Regulation
Laws and regulation including myDATA, AADE, MiCA, DORA and PSD3, with a short English summary and a link to the original article. RSS
-
Regulation
IMF and World Bank launch the Bangkok Blueprint against digital fraud
The International Monetary Fund and the World Bank Group, together with the Bank of Thailand, presented a framework for tackling fraud in digital financial services at their 2026 annual meetings in Bangkok. The Bangkok Blueprint sets out 12 considerations across five pillars. These are legal foundations, prevention and detection, supervisory and enforcement tools, domestic and cross-border cooperation, and consumer protection. It is a non-binding guide that each country can adapt.
What it means: Fraud through calls, messages and fake websites has become the biggest problem in digital payments, and the fact that the IMF and World Bank treat it as a financial stability issue says a lot. The guide is not law, but texts like this often shape what national regulators ask for later. In Europe many of its elements are already under discussion: the Payment Services Regulation foresees name and IBAN matching checks, fraud data sharing between providers and, in some cases, liability to refund victims of impersonation scams. For Greek banks and payment providers, the message is that fraud protection will increasingly be judged as an obligation rather than an option. AI transaction monitoring, quick freezing of suspicious funds and cooperation with telecoms operators and platforms are the core tools. For SMEs, fake invoices and supplier IBAN change scams remain the biggest risk, and confirming every change of bank details through a second channel is a simple but effective defence.
-
Regulation
EU General Court upholds Stripchat's designation as a very large platform
The EU General Court has dismissed in full the action brought by Technius, the company behind Stripchat, against its designation as a very large online platform under the Digital Services Act. The company had reported about 31.8 million average monthly active users in the EU, while the Commission, using Similarweb data, found unique visitors exceeded 62 million. The court held that the Commission's method was reliable and that a later correction of Similarweb's figures did not affect the legality of the decision. The DSA threshold is 45 million users.
What it means: The ruling matters well beyond this platform, because it concerns how users are counted for applying the DSA. The court accepted that the Commission may rely on third-party measurement data and reject methods that artificially lower user numbers. It also held that legality is judged on the data available when the decision was taken, not on later corrections. For digital platforms near the thresholds, the message is that creative user accounting is not a safe strategy. For Greek platforms, far below the 45 million mark, the core DSA duties already apply: notice-and-action mechanisms for illegal content, advertising transparency and regular publication of EU active user figures. The judgment is a reminder that those numbers are not a formality but can be checked and challenged. Companies building marketplaces or social apps should document their measurement method and apply it consistently from the start. The judgment can still be appealed to the Court of Justice.
Read the original on Court of Justice of the EU (General Court)
-
Regulation
ESMA: 15.5 million retail investors use firms based in another member state
ESMA's annual analysis for 2025 shows that about 15.5 million clients in the EU and EEA receive investment services from firms based in another member state, almost double the 2023 figure. Compared with 2024, retail clients rose 47%, while the number of firms grew only 2% and complaints stayed stable. Cyprus remains the main home of passporting firms with a 20% share, followed by Luxembourg and Germany. France, Spain, Germany and Italy are the main destination markets.
What it means: The data show that the single market for investment services works for retail investors mainly through a few digital platforms, many of them licensed in Cyprus. For Greek investors, that means the app they use to buy shares or ETFs is probably supervised by another country's authority, and resolving a dispute may be more complicated. The rapid rise in clients against an almost flat number of firms points to concentration: a handful of large players are winning most of the market. For Greek investment firms, competition from such platforms is already intense, and differentiation comes from local service, the Greek language and specialised advice. The fall in complaints per client is encouraging, yet regulators will keep watching aggressive marketing aimed at young investors. The Hellenic Capital Market Commission can use these figures to seek closer cooperation with home-country authorities. Greek fintechs with European ambitions can also see the room for growth here.
-
Regulation
ESMA sets enforcement priorities for 2026 annual reports
ESMA has published its European Common Enforcement Priorities for the 2026 annual financial reports of listed companies. For IFRS it focuses on geopolitical uncertainty and on restructuring provisions and debt restructuring. For sustainability statements under ESRS it calls for progress on materiality assessment and connected information on impacts, risks, policies, targets and metrics. For the ESEF digital format it highlights frequent errors in the statement of changes in equity.
What it means: ESMA's priorities are in effect the checklist the Hellenic Capital Market Commission will use when reviewing Greek listed companies' 2026 accounts. Anyone preparing financial statements or sustainability reports now knows where the focus will fall. The stress on geopolitical uncertainty means generic references to war or tariffs will not do. Companies need to show how those risks affect specific estimates such as impairments and provisions. For ESRS the key is consistency: policies, targets and metrics must link to the risks the company judged material rather than appear in isolation. ESEF errors in the statement of changes in equity are a practical issue for reporting software vendors and accounting teams, because they often stem from incorrect XBRL tagging. For unlisted Greek SMEs the priorities are not binding, yet they indirectly shape what banks and large customers ask for in sustainability data. The emphasis on materiality signals that the goal is sharper reports, not longer ones.
-
Regulation
European supervisory authorities set joint priorities for 2027
The Joint Committee of the European Supervisory Authorities, EBA, EIOPA and ESMA, has published its annual work programme for 2027. Key priorities are digital operational resilience, technological innovation, sustainable finance, securitisation and cross-sectoral risk monitoring. Under DORA the authorities will continue overseeing critical ICT third-party providers and will assess the implications of artificial intelligence. Consumer protection remains a central aim, alongside simplification of the regulatory framework.
What it means: The programme brings no new rules, but it shows where supervisors will focus next year, which is useful for anyone planning a compliance budget. The emphasis on DORA and critical ICT providers means the large cloud and software vendors serving banks and insurers will stay under constant scrutiny. For Greek software firms selling to financial institutions, client demands for documentation, resilience testing and exit plans will keep rising, even if the vendors themselves are never designated critical. The mention of artificial intelligence also matters. Supervisors want to understand how AI models affect credit scoring, insurance pricing and customer service, which could lead to guidance that complements the AI Act. The nod to simplification shows political pressure to reduce burden has reached the supervisors, although that rarely means less work for regulated firms in the short term. Compliance leads should build these themes into their plans for the coming year, starting with an updated register of ICT contracts.
-
Regulation
EBA classifies USDC as the EU's first significant e-money token
The European Banking Authority has classified USDC, issued in the EU by Circle Internet Financial Europe SAS, as a significant e-money token under MiCA. Of the 45 such tokens notified in the EU, it is the first to receive this designation. From 12 November 2026 the EBA takes over direct supervision of own funds, reserves, liquidity and recovery and redemption plans, while France's ACPR keeps oversight of governance and fit-and-proper matters. The EBA has also signed a memorandum of understanding with the New York Department of Financial Services.
What it means: The designation shows MiCA moving from theory to practice for large stablecoins. Dual supervision means the core elements of a token's stability, namely reserves, liquidity and redemption at par, move to the European level. For EU users this strengthens confidence in USDC as a settlement asset, since a European authority now checks it directly. For the issuer, significant tokens carry higher own funds and liquidity requirements and therefore higher compliance costs. For Greek crypto-asset service providers and fintechs the takeaway is practical: choosing a stablecoin for payments or treasury should depend on its regulatory status, not just its market liquidity. ESMA has already told providers not to serve stablecoins lacking MiCA authorisation, so the line between approved and unapproved tokens is becoming decisive. The memorandum with New York also shows that supervising global stablecoins requires cross-border cooperation, which will matter for future euro stablecoins as well. Greek firms holding USDC should review issuer disclosures after November.
-
Regulation
AADE: data on 171 million accounts were exchanged globally in 2024
Greece's tax authority AADE is hosting in Athens, from 12 to 15 October 2026, the 25th meeting of the OECD Global Forum's Peer Review Group on the automatic exchange of information. Governor Giorgos Pitsilis said that in 2024 alone, information on more than 171 million financial accounts holding assets of almost €13 trillion was exchanged internationally under the Common Reporting Standard. The figures are global totals, not Greek data. He also highlighted the amended CRS and the new Crypto-Asset Reporting Framework, CARF.
What it means: The reference to CARF is the most important point for Greek businesses and individuals holding crypto assets. The new framework, applied in the EU through the DAC8 directive from 2026, requires crypto-asset service providers to report client and transaction data to tax authorities, which then exchange it among themselves. Put simply, trading on foreign exchanges is no longer invisible to AADE. For accountants, clients with crypto holdings must declare gains and income correctly, because cross-checking will be automatic. For Greek crypto-asset service providers, reporting duties mean collecting clients' tax residence and tax ID properly from the start. The amended CRS also extends coverage to e-money and central bank digital currencies, which matters for fintechs offering payment accounts. Hosting the meeting in Athens shows AADE's wish to present itself as a modern, data-driven authority. Businesses should assume the transparency of their holdings abroad will keep increasing year after year.
-
Regulation
France advances €100k self-custody crypto declaration amendment
France’s National Assembly Finance Committee adopted amendment I-CF821 requiring annual declaration of self-custodied crypto wallets worth €100,000 or more as of 31 December. Failure to declare could bring a fine of up to €10,000. The measure is not law yet and still needs further budget votes. Sponsors cite a large gap between realised crypto gains and amounts reported to the tax authority.
What it means: Even as a proposal, the amendment shows where EU national tax authorities are heading on visibility into high-value self-custody. Greek holders and companies running corporate wallets should keep detailed valuation and transaction records before similar duties arrive. CASPs already report; extending duties to self-custody changes the incentive to keep large balances outside custodians. Security concerns about targeting wealthy holders remain real if state databases expand. Businesses that pay suppliers in crypto should align accounting and compliance for possible cross-border reporting duties. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs.
-
Regulation
EU AI Scientific Panel meets on loss-of-control incidents
On 9 October 2026, Executive Vice-President Henna Virkkunen and the chair of the AI Scientific Panel held a special meeting on AI loss-of-control incidents. The panel is working with the AI Office on questions for the companies that built the models involved. The Commission will send information requests combining panel and AI Office questions. Recommendations include stronger governance of internal models, better incident-investigation capacity and international information-sharing.
What it means: The meeting shows AI Act enforcement moving from principles to concrete oversight of frontier-model safety incidents. Greek firms that embed or fine-tune large models face a higher chance of being asked to document security practices and serious-incident reporting. Teams training internal models must govern development and testing, not only production release. Scrutiny of techniques that reduce monitorability means opaque training methods will draw more regulatory attention. AI vendors selling to businesses should prepare incident files and clear contacts for authorities before a request arrives. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs.
-
Regulation
EDPB: smart-glasses makers cannot shift GDPR duties onto wearers
The European Data Protection Board issued a preliminary statement on privacy risks from camera and AI smart glasses. It says manufacturers and linked app or AI providers remain controllers and cannot rely only on wearers to inform bystanders. It calls for noticeable recording indicators, audio cues and designs that distinguish the devices. Legitimate interest for further commercial use or AI training on bystander data is described as particularly hard to demonstrate.
What it means: The statement matters for anyone designing or selling camera wearables in the EU, and for buyers using them in shops, warehouses or customer sites. Greek retail and hospitality firms may need DPIAs, venue notices and recording limits if staff wear such devices. AI startups training on public-space visuals should revisit legal bases before collecting footage from glasses. Hard-to-disable indicators raise the product-design bar. Even without binding guidelines, national authorities can cite the statement in investigations and complaints, so waiting for final guidance is a weak compliance strategy. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs. It belongs in operational planning for Greek SMEs.
-
Regulation
OpenAI and Anthropic ask UK lawmakers for regulation
Executives from both companies testified at a broad UK parliamentary session, alongside whistleblowers and security experts. Their shared message was that AI needs a regulatory framework. The same day, the head of British intelligence warned that AI could help create new biological weapons. The UK debate on AI rules is now taking formal shape.
What it means: Executives from OpenAI and Anthropic asking British lawmakers for regulation is less paradoxical than it sounds: large companies often prefer clear rules they can help shape from the start over uncertainty or tougher measures that might follow a serious incident. Whistleblowers and security experts appearing at the same session, together with the warning from the head of British intelligence about AI possibly being used for biological weapons, show that the debate is about national security as well as innovation. Britain, outside the EU, is not bound by the European AI Act, but whatever framework it chooses will affect companies active in both markets, who would prefer rules that do not diverge too far. For businesses already adapting to the AI Act, the takeaway is that AI regulation is becoming a global phenomenon, and documenting how the technology is used, what data goes in and who checks the results will be useful whatever the final rules turn out to be.
-
Regulation
EU Council wants ESMA to supervise only significant crypto providers
The Commission had proposed that all MiCA crypto service providers be supervised directly by ESMA. Finance ministers narrowed this to significant providers only. The 15 million user threshold stays, but new alternative criteria mean a provider with just over one million users could also qualify. Commissioner Maria Luís Albuquerque said the Commission deeply regrets the compromise.
What it means: Finance ministers limiting direct ESMA supervision to significant crypto service providers only, instead of all of them as the Commission proposed, reflects the familiar EU tension between central supervision and national authorities keeping powers that many member states do not want to give up. The 15 million user threshold remains, but the new alternative criteria mean providers with a much smaller base, just over a million users, could also come under ESMA, so the final scope will depend on how those criteria are applied. The Commissioner publicly saying the Commission deeply regrets the compromise shows the debate is not closed, and the final shape will be set in negotiations with the European Parliament. For smaller providers in Greece, the likeliest outcome is continued supervision by the Hellenic Capital Market Commission, meaning the relationship with the national authority stays crucial, while large platforms should prepare for a European supervisor and its reporting demands.
-
Regulation
PSD3 and PSR head for a December plenary vote
The new payment services directive PSD3 and the PSR regulation reached a provisional political deal in November 2025, with final texts published in April 2026. They have still not been formally adopted. The European Parliament plenary vote is indicatively scheduled for 14 December 2026. The rules are expected to apply about 21 months after entry into force, most likely in late 2028.
What it means: PSD3 and the PSR have been politically agreed and the final texts published, but formal adoption is still pending, and the indicative European Parliament plenary vote in December 2026 will be one of the last steps before the countdown to application begins. With application roughly 21 months after entry into force, banks, payment institutions and fintechs have about two years to adapt, mainly to the new rules on fraud protection, liability in impersonation cases and open banking, where requirements for account access interfaces change. Experience with PSD2 shows that such changes take far longer than first estimated, especially when many systems and third-party providers are involved. It is therefore sensible to start preparing now by mapping the processes that will be affected, rather than waiting until the last moment, and online shops too will see changes in how payments are confirmed and how refunds are handled for their customers.
-
Regulation
ESMA tells crypto firms to stop serving non-MiCA stablecoins
ESMA issued an opinion on 8 October saying licensed crypto service providers should stop all services involving stablecoins that do not comply with the MiCA regulation. This covers trading, exchange, transfers, custody, advice and portfolio management. National authorities should require existing exposures to be cleared within three months at the latest. The document is supervisory guidance, not new legislation.
What it means: ESMA's opinion on stablecoins that do not comply with MiCA is one of the most practical developments of the year for crypto users in Europe, because it covers almost every service a licensed provider can offer, from trading and exchange to custody and portfolio management. In practice, customers of European platforms will see unauthorised stablecoins withdrawn by early 2027, since national authorities are asked to require existing positions to be wound down within three months at most. It should be noted that this is supervisory guidance and not new legislation, but national authorities, such as the Hellenic Capital Market Commission in Greece, usually follow such opinions, so providers will find it hard to ignore. Businesses that accept payments in or hold balances of such tokens should plan the switch to authorised stablecoins now, so they are not converting balances in a hurry when platforms drop support for those tokens.
-
Regulation
ESMA sets out its proposals for the MiCA review
ESMA has responded to the Commission's consultation on reviewing the MiCA regulation, drawing on its early experience of applying it. It notes that the transitional period ended on 1 July 2026. In ESMA's view MiCA offers a solid level of protection but falls short of the rules for traditional financial instruments. It asks for targeted changes to avoid duplicate requirements and legal uncertainty.
What it means: ESMA's response to the Commission's consultation on reviewing MiCA is a reminder that the European crypto framework is not a finished text, but legislation that will keep changing as supervisors gain experience applying it, especially now that the transitional period has ended and every provider must operate with a full licence. The view that MiCA offers significant protection but lags behind the rules for traditional financial instruments points towards stricter requirements in future, while the request for targeted changes to avoid duplicate obligations and legal uncertainty shows supervisors themselves seeing problems in practice. For businesses in the sector, this means compliance is not a one-off project but a process that must be able to adapt to new requirements every few years. Anyone designing products in this area in Greece or elsewhere in Europe should build flexible processes and follow the Commission proposals that will come next, since the review could reshape key obligations.
-
Regulation
Greek e-invoicing now starts on 2 November for firms under €1m turnover
Joint decisions by Greece's Deputy Finance Minister and the head of the tax authority AADE move the mandatory e-invoicing start for businesses with turnover under €1,000,000. The obligation now begins on 2 November 2026. Until 31 January 2027 a phased period allows parallel use of ERP software or the myDATA entry form, provided the start declaration was filed on time. The second phase of digital delivery documents is also postponed.
What it means: Postponing mandatory e-invoicing for businesses with turnover below one million euros gives smaller firms a little more time, but it does not change the direction: issuing invoices through certified providers and sending data to myDATA is becoming the rule for everyone. The transition period to the end of January 2027, allowing parallel use of business software or the myDATA entry form, is a practical relief, but it requires the start declaration to be filed on time, so anyone who misses it loses that margin and risks being out of compliance from day one. Postponing the second phase of digital delivery notes too shows the market needs more time to adapt, as often happens with major digital reforms by the tax administration. For small businesses and freelancers, now is the right moment to choose a provider, test the myDATA connection and train whoever issues documents, so the switch in November happens without errors or fines, always checking the official AADE announcements.
Summaries are ours. Copyright in the original articles remains with their publishers.
Have a project in mind?
Tell us what you need to achieve. You get a concrete proposal with scope, timeline and cost — no obligation.