Insights
News and articles on EU fintech topics — licensing, AML, payments, reporting for operators.
DORA threat-led penetration testing (TLPT)
TLPT under DORA Articles 26 and 27: who identifies the entities, who validates scope, testing on live systems every three years, and…
The PSD2 limited network exclusion — Article 3(k)
PSD2 Article 3(k) and 3(l): the three limited-network limbs, the functionally-connected test, the telecoms caps and the EUR 1 million notification.
Safeguarding compared across the EU
Safeguarding under PSD2 Article 10 and EMD2 Article 7: the segregation and insurance methods, the deadlines, and why eligible assets are national.
Modelo 720 — Spain’s foreign asset declaration
Modelo 720: three separate obligations under the RGAT, each with its own EUR 50,000 threshold, the growth trigger and the post-2022 penalty…
EBA remote customer onboarding guidelines
EBA/GL/2022/15 on remote customer onboarding: the pre-implementation assessment, the eIDAS shortcut, liveness rules and the review obligation.
Outsourcing under Circular CSSF 22/806
Circular CSSF 22/806 as amended by 25/883: what counts as outsourcing, when a function is critical, the three-month notification and exit plans.
PSD2 agents — the register and where liability sits
Using agents under PSD2 Article 19: what must be notified, the two-month response, why an agent may only start on registration, and…
Small payment institutions — the Article 32 exemption
The PSD2 Article 32 small payment institution regime: the monthly-average ceiling, why it cannot be passported, and how Article 33 differs for…
SCA exemptions under the PSD2 RTS
SCA exemptions: the contactless and low-value counters, the transaction-risk-analysis thresholds and reference fraud rates, and how an exemption is lost.
MiCA CASP grandfathering has closed — what now
The MiCA transitional period for crypto-asset service providers expired on 1 July 2026: what is spent, and the deadline still running to…