European Financial Regulatory Architecture in 2026: DORA ICT Operational Resilience, MiCA CASP Prudential Supervision, and EU AMLA Direct Oversight

1. Executive Synthesis: The 2026 European Single Rulebook Convergence Across DORA, MiCA, TFR, AMLA, and EMIR 3.0#

By the second quarter of 2026, the European Union's financial regulatory architecture has transitioned from fragmented national transpositions to an interconnected, directly applicable statutory compliance fabric. Investment firms, credit institutions, central counterparties (CCPs), electronic money institutions (EMIs), and Crypto-Asset Service Providers (CASPs) operating across the European Economic Area (EEA) now operate under five mutually reinforcing Level 1 regulations and their accompanying Level 2 Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS). At the center of this convergence sit Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector (DORA) [1], Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA) [2], Regulation (EU) 2023/1113 on Information Accompanying Transfers of Funds and Certain Crypto-Assets (the recast Transfer of Funds Regulation, or TFR) [3], Regulation (EU) 2024/1620 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) [4], and Regulation (EU) 2024/2987 amending EMIR (EMIR 3.0) [5].

For institutional compliance officers, chief risk officers (CROs), and regulatory technology architects, the defining feature of the 2026 supervisory cycle is statutory cross-dependency. A multi-asset brokerage or institutional CASP seeking or maintaining authorization under MiCA Articles 59–63 can no longer treat prudential capital calculations, ICT cyber-incident telemetry, Travel Rule cryptographic payload verification, and anti-money laundering (AML) transaction monitoring as separate workstreams. Under MiCA Article 62(2)(j) and DORA Article 2(1)(f), a CASP applicant cannot obtain passporting authorization from a National Competent Authority (NCA)—such as Germany's Federal Financial Supervisory Authority (BaFin), France's Autorité des Marchés Financiers (AMF), the Central Bank of Ireland (CBI), or the Cyprus Securities and Exchange Commission (CySEC)—without demonstrating auditable compliance with DORA's ICT risk management framework, Register of Information (RoI) for third-party ICT providers, and TFR cryptographic originator/beneficiary screening.

Furthermore, with the expiration of the final national grandfathering windows under MiCA Article 143(3) by July 1, 2026, Legacy Virtual Asset Service Providers (VASPs) that previously operated under heterogeneous national registration regimes under AMLD5 have either completed full MiCA Title V re-authorization or faced mandatory wind-down orders enforced by NCAs under the coordination of the European Securities and Markets Authority (ESMA) [6]. Simultaneously, the European Banking Authority (EBA) [7] and the newly operationalized Frankfurt-headquartered Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) have established joint supervisory colleges that cross-reference ICT operational outages, stablecoin reserve concentration ratios, and cross-border crypto-asset liquidity flows against unified risk scoring matrices. Institutional market participants tracked in our Regulated Brokers Directory and Global Regulators Index are therefore required to engineer automated, machine-readable RegTech pipelines capable of satisfying concurrent statutory deadlines measured in hours rather than quarters.

2. DORA (Regulation (EU) 2022/2554) in Full Enforcement: ICT Risk Management, Incident Telemetry, and Lead Overseer CTPP Supervision#

Since entering full legal application on January 17, 2025, Regulation (EU) 2022/2554 (DORA) [1] has replaced piecemeal operational risk guidelines across 20 distinct categories of regulated EU financial entities—explicitly encompassing MiFID II investment firms, credit institutions, payment institutions, central securities depositories (CSDs), CCPs, and MiCA-authorized CASPs. In 2026, supervisory enforcement by the Joint Committee of the European Supervisory Authorities (ESAs—comprising ESMA, EBA, and EIOPA) has shifted from initial policy documentation checks to intrusive audits of live telemetry, automated incident classification engines, and contractual exit architectures.

2.1 Chapter II ICT Risk Management Framework and Continuous Automated Control Verification#

Under DORA Articles 5 through 16 and Commission Delegated Regulation (EU) 2024/1774 (the RTS on ICT risk management tools, methods, processes, and policies), financial entities must maintain an internal governance and control framework where the management body bears ultimate statutory liability for ICT operational resilience. Specifically, Article 5(2) mandates that members of the management body actively maintain sufficient knowledge and skills to assess ICT risk Arrangements, approve ICT business continuity policies, and review the Register of Information on all contractual arrangements with ICT third-party service providers at least annually.

From a RegTech engineering perspective, DORA Articles 9 (Protection and Prevention) and 10 (Detection) require continuous automated monitoring of anomalous network traffic, cryptographic key management lifecycles, and privileged access boundaries. Financial entities must maintain immutable audit logs capable of reconstructing the exact sequence of events leading to data integrity compromises or availability degradation across critical or important functions (CIFs). Where an entity utilizes cloud-hosted order management systems (OMS), low-latency matching engines, or distributed ledger custody shards, Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical functions must be validated through annual live failover switches to secondary geographically segregated availability zones.

2.2 Chapter III Major ICT-Related Incident Classification and the 4h / 72h / 30d Reporting Telemetry#

One of the most stringent operational mandates under DORA Chapter III (Articles 17–23) and Commission Delegated Regulation (EU) 2024/1772 is the deterministic classification and multi-stage reporting of major ICT-related incidents. An incident is classified as "major" when it affects critical services and breaches quantitative materiality thresholds across seven criteria: clients, financial counterparts, and transactions affected; reputational impact; duration and service downtime; geographical spread across two or more Member States; data losses involving availability, authenticity, integrity, or confidentiality; criticality of services affected; and economic impact exceeding €100,000 or 0.1% of Tier 1 capital.

Once a malicious cyber intrusion compromises data integrity or when an operational outage exceeds two hours on critical functions and affects more than 10% of daily transaction volume or client base, the entity's automated SIEM/SOAR RegTech pipeline must execute the three-tier statutory reporting clock under DORA Article 19(4):

1. Initial Notification (Within 4 Hours of Classification, Maximum 24 Hours from Detection): The financial entity must transmit a structured machine-readable JSON/XML payload to its designated NCA (e.g., BaFin or AMF) within 4 hours from the moment the incident is classified as major, and no later than 24 hours from the moment the entity first detected the anomaly. This prevents entities from delaying formal classification to postpone regulatory notification.
2. Intermediate Report (Within 72 Hours of Initial Notification): Within 72 hours of submitting the initial notification, the entity must file an updated telemetry report detailing the incident's severity vector, indicators of compromise (IoCs), impact on cross-border counterparts, root-cause hypotheses, and immediate containment or failover activation steps. An updated intermediate report must also be transmitted without undue delay whenever regular activities are recovered.
3. Final Report (Within 1 Month / 30 Calendar Days of Latest Intermediate Report): Within 30 calendar days (one month) following the submission of the latest intermediate report, the entity must submit a comprehensive forensic root-cause analysis (RCA), verifiable evidence of permanent architectural remediation, and quantified financial losses.

2.3 Chapter IV Threat-Led Penetration Testing (TLPT) Under TIBER-EU (Articles 26–27)#

Under DORA Articles 26 and 27, systemically important financial entities designated by NCAs based on impact, systemic interconnectedness, and ICT risk profile must execute advanced Threat-Led Penetration Testing (TLPT) at least once every 36 months (3 years). Harmonized with the European Central Bank's TIBER-EU framework, TLPT is not a standard vulnerability scan; it requires covert, intelligence-led red-teaming against live production systems supporting critical or important functions. Crucially, Article 26(3) mandates that where critical ICT third-party service providers (CTPPs) underpin the entity's production infrastructure, those third-party providers must participate directly in the scope of the TLPT or conduct pooled testing under the supervision of a designated Lead Overseer.

2.4 Chapter V Register of Information (RoI) and Lead Overseer Powers Over Critical ICT Third-Party Providers (CTPPs)#

Under DORA Article 28(3) and Commission Implementing Regulation (EU) 2024/2956, every regulated financial entity must maintain and submit an exhaustive Register of Information (RoI) comprising 15 interlinked relational templates covering all ICT third-party service arrangements, distinguishing between standard services and those supporting critical or important functions (CIFs), and mapping the entire sub-outsourcing supply chain (fourth-party dependencies).

For hyperscale cloud providers, core banking software vendors, institutional market data feeds, and enterprise MPC custody providers designated as Critical ICT Third-Party Service Providers (CTPPs) under DORA Article 31, one of the three ESAs (ESMA, EBA, or EIOPA) is appointed as Lead Overseer (Article 31(1)(b)). Under Articles 35–42, the Lead Overseer exercises direct investigative, on-site inspection, and remedial powers over the CTPP. Most significantly, under DORA Article 35(6)–(8), if a CTPP fails to comply with Lead Overseer requests, on-site inspections, or remediation recommendations, the Lead Overseer is empowered to impose a periodic penalty payment of up to 1.0% of the average daily worldwide turnover of the CTPP in the preceding business year for each day of non-compliance, for a period of up to six months (180 days), alongside the power under Article 42(6) to require financial entities to temporarily suspend or permanently terminate their contracts with the non-compliant CTPP.

3. MiCA (Regulation (EU) 2023/1114) Post-Transitional Regime: CASP Prudential Capital Tiers and EMT/ART Reserve Engineering#

While MiCA Title III (Asset-Referenced Tokens, ARTs) and Title IV (E-Money Tokens, EMTs) became directly applicable on June 30, 2024, and Title V (Authorization and Operating Conditions for CASPs) took effect on December 30, 2024 [2], the transitional landscape across 2025 and 2026 was defined by divergent national implementation of the Article 143(3) grandfathering clause. Although Article 143(3) permitted Member States to grant pre-existing VASPs up to 18 months (until July 1, 2026) to transition to full MiCA CASP authorization, ESMA formally urged NCAs to cap transitional periods at 6 to 12 months. Consequently, jurisdictions such as Germany (BaFin) and the Netherlands capped grandfathering at 12 months (ending December 30, 2025), Ireland (CBI) enforced a 12-month window, while France (AMF) utilized the full 18-month window expiring July 1, 2026. By mid-2026, the transitional phase has closed: no entity may legally solicit, onboard, or execute crypto-asset services for EEA residents without either an active Title V CASP authorization (Article 59/63) or an institutional equivalence notification under Article 60 for credit institutions and MiFID II investment firms.

3.1 MiCA Article 67 and Annex IV: Class 1, Class 2, and Class 3 CASP Prudential Safeguards#

Under MiCA Article 67(1), every authorized CASP must, at all times, maintain prudential safeguards equal to an amount of at least the higher of:

• (a) the amount of permanent minimum capital requirements indicated in Annex IV, depending on the nature of the crypto-asset services provided; or
• (b) one quarter (25%) of the fixed overheads of the preceding year, reviewed annually (FOR_{t-1}).

Under Article 67(4), these prudential safeguards may take the form of own funds consisting of Common Equity Tier 1 (CET1) items and instruments referred to in Articles 26 to 30 of Regulation (EU) No 575/2013 (CRR) after full deductions pursuant to Article 36 CRR, or an insurance policy covering the territories of the Union where crypto-asset services are provided, or a comparable guarantee.

Annex IV of Regulation (EU) 2023/1114 stratifies CASPs into three escalating prudential classes:

• Class 1 CASPs (€50,000 Permanent Minimum Capital): Entities authorized to provide execution of orders on behalf of clients, placing of crypto-assets, reception and transmission of orders (RTO), advice on crypto-assets, portfolio management of crypto-assets, and crypto-asset transfer services—without holding client crypto-assets or client funds in custody.
• Class 2 CASPs (€125,000 Permanent Minimum Capital): Entities authorized to provide any Class 1 service plus custody and administration of crypto-assets on behalf of clients (Article 75), exchange of crypto-assets for funds (fiat-to-crypto principal dealing), or exchange of crypto-assets for other crypto-assets (crypto-to-crypto principal dealing).
• Class 3 CASPs (€150,000 Permanent Minimum Capital): Entities authorized to provide any Class 2 service plus the operation of a trading platform for crypto-assets (Article 76 multilateral order book or matching engine).

3.2 Title III & Title IV Stablecoin Prudential Mechanics: ART and EMT Reserve Segregation and EBA Significant Issuer Supervision#

Perhaps the highest-impact prudential rule set in the EU digital asset ecosystem governs Asset-Referenced Tokens (ARTs) under Title III (Articles 16–47) and E-Money Tokens (EMTs) under Title IV (Articles 48–58). Under Article 48(1), an EMT may only be offered to the public or admitted to trading in the EU by an authorized credit institution (under CRD) or an authorized electronic money institution (EMI) (under Directive 2009/110/EC), with mandatory right of redemption at par value at any moment (Article 49) and an absolute prohibition on granting interest on EMT or ART holdings (Articles 40 and 50).

Under MiCA Article 36(4), Article 38, Article 45(7)(b), and Article 54, issuers of ARTs and EMTs must maintain a segregated reserve of assets subject to strict liquidity and credit concentration buffers enforced by the EBA [7]:

• Standard ART and EMT Issuers: At least 30% of the funds received (or assets referenced in each official currency) must be deposited in cash in segregated accounts with EU-authorized credit institutions. The remaining up to 70% must be invested strictly in highly liquid financial instruments with minimal market risk, credit risk, and concentration risk (Qualifying Level 1 High-Quality Liquid Assets, HQLA, such as short-dated sovereign bills callable within tight settlement windows).
• Significant ART and Significant EMT Issuers (Articles 43, 45, 56, 58): Where an ART or EMT is classified as "significant" by the EBA based on meeting at least three statutory criteria under Article 43(1) (such as customer base exceeding 10 million holders, market capitalization or reserve size exceeding €5 billion, daily average transaction volume exceeding 2.5 million transactions or €500 million in aggregate value, or systemic interconnectedness), direct supervisory competence transfers to the EBA. A significant ART or EMT issuer is subject to two immediate prudential escalations: 1. The mandatory cash deposit reserve in segregated accounts at EU credit institutions doubles from 30% to at least 60% of the referenced funds (Article 45(7)(b) and Article 58(1)(a)), subject to strict single-bank counterparty concentration limits (typically capped at 1.5% of the credit institution's total assets or 25% of the reserve per banking group under EBA RTS). 2. The issuer's own funds requirement increases from 2% to 3% of the average amount of the reserve of assets over the preceding six months (Article 35(1)(b) and Article 45(5)), expandable by an additional risk-based buffer of up to 20% following mandatory quarterly liquidity stress testing.

4. Quantitative Prudential & Penalty Architecture: Statutory Formulas and Automated Enforcement Pipelines#

To operationalize real-time capital adequacy and third-party risk monitoring, institutional RegTech platforms deploy deterministic mathematical models that continuously evaluate a firm's liquid CET1 capital buffer against MiCA Article 67 and quantify worst-case third-party exposure under DORA Article 35.

In parallel, cross-border financial institutions must integrate four distinct regulatory telemetry streams into a single automated execution and supervisory reporting pipeline:

5. Recast Transfer of Funds Regulation (Regulation (EU) 2023/1113) and Frankfurt AMLA Direct Supervision#

5.1 Zero-Threshold Travel Rule Enforcement and the €1,000 Self-Hosted Wallet Verification Mandate#

Applicable since December 30, 2024 alongside MiCA, Regulation (EU) 2023/1113 (the recast Transfer of Funds Regulation, TFR) [3] aligns European law with Recommendation 16 of the Financial Action Task Force (FATF) [8] while imposing markedly stricter statutory requirements than non-EU jurisdictions:

• Elimination of the €1,000 De Minimis Exemption for CASP-to-CASP Transfers (Article 14): Unlike traditional wire transfers or the US FinCEN $3,000 Travel Rule threshold, Regulation (EU) 2023/1113 applies a €0 threshold to all crypto-asset transfers between CASPs. Every single transfer, regardless of value, must be accompanied—prior to or simultaneously with the blockchain broadcast—by verified originator data (name, distributed ledger address, crypto-asset account number, physical address, official personal document number, customer identification number, or date and place of birth / LEI) and beneficiary data (name, distributed ledger address, and account number) formatted in accordance with the EBA Travel Rule Guidelines (EBA/GL/2024/11).
• Missing or Incomplete Information Rejection Protocol (Articles 16–17): Intermediary and beneficiary CASPs must deploy real-time pre-credit screening filters. If a transfer arrives with missing or manifestly incomplete originator or beneficiary attributes, the beneficiary CASP must reject the transfer, return the crypto-assets to the originator's account, or hold the assets in a segregated suspense wallet while requesting the missing attributes within 3 working days (72 hours) for intra-EU transfers (or 5 working days for third-country transfers), failing which rejection or regulatory freeze is mandatory.
• Self-Hosted (Unhosted) Wallet Transfers Exceeding €1,000 (Articles 14(5) and 16(2)): Where a transfer involves a self-hosted address (an unhosted hardware or software wallet not linked to a regulated CASP), the CASP must still collect and retain originator and beneficiary information on its own client for all transfers regardless of amount. Furthermore, whenever an individual transfer or a linked series of transfers to or from a self-hosted address exceeds €1,000, the CASP must verify whether the self-hosted address is effectively owned or controlled by its own client using at least one technical verification method specified in the EBA Guidelines (such as an attended visual session, cryptographic digital signature verification against a challenge string, or an automated micro-transaction test).

5.2 Regulation (EU) 2024/1620: The Frankfurt AMLA and Direct Supervision of 40 High-Risk Cross-Border Financial Groups#

Enacted as the institutional cornerstone of the EU's Sixth Anti-Money Laundering Package—alongside the directly applicable Single Rulebook AML Regulation (Regulation (EU) 2024/1624, AMLR) and the Sixth AML Directive (Directive (EU) 2024/1640, AMLD6)—Regulation (EU) 2024/1620 [4] established the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) headquartered in Frankfurt am Main, Germany.

In 2026, AMLA is executing its phased operational ramp-up toward full direct supervisory selection:

• Direct Supervision of Selected Obliged Entities (Articles 12–13): AMLA is mandated to assume direct supervision over an initial cohort of 40 of the highest-risk cross-border credit institutions, financial institutions, and CASPs that operate across at least 6 Member States (whether via physical establishment or freedom to provide services under a MiCA/MiFID passport) and whose residual AML/CFT risk profile is classified as "high" under AMLA's harmonized supervisory assessment methodology.
• Joint Supervisory Teams (JSTs) and Administrative Sanctions (Articles 16–22): Modelled on the ECB Single Supervisory Mechanism (SSM), AMLA supervises each selected obliged entity through a dedicated Joint Supervisory Team (JST) led by an AMLA coordinator in Frankfurt and staffed with supervisors from relevant national FIUs and NCAs (such as BaFin, AMF, CBI, and CySEC). Under Article 22, AMLA possesses direct statutory power to impose administrative pecuniary sanctions of up to 10% of total annual turnover or €10 million (whichever is higher) for serious, repetitive, or systematic breaches of the EU AML Regulation or the Transfer of Funds Regulation.
• FIU.net Centralization and Indirect Oversight of Non-Selected CASPs: Beyond the 40 directly supervised groups, AMLA hosts the upgraded FIU.net cross-border intelligence infrastructure, conducts joint analyses of suspicious transaction reports (STRs), and possesses step-in powers under Article 32 to assume direct supervision over any individual CASP or brokerage firm if a national supervisor fails to enforce effective remedial measures.

6. EMIR 3.0 (Regulation (EU) 2024/2987) & MiFID II / MiFIR Review: Active Account Requirements, Consolidated Tape, and PFOF Prohibition#

6.1 EMIR 3.0 Article 7a: The Active Account Requirement (AAR) and Representative Trade Mandates#

Published in the Official Journal on December 4, 2024 and entering into force on December 24, 2024, Regulation (EU) 2024/2987 (EMIR 3.0) [5] fundamentally restructures derivatives clearing across the European Union to reduce systemic reliance on third-country Tier 2 CCPs (principally UK-based LCH Ltd and ICE Clear Europe).

Under the newly inserted EMIR Article 7a (Active Account Requirement, AAR), Financial Counterparties (FC+) and Non-Financial Counterparties (NFC+) that are subject to the clearing obligation under Article 4 and exceed the €3 billion clearing threshold (individually or in aggregate across over-the-counter derivatives pertaining to euro-denominated interest rate derivatives (EUR IRD), Polish zloty-denominated interest rate derivatives (PLN IRD), or short-term euro interest rate derivatives (STIR)) had 6 months from entry into force (until June 24, 2025) to establish at least one active clearing account at an EU-authorized CCP (such as Eurex Clearing AG). In 2026, following finalization of ESMA's Level 2 RTS on the Active Account conditions, counterparties are audited on two strict pillars:

1. Operational Conditions & Stress-Testing Readiness (Article 7a(3)(a)–(c)): The EU CCP clearing account must have permanently active legal documentation, IT connectivity, internal margin processes, and collateral pipelines capable of absorbing a 3-fold surge in clearing volume transferred from a third-country CCP at short notice without operational bottlenecks.
2. Representativeness Obligation (Article 7a(3)(d)): Counterparties holding more than €6 billion in notional clearing volume across the relevant derivative categories must clear a minimum number of trades at an EU CCP across a matrix of subcategories defined by product class, trade size, and maturity range (up to 5 representative trades per subcategory per reference period, or an annual average across defined cohorts), accompanied by semi-annual quantitative reporting to their NCA and ESMA.

6.2 MiFIR Review (Regulation (EU) 2024/791): Complete PFOF Ban by June 30, 2026 and Consolidated Tape Provider (CTP)#

Alongside EMIR 3.0 and DORA, institutional retail and institutional brokers operating under MiFID II / MiFIR must complete two transformative structural migrations in 2026 under Regulation (EU) 2024/791 (the MiFIR Review):

• Absolute Prohibition on Payment for Order Flow (PFOF) under MiFIR Article 39a (Effective June 30, 2026): While Article 39a prohibited PFOF across the EU upon entry into force in March 2024, Article 54(3) permitted Member States where PFOF was previously practiced (most notably Germany under BaFin supervision) to grant a transitional grandfathering exemption until June 30, 2026. As of June 30, 2026, that transitional derogation expires completely: no investment firm or multi-asset neobroker anywhere in the EU may receive any fee, commission, or non-monetary benefit from any third party (such as a single-dealer market maker or MTF) for executing client orders on a particular execution venue or forwarding client orders to a third party for execution.
• EU Consolidated Tape Provider (CTP) Rollout (MiFIR Articles 27da–27i): Throughout 2025 and 2026, ESMA has conducted the competitive selection tenders for single asset-class Consolidated Tape Providers (CTPs)—commencing with the Bond CTP selection in 2025, followed by the Equities/ETF pre- and post-trade CTP in 2026, and the OTC Derivatives CTP. Trading venues and Approved Publication Arrangements (APAs) are now legally required to contribute low-latency, standardized market data feeds to the authorized CTPs under harmonized clock-synchronization RTS.

7. National Competent Authority (NCA) Supervisory Divergence, Passporting Friction & Enforcement Matrix#

Although DORA, MiCA, TFR, and EMIR 3.0 are directly applicable EU Regulations rather than Directives, practical supervisory execution in 2026 remains shaped by the technical examination depth, staffing specialization, and cross-border supervisory posture of key National Competent Authorities. Through its Peer Review mechanisms and Article 42 product intervention powers, ESMA has actively targeted "forum shopping" and letterbox entities—explicitly instructing NCAs via its Opinion on Global Crypto-Asset Firms to prohibit authorized EU CASPs from routing EEA client order flow blindly to unregulated intra-group non-EU execution hubs.

7.1 Deep-Dive: BaFin (Germany), AMF (France), CBI (Ireland), and CySEC (Cyprus)#

• Germany (BaFin): Following the enactment of Germany's Finanzmarktdigitalisierungsgesetz (FinmDigiG) and the Kryptomärkteaufsichtsgesetz (KMAG), BaFin retired its legacy national circular BAIT (Bankaufsichtliche Anforderungen an die IT) in favor of direct DORA enforcement. Institutions holding the legacy German crypto custody license under § 1(1a) sentence 2 no. 6 KWG benefited from a streamlined notification procedure, whereas pure-play VASPs faced a strict December 30, 2025 cutoff. Crucially, German retail brokers and execution venues face an absolute revenue structural shift on June 30, 2026, when Germany's transitional exemption under MiFIR Article 54(3) expires and all PFOF rebates must cease.
• France (AMF and ACPR): France permitted ”simple” and ”enhanced” PSAN (Prestataires de Services sur Actifs Numériques) entities registered prior to December 30, 2024 to continue operating domestically until July 1, 2026 under MiCA Article 143(3). However, un-transitioned PSANs could not exercise EEA passporting rights during the grandfathering window. By Q2 2026, the AMF and the Autorité de Contrôle Prudentiel et de Résolution (ACPR) have enforced strict final cutoffs requiring complete DORA Register of Information (RoI) submissions and on-chain segregation audits before granting permanent MiCA Article 63 authorizations.
• Ireland (CBI): Serving as the primary EEA hub for global payment institutions, EMIs, and institutional liquidity venues, the Central Bank of Ireland enforces rigorous Pre-Approval Controlled Function (PCF) fitness-and-probity interviews. Under the CBI's 2026 supervisory priorities, any MiCA CASP or EMT issuer operating out of Dublin must demonstrate that core risk, compliance, and ICT incident decision-making reside physically within the State, backed by daily automated reconciliation of the 30% / 60% credit institution cash reserves.
• Cyprus (CySEC): Historically the dominant domicile for retail multi-asset Cyprus Investment Firms (CIFs) listed in our Regulated Brokers Directory, CySEC halted national CASP registrations in October 2024 ahead of MiCA entry into application and now enforces ESMA's strict prohibitions against shared order-book routing to offshore third-country affiliates.

8. 2026 RegTech Engineering & Compliance Readiness Checklist for Multi-Asset Brokers and CASPs#

To pass unannounced supervisory inspections by NCAs, ESMA, EBA, and AMLA in 2026, chief compliance officers and technology architects must verify eight non-negotiable engineering controls:

1. Automated DORA Article 19 Incident Classification & 4-Hour Telemetry Pipeline: Configure SIEM/SOAR rule sets to evaluate every production outage or security alert against the seven DORA materiality thresholds automatically, generating pre-populated JSON/XML Initial Notification templates within 4 hours of classification (and strictly within 24 hours of initial anomaly detection), followed by 72-hour intermediate and 30-day final forensic packages.
2. Relational DORA Register of Information (RoI) Database: Maintain all 15 Implementing Technical Standard (ITS) relational tables mapping every ICT third-party contract, identifying all Critical or Important Functions (CIFs), and documenting tested exit strategies and secondary cloud failover providers.
3. Continuous MiCA Article 67 Own Funds & Fixed Overhead Ratio (FOR) Engine: Automate daily CET1 capital calculations verifying that liquid own funds exceed $\max(C{\text{perm}, k}, 0.25 \times \text{FOR}{t-1})$ across Class 1 (€50,000), Class 2 (€125,000), or Class 3 (€150,000) licenses.
4. Segregated EMT/ART Reserve & Delisting Controls: For CASPs operating trading platforms or offering stablecoin pairs, block any non-MiCA-authorized ART or EMT from EEA order books and, for issuers, enforce real-time treasury sweeps maintaining the 30% (standard) or 60% (significant) EU credit institution deposit floor.
5. Zero-Threshold TFR Travel Rule Gateway & €1,000 Self-Hosted Wallet Attestation: Integrate interoperable IVMS101 messaging protocols (e.g., TRP, Notabene, Sygna, or OpenVASP) with pre-credit suspense queues that automatically quarantine transfers lacking mandatory originator/beneficiary fields, paired with automated cryptographic signature verification whenever self-hosted wallet transfers exceed €1,000.
6. AMLA Cross-Border Risk Scoring Alignment: Standardize customer due diligence (CDD), ultimate beneficial ownership (UBO) registries, and blockchain analytics risk scores across all EEA branches and passported corridors in preparation for AMLA Joint Supervisory Team (JST) data calls.
7. EMIR 3.0 Article 7a Active Account Connectivity & Representative Clearing: For derivatives counterparties exceeding the €3 billion clearing threshold in EUR/PLN IRD or STIR contracts, maintain live EU CCP margin plumbing capable of handling a 3x volume stress transfer and automate execution and semi-annual reporting of the representative trade cohorts.
8. MiFIR Article 39a Post-PFOF Execution Architecture: Ahead of the final June 30, 2026 sunset of national PFOF transitional exemptions, eliminate all third-party order-routing rebates and re-architect retail execution around transparent commission schedules or multi-dealer request-for-quote (RFQ) / lit multilateral order books compliant with MiFID II Best Execution mandates.

Primary Regulatory Filings, Statutory Citations & Empirical References#

• [1] European Parliament and Council of the European Union, Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union, L 333/1. https://eur-lex.europa.eu/eli/reg/2022/2554/oj
• [2] European Parliament and Council of the European Union, Regulation (EU) 2023/1114 of 31 May 2023 on markets in crypto-assets (MiCA), Official Journal of the European Union, L 150/40. https://eur-lex.europa.eu/eli/reg/2023/1114/oj
• [3] European Parliament and Council of the European Union, Regulation (EU) 2023/1113 of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets (Recast Transfer of Funds Regulation / TFR), Official Journal of the European Union, L 150/1. https://eur-lex.europa.eu/eli/reg/2023/1113/oj
• [4] European Parliament and Council of the European Union, Regulation (EU) 2024/1620 of 31 May 2024 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), Official Journal of the European Union, L 2024/1620. https://eur-lex.europa.eu/eli/reg/2024/1620/oj
• [5] European Parliament and Council of the European Union, Regulation (EU) 2024/2987 of 27 November 2024 amending Regulations (EU) No 648/2012, (EU) No 575/2013 and (EU) 2017/1131 as regards measures to mitigate excessive exposures to third-country central counterparties and improve the efficiency of Union clearing markets (EMIR 3.0), Official Journal of the European Union, L 2024/2987. https://eur-lex.europa.eu/eli/reg/2024/2987/oj
• [6] European Securities and Markets Authority (ESMA), Markets in Crypto-Assets Regulation (MiCA) — Supervisory Convergence, Technical Standards & Opinion on Global Crypto-Asset Firms, Paris. https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica
• [7] European Banking Authority (EBA), Digital Finance: MiCA Asset-Referenced and E-Money Token Prudential RTS, Travel Rule Guidelines (EBA/GL/2024/11) and DORA Oversight, Paris. https://www.eba.europa.eu/activities/digital-finance
• [8] Financial Action Task Force (FATF), Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (Recommendation 15 & Recommendation 16 Travel Rule), Paris. https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-rba-virtual-assets-2021.html