The ESAs today published their first annual overview of major ICT-related incidents in the EU financial sector based on a reporting mechanism established by the Digital Operational Resilience Act (DORA). It shows that ICT risks are increasingly borderless and interconnected.
The European Supervisory Authorities (EBA, EIOPA, and ESMA) published their first annual overview of major ICT-related incidents in the EU financial sector. This report is based on a reporting mechanism established by the Digital Operational Resilience Act (DORA). It highlights that ICT risks are increasingly borderless and interconnected.
Cyber Briefs are monthly executive reports. They aim to present an overview of the most relevant developments in cyber security. These reports are based exclusively on open sources. Their purpose is to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
Cyber Briefs are monthly executive reports providing an overview of relevant cybersecurity developments. They are based exclusively on open sources, aiming to inform political leadership and senior management within their constituency. This ensures broad accessibility and transparency in reporting. Additional information on any item discussed in these Briefs can be provided upon request.
The Malta Financial Services Authority (MFSA) has launched a public consultation on the tokenisation of financial instruments and real-world assets. This marks a significant step in exploring how distributed ledger technology (DLT) could integrate within Malta’s financial services framework. Tokenisation refers to the digital representation of ownership rights in financial instruments or real-world assets using DLT.
Cyber Briefs are monthly executive reports. They aim to present an overview of the most relevant developments in cyber security. These reports are based exclusively on open sources. Their purpose is to inform political leadership and senior management within their constituency. Additional information on any item in this Brief can be provided upon request. All Cyber Briefs are designated as TLP:CLEAR.
The European Banking Federation (EBF) issued its Key Messages on the EBA Consultation on Systemic Risk Buffer concerning climate risk. This response, dated 30 April 2026, from Brussels, addresses the EBA's consultation. The EBF's stance is a formal reply to the proposed framework for managing climate-related systemic risks within the banking sector, highlighting their initial observations and recommendations on the matter.
The European Banking Authority (EBA) today published its final Guidelines on Supervisory Independence under the Capital Requirements Directive (CRD). These Guidelines clarify arrangements for competent authorities to prevent and manage conflicts of interest. This involves both their staff and members of their governance bodies.
The ESAs today published its Annual Report for 2025, setting out the main priorities and achievements of its cross-sectoral work over the past year. In 2025, the Joint Committee focused on protecting consumers in increasingly digital financial markets, strengthening operational resilience.
The Joint Committee of European Supervisory Authorities (EBA, EIOPA, ESMA) published its 2025 Annual Report. It details main priorities and achievements from its cross-sectoral work. The report highlights digitalisation, cyber resilience, and sustainable finance as key priorities for the year. In 2025, the Committee focused on consumer protection in digital financial markets.
The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator and supervisor, launched a call for evidence today. This initiative aims to gather stakeholder views on restricted subscription and private credit ratings. ESMA seeks insights into their purposes, market practices, needs, and associated risks. ESMA encourages all interested stakeholders to share their views, data, and analysis.
CERT-EU Cyber Threat Landscape Report for 2025 - Year Review
Cyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
Brussels, 9 March 2026 – In November 2025, the European Commission announced the Sustainable Transport Investment Plan (STIP). This roadmap, under the EU Clean Industrial Deal, aims to mobilise funding for decarbonizing aviation and waterborne transport sectors. The aviation sector significantly contributes to the EU economy, adding over €110 billion to GDP and employing 281,000 people.
Cyber Briefs are monthly executive reports providing an overview of relevant cyber security developments. They are based exclusively on open sources, aiming to inform political leadership and senior management within their constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
The European Banking Federation (EBF) has submitted its response to the European Commission’s consultation regarding the forthcoming European Climate Resilience Framework. This submission is part of an open public consultation process. The EBF's input aims to shape the new framework effectively. The consultation took place in Brussels on March 2, 2026.
The European Banking Authority (EBA) today published the follow-up to its 2022 peer review report on ICT risk assessment under the supervisory review and evaluation process (SREP). The follow-up Report shows that competent authorities have made notable progress in strengthening ICT risk assessment, driven largely by the implementation of the Digital Operational Resilience Act.
The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator and supervisor, has launched a consultation. It proposes amendments to its Market Abuse Regulation (MAR) guidelines. These concern the delay in the disclosure of inside information. The proposals align the guidelines with the disclosure regime, as amended by the Listing Act. This ensures issuers face fewer administrative burdens.
EIOPA published today its Opinion on the European Financial Reporting Advisory Group’s technical advice concerning the draft revised European Sustainability Reporting Standards (ESRS), following a request from the European Commission.
Cyber Threat Intelligence Framework
The European Banking Federation (EBF) welcomes the supervisory intent to streamline and support risk-based supervision. While draft revisions are a positive step, members believe more focus is needed on risk, not processes. This aligns with international trends, ensuring banks deploy resources effectively for stability and resilience. Despite the EU's focus on simplification, the Guidelines lack sufficient progress.
Cyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
The European Supervisory Authorities (ESAs) and UK financial regulators, including the Bank of England, PRA, and FCA, have signed a Memorandum of Understanding (MoU). This agreement strengthens cooperation between these authorities. Its purpose is to oversee critical ICT third-party service providers (CTPPs), as mandated by the Digital Operational Resilience Act (DORA).
Cyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security. They are based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator and supervisor, has today published the latest edition of its Spotlight on Markets newsletter.
The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator and supervisor, in cooperation with National Competent Authorities (NCAs), completed an analysis of the cross-border provision of investment services in 2024. Data was gathered from investment firms across 30 jurisdictions in the EU/EEA. The main findings include: Around 370 financial firms provided cross-border services to retail clients. Approximately 10.
The European Banking Authority (EBA) has updated its confidential Report on equivalence monitoring activities. It submitted this report to the European Parliament, the Council, the European Commission, and other European Supervisory Authorities (ESAs). To enhance transparency, the EBA also published a public summary.
The ESAs today published two factsheets designed to help consumers protect themselves from crypto and other online frauds and scams and explain how fraudsters increasingly use artificial intelligence (AI) to deceive consumers.
Brussels, 4 December 2025 – The European Banking Federation (EBF) notes the publication of the Market Integration and Supervision Package. This marks a decisive step toward delivering the objectives of the Savings and Investments Union Strategy (SIU). The EBF has long advocated for deep, competitive, and well-integrated capital markets in the EU.
Cyber Briefs are monthly executive reports. They aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources. Their purpose is to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator and supervisor, will launch a Common Supervisory Action (CSA). This CSA will be conducted with National Competent Authorities (NCAs) to address conflicts of interest in the distribution of financial instruments.
The European Banking Federation (EBF) submitted its response to the European Commission’s consultation. This consultation aims to increase lending for energy renovations in buildings. The EBF welcomes the initiative to develop a voluntary and non-binding portfolio framework to boost this lending. However, it is crucial to also address existing demand and supply-side issues that currently exist within the European Union.
The European Supervisory Authorities (EBA, EIOPA, and ESMA – the ESAs) publish today the list of designated critical ICT third-party providers (CTPPs) under the Digital Operational Resilience Act (DORA). This designation marks a crucial step in the implementation of the DORA oversight framework. The list of the CTPP designated by the ESAs is accessible through this link. The designation process followed the methodology mandated by DORA.
The European Supervisory Authorities (EBA, EIOPA, and ESMA – the ESAs) publish today the list of designated critical ICT third-party providers (CTPPs) under the Digital Operational Resilience Act (DORA). This designation marks a crucial step in the implementation of the DORA oversight framework. The list of the CTPP designated by the ESAs is accessible through this link. The designation process followed the methodology mandated by DORA.
The ESAs published today the list of designated critical ICT third-party providers (CTPPs) under the Digital Operational Resilience Act (DORA). This designation marks a crucial step in the implementation of the DORA oversight framework.
The European Securities and Markets Authority (ESMA) published a peer review today. This review assessed the supervision of depositaries, focusing on their oversight and safekeeping obligations. ESMA, the EU’s financial markets regulator, aims to enhance depositary supervision. The peer review concluded that foundational frameworks for depositary supervision exist. However, significant differences were noted across jurisdictions.
EIOPA has been made aware of recent fraudulent activities in which scammers falsely claiming to represent our institution are requesting payments or personal information from individuals.
The Joint Committee of the European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) today presented its 2026 Work Programme. This programme outlines key areas of collaboration for the coming year. It aims to strengthen the financial system’s digital operational resilience and ensure consumer protection. Furthermore, it seeks to identify risks that could undermine financial stability.
The Joint Committee of the European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) today presented its 2026 Work Programme, outlining key areas of collaboration for the coming year. The upcoming Programme aims to strengthen the financial system’s digital operational resilience, ensure the continued protection of consumers, and identify risks that could undermine financial stability.
The European Banking Authority (EBA) today published its annual Report on convergence of supervisory practices for 2024 across the European Union (EU). The Report details the EBA’s extensive efforts to strengthen the alignment of supervisory approaches across Member States.
The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator and supervisor, is announcing its first Data Day on 2 December 2025. This flagship event will showcase how smarter data use and digitalisation can simplify the regulatory framework and reduce reporting burdens. The event aims to achieve this while steering clear of deregulation.
Cyber Briefs are monthly executive reports providing an overview of relevant cybersecurity developments. They are based exclusively on open sources, aiming to inform political leadership and senior management within their constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
Cyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
Cyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources. This is with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
CSSF reminds of ICT incident reporting, emphasizing that publicity does not exempt supervised entities from reporting.
ESAs publish a guide on DORA Oversight activities 15 July 2025 Digital Finance and Innovation Joint Committee The European Supervisory Authorities (EBA, EIOPA, ESMA – the ESAs) today published a guide on oversight activities under the Digital Operational Resilience Act (DORA).
Knowledge and competence of staff providing information on crypto-assets – ESMA criteria published. 11 July 2025. Digital Finance and Innovation. Guidelines and Technical standards. The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator and supervisor, has published today the guidelines specifying the criteria for assessing the knowledge and competence of staff at crypto-asset service providers (CASPs).
ESMA identifies opportunities to strengthen MiCA authorisations. 10 July 2025 Digital Finance and Innovation Supervisory convergence The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator and supervisor, published today the results of a peer review looking at the authorisation of Crypto Asset Service Providers (CASPs) in Malta under the Market in Crypto Assets Regulation (MICA).
The European Banking Authority (EBA) today launched a public consultation on the draft Guidelines on the sound management of third-party risk. The draft Guidelines focus on third-party arrangements in relation to non-ICT related services provided by third-party service providers and their subcontractors with a particular focus on the provision of critical or important functions.
New Q&As available 27 June 2025 Digital Finance and Innovation Fund Management Prospectus The European Securities and Markets Authority (ESMA), the EU's securities markets regulator, has published or updated the following Questions and Answers: Prospectus Regulation Historical financial information (2454) Markets in Crypto-Assets Regulation (MiCA) Custody agreements in the exercise of rights attached to crypto-assets (2290) Commingling...
The integration of generative AI into cybersecurity operations represents both unprecedented opportunity and emerging risk. While these technologies offer powerful capabilities for threat analysis, incident response, and security automation, they simultaneously introduce new attack vectors that adversaries are rapidly exploiting.
The Regulatory Technical Standards (RTS) on ICT Subcontracting have been published in the EU Official Journal and will enter into force on 22 July 2025. Financial entities and ICT providers must ensure compliance.
Cyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
Cyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions
on reporting of major ICT-related incidents and significant cyber threats under the Digital Operational Resilience Act (DORA)
Application of the Joint ESA Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554 (JC 2024 34).
Cyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
on requirements on the use of ICT third-party services for Financial Entities subject to the Digital Operational Resilience Act (DORA)
Circular CSSF 25/881 amends Circular CSSF 20/750, which outlines requirements for information and communication technology (ICT) and robust security risk management practices.
on relationship management of payment service users and PSP ICT assessment
Requirements regarding information and communication technology (ICT) and security risk management
Cyber Briefs are monthly executive reports designed to provide an overview of the most relevant developments in cybersecurity. These reports are compiled exclusively from open sources, aiming to inform political leadership and senior management within their respective constituencies. Further details on any topic covered in these Briefs are available upon request. All Cyber Briefs are classified as TLP:CLEAR.
This regulation establishes the detailed technical standards that financial entities must follow when reporting significant ICT-related incidents and notifying major cyber threats. It specifies the standard forms, templates, and procedures required under EU Regulation 2022/2554.
This regulation supplements Regulation (EU) 2022/2554, introducing regulatory technical standards. These standards specify the required content and time limits for the initial notification, as well as intermediate and final reports, concerning major ICT-related incidents. Furthermore, the regulation defines the content for voluntary notifications of significant cyber threats.
Cyber Briefs are monthly executive reports providing an overview of the most relevant cybersecurity developments. Based exclusively on open sources, they aim to inform political leadership and senior management. Additional information on any item within these Briefs is available upon request. All Cyber Briefs are TLP:CLEAR.
