EU Regulators Advance Third-Party ICT Oversight Under DORA and Reiterate Crypto Warnings

Friday, 24/04/2026 | 13:41 GMT by Tareq Sikder
  • ESAs designate 19 ICT providers and expand cyber coordination tools under the framework in 2025.
  • Supervisors continue work on PRIIPs updates, ESG stress testing and SFDR changes in the EU.
Europe

EU Supervisory Authorities highlight cyber resilience, crypto risks and regulatory simplification in 2025 annual report. The report has indirect relevance for retail trading and CFD markets through its focus on consumer protection, crypto-asset risks and PRIIPs rules.

Singapore Summit: Meet the largest APAC brokers you know (and those you still don't!).

It does not introduce new CFD or leveraged trading measures, but continues emphasis on disclosure standards, fraud prevention and supervisory convergence across EU retail markets.

EU Supervisors Expand Cyber and DORA

The Joint Committee of the European Supervisory Authorities said it maintained a central coordinating role in 2025 with the European Commission and the European Systemic Risk Board. Chaired by EIOPA, it focused on EU-wide supervisory coordination.

The report covered consumer protection, financial stability and supervisory cooperation. It said 2025 was shaped by geopolitical uncertainty, faster digitalisation and financial innovation. The ESAs said they aimed to keep “regulatory frameworks robust, proportionate, and forward-looking”.

A key focus was the Digital Operational Resilience Act. The ESAs said they delivered all required legal instruments and issued guidance ahead of the 17 January 2025 application date. They also designated 19 critical third-party ICT providers between April and November 2025, with the European Banking Authority acting as lead overseer.

EU Supervisors Launch CITE and Review

New cyber coordination tools were introduced, including the Cyber Incident Information Sharing and Threat Intelligence Exchange . The ESAs said these measures “constitute a comprehensive and coordinated effort to bolster the EU’s resilience to ICT-related risks”.

On regulation , the committee supported EU efforts to simplify financial rules, including PRIIPs Key Information Document work and SFDR reporting adjustments, including deprioritising one annual report. It said simplification must not weaken financial stability or consumer protection.

ESAs Highlight Risks Across Financial System

In its risk assessment, the ESAs said geopolitical tensions, trade restrictions and global conflicts increased uncertainty and market volatility. They warned institutions should remain vigilant, saying “strengthening risk management practices, enhancing resilience to cyber threats, and ensuring preparedness for market shocks are essential”.

The report also flagged risks from cyber threats, ICT third-party concentration, digital assets and non-bank finance. Crypto risks were highlighted, with warnings on limited legal protection depending on asset type.

Consumer protection remained a priority. The ESAs updated PRIIPs guidance and reported 12 administrative sanctions across Belgium, Denmark, Hungary and Poland. They also issued warnings on crypto fraud and AI-driven scams.

Other initiatives included ESAP development, AMLA cooperation, BigTech monitoring, securitisation review and a supervisory data exchange system. The ESAs said geopolitical risks, cyber threats and structural market shifts remain key financial stability concerns.

EU Supervisory Authorities highlight cyber resilience, crypto risks and regulatory simplification in 2025 annual report. The report has indirect relevance for retail trading and CFD markets through its focus on consumer protection, crypto-asset risks and PRIIPs rules.

Singapore Summit: Meet the largest APAC brokers you know (and those you still don't!).

It does not introduce new CFD or leveraged trading measures, but continues emphasis on disclosure standards, fraud prevention and supervisory convergence across EU retail markets.

EU Supervisors Expand Cyber and DORA

The Joint Committee of the European Supervisory Authorities said it maintained a central coordinating role in 2025 with the European Commission and the European Systemic Risk Board. Chaired by EIOPA, it focused on EU-wide supervisory coordination.

The report covered consumer protection, financial stability and supervisory cooperation. It said 2025 was shaped by geopolitical uncertainty, faster digitalisation and financial innovation. The ESAs said they aimed to keep “regulatory frameworks robust, proportionate, and forward-looking”.

A key focus was the Digital Operational Resilience Act. The ESAs said they delivered all required legal instruments and issued guidance ahead of the 17 January 2025 application date. They also designated 19 critical third-party ICT providers between April and November 2025, with the European Banking Authority acting as lead overseer.

EU Supervisors Launch CITE and Review

New cyber coordination tools were introduced, including the Cyber Incident Information Sharing and Threat Intelligence Exchange . The ESAs said these measures “constitute a comprehensive and coordinated effort to bolster the EU’s resilience to ICT-related risks”.

On regulation , the committee supported EU efforts to simplify financial rules, including PRIIPs Key Information Document work and SFDR reporting adjustments, including deprioritising one annual report. It said simplification must not weaken financial stability or consumer protection.

ESAs Highlight Risks Across Financial System

In its risk assessment, the ESAs said geopolitical tensions, trade restrictions and global conflicts increased uncertainty and market volatility. They warned institutions should remain vigilant, saying “strengthening risk management practices, enhancing resilience to cyber threats, and ensuring preparedness for market shocks are essential”.

The report also flagged risks from cyber threats, ICT third-party concentration, digital assets and non-bank finance. Crypto risks were highlighted, with warnings on limited legal protection depending on asset type.

Consumer protection remained a priority. The ESAs updated PRIIPs guidance and reported 12 administrative sanctions across Belgium, Denmark, Hungary and Poland. They also issued warnings on crypto fraud and AI-driven scams.

Other initiatives included ESAP development, AMLA cooperation, BigTech monitoring, securitisation review and a supervisory data exchange system. The ESAs said geopolitical risks, cyber threats and structural market shifts remain key financial stability concerns.

About the Author: Tareq Sikder
Tareq Sikder
  • 2265 Articles
  • 41 Followers
About the Author: Tareq Sikder
Tareq is a financial writer with 15 years of experience covering global markets. His work spans technical analysis, forex broker reviews, and market sentiment, with a focus on topics relevant to retail traders. He joined Finance Magnates in 2023. At Finance Magnates, he serves as News Editor, covering retail forex and CFD brokers, cryptocurrency exchanges, fintech firms, and regulatory developments shaping the trading industry. He holds an Honours degree in Information Technology from Anfell College, London. Education: Honours degree Information Technology, Anfell College, London
  • 2265 Articles
  • 41 Followers

More from the Author

CryptoCurrency

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|} !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}