Executive Summary: In their 2025 Joint Committee report, EU regulators confirmed the full activation of DORA as of January 17, 2025. The ESAs have shifted from policy-making to active oversight, designating 19 critical third-party ICT providers for direct supervision. Simultaneously, the authorities warned that geopolitical volatility and "faster digitalization" necessitate a zero-tolerance approach to crypto-asset fraud and AI-driven scams.
DORA: The End of "Infrastructure Blind Spots"
The application of the Digital Operational Resilience Act (DORA) in early 2025 has fundamentally changed how EU financial firms manage their technology stacks.
-
Critical Provider Oversight: Between April and November 2025, the ESAs designated 19 ICT providers (likely including major cloud and data analytics firms) as "critical." These entities are now under the direct supervision of the European Banking Authority (EBA).
-
Information Sharing (CITE): The launch of the Cyber Incident Information Sharing and Threat Intelligence Exchange (CITE) allows EU firms to share real-time data on cyber threats, creating a "communal shield" against systemic ICT failures.
-
Compliance for Brokers: For retail brokers, DORA now requires strict verification of every software component in their infrastructure. Failure to maintain "reliable security maintenance" of open-source or third-party tools is now a direct regulatory violation.
Crypto Risks and Consumer Protection
Despite the rollout of MiCA (Markets in Crypto-Assets), EU regulators remain highly cautious regarding the retail digital asset space.
-
Limited Legal Protection: The ESAs reiterated that depending on the asset type, many crypto-investors still have "limited legal protection" in the event of platform failures.
-
Anti-Fraud Offensive: The report highlighted a surge in AI-driven scams and crypto fraud. In 2025, the ESAs issued 12 administrative sanctions across Belgium, Denmark, Hungary, and Poland related to PRIIPs (Packaged Retail and Insurance-based Investment Products) and consumer protection failures.
-
Finfluencer Crackdown: Coordination with 16 international regulators led to action against "finfluencers," with over 1,267 illegal ads removed that had reached an estimated 2.3 million UK and EU users.
Regulatory "Simplification" Without Compromise
A key theme of the 2025 report is the European Commission’s push to simplify financial reporting, though the ESAs insist this will not weaken the system.
-
PRIIPs & KIDs: Work continues on streamlining the Key Information Document (KID) to make risk disclosures more digestible for retail traders without removing essential data.
-
SFDR Adjustments: To reduce the "reporting burden," the ESAs deprioritized one annual report under the Sustainable Finance Disclosure Regulation (SFDR), aiming for a "proportionate and forward-looking" framework.
Global Market Context: Volatility as the New Normal
The ESAs warned that the market environment in 2026 is defined by "geopolitical uncertainty and trade restrictions."
| Risk Factor | Regulatory Stance |
| Market Volatility | Institutions must enhance resilience to "market shocks." |
| ICT Concentration | High reliance on a few "Critical Providers" is a systemic risk. |
| Non-Bank Finance | Increased monitoring of shadow banking and fintech lenders. |
| Supervisory Data | Launch of a new exchange system to track cross-border market shifts. |
