Payments & E-Money regulatory updates from European Union.
We track 20 Payments & E-Money updates from European Union regulators, published by ECB, ESMA and EBA. The archive covers 8 speeches, 5 guidance notes and 2 policy statements. Most recent update: October 2026. Coverage runs from 2025 to 2026.
New Q&As available 16 October 2026 CCP Digital Finance and Innovation The European Securities and Markets Authority (ESMA), the EU's securities markets regulator, has published the following question and answer: Crypto-Asset Service Provider (CASP) Use by CASPs of payment accounts provided by non-bank payment service…
AI Analysis
ESMA published five Q&As on 16 October 2026 covering MiCA client-funds safeguarding, ECSPR fee-based crowdfunding models and EMIR 3’s active account requirement (AAR). The update is principally interpretive, but it materially affects CASP safeguarding structures, crowdfunding platforms marketed as “investment clubs” and counterparties calculating the EUR 6 billion and 85% AAR tests.
Key dates
2026-10-16
ESMA published Q&As 2949, 2950, 2936, 2937 and 2938.
2025-06-25
The EMIR 3 active account regime began applying to counterparties already within scope after the six-month implementation period.
Suggested considerations
CASPs should consider mapping each client-funds flow against MiCA Article 70(2) and (3), documenting the end-of-next-business-day transfer control and verifying that any intermediary-held credit-institution account is specifically held for the CASP and technically segregated.
CASPs and their payment-service-provider partners may wish to review contractual terms, account mandates, insolvency protections, reconciliation processes and evidence demonstrating clients’ ownership rights and prohibition of proprietary use.
Crowdfunding providers using registration, membership or access fees should consider documenting why their model does or does not constitute a crowdfunding service under Regulation (EU) 2020/1503 and reviewing website disclosures, fee descriptions, client communications and investor-protection controls.
AAR counterparties should recalculate the 12-month aggregate month-end average gross notional position, including the applicable group perimeter and excluding client-clearing activity, against the EUR 6 billion and EUR 100 billion thresholds.
AAR counterparties relying on the 85% exemption should consider testing the one-half rule across the relevant derivative classes, retaining the underlying EU-CCP clearing data and avoiding any assumption that the exemption removes the representativeness requirement.
Affected counterparties should review trade-level residual-maturity data, bucket allocation, annual-average trade counts and reporting calendars so that representative clearing can be demonstrated at the applicable reporting date.
Compliance teams may wish to update policies, procedures, management information and regulatory inventories to distinguish ESMA Q&A interpretive expectations from directly binding Level 1 and Level 2 requirements.
What changed
For CASPs, ESMA clarifies that client funds may be temporarily held in an account with a non-bank payment service provider, such as a payment institution or electronic money institution, provided the funds are transferred to an account with a credit institution or central bank no later than the end of the business day following receipt.
Compliance impact
The publication does not create a new standalone authorisation or reporting regime, but it narrows interpretive uncertainty in areas where deficient controls could expose firms to MiCA safeguarding, ECSPR conduct or EMIR supervisory findings. The most consequential points are the restriction of the 85% AAR exemption, the EUR 6 billion trigger for representativeness obligations and the requirement for CASPs to evidence legally and operationally effective segregation and safeguarding arrangements.
The European Banking Authority (EBA) has classified USDC, issued by Circle Internet Financial Europe SAS, as a significant e-money token (EMT) under the Markets in Crypto Assets Regulation (MiCA), following its assessment of the criteria set out in the Regulation. There are currently 45 EMTs in the European Union…
AI Analysis
The EBA has classified Circle Internet Financial Europe SAS’s USDC as the European Union’s first significant e-money token (EMT) under Regulation (EU) 2023/1114 (MiCA). From 2026-11-12, prudential supervision of USDC will be shared between the EBA and France’s ACPR, increasing supervisory scrutiny of own funds, reserves, liquidity, and recovery and redemption arrangements while ACPR retains responsibility for governance and other organisational matters.
Key dates
2026-10-14
The EBA announced that USDC issued by Circle Internet Financial Europe SAS had been classified as a significant EMT under MiCA.
2026-11-12 Deadline
Dual supervision of USDC begins: the EBA assumes direct responsibility for own funds, reserve of assets, liquidity requirements, and recovery and redemption plans, while the ACPR retains specified governance and organisational responsibilities.
Suggested considerations
Circle and its regulatory counsel should map existing own-funds, reserve-of-assets, liquidity, recovery, and redemption controls to the EBA’s supervisory expectations and establish clear evidence and reporting channels before 2026-11-12.
Circle should confirm the allocation of responsibilities between the EBA and ACPR, including supervisory contacts, escalation procedures, information requests, and documentation ownership for prudential and organisational matters.
Crypto-asset service providers should reassess their USDC due diligence, product governance, liquidity, redemption, custody, safeguarding, and operational-risk controls in light of the significant-EMT designation.
Firms using USDC should identify exposures in client assets, settlement, treasury, collateral, and payment flows and assess whether updated counterparty, liquidity, concentration, and business-continuity assessments are appropriate.
Compliance teams should monitor EBA and ACPR communications, supervisory-college activity, and any subsequent guidance or requests concerning significant EMT reporting and recovery or redemption planning.
Firms operating across the EU and United States should review information-sharing, incident-notification, and cross-border supervisory arrangements, noting the EBA’s memorandum of understanding with the New York State Department of Financial Services.
What changed
USDC will be subject to the MiCA framework for significant EMTs from 2026-11-12. The EBA will assume direct supervisory responsibility for own-funds requirements, the reserve of assets, liquidity requirements, and recovery and redemption plans; the ACPR will continue supervising governance, qualifying holdings, fit and proper assessments, outsourcing, and conflicts of interest. Under MiCA Articles 56 and 43(1), an EMT is classified as significant where at least three significance criteria are met during the applicable reporting periods.
Compliance impact
The immediate legal effect is concentrated on Circle as the issuer, but the designation is an important supervisory precedent for the 45 EMTs notified under MiCA and signals that large or systemically connected stablecoins may attract EU-level prudential oversight. Firms distributing or materially using USDC may face heightened scrutiny of liquidity, redemption, safeguarding, operational resilience, and counterparty-risk arrangements, although the publication does not introduce a new obligation for every USDC user.
The European Banking Authority (EBA) today published a report proposing draft amendments to the Regulatory Technical Standards (RTS) on certain prudential requirements for central securities depositories (CSDs) and designated credit institutions offering ‘banking-type ancillary services’. This mostly responds to…
AI Analysis
On 12 October 2026, the EBA submitted a Final Report containing draft amendments to the RTS on prudential requirements for CSDs and designated credit institutions providing banking-type ancillary services. The amendments principally operationalise the CSDR Refit permission for banking CSDs to provide cash, payment and foreign-exchange services to other CSDs, while addressing the resulting interconnectedness, supervisory notifications and updated CRR references; the draft is not itself yet a binding EU rule.
Key dates
2025-12-03
The EBA launched its consultation on the draft amendments to the CSD prudential RTS.
2026-03-03 Deadline
The EBA consultation closed.
2026-10-12
The EBA published the Final Report and submitted draft amendments to the European Commission.
Suggested considerations
Banking CSDs and designated credit institutions should map existing and planned cash, deposit, payment and foreign-exchange services against the CSDR Refit permissions and the draft RTS risk-management and notification framework.
CSDs should assess whether providing or receiving these services creates additional intraday credit, liquidity, settlement, counterparty or concentration exposures, including exposures arising through foreign-currency settlement and increased inter-CSD interconnectedness.
Compliance and regulatory-policy teams should compare current prudential policies, risk limits, management information, reporting and public-disclosure processes with the draft RTS once the EBA draft text has been reviewed in detail.
Firms should monitor the European Commission's endorsement, any amendments made during adoption, publication in the Official Journal and the eventual application date before treating the draft requirements as binding.
CSDs and designated credit institutions may wish to engage with their competent authorities early on the expected supervisory notifications, information flows and governance for arrangements involving participants of another CSD.
Regulatory inventories and internal legal references should be updated for the amended CSDR terminology and relevant CRR changes after the final delegated act is adopted.
What changed
The draft RTS update the prudential framework under Article 59(5) of Regulation (EU) No 909/2014 (CSDR) for monitoring, measuring, managing, reporting and publicly disclosing credit and liquidity risks, including intraday risks. They address arrangements under which a banking CSD provides banking-type ancillary services to another, or designating, CSD, including cash accounts, deposits and payment services involving cash and foreign-exchange transactions, with particular attention to the effect on the banking CSD's risk profile and to notifications required by supervisors.
Compliance impact
The immediate impact is medium because the publication is a draft RTS report rather than an immediately applicable obligation, but it signals a material prudential and supervisory focus for banking CSDs that serve other CSDs. The regulator is specifically seeking to prevent increased inter-CSD interconnectedness from raising systemic risk, with consequences for intraday liquidity and credit-risk controls, supervisory notifications, reporting and disclosure once the amendments enter into force.
ESMA sets out supervisory expectations on services related to unauthorised stablecoins 08 October 2026 Digital Finance and Innovation The European Securities and Markets Authority (ESMA), the EU regulator and supervisor, has published an opinion clarifying supervisory expectations of crypto-asset services involving…
AI Analysis
ESMA published an opinion on 8 October 2026 stating that MiCA-authorised crypto-asset service providers should cease providing EU clients with services relating to asset-referenced tokens and e-money tokens that do not comply with MiCA. The opinion signals a broad, supervisory-enforced wind-down: firms should prevent new or increased client exposure and remediate remaining exposures as soon as possible, and no later than 8 January 2027.
Key dates
2026-10-08
ESMA published its opinion on the provision of crypto-asset services in relation to non-MiCA-compliant asset-referenced tokens and e-money tokens.
2027-01-08 Deadline
Latest date by which National Competent Authorities should require remediation of remaining pre-existing exposures, calculated as three months after publication; firms may be required to act earlier.
Suggested considerations
Firms should inventory every ART and EMT made available to EU clients and classify whether each token satisfies the applicable MiCA requirements, including any relevant authorisation, notification, offer, and admission-to-trading conditions.
Compliance teams may wish to map each affected token across trading, exchange, execution, placing, order-routing, advice, transfer, custody, and portfolio-management workflows, including bundled or indirect services.
Firms should consider suspending onboarding, purchases, subscriptions, trading, swaps, staking-related access where relevant, and other activities that could allow EU clients to acquire or increase exposure to a non-MiCA-compliant token.
Technology and operations teams should assess geolocation, account, wallet, order-management, token-listing, transfer, and API controls, with testing and monitoring designed to prevent EU-client access or increased exposure.
Legal and product teams should review client terms, token-listing policies, disclosures, contractual restrictions, and arrangements with issuers, liquidity providers, exchanges, and other intermediaries.
Firms should identify pre-existing client exposures and prepare a documented wind-down or remediation plan capable of completion by 2027-01-08, subject to any earlier NCA requirement.
Firms may wish to define narrowly controlled exit-only services for liquidation, conversion, withdrawal, transfer, and safekeeping, with time limits, risk controls, client communications, records, and escalation to the relevant NCA.
Governance functions should document the interpretation of the ESMA opinion, approvals for affected product changes, control ownership, exceptions, surveillance, management information, and evidence available for supervisory review.
What changed
The opinion covers the full range of MiCA crypto-asset services, including operating trading platforms, exchanging crypto-assets for funds or other crypto-assets, executing orders, placing crypto-assets, reception and transmission of orders, investment advice, transfers, custody and administration, and portfolio management. ESMA expects National Competent Authorities to supervise so that CASPs do not maintain, introduce, or facilitate EU-client access to non-MiCA-compliant ARTs or EMTs.
Compliance impact
The impact is high for MiCA-authorised CASPs because the expectation applies across the service lifecycle and requires controls preventing both continued availability and increased client exposure, not only new issuance or admission to trading. Non-compliance may lead to supervisory intervention, mandated wind-down or remediation, restrictions on services, and heightened scrutiny of governance, systems, client communications, and outsourcing arrangements.
The European Banking Authority (EBA) published today its Work Programme outlining the key areas of focus and deliverables for 2027. The Programme also marks the first step towards a broader medium-term strategy to position the EBA as a next-generation regulator, a body developing supervision at new frontiers, and a…
Why this matters
This is an informational announcement of the EBA's annual work programme, not a binding rule or consultation. However, it carries strategic significance as it outlines the regulator's enforcement and supervisory focus areas for 2027, including completion of the 2024 banking package, DORA implementation, MiCA...
This is an interview with Sharon Donnery, ECB Supervisory Board member, discussing supervisory priorities and policy direction for 2025-27. The content covers multiple material areas: SREP structural reform and Pillar 2 guidance changes; geopolitical risk management expectations; asset quality monitoring (NPLs);...
The European Banking Authority (EBA) today published its response to the European Commission’s targeted consultation on the review of the Regulation on Markets in Crypto-assets (MiCA). While MiCA has established a comprehensive regulatory framework for crypto-asset activities in the European Union, the crypto sector…
Why this matters
This is a formal EBA response to the European Commission's targeted consultation on MiCA review, published 24 September 2026. It identifies concrete regulatory priorities including strengthening multi-issuer stablecoin schemes, clarifying crypto-asset classification scope, regulating crypto-asset lending and DeFi...
This is a substantive policy speech by a senior ECB official addressing digital innovation's impact on bank business models and financial stability. It signals supervisory priorities (data aggregation remediation, AI governance, cyber resilience, quantum-resistant cryptography, outsourcing dependencies) and describes...
As part of the European Banking Authority’s (EBA) ongoing efforts to simplify its regulatory framework, the Guidelines focus on third-party arrangements supporting critical or important functions (CIFs) namely the disruption of which would materially impair the performance of a financial entity. By concentrating on…
Why this matters
This is a final EBA guideline publication establishing mandatory requirements for third-party risk management across ICT and non-ICT services. It applies to critical or important functions and covers the full lifecycle of third-party arrangements.
ESMA publishes latest edition of its newsletter 31 July 2026 ESMA newsletter The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator and supervisor, has published today the latest edition of its Spotlight on Markets newsletter, covering key activities and publications from June and…
Why this matters
ESMA newsletter covering multiple regulatory updates including MiCA transitional period wind-down for crypto providers, T+1 settlement preparations, transaction reporting simplification, DORA ICT incident reporting, and consolidated tape provider authorizations.
Joint Board of Appeal dismisses appeal against the EBA 16 July 2026 Board of Appeal The Joint Board of Appeal of the European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) has issued a decision stating that an appeal brought by an individual against the European Banking Authority (EBA) is inadmissible. The…
AI Analysis
The Joint Board of Appeal of the ESAs has dismissed as inadmissible an individual’s appeal against the EBA’s decision not to open a breach‑of‑Union‑law investigation into the Finnish supervisory authority’s handling of a bank account closure. This confirms that EBA’s decision whether to initiate a Union law breach investigation is a discretionary act that is not reviewable by the Board of Appeal and, in practice, offers very limited avenues for customers or firms to challenge an EBA non‑investigation decision. For compliance teams, this reinforces that supervisory recourse routes for disputes over account closures and similar conduct are primarily at national level and in national courts, with EBA’s Article 17 “breach of Union law” mechanism remaining a high‑threshold, discretionary tool rather than a complaint or appeal channel.
Key dates
24 June 2013
– Earlier ESA Board of Appeal case law clarifies that appeals are reserved for “decisions” that produce binding legal effects and that the Board lacks jurisdiction over acts that are not such decisions, including certain complaints‑handling outcomes
21 July 2022
– In Decision BoA‑D‑2022‑01 (appeal “C” v EBA), the Board of Appeal holds that an appeal against EBA’s decision not to initiate an investigation into alleged non‑application of EU law in relation to payment accounts is inadmissible under Article 60(2) of Regulation (EU) No 1093/2010
16 July 2026
– The ESAs’ Joint Board of Appeal issues the present decision dismissing, as inadmissible, an individual’s appeal against EBA’s decision not to open an investigation into a possible breach of Union law by the Finnish FIN‑FSA in relation to a bank account closure
Suggested considerations
Review internal complaints‑handling and escalation procedures to ensure that disputes over account closures and related supervisory decisions are managed through national complaint bodies and courts, rather than assuming EBA or Board of Appeal review will be available.
Update legal and compliance guidance notes to reflect that EBA’s decision whether to initiate a breach‑of‑Union‑law investigation is discretionary and generally not subject to appeal before the Board of Appeal, limiting external escalation avenues.
Train front‑office, customer‑service and complaints staff to provide accurate information to customers about available redress routes, emphasising national ombudsman, national competent authority and judicial mechanisms rather than ESMA/EBA appeals.
For groups operating across the EU, map national complaint and judicial mechanisms for account closures in each jurisdiction and integrate them into group‑wide conduct risk frameworks and customer communication templates.
Monitor further ESA and EU court case law on which ESA acts are susceptible to appeal before the Board of Appeal, and adjust litigation and escalation strategies accordingly.
What changed
- The decision clarifies that EBA’s decision whether or not to initiate an investigation into a possible breach or non‑application of Union law under Article 17 of Regulation (EU) No 1093/2010 is a...
The Board of Appeal confirms that a decision not to open a Union law breach investigation does not constitute a reviewable “decision” for the purposes of Article 60(1)–(2) of the ESA Regulations and...
The Board of Appeal confirms that individual complaints about account closures and associated supervisory handling remain primarily within the remit of national competent authorities and national...
The decision reiterates that only certain categories of ESA acts that produce binding legal effects (for example, decisions adopted under Articles 17, 18 or 19 of the ESA Regulations, and acts within...
The outcome aligns with prior Board of Appeal and EU court case law confirming that persons outside the specific categories listed in Article 17(2) of the ESA Regulations have no right of appeal to...
Compliance impact
Non‑compliance with national rules on account closures and customer treatment can lead to supervisory sanctions, civil liability and reputational damage, and firms should not rely on ESA‑level appeals as a corrective mechanism. The inability to challenge EBA’s non‑investigation decisions heightens the importance of robust conduct, documentation and national‑level redress management.
The ESAs support ESRB warning on systemic cyber risks from frontier AI models 07 July 2026 Digital Finance and Innovation Joint Committee Press Releases The European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) welcome and support today’s warning from European Systemic Risk Board (ESRB) on the systemic…
Why this matters
ESAs issue joint warning on systemic cyber risks from frontier AI models threatening financial sector operational resilience. Applies across all financial entities under DORA framework.
Interview with ECB Supervisory Board member discussing banking supervision priorities including geopolitical risk stress testing, digital transformation, AI strategies, SREP reforms, capital requirements (P2R), operational resilience including cyber threats and third-party outsourcing, and Basel III implementation.
This is a fireside chat speech by ECB Executive Board member Frank Elderson discussing regulatory simplification, capital requirements, banking competitiveness, cyber resilience with frontier AI models, and the digital euro project.
This is an informational keynote speech by ECB Executive Board member Frank Elderson addressing operational resilience and AI-driven cyber threats in banking. While it contains supervisory guidance and expectations (including mention of forthcoming 'dear CEO letter'), it is primarily a speech outlining strategic...
This regulatory update from the ECB focuses on upgrading banks' capacity to deal with digital risks, including IT change management, third-party dependencies, and cybersecurity testing. It is relevant for banks and fintechs and covers key operational resilience and technology/cyber topics.
New Q&As available 27 February 2026 CCP Digital Finance and Innovation Financial reporting Issuer disclosure Transparency The European Securities and Markets Authority (ESMA), the EU's securities markets regulator, has published or updated the following Questions and Answers: European crowdfunding service providers…
AI Analysis
ESMA has published or updated multiple Q&As covering European crowdfunding, MiCA for crypto-asset service providers (CASPs), EMIR for central counterparties (CCPs), and Transparency Directive requirements on financial reporting and alternative performance measures (APMs). These updates provide clarifications on operational, reporting, and disclosure obligations, enhancing supervisory convergence and compliance certainty amid evolving EU regulations like MiCA and IFRS 18. Compliance professionals must prioritize these to avoid enforcement risks, particularly with upcoming effective dates in 2027.
Key dates
27 February 2026
- Publication date of new/updated Q&As on crowdfunding, MiCA, EMIR, and Transparency Directive
1 January 2027
- Effective date for new Q&A on IFRS 18 & APMs interaction (2775) and updates to APM-related Q&As (1868, 1874, 1875, 1877)
31 December 2027 Deadline
- Deadline for trading platform operators under MiCA to ensure compliant white papers for legacy tokens (related context from prior MiCA Q&As)
Suggested considerations
Review and update policies: CASPs must align withdrawal processes (Art. 75), overhead calculations, client fund interest handling, fiat payout mechanisms, offer/placing distinctions, and trading platform compliance with Title II.
Crowdfunding firms: Assess and document use of nominee structures per Q&A 2601.
CCPs/counterparties: Implement AAR reporting for thresholds, representativeness (with subcategory identification and trade reporting examples), and stress testing; reference ESMA's supervisory briefing for compliance models.
Issuers/reporters: Revise APM disclosures for IFRS 18 compatibility, ensuring prominence, clear definitions, and consistent presentation inside/outside statements effective 1 January 2027.
General: Integrate Q&As into compliance training, internal audits, and NCA reporting; monitor ESMA's Questions and Answers section for full texts.
What changed
- Crowdfunding: New Q&A (2601) on use of fiduciary (nominee) structures in equity crowdfunding, clarifying permissible structures for service providers.
MiCA (CASPs): Updates include clarification on withdrawal requirements under Article 75 (2320); fixed overheads calculation (2349); interests from client funds at credit institutions (2486); fiat...
EMIR (CCPs): New Q&As on AAR threshold calculation (2418, 2779), AAR representativeness obligation (2776, 2777), and AAR stress testing (2778), building on ESMA's supervisory briefing for...
Transparency Directive: New Q&A (2775, effective 1 January 2027) on IFRS 18 and APMs interaction; updated Q&As (effective 1 January 2027) on measures in/outside financial statements (1868), interim...
Compliance impact
Urgency: High - These Q&As address supervisory priorities in high-risk areas like crypto (MiCA) and CCP resilience (EMIR), with imminent 2027 deadlines for reporting changes aligning to IFRS 18. Non-compliance risks fines, authorization delays, or supervisory actions, especially as ESMA emphasizes convergence (e.g., AAR briefing). Firms in crypto/digital assets face heightened scrutiny amid MiCA rollout, while reporters must adapt quickly to avoid disclosure breaches.
ESMA consults on guarantees as CCP collateral and on certain aspects of CCP investment policy 23 February 2026 CCP The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator and supervisor, has launched a public consultation following the review of the European Market Infrastructure…
AI Analysis
ESMA has launched a public consultation under EMIR 3 to gather stakeholder input on conditions for CCPs accepting public guarantees, public bank guarantees, and commercial bank guarantees as collateral, eligibility of debt instruments for CCP investment policies, and secured arrangements for emission allowances as margins or default fund contributions. This matters because it permanently broadens eligible collateral types and extends access to NFC clients, enhancing EU CCP efficiency, competitiveness, and accessibility amid liquidity pressures in energy and other markets.
Key dates
End of 2026
- ESMA to submit final draft technical standards to the European Commission following final report preparation
30 April 2026 Deadline
- Consultation response deadline; submit online via ESMA portal, addressing specific questions with rationale
Suggested considerations
Review and Respond to Consultation: CCPs, clearing members, NFCs, and clients should analyze the paper, prepare responses to Annex 1 questions by 30 April 2026, and submit online; indicate confidentiality if needed.
Assess Internal Policies: CCPs must evaluate current collateral, investment, and emission allowance frameworks against proposed conditions; clearing members/NFCs should model impacts on liquidity and margin posting.
Monitor Developments: Track ESMA's final report and RTS submission; prepare for potential supervisory expectations on guarantee acceptance and debt instrument eligibility post-2026.
Engage with Industry: Join associations like EACH for coordinated feedback on risk-based approaches and proportionality.
What changed
- Permanent expansion of eligible CCP collateral to include public guarantees, public bank guarantees, and commercial bank guarantees, with specified conditions for acceptance.
Criteria for deeming debt instruments as eligible financial instruments under CCP investment policies.
Requirements for highly secured arrangements to deposit emission allowances as margins or default fund contributions. These build on EMIR 3's measures to broaden collateral scope and entity coverage,...
Compliance impact
Urgency: High - Firms face a tight 2-month window (from 23 February 2026) to influence final RTS, with implementation likely in 2027+ affecting core clearing operations; delays risk non-compliance with broadened collateral rules amid ongoing liquidity strains, especially for NFCs in volatile markets like energy.
This speech covers the ECB's approach to digital transformation and innovation in the banking sector, with a focus on the opportunities and risks of technologies like AI and tokenization.
This regulatory update is relevant for banks, fintechs, and crypto exchanges as it provides guidance on implementing the TIBER-EU framework for digital operational resilience, which is a key requirement under the DORA regulation.