity named in Article 16(1), Articles 5 to 15 do not apply to you and the simplified framework of Article 16 applies instead. Apply these rules in proportion to your size, overall risk profile, and the nature, scale and complexity of your services, activities and operations (Article 4(1)). An ICT third-party service provider is not a financial entity under Article 2(2) and these Articles do not bind it directly.

Commission Implementing Regulation (EU) 2025/302 · Read the law's page

• Use the template in Annex I for the initial notification, the intermediate report and the final report, completing the data fields that correspond to the information that Articles 2, 3 and 4 of Delegated Regulation (EU) 2025/301 require for each report, follow the data glossary and instructions in Annex II, ensure that the information is complete and accurate, and give estimated values based on other available data and information where accurate data are not available for the initial notification or the intermediate report (Article 1).when it serves a financial business
• When you submit an intermediate or a final report, use the Annex I template to submit all required information and update, where applicable, the information that you provided earlier (Article 1(4)).when it serves a financial business
• If you combine two or all of the reports in one submission, which Article 2 allows where regular activities have recovered or the root cause analysis has been completed, meet the time limits of Article 5 of Delegated Regulation (EU) 2025/301 for each report (Article 2).when it serves a financial business
• Provide information on non-major recurring ICT-related incidents that cumulatively meet the conditions for one major incident under Article 8(2) of Delegated Regulation (EU) 2024/1772 in an aggregated form (Article 3).when it serves a financial business
• Submit the initial notification and the intermediate and final reports through the secure electronic channels your competent authority makes available. If you cannot use them, inform your competent authority about the major ICT-related incident through other secure means in agreement with the authority, and resubmit through the secure electronic channel once you are able to, if your authority requires it (Article 4).when it serves a financial business
• If, after further assessment, you conclude that an incident you reported as major at no time fulfilled the classification criteria and thresholds of Article 8 of Delegated Regulation (EU) 2024/1772, notify your competent authority that you have reclassified it from major to non-major, using the Annex II template fields 'type of report' and 'other information' (Article 5).when it serves a financial business
• If you outsource the obligation to report major ICT-related incidents under Article 19(5) of Regulation (EU) 2022/2554, inform your competent authority of the arrangement as soon as it is concluded and at the latest before the first notification or report, with the name, contact details and identification code of the third party that will submit the reports, and inform the authority as soon as you no longer outsource the reporting (Article 6).when it serves a financial business
• If you are a credit institution of significant relevance under Article 2, point (16), of Regulation (EU) No 468/2014, an operator of a trading venue or a central counterparty, submit your notifications and reports individually to your competent authority. Where your competent authority requires information on the individual impact of an aggregated report on you, submit an individual notification or report on request (Article 7(2) and (3)).when it serves a financial business
• If you notify a significant cyber threat to your competent authority under Article 19(2) of Regulation (EU) 2022/2554, use the template in Annex III, follow the data glossary and instructions in Annex IV, and ensure that the information is complete and accurate (Article 8).when it serves a financial business
• This Regulation sets the forms and procedures for the reports under Article 19 of Regulation (EU) 2022/2554, so it reaches you if you are a financial entity under Article 2(1), points (a) to (t), of that Regulation that reports a major ICT-related incident or notifies a significant cyber threat, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). A third-party service provider to which you have outsourced your reporting uses the same forms on your behalf (Articles 6 and 7).

Directive (EU) 2019/882, Arts. 2(2) and 13, Annex I Sections III and IV · Read the law's page

• This duty reaches you through the law of each Member State that transposes the Directive, where you provide, or offer to provide, to consumers in the Union after 28 June 2025 an electronic communications service (other than a transmission service used for machine-to-machine services), a service providing access to audiovisual media services, the website, mobile application, electronic ticketing, travel-information or interactive self-service terminal elements of air, bus, rail or waterborne passenger transport services (for urban, suburban and regional transport services, only the interactive self-service terminals), a consumer banking service, e-books and dedicated software, or an e-commerce service (Article 2(2), Article 3(4)). A microenterprise providing services is exempt from the requirements of Article 4(3) and from any obligations relating to compliance with them (Article 4(5)); Article 3(23) defines a microenterprise as an enterprise which employs fewer than 10 persons and which has an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million.
• Design and provide your service in accordance with the accessibility requirements of the Directive (Article 13(1)): unless it is an urban, suburban or regional transport service it must meet Section III of Annex I, and every service must meet the part of Section IV of Annex I that applies to it (Article 4(3)).
• Unless your service is an urban, suburban or regional transport service, make your websites, including the related online applications, and your mobile device-based services, including mobile applications, accessible in a consistent and adequate way by making them perceivable, operable, understandable and robust (Annex I, Section III, point (c)).
• Unless your service is an urban, suburban or regional transport service, make sure the products you use to provide it meet the accessibility requirements of Section I and, where applicable, Section II of Annex I (Annex I, Section III, point (a)).
• Unless your service is an urban, suburban or regional transport service, give information about how it works, and about the accessibility characteristics of any products used in it and their interoperability with assistive devices and facilities, through more than one sensory channel, in an understandable way and in ways users can perceive, in text formats that can be used to generate alternative assistive formats, in fonts of adequate size and suitable shape with sufficient contrast and adjustable spacing between letters, lines and paragraphs, with an alternative presentation of any non-textual content, and provide the electronic information needed to provide the service in a consistent and adequate way by making it perceivable, operable, understandable and robust (Annex I, Section III, point (b)).
• Unless your service is an urban, suburban or regional transport service, where you provide support services such as help desks, call centers, technical support, relay services and training services, have them give information on the accessibility of the service and its compatibility with assistive technologies, in accessible modes of communication (Annex I, Section III, point (d)).
• If you offer e-commerce services, provide the information concerning accessibility of the products and services being sold when the responsible economic operator provides it, make the functionality for identification, security and payment perceivable, operable, understandable and robust when it is delivered as part of a service instead of a product, and provide identification methods, electronic signatures and payment services that are perceivable, operable, understandable and robust (Annex I, Section IV, point (g)).
• If you provide consumer banking services, provide identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust, and ensure that the information is understandable without exceeding a level of complexity superior to level B2 (upper intermediate) of the Council of Europe's Common European Framework of Reference for Languages (Annex I, Section IV, point (e)).
• If you provide an electronic communications service, provide real time text in addition to voice communication, provide total conversation where video is provided in addition to voice, and ensure that emergency communications using voice and text, and video where provided, are synchronized and transmitted to the most appropriate public safety answering point (Annex I, Section IV, point (a)).
• If you provide services giving access to audiovisual media services, provide electronic program guides that are perceivable, operable, understandable and robust and give information about the availability of accessibility, and ensure that subtitles for the deaf and hard of hearing, audio description, spoken subtitles and sign language interpretation are fully transmitted with adequate quality, synchronized with sound and video, with user control of their display and use (Annex I, Section IV, point (b)).
• If you provide e-books or dedicated software, provide synchronized text and audio where an e-book contains audio in addition to text, keep e-book digital files from preventing assistive technology from operating properly, give access to the content, the navigation of the file content and layout including dynamic layout, with structure, flexibility and choice in the presentation of the content, allow alternative renditions interoperable with a variety of assistive technologies, make the e-books discoverable through metadata about their accessibility features, and do not let digital rights management measures block accessibility features (Annex I, Section IV, point (f)).
• If you provide air, bus, rail or waterborne passenger transport services, other than urban, suburban and regional transport services, provide information on the accessibility of vehicles, the surrounding infrastructure and the built environment and on assistance for persons with disabilities, and information about smart ticketing, real-time travel information and additional service information (Annex I, Section IV, point (c)). For urban, suburban and regional transport services, make the self-service terminals used in the service accessible under Section I of Annex I (Annex I, Section IV, point (d)).
• Include in your general terms and conditions, or an equivalent document, the information assessing how the service meets the accessibility requirements, with a general description of the service in accessible formats, the descriptions and explanations needed to understand its operation, and a description of how the relevant requirements of Annex I are met; make that information available to the public in written and oral format, including in a manner accessible to persons with disabilities, and keep it for as long as the service is in operation; and provide information demonstrating that the service delivery process and its monitoring ensure compliance (Article 13(2), Annex V, points 1 and 3).
• Have procedures in place so that the provision of your service remains in conformity, and take adequate account of changes in the characteristics of the service, in the applicable accessibility requirements and in the harmonized standards or technical specifications by reference to which the service is declared to meet them (Article 13(3)).
• If your service does not conform, take the corrective measures necessary to bring it into conformity and immediately inform the competent national authorities of the Member States in which the service is provided, giving details of the non-compliance and of the corrective measures taken (Article 13(4)). On a reasoned request from a competent authority, provide all the information necessary to demonstrate conformity and cooperate on any action taken to bring the service into compliance (Article 13(5)).
• You may rely on fundamental alteration or disproportionate burden only to the extent that compliance would require a significant change that results in the fundamental alteration of the basic nature of the service or would impose a disproportionate burden. Carry out an assessment of either ground, judging disproportionate burden against the criteria in Annex VI, document it, keep all relevant results for five years from the day the service was last provided, give a copy of the assessment to the authorities responsible for checking compliance of services on request, and send information that you rely on this ground to those authorities of the Member State where the service is provided (Article 14(1), (2), (3) and (8)). If you rely on disproportionate burden, renew that assessment for each category or type of service when the service is altered, when those authorities ask, and in any event at least every five years (Article 14(5)). You cannot rely on disproportionate burden where you receive funding, public or private, from other sources than your own resources that is provided for the purpose of improving accessibility (Article 14(6)).
• The Directive does not apply to the following content of websites and mobile applications: pre-recorded time-based media and office file formats published before 28 June 2025, online maps and mapping services if essential information is provided in an accessible digital manner for maps intended for navigational use, third-party content that is neither funded, developed by, or under the control of the economic operator concerned, and archives that only contain content not updated or edited after 28 June 2025 (Article 2(4)).
• Member States provide for a transitional period ending on 28 June 2030 during which you may continue to provide your service using products you lawfully used to provide similar services before that date, and service contracts agreed before 28 June 2025 may continue without alteration until they expire, but no longer than five years from that date; a Member State may also let you keep using self-service terminals you lawfully used to provide services before 28 June 2025 until the end of their economically useful life, but no longer than 20 years after their entry into use (Article 32(1) and (2)).
• If you provide air, bus, rail or waterborne passenger transport services, a service that complies with the requirements on accessible information and on information on accessibility of Regulations (EC) No 261/2004, (EC) No 1107/2006, (EC) No 1371/2007, (EU) No 1177/2010 and (EU) No 181/2011 is deemed to comply with the corresponding requirements of the Directive, and the Directive's additional requirements apply in full (Article 5).

Commission Delegated Regulation (EU) 2025/1140, Art. 2(2) and Annex, Section 1; Regulation (EU) 2023/1114, Art. 68(9) · Read the law's page

• It reaches you if you are a crypto-asset service provider, meaning a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis and that is allowed to provide crypto-asset services in accordance with Article 59 of Regulation (EU) 2023/1114 (Article 3(1), point (15), of that Regulation): keep records of telephone conversations or electronic communications relating to transactions or to the reception, transmission and execution of client orders, including where such conversations or communications do not result in the conclusion of a transaction or in the provision of the services of reception and transmission of orders or execution of order (Article 2(2) and Annex, Section 1, communication with clients).when it serves a financial business
• Retain the records in a medium that lets the competent authority access them readily and reconstitute each key stage of the processing of each crypto-asset service, activity, order or transaction, lets any corrections or other amendments and the earlier contents be ascertained, and does not allow the records to be manipulated or altered (Article 2(1)).when it serves a financial business
• Provide the records to clients upon request and keep them for five years and, where the competent authority requests before five years have elapsed, for up to seven years (Article 68(9) of Regulation (EU) 2023/1114).when it serves a financial business
• Delegated Regulation (EU) 2025/1140 is binding in its entirety and directly applicable in all Member States and entered into force on the twentieth day after its publication on 10 June 2025 (Article 18); it specifies the records that Article 68(9) of Regulation (EU) 2023/1114 requires crypto-asset service providers to keep (Article 68(10) of that Regulation).

Directive (EU) 2023/2673, inserting Article 16d(1), (3) and (4) into Directive 2011/83/EU · Read the law's page

• If you are a trader concluding a financial services contract with a consumer at a distance, give the consumer free of charge, before the contract is concluded, adequate explanations that make it possible to assess whether the proposed contract and ancillary services are adapted to the consumer's needs and financial situation (Article 16d(1)).when it serves a financial business
• If you use online tools, let the consumer request and obtain human intervention at the pre-contractual stage and, in justified cases, after the distance contract is concluded, in the same language as the pre-contractual information (Article 16d(3)).when it serves a financial business
• Be ready to prove that you gave the adequate explanations, since the burden of proof is on the trader (Article 16d(4)).when it serves a financial business
• This Directive is addressed to the Member States (Article 5), which had to adopt and publish the measures necessary to comply with it by 19 December 2025 and apply them from 19 June 2026 (Article 2(1)), so a trader meets these rules through each Member State's national law.

Directive 2011/83/EU, Art. 16a(3), first sentence, as inserted by Directive (EU) 2023/2673 · Read the law's page

• It reaches you if you are a trader in a distance contract with a consumer for the supply of financial services (Article 3(1b) of Directive 2011/83/EU) and you communicate with the consumer by voice telephony: make your identity and the commercial purpose of the call you initiate explicitly clear at the beginning of any call with the consumer (Article 16a(3), first sentence).when it serves a financial business
• This Directive is addressed to the Member States (Article 5), which had to adopt and publish the measures necessary to comply with it by 19 December 2025 and apply them from 19 June 2026 (Article 2(1)), so a trader meets these rules through each Member State's transposing law.

Directive 2011/83/EU, Art. 16a(3), second sentence, as inserted by Directive (EU) 2023/2673 · Read the law's page

• It reaches you if you are a trader in a distance contract with a consumer for the supply of financial services (Article 3(1b) of Directive 2011/83/EU) and you communicate with the consumer by voice telephony: when a call is being recorded, or might be recorded, notify the consumer that this is the case (Article 16a(3), second sentence).when it serves a financial business
• This Directive is addressed to the Member States (Article 5), which had to adopt and publish the measures necessary to comply with it by 19 December 2025 and apply them from 19 June 2026 (Article 2(1)), so a trader meets these rules through each Member State's transposing law.

Directive (EU) 2023/2225, Art. 18(8) · Read the law's page

• If your creditworthiness assessment involves the use of automated processing of personal data, give the consumer the right to request and obtain human intervention from you (Article 18(8)).when it serves a financial business
• Give the consumer the right to request and obtain from you a clear and comprehensible explanation of the assessment of creditworthiness, including on the logic and risks involved in the automated processing of personal data as well as its significance and effects on the decision (Article 18(8), point (a)).when it serves a financial business
• Give the consumer the right to express the consumer's own point of view to you (Article 18(8), point (b)).when it serves a financial business
• Give the consumer the right to request a review of the assessment of the creditworthiness and of your decision on the granting of the credit (Article 18(8), point (c)).when it serves a financial business
• Inform the consumer of the right to request and obtain human intervention (Article 18(8), second subparagraph).when it serves a financial business
• If the assessment of creditworthiness is based on automated processing of data, inform the consumer of that fact, of the consumer's right to human assessment and of the procedure for contesting the decision; Article 18(9) places this information duty in the paragraph on a rejected credit application (Article 18(9), second sentence).when it serves a financial business
• This duty takes effect on 20 November 2026 (Article 48(1)), the date from which Member States must apply the national measures that transpose the Directive, and it does not reach a credit agreement existing on that date (Article 2(2), point (l)).
• This Directive is addressed to the Member States (Article 50), which must adopt and publish the measures necessary to comply with it by 20 November 2025 and apply them from 20 November 2026 (Article 48(1)), so a creditor or credit intermediary meets these rules through each Member State's national law.

Directive (EU) 2023/2225, Article 18(1) to (7), (9), first sentence, and (10) and (11) · Read the law's page

• If you are a creditor, carry out a thorough assessment of the consumer's creditworthiness before concluding a credit agreement (Article 18(1)).when it serves a financial business
• Carry out that assessment in the interest of the consumer, to prevent irresponsible lending practices and over-indebtedness, taking appropriate account of factors relevant to verifying the prospect of the consumer meeting his or her obligations under the credit agreement (Article 18(1)).when it serves a financial business
• If you are a credit intermediary, accurately submit the necessary information obtained from the consumer to the relevant creditor, in accordance with Regulation (EU) 2016/679, to enable the creditworthiness assessment to be carried out (Article 18(2)).when it serves a financial business
• Obtain the information for the assessment from relevant internal or external sources, including the consumer and, where necessary, a consultation of a database referred to in Article 19 (Article 18(3), fourth sentence).when it serves a financial business
• Appropriately verify the information obtained, where necessary through reference to independently verifiable documentation (Article 18(3), last sentence).when it serves a financial business
• Establish procedures for the creditworthiness assessment, and document and maintain those procedures (Article 18(4)).when it serves a financial business
• Document and maintain the information on which the assessment is carried out, as referred to in Article 18(3) (Article 18(4), second sentence).when it serves a financial business
• If the credit application is submitted jointly by more than one consumer, perform the creditworthiness assessment on the basis of the joint repayment capacity of the consumers (Article 18(5)).when it serves a financial business
• Make credit available to the consumer only where the result of the creditworthiness assessment indicates that the obligations resulting from the credit agreement are likely to be met in the manner required under that agreement, taking into account the relevant factors referred to in Article 18(1) (Article 18(6)).when it serves a financial business
• Do not cancel or modify a concluded credit agreement to the consumer's detriment on the grounds that the assessment of creditworthiness was incorrectly conducted, unless it is demonstrated that the consumer knowingly withheld or falsified the information referred to in Article 18(3) that was provided to you (Article 18(7)).when it serves a financial business
• If you reject the credit application, inform the consumer of the rejection without delay and, where relevant, refer the consumer to easily accessible debt advisory services (Article 18(9), first sentence).when it serves a financial business
• Where the parties agree to change the total amount of credit after the conclusion of the credit agreement, reassess the consumer's creditworthiness on the basis of updated information before any significant increase in the total amount of credit is granted (Article 18(10)).when it serves a financial business
• Do not base the assessment of creditworthiness exclusively on the consumer's credit history (Article 18(11), second sentence).when it serves a financial business
• This duty takes effect on 20 November 2026 (Article 48(1)), the date from which Member States must apply the national measures that transpose the Directive, and it does not reach a credit agreement existing on that date (Article 2(2), point (l)).
• This Directive is addressed to the Member States (Article 50), which must adopt and publish the measures necessary to comply with it by 20 November 2025 and apply them from 20 November 2026 (Article 48(1)), so a creditor or credit intermediary meets these rules through each Member State's national law.
• It reaches you if you are a creditor, a natural or legal person who grants or promises to grant credit to a consumer in the course of your trade, business or profession, or, for the information duty in Article 18(2), a credit intermediary (Article 3, points (1) to (3) and (12)). It does not reach a credit agreement secured by a mortgage or comparable security on immovable property (Article 2(2), point (a)), one for more than EUR 100,000 unless it is unsecured and for the renovation of a residential immovable property (Article 2(2), point (c) and Article 2(3)), or a deferred payment within the limits of Article 2(2), point (h). For an overrunning, Article 18 applies unless the Member State determines otherwise (Article 2(4)), and a Member State may limit the Articles that apply to a credit agreement of a membership organization (Article 2(6)) or to a deferral where the consumer is in or likely to be in default (Article 2(7)).

Directive (EU) 2023/2225, Arts. 18(3) and 19(5) · Read the law's page

• If you are a creditor, base the assessment of a consumer's creditworthiness on relevant and accurate information on the consumer's income and expenses and other financial and economic circumstances that is necessary and proportionate to the nature, duration, value and risks of the credit for the consumer (Article 18(3)).when it serves a financial business
• Do not include special categories of data referred to in Article 9(1) of Regulation (EU) 2016/679 in the information on which the creditworthiness assessment is carried out (Article 18(3)).when it serves a financial business
• Do not consider a social network as an external source for the purpose of this Directive (Article 18(3)).when it serves a financial business
• If you are a creditor or a credit intermediary, do not process special categories of data as referred to in Article 9(1) of Regulation (EU) 2016/679 and personal data processed from social networks that may be contained in a database that Article 19(1) refers to (Article 19(5)).when it serves a financial business
• This duty takes effect on 20 November 2026 (Article 48(1)), the date from which Member States must apply the national measures that transpose the Directive, and it does not reach a credit agreement existing on that date (Article 2(2), point (l)).
• This Directive is addressed to the Member States (Article 50), which must adopt and publish the measures necessary to comply with it by 20 November 2025 and apply them from 20 November 2026 (Article 48(1)), so a creditor or credit intermediary meets these rules through each Member State's national law.

Regulation (EU) 2024/1624, Art. 76(5) · Read the law's page

• If you are an obliged entity and adopt decisions resulting from automated processes, including profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679, or from processes involving AI systems as defined in Article 3, point (1), of the Artificial Intelligence Act, limit the data processed by those systems to data obtained pursuant to Chapter III of the Regulation (Article 76(5), point (a)).when it serves a financial business
• Subject any decision to enter or refuse to enter into or maintain a business relationship with a customer, or to carry out or refuse to carry out an occasional transaction for a customer, or to increase or decrease the extent of the customer due diligence measures applied pursuant to Article 20, to meaningful human intervention to ensure the accuracy and appropriateness of the decision (Article 76(5), point (b)).when it serves a financial business
• Let the customer obtain an explanation of the decision you have reached, except in relation to a report as referred to in Article 69 (Article 76(5), point (c)).when it serves a financial business
• Let the customer challenge the decision you have reached, except in relation to a report as referred to in Article 69 (Article 76(5), point (c)).when it serves a financial business
• This duty takes effect on 10 July 2027 (Article 90), except for the obliged entities referred to in Article 3, points (3)(n) and (o), football agents and professional football clubs, for which it takes effect on 10 July 2029 (Article 90).

Regulation (EU) 2024/1624, Article 75(4), point (g) · Read the law's page

• Share information generated through the use of artificial intelligence, machine learning technologies or algorithms within the partnership only where those processes were subject to adequate human oversight (Article 75(4), point (g)).when it serves a financial business
• This duty takes effect on 10 July 2027 (Article 90), except for the obliged entities referred to in Article 3, points (3)(n) and (o), football agents and professional football clubs, for which it takes effect on 10 July 2029 (Article 90).
• It reaches you if you are an obliged entity within Article 3, which lists credit institutions and financial institutions, and take part in a partnership for information sharing (Article 75(1)).

Regulation (EU) 2024/1624, Articles 69 and 73 · Read the law's page

• It reaches you if you are an obliged entity within Article 3, which lists credit institutions, financial institutions and the persons named in point (3) acting in the exercise of their professional activities: cooperate fully with the financial intelligence unit by promptly reporting to it, on your own initiative, where you know, suspect or have reasonable grounds to suspect that funds or activities, regardless of the amount involved, are the proceeds of criminal activity or are related to terrorist financing or criminal activity, and by responding to its requests for additional information in such cases (Article 69(1), point (a)). A notary, lawyer, other independent legal professional, auditor, external accountant or tax advisor is exempt from Article 69(1) to the extent that the exemption relates to information received from, or obtained on, a client in the course of ascertaining the legal position of that client or performing the task of defending or representing that client in, or concerning, judicial proceedings, but not where the person takes part in money laundering, its predicate offences or terrorist financing, provides legal advice for those purposes, or knows that the client is seeking legal advice for those purposes (Article 70(2)).when it serves a financial business
• Provide the financial intelligence unit, at its request, with all necessary information, including information on transaction records, within the deadlines imposed, and reply to its requests for information within 5 working days, a deadline the unit may shorten in justified and urgent cases, including to less than 24 hours, or extend where it considers that justified and the extension does not undermine its analysis (Article 69(1), point (b), and third and fourth subparagraphs).when it serves a financial business
• Report all suspicious transactions, including attempted transactions and suspicions arising from the inability to conduct customer due diligence (Article 69(1), second subparagraph).when it serves a financial business
• Assess the transactions or activities carried out by your customers on the basis of and against any relevant fact and information known to you or which you are in possession of, prioritizing the assessment where necessary according to the urgency of the transaction or activity and the risks affecting the Member State in which you are established, and base a suspicion on the characteristics of the customer and their counterparts, the size and nature of the transaction or activity or the methods and patterns thereof, the link between several transactions or activities, the origin, destination or use of funds, or any other circumstance known to you, including the consistency of the transaction or activity with the information obtained under Chapter III, including the risk profile of the client (Article 69(2)).when it serves a financial business
• Have the compliance officer appointed in accordance with Article 11(2) transmit the information to the financial intelligence unit of the Member State in whose territory you are established (Article 69(6)), and protect the compliance officer, and any employee or person in a comparable position, including agents and distributors, involved in these tasks against retaliation, discrimination and any other unfair treatment for carrying out them (Article 69(7)).when it serves a financial business
• Do not disclose to the customer concerned or to other third persons the fact that transactions or activities are being or have been assessed in accordance with Article 69, that information is being, will be or has been transmitted in accordance with Article 69 or 70, or that a money laundering or terrorist financing analysis is being, or may be, carried out; the prohibition binds you and your directors, employees and persons in comparable positions, including agents and distributors, subject to the exceptions of Article 73(2) to (6) (Article 73(1)).when it serves a financial business
• This duty takes effect on 10 July 2027 (Article 90), except for the obliged entities referred to in Article 3, points (3)(n) and (o), football agents and professional football clubs, for which it takes effect on 10 July 2029 (Article 90); Directive (EU) 2015/849 is repealed with effect from 10 July 2027 (Directive (EU) 2024/1640, Article 77), and references to its Articles 33 and 39 are read as references to Articles 69 and 73 of this Regulation (Article 89 and Annex VI).

Regulation (EU) 2024/1624, Arts. 76(1)-(4) and 77(3) · Read the law's page

• If you are an obliged entity, process special categories of personal data referred to in Article 9(1) of Regulation (EU) 2016/679, and personal data relating to criminal convictions and offences referred to in Article 10 of that Regulation, only to the extent that it is strictly necessary for the purposes of preventing money laundering and terrorist financing, and subject to the safeguards of Article 76(2) and (3) (Article 76(1)).when it serves a financial business
• Inform your customers or prospective customers that special categories of data may be processed for the purpose of complying with the requirements of this Regulation (Article 76(2), point (a)).when it serves a financial business
• Process personal data covered by Article 9 of Regulation (EU) 2016/679 only if the data originate from reliable sources and are accurate and up-to-date (Article 76(2), point (b)).when it serves a financial business
• Do not take decisions that would lead to biased and discriminatory outcomes on the basis of personal data covered by Article 9 of Regulation (EU) 2016/679 (Article 76(2), point (c)).when it serves a financial business
• Adopt measures of a high level of security in accordance with Article 32 of Regulation (EU) 2016/679, in particular in terms of confidentiality, for personal data covered by Article 9 of that Regulation (Article 76(2), point (d)).when it serves a financial business
• Process personal data covered by Article 10 of Regulation (EU) 2016/679 only if you comply with the conditions of Article 76(2), the data relate to money laundering, its predicate offences or terrorist financing, and you have procedures in place that allow the distinction, in the processing of such data, between allegations, investigations, proceedings and convictions, taking into account the fundamental right to a fair trial, the right of defence and the presumption of innocence (Article 76(3)).when it serves a financial business
• Process personal data on the basis of this Regulation only for the purposes of the prevention of money laundering and terrorist financing, and do not further process it in a way that is incompatible with those purposes (Article 76(4)).when it serves a financial business
• Do not process personal data on the basis of this Regulation for commercial purposes (Article 76(4)).when it serves a financial business
• Delete personal data upon expiry of the five-year retention period of Article 77(3), without prejudice to retention periods for data collected for the purposes of other Union legal acts or national law complying with Regulation (EU) 2016/679 (Article 77(3)).when it serves a financial business
• This duty takes effect on 10 July 2027 (Article 90), except for the obliged entities referred to in Article 3, points (3)(n) and (o), football agents and professional football clubs, for which it takes effect on 10 July 2029 (Article 90).

Regulation (EU) 2024/1689, Article 6(2) and Annex III, point 5(b) · Read the law's page

• Ensure the system complies with the requirements of Chapter III, Section 2: risk management (Article 9), data and data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency and instructions for use (Article 13), human oversight (Article 14) and accuracy, robustness and cybersecurity (Article 15).Makes itproviderfor a supplier to a financial business
• Indicate your name, registered trade name or registered trade mark and the address at which you can be contacted on the system or, where that is not possible, on its packaging or its accompanying documentation.Makes itproviderfor a supplier to a financial business
• Have a quality management system in place that complies with Article 17, and keep the documentation referred to in Article 18.Makes itproviderfor a supplier to a financial business
• Keep the logs the system automatically generates, to the extent they are under your control, as Article 19 requires.Makes itproviderfor a supplier to a financial business
• Before you place the system on the market or put it into service, have it undergo the conformity assessment procedure of Article 43; for a point 5 system that is the procedure based on internal control in Annex VI, with no notified body.Makes itproviderfor a supplier to a financial business
• Draw up an EU declaration of conformity (Article 47), affix the CE marking (Article 48) and register yourself and the system in the EU database (Article 49(1)).Makes itproviderfor a supplier to a financial business
• If you consider or have reason to consider that the system is not in conformity with the Regulation, take the necessary corrective actions and provide the information Article 20 requires.Makes itproviderfor a supplier to a financial business
• Demonstrate the system's conformity with the requirements of Section 2 when a national competent authority makes a reasoned request.Makes itproviderfor a supplier to a financial business
• Ensure the system complies with the accessibility requirements of Directives (EU) 2016/2102 and (EU) 2019/882.Makes itproviderfor a supplier to a financial business
• This duty takes effect on 2 December 2027 (Article 113, as amended by Regulation (EU) 2026/1744) for a high-risk AI system classified under Article 6(2) and Annex III, the only classification point 5(b) reaches, so the later date of 2 August 2028 for one classified under Article 6(1) and Annex I adds no system to it; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• It reaches you if you are the provider of an AI system intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, other than one used for the purpose of detecting financial fraud: Article 6(2) makes it a high-risk AI system, and you are its provider if you develop it, or have it developed, and place it on the market or put it into service under your own name or trademark.

Regulation (EU) No 910/2014, Article 5f(2) · Read the law's page

• This duty reaches you if you provide services as a private relying party other than a microenterprise or small enterprise, and Union or national law, or a contractual obligation, requires you to use strong user authentication for online identification, in any area (Art. 5f(2) names transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications as examples and the list is open); it applies no later than 24 December 2027, 36 months after the implementing acts under Article 5a(23) and Article 5c(6) entered into force on 24 December 2024.
• Accept European Digital Identity Wallets that are provided in accordance with the Regulation, only upon the voluntary request of the user (Art. 5f(2)).