European Banking Authority (EBA) summary of voting results from September–October 2025 on final draft Regulatory Technical Standards (RTS) for CVA risk in securities financing transactions and opinions on liquidity requirements and highly liquid financial instruments under the Markets in Crypto-Assets Regulation (MiCA).
European Banking Authority (EBA) Chairperson Jose Manuel Campa’s November 2025 public meeting register – details stakeholder engagements on regulatory outlook, consumer protection, financial stability, and geopolitical impacts on banking and financial services policy.
European Banking Authority publishes the official list of critical ICT third-party service providers designated under the Digital Operational Resilience Act (DORA), including major cloud, data, and technology firms supporting financial institutions.
EBA Chair José Manuel Campa addresses the ECON hearing in November 2025, highlighting EU banking sector resilience with improved capital ratios, profitability, and liquidity, while outlining key risks like operational threats, NBFI interlinkages, and digital transformation. The speech also covers regulatory efficiency, MiCA implementation, AML/CFT transition, and challenges in deepening the Single Market.
European Banking Authority (EBA) public meeting register for October 16–31, 2025, listing engagements of Executive Director François-Louis Michaud – no meetings disclosed for this period under transparency requirements.
European Banking Authority (EBA) public meeting register for November 2025 listing Executive Director François-Louis Michaud’s engagements, including discussions on digital fraud and scams during the Joint ESAs Consumer Protection Day in Riga.
The European Supervisory Authorities (EBA, EIOPA, and ESMA – the ESAs) publish today the list of designated critical ICT third-party providers (CTPPs) under the Digital Operational Resilience Act (DORA). This designation marks a crucial step in the implementation of the DORA oversight framework.
EBA Training Plan 2025 outlines scheduled workshops and courses for EU supervisors covering AML/CFT, MiCAR, DORA, ESG risks, crypto assets, IRRBB, FRTB, and supervisory reporting to enhance regulatory compliance and best practices.
According to Article 2 par 1 of DORA AIFM is in scope of DORA, AIF is not defined as financial entity. There are situations when agreement is concluded directly between AIF and ICT service provider. It is obvious that the agreement in such situation should contain elements listed in Article 30 of DORA and the risk assessment should be performed by AIFM. But shall such agreement also be:
- included in the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers according to Article 28 par 3 and
- notified to competent authority in a timely manner prior of the conclusion of the agreement if the agreement supports critical or important functions?
The regulation applies to managers of alternative investment funds according to Article 2, point (k) of DORA. According to Article 3, (point 44), of DORA a manager of alternative investment funds is defined as “a manager of alternative investment funds as defined in Article 4(1), point (b), of Directive 2011/61/EU”.
According to Article 4(1), point (b), of Directive 2011/61/EU (AIFM Directive) “AIFMs’ means legal persons whose regular business is managing one or more AIFs”. We are of the understanding that Article 4(1), point (b), does not exclude non-EU AIFM. EU AIFM and non-EU AIFM are defined in Article 4(1), point (L) and point (ab). Since DORA only refers to article 4(1), point (b), of the AIFM Directive and not to article 4(1), point (L), we are wondering if DORA applies to both EU and non-EU AIFM as the definition implies.
Do the requirements of the Digital Operational Resilience Act (DORA) apply to Virtual Asset Service Providers (VASPs) that are not classified as Crypto-Asset Service Providers (CASPs) under the Markets in Crypto-Assets Regulation (MiCAR) as of December 30, 2024 and are benefiting from the MiCAR transition period?"
When restoring backup data using own systems, financial entities shall use ICT systems that are physically and logically segregated from the source ICT system. What does DORA mean by "recovering backed-up data using own systems"? What does "own systems" mean? What is the source ICT system? The productive system whose data is backed-up or the system where the backed-up data is stored?
The European Banking Authority (EBA) today launched a consultation on its Guidelines on supervisory independence of competent authorities under the Capital Requirements Directive (CRD). Risks to supervisory independence pose challenges to the soundness of supervision and good governance and new requirements in the CRD introduce measures to manage them. These Guidelines further clarify the arrangements that competent authorities should have in place to prevent and manage conflicts of interest. The consultation runs until 23 January 2026.