Is a crypto-asset provider, in the European Union

Directive (EU) 2015/849, Articles 33 and 39 · Read the law's page

• It reaches you if you are an obliged entity within Article 2(1), which lists credit institutions, financial institutions and the natural or legal persons acting in the exercise of their professional activities that the paragraph names: cooperate fully with the financial intelligence unit by promptly informing it, including by filing a report, on your own initiative, where you know, suspect or have reasonable grounds to suspect that funds, regardless of the amount involved, are the proceeds of criminal activity or are related to terrorist financing, and by promptly responding to its requests for additional information in such cases (Article 33(1), point (a)). A notary, other independent legal professional, auditor, external accountant or tax advisor is outside the obligations of Article 33(1) only to the strict extent that the information is received from, or obtained on, a client in the course of ascertaining the legal position of the client, or performing the task of defending or representing that client in, or concerning, judicial proceedings (Article 34(2)).when it serves a financial business
• Provide the financial intelligence unit directly, at its request, with all necessary information (Article 33(1), point (b), as replaced by Directive (EU) 2018/843, Article 1, point (21)).when it serves a financial business
• Report all suspicious transactions, including attempted transactions (Article 33(1)).when it serves a financial business
• Have the person appointed in accordance with Article 8(4), point (a), transmit the information to the financial intelligence unit of the Member State in whose territory you are established (Article 33(2)).when it serves a financial business
• Do not disclose to the customer concerned or to other third persons the fact that information is being, will be or has been transmitted to the financial intelligence unit in accordance with Article 33 or 34, or that a money laundering or terrorist financing analysis is being, or may be, carried out; the prohibition binds you and your directors and employees, subject to the exceptions of Article 39(2) to (6) (Article 39(1)).when it serves a financial business
• This Directive is addressed to the Member States (Article 69), which had to bring into force the laws, regulations and administrative provisions necessary to comply with it by 26 June 2017 (Article 67(1), as replaced by Directive (EU) 2018/843, Article 1, point (42)), so an obliged entity meets these rules through each Member State's national law; Article 77 of Directive (EU) 2024/1640 repeals this Directive with effect from 10 July 2027, and Annex VI to Regulation (EU) 2024/1624 correlates Article 33(1) with Article 69(1) and Article 39 with Article 73 of that Regulation.

Commission Delegated Regulation (EU) 2024/1772 · Read the law's page

• Classify an ICT-related incident as major where it has affected critical services, meaning it affects ICT services or network and information systems that support your critical or important functions, affects financial services that require authorization, registration or supervision, or is a successful, malicious and unauthorized access to your network and information systems, and either the data losses threshold of Article 9(5), point (b), is met or two or more of the other materiality thresholds of Article 9(1) to (6) are met (Articles 6 and 8(1)).when it serves a financial business
• Apply these materiality thresholds: for clients, financial counterparts and transactions, more than 10 % of all clients using the affected service, more than 100,000 affected clients, more than 30 % of the financial counterparts carrying out activities related to the affected service, more than 10 % of the daily average number of transactions or of their daily average value, or the affecting of clients or financial counterparts identified as relevant; for reputational impact, any condition of Article 2(1); for duration and service downtime, a duration longer than 24 hours or a service downtime longer than 2 hours for ICT services that support critical or important functions; for geographical spread, an impact in two or more Member States; for data losses, an adverse impact on your business objectives or your ability to meet regulatory requirements, or a successful, malicious and unauthorized access that may result in data losses; and for economic impact, costs and losses that have exceeded or are likely to exceed 100,000 euro (Article 9(1) to (6)).when it serves a financial business
• Count the affected clients, financial counterparts and transactions as Article 1 requires and estimate the numbers from comparable reference periods where the actual figures cannot be determined, measure the duration and the service downtime of the incident as Article 3 requires, assess data losses against the availability, authenticity, integrity and confidentiality of data as Article 5 requires, and add up the direct and indirect costs and losses listed in Article 7(1), without accounting for financial recoveries (Articles 1, 3, 5 and 7).when it serves a financial business
• Treat recurring incidents that individually are not major as one major incident where they have occurred at least twice within 6 months, have the same apparent root cause and together fulfill Article 8(1), and assess whether recurring incidents exist on a monthly basis. This does not apply if you are a microenterprise or an entity listed in Article 16(1) of Regulation (EU) 2022/2554 (Article 8(2)).when it serves a financial business
• This Regulation details the classification of incidents under Article 18 of Regulation (EU) 2022/2554, so it reaches you if you are a financial entity under Article 2(1), points (a) to (t), of that Regulation, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). Use these criteria to decide whether an ICT-related incident is a major incident that you must report under Article 19(1) of that Regulation.

Commission Delegated Regulation (EU) 2024/1774 · Read the law's page

• Embed your ICT security policies, information security and related procedures, protocols and tools in your ICT risk management framework, align them with the information security objectives of your digital operational resilience strategy, and indicate the date of their formal approval by the management body (Article 2).for a financial business
• Develop, document and implement ICT risk management policies and procedures that contain the approved risk tolerance level for ICT risk, a procedure and a methodology to conduct the ICT risk assessment, ICT risk treatment measures, and provisions on the review of accepted residual ICT risks at least once a year (Article 3).for a financial business
• Develop, document and implement vulnerability management procedures that identify trustworthy information resources, perform automated vulnerability scanning and assessments (at least weekly for the ICT assets supporting critical or important functions), verify that ICT third-party service providers handle vulnerabilities and report at least the critical ones, track third-party and open-source libraries used by ICT services supporting critical or important functions, establish procedures for the responsible disclosure of vulnerabilities to clients, counterparties and the public, and prioritize the deployment of patches (Article 10(1) and (2)). Develop, document and implement patch management procedures that identify emergency procedures and set deadlines for installing patches and updates with escalation procedures in case those deadlines cannot be met (Article 10(3) and (4)).when it serves a financial business
• Develop, document and implement logging procedures, protocols and tools that identify the events to be logged and the retention period (set it taking into account your business and information security objectives, the reason for recording the event in the logs and the results of your ICT risk assessment), log events related to access control, identity management, capacity management, change management, ICT operations and network traffic, protect logs against tampering, deletion and unauthorized access, detect failures of logging systems, and synchronize the clocks of your ICT systems to a documented reliable reference time source (Article 12).when it serves a financial business
• Develop, document and implement network security management policies that segregate and segment ICT systems and networks, document network connections and data flows, use a separate and dedicated network for the administration of ICT assets, apply network access controls, encrypt network connections, review the network architecture once a year (periodically if you are a microenterprise), and verify the adequacy of firewall rules and connection filters for ICT systems supporting critical or important functions at least every 6 months (Article 13).when it serves a financial business
• Update access rights where changes are necessary and at least once a year for all ICT systems other than those supporting critical or important functions, and at least every 6 months for ICT systems supporting critical or important functions (Article 21).when it serves a financial business
• Develop, document and implement an ICT-related incident policy that documents the incident management process, lists the relevant internal and external contacts, sets up mechanisms to support incident management, retains evidence relating to ICT-related incidents in a secure manner, and analyses significant or recurring incidents (Article 22). Set clear roles and responsibilities to detect and respond to ICT-related incidents and anomalous activities, collect, monitor and analyze logs, cyber threat information and incident notifications from ICT third-party service providers, implement tools that generate alerts at least for the ICT assets and information assets supporting critical or important functions, and log the date, time and type of each detected anomalous activity (Article 23).when it serves a financial business
• Include in the ICT business continuity policy the objectives, scope, timeframe, activation and deactivation criteria, governance and recovery objectives set out in Article 24(1). If you are a central counterparty, set a maximum recovery time for your critical functions of not longer than 2 hours. If you are a central securities depository, ensure a recovery time objective of not longer than 2 hours for your critical or important functions. If you are a trading venue, ensure that trading can be resumed within or close to 2 hours of a disruptive incident and that the maximum amount of data lost is close to zero (Article 24(2) to (4)). Test the plans on scenarios that simulate potential disruptions, including severe but plausible scenarios, include the ICT services provided by ICT third-party service providers where applicable, document the results, and report identified deficiencies to the management body (Article 25).for a financial business
• Submit the report on the review of the ICT risk management framework in a searchable electronic format and include the information that Article 27(2) lists (Article 27).when it serves a financial business
• If you are an entity referred to in Article 16(1) of Regulation (EU) 2022/2554, apply the simplified framework of Title III: have an internal governance and control framework with the management body responsibilities set out in Article 28, and meet Articles 29 to 41 on the information security policy, the classification of assets, ICT risk management, physical and environmental security, access control, ICT operations security, data, system and network security, ICT security testing, acquisition, development and maintenance, project and change management, the business continuity plan and the review report. Test your business continuity plans at least once every year for the back-up and restore procedures, or upon every major change of the plan (Article 40).for a financial business
• This Regulation details the ICT risk management duties of Regulation (EU) 2022/2554 (Articles 15 and 16(3)), so it reaches you if you are a financial entity under Article 2(1), points (a) to (t), of that Regulation. Title II applies to you unless you are an entity referred to in Article 16(1) of that Regulation, and Title III, the simplified framework, applies to you if you are. Take your size and overall risk profile, and the nature, scale and complexity of your services, activities and operations, into account when you develop and implement the policies, procedures, protocols and tools (Article 1).

Regulation (EU) 2022/2554, Article 17 · Read the law's page

• Define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents (Article 17(1)).when it serves a financial business
• Record all ICT-related incidents and significant cyber threats, and establish procedures and processes that ensure consistent and integrated monitoring, handling and follow-up of ICT-related incidents so that root causes are identified, documented and addressed (Article 17(2)).when it serves a financial business
• In the process, establish procedures to identify, track, log, categorize and classify ICT-related incidents according to their priority and severity and the criticality of the services impacted, in accordance with the criteria set out in Article 18(1) (Article 17(3)(b)).when it serves a financial business
• In the process, put in place early warning indicators, assign roles and responsibilities for different incident types and scenarios, set out plans for communication and internal escalation, make sure at least major ICT-related incidents are reported to relevant senior management and to the management body, and establish response procedures to mitigate impacts and make services operational and secure in a timely manner (Article 17(3)(a) and (c) to (f)).when it serves a financial business
• It reaches you if you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554, such as a credit institution, payment institution, electronic money institution, investment firm, crypto-asset service provider, central counterparty or trading venue, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). Article 16(1) disapplies Articles 5 to 15 for the small entities it names, and Article 17 is not among them. The duties apply from 17 January 2025 (Article 64).

Regulation (EU) 2022/2554, Article 19 · Read the law's page

• Report a major ICT-related incident to the competent authority your sector's Union law designates under Article 46, the European Central Bank through your national supervisor if you are a credit institution classified as significant, using the templates referred to in Article 20, and submit an initial notification as early as possible and in any case within four hours of classifying the incident as major, and no later than 24 hours from becoming aware of it.when it serves a financial business
• Where classification as major comes later than that, submit the initial notification within four hours of the classification instead.when it serves a financial business
• Submit an intermediate report within 72 hours of the initial notification, and submit an updated intermediate report without undue delay and in any case when you have recovered regular activities.when it serves a financial business
• Submit a final report no later than one month after the intermediate report, or your latest updated one, once you know the root cause and the actual impact figures.when it serves a financial business
• If you cannot meet one of those deadlines, tell the competent authority without undue delay and before the deadline lapses, explaining why. A deadline falling on a weekend or bank holiday moves to noon of the next working day, unless you are a credit institution, a central counterparty, a trading venue operator, or an entity your Member State has designated essential or important under the NIS2 Directive, none of which get that extension for an initial notification or intermediate report. Your competent authority may also decide, and notify you, that the extension does not apply to you if you are a financial entity that is significant or has a systemic character for the financial sector at national or Union level.when it serves a financial business
• Notifying a significant cyber threat under Article 19(2) is voluntary, only where you judge it relevant to the financial system, service users, or your clients. Where a major ICT-related incident affects your clients' financial interests, tell them without undue delay as soon as you become aware of it, describing the incident and the mitigation measures you took, and, for a significant cyber threat, tell a potentially affected client of protection measures it could take, where applicable.when it serves a financial business
• This duty reaches you where you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554: a credit institution, payment institution, electronic money institution, investment firm, crypto-asset service provider, central securities depository, central counterparty, trading venue, insurance or reinsurance undertaking, institution for occupational retirement provision, credit rating agency, crowdfunding service provider, or one of the Article's other listed categories, unless Article 2(3) takes you out of the Regulation (among others, insurance and reinsurance undertakings referred to in Article 4 of Directive 2009/138/EC, institutions for occupational retirement provision with no more than 15 members in total, insurance intermediaries that are microenterprises or small or medium-sized enterprises, and post office giro institutions) or your Member State has excluded you under Article 2(4). It does not reach you as an ICT third-party service provider merely because you serve one of those entities: Article 2(2) confines the term 'financial entities' to points (a) to (t), so you carry this duty only where a financial entity has outsourced its own Article 19 reporting task to you, or where your own contract for a critical or important ICT service separately obliges you to assist that financial entity when an ICT incident occurs.

Regulation (EU) 2022/2554, Arts. 24-27 · Read the law's page

• Unless you are a microenterprise, establish, maintain and review a sound and comprehensive digital operational resilience testing program as an integral part of your ICT risk-management framework, follow a risk-based approach that takes account of the evolving landscape of ICT risk and the criticality of your information assets and services, and ensure that tests are undertaken by independent parties, internal or external, with sufficient resources and no conflict of interest where the tester is internal (Article 24(1) to (4)).for a financial business
• Unless you are a microenterprise, establish procedures and policies to prioritize, classify and remedy all issues the tests reveal, set up internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed, and ensure at least yearly that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions (Article 24(5) and (6)).for a financial business
• Include in the program a range of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing (Article 25(1)). If you are a central securities depository or central counterparty, perform vulnerability assessments before any deployment or redeployment of applications and infrastructure components and of the ICT services supporting critical or important functions (Article 25(2)). If you are a microenterprise, combine a risk-based approach with strategic planning of ICT testing (Article 25(3)).for a financial business
• If your competent authority has identified you for threat-led penetration testing, carry out advanced testing by TLPT at least every 3 years, or at the frequency your competent authority sets, cover several or all critical or important functions on live production systems, assess which critical or important functions need to be covered, and have the scope validated by the competent authorities (Article 26(1) and (2)).for a financial business
• Take the necessary measures and safeguards to ensure the participation of any ICT third-party service provider in the scope of the test, keep full responsibility for compliance with the Regulation, and apply effective risk management controls to mitigate the risks of any impact on data, damage to assets and disruption to critical or important functions, services or operations (Article 26(3) and (5)).for a supplier to a financial business
• When the testing ends and reports and remediation plans are agreed, give the designated authority a summary of the relevant findings, the remediation plans and the documentation demonstrating that the TLPT was conducted in accordance with the requirements, and notify your competent authority of the attestation you receive, the summary and the remediation plans (Article 26(6) and (7)).when it serves a financial business
• Contract only testers that meet Article 27(1): of the highest suitability and reputability, with technical and organizational capabilities and specific expertise in threat intelligence, penetration testing and red team testing, certified by an accreditation body in a Member State or adhering to formal codes of conduct or ethical frameworks, able to provide an independent assurance or an audit report on the sound management of the risks of TLPT, and covered by professional indemnity insurance. Use internal testers only with the approval of your competent authority or the designated single public authority, contract external testers every three tests, use only external testers if you are a credit institution classified as significant under Regulation (EU) No 1024/2013, and ensure that the threat intelligence provider is external to you (Article 26(8) and Article 27(1) and (2)).for a supplier to a financial business
• Ensure that contracts with external testers require a sound management of the TLPT results and that any data processing, including generation, storage, aggregation, drafting, reporting, communication or destruction, does not create risks to you (Article 27(3)).for a supplier to a financial business
• It reaches you if you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). The testing program duties of Article 24 apply to you unless you are a microenterprise. The threat-led penetration testing duty of Article 26(1) applies to you only if your competent authority has identified you under Article 26(8) and you are neither a microenterprise nor an entity named in Article 16(1), first subparagraph. An ICT third-party service provider that is in the scope of a test takes part through the financial entity, which keeps full responsibility (Article 26(3)).

Regulation (EU) 2022/2554, Arts. 28-30 · Read the law's page

• Manage ICT third-party risk as an integral, proportionate component of your ICT risk management framework, and, unless you are a microenterprise or an entity covered by Article 16(1), adopt and regularly review a strategy on ICT third-party risk.for a financial business
• Maintain and update a register of all your ICT services contracts, distinguishing those supporting a critical or important function, report on it at least yearly to your competent authority, and produce it in full on the authority's request.when it serves a financial business
• Before entering into an ICT services contract, assess whether it supports a critical or important function, whether supervisory conditions for contracting are met, and the concentration risk under Article 29, including whether the provider is easily substitutable and whether you already rely on it, or a closely connected provider, for other critical functions.for a financial business
• Put every ICT services contract in writing in one document, covering at minimum the functions and locations involved, data-protection and access-on-termination provisions, service levels, the provider's duty to assist you on an incident and to cooperate with your regulators, termination rights, and your security-awareness programme.for a supplier to a financial business
• For a contract supporting a critical or important function, add quantitative service level targets, an unrestricted right to monitor, inspect and audit the provider, the provider's cooperation in your threat-led penetration testing, and an exit strategy with a mandatory transition period. If you are a microenterprise, you and the provider may agree that your access, inspection and audit rights are delegated to an independent third party the provider appoints.for a supplier to a financial business
• This duty binds you as the financial entity contracting for an ICT service, not the ICT third-party service provider directly, though the provider's own obligations enter through the contract terms Article 30 requires you to include; it reaches you where you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554, unless Article 2(3) takes you out of the Regulation (among others, insurance and reinsurance undertakings referred to in Article 4 of Directive 2009/138/EC, institutions for occupational retirement provision with no more than 15 members in total, insurance intermediaries that are microenterprises or small or medium-sized enterprises, and post office giro institutions) or your Member State has excluded you under Article 2(4).

Regulation (EU) 2022/2554, Arts. 31-44 · Read the law's page

• If you are part of a group, designate one legal person as the coordination point for adequate representation and communication with the Lead Overseer, and notify the financial entities to which you provide services of your designation as critical (Article 31(4) and (5)).for a supplier to a financial business
• If you are established in a third country, establish a subsidiary in the Union within the 12 months following your designation, because financial entities may use your services only if you have, and notify the Lead Overseer of any changes to the structure of the management of that subsidiary (Article 31(12) and (13)).for a supplier to a financial business
• Cooperate in good faith with the Lead Overseer and assist it in the fulfillment of its tasks (Article 35(5)). Provide the information the Lead Overseer requires by simple request or by decision, including business or operational documents, contracts, policies, documentation, ICT security audit reports, ICT-related incident reports and information on the parties to whom you have outsourced operational functions or activities, and do not supply incorrect or misleading information, since you remain fully responsible if the information is incomplete, incorrect or misleading (Article 37).for a supplier to a financial business
• Submit to the investigations and the on-site inspections that the Lead Overseer orders by decision, including the examination of records, data and procedures, explanations from your representatives, and entry to your business premises, land or property (Articles 38 and 39).for a supplier to a financial business
• Where the Lead Overseer examines a planned subcontracting arrangement with a subcontractor established in a third country that concerns critical or important functions of a financial entity, transmit the information regarding subcontracting to the Lead Overseer using the template referred to in Article 41(1), point (b) (Article 35(1), point (d)(iv)).for a supplier to a financial business
• Within 60 calendar days of receiving the Lead Overseer's recommendations, notify the Lead Overseer of your intention to follow them or give a reasoned explanation for not following them (Article 42(1)). If a competent authority requires financial entities to suspend or terminate their use of your service, cooperate fully with the financial entities affected, in particular in the suspension or termination of their contractual arrangements (Article 42(9)).for a supplier to a financial business
• It reaches you if you are an ICT third-party service provider that the European Supervisory Authorities designate as critical for financial entities under Article 31(1), point (a), after an assessment of the criteria in Article 31(2). It does not reach a financial entity providing ICT services to other financial entities, an ICT intra-group service provider, a provider subject to the oversight frameworks that support the tasks referred to in Article 127(2) of the Treaty on the Functioning of the European Union, or a provider that serves only financial entities active solely in one Member State from within that Member State (Article 31(8)). Your oversight duties run from the starting date notified with your designation, no later than one month after the notification (Article 31(5)), and the designation is not used until the Commission has adopted the delegated act specifying the criteria (Article 31(7)).

Regulation (EU) 2022/2554, Arts. 5-16 · Read the law's page

• Have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk. Have your management body define, approve, oversee and answer for all arrangements under the ICT risk management framework, bear the ultimate responsibility for managing ICT risk, set and approve the digital operational resilience strategy and risk tolerance level, and approve and review your ICT business continuity policy, response and recovery plans, ICT internal audit plans and policy on the use of ICT third-party services (Article 5(1) and (2)).for a financial business
• Keep the members of your management body up to date with sufficient knowledge and skills to understand and assess ICT risk, including through specific training on a regular basis. Unless you are a microenterprise, establish a role, or designate a member of senior management, to monitor the arrangements with ICT third-party service providers (Article 5(3) and (4)).for a financial business
• Maintain a sound, comprehensive and well-documented ICT risk management framework as part of your overall risk management system, with the strategies, policies, procedures, ICT protocols and tools needed to protect all information assets and ICT assets. Document and review it at least once a year (periodically if you are a microenterprise), after major ICT-related incidents, and after supervisory instructions or conclusions from testing or audit. Give your competent authority complete and updated information on ICT risk and a report on the review of the framework on request (Article 6(1) to (3) and (5)).for a financial business
• Unless you are a microenterprise, assign responsibility for managing and overseeing ICT risk to a control function with an appropriate level of independence, keep ICT risk management, control and internal audit functions segregated, have the framework audited internally on a regular basis by auditors with sufficient knowledge, skills and expertise in ICT risk, and establish a formal follow-up process for critical ICT audit findings (Article 6(4), (6) and (7)).for a financial business
• Include in the framework a digital operational resilience strategy that explains how the framework supports your business strategy, sets the risk tolerance level for ICT risk and the impact tolerance for ICT disruptions, sets information security objectives with key performance indicators and key risk metrics, describes the ICT reference architecture, outlines the mechanisms to detect and prevent the impact of ICT-related incidents, provides for digital operational resilience testing, and outlines a communication strategy for incident disclosure (Article 6(8)).for a financial business
• Use and maintain updated ICT systems, protocols and tools that are appropriate to the magnitude of your operations, reliable, equipped with sufficient capacity to process data accurately and deal with peak volumes, and technologically resilient under stressed conditions (Article 7).when it serves a financial business
• Identify, classify and document all ICT supported business functions, the information assets and ICT assets that support them and their dependencies, and review that classification at least yearly. Identify all sources of ICT risk on a continuous basis and review the risk scenarios that affect you at least yearly. Map the assets you consider critical, and identify the processes that depend on ICT third-party service providers. Unless you are a microenterprise, perform a risk assessment on each major change in your network and information system infrastructure and at least yearly on all legacy ICT systems (Article 8).when it serves a financial business
• Continuously monitor and control the security and functioning of your ICT systems and deploy ICT security policies, procedures, protocols and tools that keep data available, authentic, intact and confidential at rest, in use and in transit. Document an information security policy, policies that limit physical and logical access to what is needed, strong authentication mechanisms and protection of cryptographic keys, ICT change management, and policies for patches and updates, and design network connections so that they can be instantaneously severed or segmented (Article 9).when it serves a financial business
• Have mechanisms with multiple layers of control, alert thresholds and criteria that promptly detect anomalous activities, ICT network performance issues and ICT-related incidents and trigger incident response, test them regularly under Article 25, and devote sufficient resources to monitor user activity, ICT anomalies and ICT-related incidents. If you are a data reporting service provider, also have systems that check trade reports for completeness, identify omissions and obvious errors, and request re-transmission (Article 10).when it serves a financial business
• Put in place a comprehensive ICT business continuity policy and ICT response and recovery plans, and conduct a business impact analysis of your exposures to severe business disruptions. Test the continuity and the response and recovery plans at least yearly and on substantive changes to systems supporting critical or important functions, and test your crisis communication plans. Keep readily accessible records of activities before and during disruption events. Unless you are a microenterprise, include cyber-attack and switchover scenarios in the tests, have a crisis management function, and report to your competent authority on request an estimate of the aggregated annual costs and losses caused by major ICT-related incidents (Article 11).for a financial business
• Develop and document backup policies and procedures and restoration and recovery procedures and methods, set up backup systems and test them periodically, and restore backup data on ICT systems that are physically and logically segregated from the source system. Unless you are a microenterprise, maintain redundant ICT capacities adequate to your business needs. If you are a central securities depository, maintain a secondary processing site that meets Article 12(5) (Article 12).when it serves a financial business
• Have capabilities and staff to gather information on vulnerabilities, cyber threats and ICT-related incidents, run post-incident reviews after a major ICT-related incident disrupts your core activities, build the lessons from testing and real incidents into the ICT risk assessment, have senior ICT staff report at least yearly to the management body, and make ICT security awareness programs and digital operational resilience training compulsory modules for all employees and senior management (Article 13).for a financial business
• Have crisis communication plans that enable a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts and to the public, communication policies for staff and external stakeholders, and at least one person tasked with implementing the communication strategy and fulfilling the public and media function (Article 14).for a financial business
• If you are an entity named in Article 16(1), maintain a sound and documented ICT risk management framework, continuously monitor the security and functioning of all ICT systems, use sound, resilient and updated ICT systems, protocols and tools, promptly identify and detect sources of ICT risk and anomalies, identify key dependencies on ICT third-party service providers, ensure the continuity of critical or important functions through business continuity plans and response and recovery measures that include back-up and restoration, and test those plans and the controls regularly. Document and review the framework periodically and after major ICT-related incidents, and give the competent authority a report on the review on request (Article 16(1) and (2)).when it serves a financial business
• It reaches you if you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554, such as a credit institution, payment institution, electronic money institution, investment firm, crypto-asset service provider, central counterparty or trading venue, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). If you are an entity named in Article 16(1), Articles 5 to 15 do not apply to you and the simplified framework of Article 16 applies instead. Apply these rules in proportion to your size, overall risk profile, and the nature, scale and complexity of your services, activities and operations (Article 4(1)). An ICT third-party service provider is not a financial entity under Article 2(2) and these Articles do not bind it directly.

Commission Implementing Regulation (EU) 2025/302 · Read the law's page

• Use the template in Annex I for the initial notification, the intermediate report and the final report, completing the data fields that correspond to the information that Articles 2, 3 and 4 of Delegated Regulation (EU) 2025/301 require for each report, follow the data glossary and instructions in Annex II, ensure that the information is complete and accurate, and give estimated values based on other available data and information where accurate data are not available for the initial notification or the intermediate report (Article 1).when it serves a financial business
• When you submit an intermediate or a final report, use the Annex I template to submit all required information and update, where applicable, the information that you provided earlier (Article 1(4)).when it serves a financial business
• If you combine two or all of the reports in one submission, which Article 2 allows where regular activities have recovered or the root cause analysis has been completed, meet the time limits of Article 5 of Delegated Regulation (EU) 2025/301 for each report (Article 2).when it serves a financial business
• Provide information on non-major recurring ICT-related incidents that cumulatively meet the conditions for one major incident under Article 8(2) of Delegated Regulation (EU) 2024/1772 in an aggregated form (Article 3).when it serves a financial business
• Submit the initial notification and the intermediate and final reports through the secure electronic channels your competent authority makes available. If you cannot use them, inform your competent authority about the major ICT-related incident through other secure means in agreement with the authority, and resubmit through the secure electronic channel once you are able to, if your authority requires it (Article 4).when it serves a financial business
• If, after further assessment, you conclude that an incident you reported as major at no time fulfilled the classification criteria and thresholds of Article 8 of Delegated Regulation (EU) 2024/1772, notify your competent authority that you have reclassified it from major to non-major, using the Annex II template fields 'type of report' and 'other information' (Article 5).when it serves a financial business
• If you outsource the obligation to report major ICT-related incidents under Article 19(5) of Regulation (EU) 2022/2554, inform your competent authority of the arrangement as soon as it is concluded and at the latest before the first notification or report, with the name, contact details and identification code of the third party that will submit the reports, and inform the authority as soon as you no longer outsource the reporting (Article 6).when it serves a financial business
• If you are a credit institution of significant relevance under Article 2, point (16), of Regulation (EU) No 468/2014, an operator of a trading venue or a central counterparty, submit your notifications and reports individually to your competent authority. Where your competent authority requires information on the individual impact of an aggregated report on you, submit an individual notification or report on request (Article 7(2) and (3)).when it serves a financial business
• If you notify a significant cyber threat to your competent authority under Article 19(2) of Regulation (EU) 2022/2554, use the template in Annex III, follow the data glossary and instructions in Annex IV, and ensure that the information is complete and accurate (Article 8).when it serves a financial business
• This Regulation sets the forms and procedures for the reports under Article 19 of Regulation (EU) 2022/2554, so it reaches you if you are a financial entity under Article 2(1), points (a) to (t), of that Regulation that reports a major ICT-related incident or notifies a significant cyber threat, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). A third-party service provider to which you have outsourced your reporting uses the same forms on your behalf (Articles 6 and 7).

Directive (EU) 2019/882, Arts. 2(2) and 13, Annex I Sections III and IV · Read the law's page

• This duty reaches you through the law of each Member State that transposes the Directive, where you provide, or offer to provide, to consumers in the Union after 28 June 2025 an electronic communications service (other than a transmission service used for machine-to-machine services), a service providing access to audiovisual media services, the website, mobile application, electronic ticketing, travel-information or interactive self-service terminal elements of air, bus, rail or waterborne passenger transport services (for urban, suburban and regional transport services, only the interactive self-service terminals), a consumer banking service, e-books and dedicated software, or an e-commerce service (Article 2(2), Article 3(4)). A microenterprise providing services is exempt from the requirements of Article 4(3) and from any obligations relating to compliance with them (Article 4(5)); Article 3(23) defines a microenterprise as an enterprise which employs fewer than 10 persons and which has an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million.
• Design and provide your service in accordance with the accessibility requirements of the Directive (Article 13(1)): unless it is an urban, suburban or regional transport service it must meet Section III of Annex I, and every service must meet the part of Section IV of Annex I that applies to it (Article 4(3)).
• Unless your service is an urban, suburban or regional transport service, make your websites, including the related online applications, and your mobile device-based services, including mobile applications, accessible in a consistent and adequate way by making them perceivable, operable, understandable and robust (Annex I, Section III, point (c)).
• Unless your service is an urban, suburban or regional transport service, make sure the products you use to provide it meet the accessibility requirements of Section I and, where applicable, Section II of Annex I (Annex I, Section III, point (a)).
• Unless your service is an urban, suburban or regional transport service, give information about how it works, and about the accessibility characteristics of any products used in it and their interoperability with assistive devices and facilities, through more than one sensory channel, in an understandable way and in ways users can perceive, in text formats that can be used to generate alternative assistive formats, in fonts of adequate size and suitable shape with sufficient contrast and adjustable spacing between letters, lines and paragraphs, with an alternative presentation of any non-textual content, and provide the electronic information needed to provide the service in a consistent and adequate way by making it perceivable, operable, understandable and robust (Annex I, Section III, point (b)).
• Unless your service is an urban, suburban or regional transport service, where you provide support services such as help desks, call centers, technical support, relay services and training services, have them give information on the accessibility of the service and its compatibility with assistive technologies, in accessible modes of communication (Annex I, Section III, point (d)).
• If you offer e-commerce services, provide the information concerning accessibility of the products and services being sold when the responsible economic operator provides it, make the functionality for identification, security and payment perceivable, operable, understandable and robust when it is delivered as part of a service instead of a product, and provide identification methods, electronic signatures and payment services that are perceivable, operable, understandable and robust (Annex I, Section IV, point (g)).
• If you provide consumer banking services, provide identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust, and ensure that the information is understandable without exceeding a level of complexity superior to level B2 (upper intermediate) of the Council of Europe's Common European Framework of Reference for Languages (Annex I, Section IV, point (e)).
• If you provide an electronic communications service, provide real time text in addition to voice communication, provide total conversation where video is provided in addition to voice, and ensure that emergency communications using voice and text, and video where provided, are synchronized and transmitted to the most appropriate public safety answering point (Annex I, Section IV, point (a)).
• If you provide services giving access to audiovisual media services, provide electronic program guides that are perceivable, operable, understandable and robust and give information about the availability of accessibility, and ensure that subtitles for the deaf and hard of hearing, audio description, spoken subtitles and sign language interpretation are fully transmitted with adequate quality, synchronized with sound and video, with user control of their display and use (Annex I, Section IV, point (b)).
• If you provide e-books or dedicated software, provide synchronized text and audio where an e-book contains audio in addition to text, keep e-book digital files from preventing assistive technology from operating properly, give access to the content, the navigation of the file content and layout including dynamic layout, with structure, flexibility and choice in the presentation of the content, allow alternative renditions interoperable with a variety of assistive technologies, make the e-books discoverable through metadata about their accessibility features, and do not let digital rights management measures block accessibility features (Annex I, Section IV, point (f)).
• If you provide air, bus, rail or waterborne passenger transport services, other than urban, suburban and regional transport services, provide information on the accessibility of vehicles, the surrounding infrastructure and the built environment and on assistance for persons with disabilities, and information about smart ticketing, real-time travel information and additional service information (Annex I, Section IV, point (c)). For urban, suburban and regional transport services, make the self-service terminals used in the service accessible under Section I of Annex I (Annex I, Section IV, point (d)).
• Include in your general terms and conditions, or an equivalent document, the information assessing how the service meets the accessibility requirements, with a general description of the service in accessible formats, the descriptions and explanations needed to understand its operation, and a description of how the relevant requirements of Annex I are met; make that information available to the public in written and oral format, including in a manner accessible to persons with disabilities, and keep it for as long as the service is in operation; and provide information demonstrating that the service delivery process and its monitoring ensure compliance (Article 13(2), Annex V, points 1 and 3).
• Have procedures in place so that the provision of your service remains in conformity, and take adequate account of changes in the characteristics of the service, in the applicable accessibility requirements and in the harmonized standards or technical specifications by reference to which the service is declared to meet them (Article 13(3)).
• If your service does not conform, take the corrective measures necessary to bring it into conformity and immediately inform the competent national authorities of the Member States in which the service is provided, giving details of the non-compliance and of the corrective measures taken (Article 13(4)). On a reasoned request from a competent authority, provide all the information necessary to demonstrate conformity and cooperate on any action taken to bring the service into compliance (Article 13(5)).
• You may rely on fundamental alteration or disproportionate burden only to the extent that compliance would require a significant change that results in the fundamental alteration of the basic nature of the service or would impose a disproportionate burden. Carry out an assessment of either ground, judging disproportionate burden against the criteria in Annex VI, document it, keep all relevant results for five years from the day the service was last provided, give a copy of the assessment to the authorities responsible for checking compliance of services on request, and send information that you rely on this ground to those authorities of the Member State where the service is provided (Article 14(1), (2), (3) and (8)). If you rely on disproportionate burden, renew that assessment for each category or type of service when the service is altered, when those authorities ask, and in any event at least every five years (Article 14(5)). You cannot rely on disproportionate burden where you receive funding, public or private, from other sources than your own resources that is provided for the purpose of improving accessibility (Article 14(6)).
• The Directive does not apply to the following content of websites and mobile applications: pre-recorded time-based media and office file formats published before 28 June 2025, online maps and mapping services if essential information is provided in an accessible digital manner for maps intended for navigational use, third-party content that is neither funded, developed by, or under the control of the economic operator concerned, and archives that only contain content not updated or edited after 28 June 2025 (Article 2(4)).
• Member States provide for a transitional period ending on 28 June 2030 during which you may continue to provide your service using products you lawfully used to provide similar services before that date, and service contracts agreed before 28 June 2025 may continue without alteration until they expire, but no longer than five years from that date; a Member State may also let you keep using self-service terminals you lawfully used to provide services before 28 June 2025 until the end of their economically useful life, but no longer than 20 years after their entry into use (Article 32(1) and (2)).
• If you provide air, bus, rail or waterborne passenger transport services, a service that complies with the requirements on accessible information and on information on accessibility of Regulations (EC) No 261/2004, (EC) No 1107/2006, (EC) No 1371/2007, (EU) No 1177/2010 and (EU) No 181/2011 is deemed to comply with the corresponding requirements of the Directive, and the Directive's additional requirements apply in full (Article 5).

Commission Delegated Regulation (EU) 2025/1140, Art. 2(2) and Annex, Section 1; Regulation (EU) 2023/1114, Art. 68(9) · Read the law's page

• It reaches you if you are a crypto-asset service provider, meaning a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis and that is allowed to provide crypto-asset services in accordance with Article 59 of Regulation (EU) 2023/1114 (Article 3(1), point (15), of that Regulation): keep records of telephone conversations or electronic communications relating to transactions or to the reception, transmission and execution of client orders, including where such conversations or communications do not result in the conclusion of a transaction or in the provision of the services of reception and transmission of orders or execution of order (Article 2(2) and Annex, Section 1, communication with clients).when it serves a financial business
• Retain the records in a medium that lets the competent authority access them readily and reconstitute each key stage of the processing of each crypto-asset service, activity, order or transaction, lets any corrections or other amendments and the earlier contents be ascertained, and does not allow the records to be manipulated or altered (Article 2(1)).when it serves a financial business
• Provide the records to clients upon request and keep them for five years and, where the competent authority requests before five years have elapsed, for up to seven years (Article 68(9) of Regulation (EU) 2023/1114).when it serves a financial business
• Delegated Regulation (EU) 2025/1140 is binding in its entirety and directly applicable in all Member States and entered into force on the twentieth day after its publication on 10 June 2025 (Article 18); it specifies the records that Article 68(9) of Regulation (EU) 2023/1114 requires crypto-asset service providers to keep (Article 68(10) of that Regulation).

Directive (EU) 2023/2673, inserting Article 16d(1), (3) and (4) into Directive 2011/83/EU · Read the law's page

• If you are a trader concluding a financial services contract with a consumer at a distance, give the consumer free of charge, before the contract is concluded, adequate explanations that make it possible to assess whether the proposed contract and ancillary services are adapted to the consumer's needs and financial situation (Article 16d(1)).when it serves a financial business
• If you use online tools, let the consumer request and obtain human intervention at the pre-contractual stage and, in justified cases, after the distance contract is concluded, in the same language as the pre-contractual information (Article 16d(3)).when it serves a financial business
• Be ready to prove that you gave the adequate explanations, since the burden of proof is on the trader (Article 16d(4)).when it serves a financial business
• This Directive is addressed to the Member States (Article 5), which had to adopt and publish the measures necessary to comply with it by 19 December 2025 and apply them from 19 June 2026 (Article 2(1)), so a trader meets these rules through each Member State's national law.

Directive 2011/83/EU, Art. 16a(3), first sentence, as inserted by Directive (EU) 2023/2673 · Read the law's page

• It reaches you if you are a trader in a distance contract with a consumer for the supply of financial services (Article 3(1b) of Directive 2011/83/EU) and you communicate with the consumer by voice telephony: make your identity and the commercial purpose of the call you initiate explicitly clear at the beginning of any call with the consumer (Article 16a(3), first sentence).when it serves a financial business
• This Directive is addressed to the Member States (Article 5), which had to adopt and publish the measures necessary to comply with it by 19 December 2025 and apply them from 19 June 2026 (Article 2(1)), so a trader meets these rules through each Member State's transposing law.

Directive 2011/83/EU, Art. 16a(3), second sentence, as inserted by Directive (EU) 2023/2673 · Read the law's page

• It reaches you if you are a trader in a distance contract with a consumer for the supply of financial services (Article 3(1b) of Directive 2011/83/EU) and you communicate with the consumer by voice telephony: when a call is being recorded, or might be recorded, notify the consumer that this is the case (Article 16a(3), second sentence).when it serves a financial business
• This Directive is addressed to the Member States (Article 5), which had to adopt and publish the measures necessary to comply with it by 19 December 2025 and apply them from 19 June 2026 (Article 2(1)), so a trader meets these rules through each Member State's transposing law.

Regulation (EU) 2024/1624, Art. 76(5) · Read the law's page

• If you are an obliged entity and adopt decisions resulting from automated processes, including profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679, or from processes involving AI systems as defined in Article 3, point (1), of the Artificial Intelligence Act, limit the data processed by those systems to data obtained pursuant to Chapter III of the Regulation (Article 76(5), point (a)).when it serves a financial business
• Subject any decision to enter or refuse to enter into or maintain a business relationship with a customer, or to carry out or refuse to carry out an occasional transaction for a customer, or to increase or decrease the extent of the customer due diligence measures applied pursuant to Article 20, to meaningful human intervention to ensure the accuracy and appropriateness of the decision (Article 76(5), point (b)).when it serves a financial business
• Let the customer obtain an explanation of the decision you have reached, except in relation to a report as referred to in Article 69 (Article 76(5), point (c)).when it serves a financial business
• Let the customer challenge the decision you have reached, except in relation to a report as referred to in Article 69 (Article 76(5), point (c)).when it serves a financial business
• This duty takes effect on 10 July 2027 (Article 90), except for the obliged entities referred to in Article 3, points (3)(n) and (o), football agents and professional football clubs, for which it takes effect on 10 July 2029 (Article 90).

Regulation (EU) 2024/1624, Article 75(4), point (g) · Read the law's page

• Share information generated through the use of artificial intelligence, machine learning technologies or algorithms within the partnership only where those processes were subject to adequate human oversight (Article 75(4), point (g)).when it serves a financial business
• This duty takes effect on 10 July 2027 (Article 90), except for the obliged entities referred to in Article 3, points (3)(n) and (o), football agents and professional football clubs, for which it takes effect on 10 July 2029 (Article 90).
• It reaches you if you are an obliged entity within Article 3, which lists credit institutions and financial institutions, and take part in a partnership for information sharing (Article 75(1)).

Regulation (EU) 2024/1624, Articles 69 and 73 · Read the law's page

• It reaches you if you are an obliged entity within Article 3, which lists credit institutions, financial institutions and the persons named in point (3) acting in the exercise of their professional activities: cooperate fully with the financial intelligence unit by promptly reporting to it, on your own initiative, where you know, suspect or have reasonable grounds to suspect that funds or activities, regardless of the amount involved, are the proceeds of criminal activity or are related to terrorist financing or criminal activity, and by responding to its requests for additional information in such cases (Article 69(1), point (a)). A notary, lawyer, other independent legal professional, auditor, external accountant or tax advisor is exempt from Article 69(1) to the extent that the exemption relates to information received from, or obtained on, a client in the course of ascertaining the legal position of that client or performing the task of defending or representing that client in, or concerning, judicial proceedings, but not where the person takes part in money laundering, its predicate offences or terrorist financing, provides legal advice for those purposes, or knows that the client is seeking legal advice for those purposes (Article 70(2)).when it serves a financial business
• Provide the financial intelligence unit, at its request, with all necessary information, including information on transaction records, within the deadlines imposed, and reply to its requests for information within 5 working days, a deadline the unit may shorten in justified and urgent cases, including to less than 24 hours, or extend where it considers that justified and the extension does not undermine its analysis (Article 69(1), point (b), and third and fourth subparagraphs).when it serves a financial business
• Report all suspicious transactions, including attempted transactions and suspicions arising from the inability to conduct customer due diligence (Article 69(1), second subparagraph).when it serves a financial business
• Assess the transactions or activities carried out by your customers on the basis of and against any relevant fact and information known to you or which you are in possession of, prioritizing the assessment where necessary according to the urgency of the transaction or activity and the risks affecting the Member State in which you are established, and base a suspicion on the characteristics of the customer and their counterparts, the size and nature of the transaction or activity or the methods and patterns thereof, the link between several transactions or activities, the origin, destination or use of funds, or any other circumstance known to you, including the consistency of the transaction or activity with the information obtained under Chapter III, including the risk profile of the client (Article 69(2)).when it serves a financial business
• Have the compliance officer appointed in accordance with Article 11(2) transmit the information to the financial intelligence unit of the Member State in whose territory you are established (Article 69(6)), and protect the compliance officer, and any employee or person in a comparable position, including agents and distributors, involved in these tasks against retaliation, discrimination and any other unfair treatment for carrying out them (Article 69(7)).when it serves a financial business
• Do not disclose to the customer concerned or to other third persons the fact that transactions or activities are being or have been assessed in accordance with Article 69, that information is being, will be or has been transmitted in accordance with Article 69 or 70, or that a money laundering or terrorist financing analysis is being, or may be, carried out; the prohibition binds you and your directors, employees and persons in comparable positions, including agents and distributors, subject to the exceptions of Article 73(2) to (6) (Article 73(1)).when it serves a financial business
• This duty takes effect on 10 July 2027 (Article 90), except for the obliged entities referred to in Article 3, points (3)(n) and (o), football agents and professional football clubs, for which it takes effect on 10 July 2029 (Article 90); Directive (EU) 2015/849 is repealed with effect from 10 July 2027 (Directive (EU) 2024/1640, Article 77), and references to its Articles 33 and 39 are read as references to Articles 69 and 73 of this Regulation (Article 89 and Annex VI).

Regulation (EU) 2024/1624, Arts. 76(1)-(4) and 77(3) · Read the law's page

• If you are an obliged entity, process special categories of personal data referred to in Article 9(1) of Regulation (EU) 2016/679, and personal data relating to criminal convictions and offences referred to in Article 10 of that Regulation, only to the extent that it is strictly necessary for the purposes of preventing money laundering and terrorist financing, and subject to the safeguards of Article 76(2) and (3) (Article 76(1)).when it serves a financial business
• Inform your customers or prospective customers that special categories of data may be processed for the purpose of complying with the requirements of this Regulation (Article 76(2), point (a)).when it serves a financial business
• Process personal data covered by Article 9 of Regulation (EU) 2016/679 only if the data originate from reliable sources and are accurate and up-to-date (Article 76(2), point (b)).when it serves a financial business
• Do not take decisions that would lead to biased and discriminatory outcomes on the basis of personal data covered by Article 9 of Regulation (EU) 2016/679 (Article 76(2), point (c)).when it serves a financial business
• Adopt measures of a high level of security in accordance with Article 32 of Regulation (EU) 2016/679, in particular in terms of confidentiality, for personal data covered by Article 9 of that Regulation (Article 76(2), point (d)).when it serves a financial business
• Process personal data covered by Article 10 of Regulation (EU) 2016/679 only if you comply with the conditions of Article 76(2), the data relate to money laundering, its predicate offences or terrorist financing, and you have procedures in place that allow the distinction, in the processing of such data, between allegations, investigations, proceedings and convictions, taking into account the fundamental right to a fair trial, the right of defence and the presumption of innocence (Article 76(3)).when it serves a financial business
• Process personal data on the basis of this Regulation only for the purposes of the prevention of money laundering and terrorist financing, and do not further process it in a way that is incompatible with those purposes (Article 76(4)).when it serves a financial business
• Do not process personal data on the basis of this Regulation for commercial purposes (Article 76(4)).when it serves a financial business
• Delete personal data upon expiry of the five-year retention period of Article 77(3), without prejudice to retention periods for data collected for the purposes of other Union legal acts or national law complying with Regulation (EU) 2016/679 (Article 77(3)).when it serves a financial business
• This duty takes effect on 10 July 2027 (Article 90), except for the obliged entities referred to in Article 3, points (3)(n) and (o), football agents and professional football clubs, for which it takes effect on 10 July 2029 (Article 90).

Regulation (EU) No 910/2014, Article 5f(2) · Read the law's page

• This duty reaches you if you provide services as a private relying party other than a microenterprise or small enterprise, and Union or national law, or a contractual obligation, requires you to use strong user authentication for online identification, in any area (Art. 5f(2) names transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications as examples and the list is open); it applies no later than 24 December 2027, 36 months after the implementing acts under Article 5a(23) and Article 5c(6) entered into force on 24 December 2024.
• Accept European Digital Identity Wallets that are provided in accordance with the Regulation, only upon the voluntary request of the user (Art. 5f(2)).