EU Supervisory Authorities highlight cyber resilience, crypto risks and regulatory simplification in 2025 annual report. The report has indirect relevance for retail trading and CFD markets through its focus on consumer protection, crypto-asset risks and PRIIPs rules.
Singapore Summit: Meet the largest APAC brokers you know (and those you still don't!).
It does not introduce new CFD or leveraged trading measures, but continues emphasis on disclosure standards, fraud prevention and supervisory convergence across EU retail markets.
EU Supervisors Expand Cyber and DORA
The Joint Committee of the European Supervisory Authorities said it maintained a central coordinating role in 2025 with the European Commission and the European Systemic Risk Board. Chaired by EIOPA, it focused on EU-wide supervisory coordination.
- FCA and 16 Regulators Coordinate Action Against Finfluencers as 1,267 Illegal Ads Reach 2.3M UK Users
- Exclusive: ACCM Posts $2.1 Trillion Q1 Volume as Gold Drives 91% of CFD Activity
- Robinhood Gets Singapore IPA as Capital.com Progresses for MAS Licence
The report covered consumer protection, financial stability and supervisory cooperation. It said 2025 was shaped by geopolitical uncertainty, faster digitalisation and financial innovation. The ESAs said they aimed to keep “regulatory frameworks robust, proportionate, and forward-looking”.
A key focus was the Digital Operational Resilience Act. The ESAs said they delivered all required legal instruments and issued guidance ahead of the 17 January 2025 application date. They also designated 19 critical third-party ICT providers between April and November 2025, with the European Banking Authority acting as lead overseer.
EU Supervisors Launch CITE and Review
New cyber coordination tools were introduced, including the Cyber Incident Information Sharing and Threat Intelligence Exchange . The ESAs said these measures “constitute a comprehensive and coordinated effort to bolster the EU’s resilience to ICT-related risks”.
The Digital Operational Resilience Act (DORA) requires verification for everything running in your infrastructure. Here's how supported open source and reliable security maintenance help you meet this requirement.
— Canonical (@Canonical) January 28, 2026
Learn more: https://t.co/62Fbv7YEtf#DORA #Compliance pic.twitter.com/c6GXXZ00VG
On regulation , the committee supported EU efforts to simplify financial rules, including PRIIPs Key Information Document work and SFDR reporting adjustments, including deprioritising one annual report. It said simplification must not weaken financial stability or consumer protection.
ESAs Highlight Risks Across Financial System
In its risk assessment, the ESAs said geopolitical tensions, trade restrictions and global conflicts increased uncertainty and market volatility. They warned institutions should remain vigilant, saying “strengthening risk management practices, enhancing resilience to cyber threats, and ensuring preparedness for market shocks are essential”.
The report also flagged risks from cyber threats, ICT third-party concentration, digital assets and non-bank finance. Crypto risks were highlighted, with warnings on limited legal protection depending on asset type.
Consumer protection remained a priority. The ESAs updated PRIIPs guidance and reported 12 administrative sanctions across Belgium, Denmark, Hungary and Poland. They also issued warnings on crypto fraud and AI-driven scams.
Other initiatives included ESAP development, AMLA cooperation, BigTech monitoring, securitisation review and a supervisory data exchange system. The ESAs said geopolitical risks, cyber threats and structural market shifts remain key financial stability concerns.