What are the exact statutory timelines for reporting a major ICT-related incident under EU DORA (Regulation (EU) 2022/2554)?+
Under DORA Article 19(4) and Commission Delegated Regulation (EU) 2024/1772, once an ICT incident breaches materiality thresholds and is classified as major, the financial entity must submit: (1) an Initial Notification within 4 hours of classification and no later than 24 hours from the time the incident was first detected; (2) an Intermediate Report within 72 hours of the initial notification detailing impact, indicators of compromise, and containment actions; and (3) a Final Report within 1 month (30 calendar days) of the latest intermediate report providing a full forensic root-cause analysis and permanent remediation evidence.
How do MiCA Class 1, Class 2, and Class 3 CASP capital requirements differ from EMT and ART stablecoin reserve rules?+
Under MiCA Article 67 and Annex IV, Crypto-Asset Service Providers (CASPs) must hold own funds equal to the higher of 25% of preceding-year fixed overheads or a permanent minimum capital floor: €50,000 for Class 1 (order execution, RTO, advice, transfer services), €125,000 for Class 2 (custody and principal fiat/crypto exchange), and €150,000 for Class 3 (operating a trading platform). By contrast, issuers of E-Money Tokens (EMTs) and Asset-Referenced Tokens (ARTs) under Titles III and IV must hold own funds equal to 2% of average reserve assets (3% for Significant issuers) and deposit at least 30% of reserve funds in segregated cash accounts at EU credit institutions (60% for Significant issuers directly supervised by the EBA).
How does Regulation (EU) 2023/1113 (the EU Travel Rule) regulate transfers to and from self-hosted crypto wallets?+
Regulation (EU) 2023/1113 eliminates the €1,000 de minimis exemption for CASP-to-CASP transfers, requiring full originator and beneficiary information on every transaction from €0 upward. When a transfer involves a self-hosted (unhosted) wallet, the CASP must collect and retain information on its client for all transfers, and whenever an individual or linked transfer to or from a self-hosted address exceeds €1,000, the CASP must verify under Article 14(5) and 16(2) whether its client effectively owns or controls that wallet using technical proof-of-ownership methods (such as cryptographic signature verification or micro-transaction tests) specified in EBA Guidelines EBA/GL/2024/11.
What are the EMIR 3.0 Active Account Requirement (AAR) and the MiFIR Payment for Order Flow (PFOF) deadlines in 2026?+
Under EMIR 3.0 (Regulation (EU) 2024/2987) Article 7a, financial and non-financial counterparties exceeding the €3 billion clearing threshold in EUR/PLN interest rate derivatives or short-term euro interest rate derivatives (STIR) must maintain an operationally active clearing account at an EU CCP capable of absorbing a 3x volume surge, and counterparties above €6 billion notional must clear up to 5 representative trades per subcategory/cohort with semi-annual reporting. Separately, under the MiFIR Review (Regulation (EU) 2024/791) Article 39a and 54(3), the final national transitional exemptions for Payment for Order Flow (PFOF)—such as in Germany—expire permanently on June 30, 2026.
