Blog

DORA aims to minimize risks from digital transformation, but implementing its complex requirements remains a hurdle for many financial enitites. Further interpretation guidance and practical tools are urgently needed.

The current draft of the lacking regulatory technical standards (RTS) for DORA still contains some ambiguities, particularly regarding the classification of financial entities as ICT third-party service providers. EIOPA has now issued interpretation notes to reduce these ambiguities. There has also been movement on the subject of RTS for subcontracting. An overview.

Token sales are usually massively digitally advertised and often in creative ways. However, marketing communications for public offerings of crypto assets are now very strictly regulated under MiCAR. What do providers need to consider in this regard?

Artificial intelligence (AI) is penetrating more and more areas of life and the economy. AI-as-a-Service (AIaaS) as a cloud-based service is subject to its own legal peculiarities, not least due to the European AI Act. An overview:

Die DORA gilt seit dem 17. Januar 2025 und schon bis zum 11. April 2025 müssen Finanzunternehmen ihre Informationsregister gemäß DORA-Vorgaben bei der BaFin einreichen. Finanzunternehmen sollten sich frühzeitig vorbereiten und sicherstellen, dass die Register formgerecht eingereicht werden.

How are wrapped tokens and token bridges regulated under MiCAR? What obligations apply to providers and issuers and are there possibilities to realize a token bridge outside the scope of MiCAR?

How are wrapped tokens and token bridges regulated under MiCAR? What obligations apply to providers and issuers and are there possibilities to realize a token bridge outside the scope of MiCAR?

From January 2025, DORA will introduce uniform requirements for ICT security, but exceptions for smaller financial institutions will provide a degree of relief. Nevertheless, differences between EU member states will remain due to national implementation leeway.

Tied agents can currently provide regulated crypto-asset services in Germany under the liability umbrella of a supervised institution without requiring an own license. However, MiCAR no longer provides for this concept. How can liability umbrellas and tied agents respond to this?

The German government has broken up. But what does this mean for the long-delayed adoption of the accompanying legislation for the MiCAR transition and which legal framework will the German crypto industry operate within as of 30 December 2024?

DORA places new demands on the digital resilience of financial companies, while the distinction between financial and ICT services raises questions in detail. Clear principles for interpreting the regulations are urgently needed to create legal certainty for the industry.

Crypto service providers from non-European countries such as the USA, Switzerland and the UK are also interested in doing business on the old continent under MiCAR. However, ESMA is making it more difficult for such companies to enter the market with its recommendations to the relevant national supervisory authorities.