MiFID Monitor – Q3 2026
1 MiFID II
1.1 Simplification of transaction reporting under MiFIR, EMIR and SFTR
On 2 July 2026, the European Securities and Markets Authority (ESMA) published a final report[1] setting out recommendations for the simplification and integration of transaction reporting requirements under the Markets in Financial Instruments Regulation (MiFIR)[2], the European Market Infrastructure Regulation (EMIR)[3] and the Securities Financing Transaction Regulation (SFTR)[4].
The report includes:
The identification of duplicated reporting requirements, unsynchronised regulatory changes and dual-sided reporting as key drivers of cost and complexity;
A recommendation for a single integrated transaction reporting framework based on a “report once” principle, allowing transaction data to be submitted once and reused for multiple supervisory purposes;
Estimates that the proposed reforms could generate annual net savings of between €250 million and €1 billion for market participants; and
Several proposed short-term measures to reduce reporting burdens, including expanded delegated reporting arrangements, streamlined intragroup exemption procedures and targeted reductions in duplicative reporting requirements.
ESMA considers that a more integrated reporting framework would reduce compliance costs for firms while improving the quality and usability of data for supervisors.
ESMA will engage with EU institutions on its recommendations. The proposed integrated reporting framework will require legislative amendments and a phased implementation process.
The final report can be accessed here.
1.2 Application of product intervention measures on binary options to event contracts
On 3 July 2026, ESMA published a Public Statement[5] reminding firms and national competent authorities (NCAs) that certain event contracts may fall within the scope of national product intervention measures on binary options.
Key points include:
Event contracts are agreements with a binary outcome (fixed payout or no payout) based on the occurrence of a future event;
Event contracts that qualify as financial instruments under MiFID II are derivatives and fall within the scope of national product intervention measures on binary options;
The marketing, distribution or sale of such products to retail clients is prohibited;
Firms should assess whether the measures apply based on the characteristics of the product rather than its commercial name;
The existence of a coupon or reward does not alter the binary nature of an event contract; and
The distribution of event contracts that qualify as financial instruments requires MiFID II authorisation, including where they are offered solely to non-retail clients.
In summary, ESMA reminds firms to carefully assess whether event contracts fall within the scope of existing binary options restrictions and to ensure compliance with applicable MiFID II requirements.
The Public Statement can be accessed here.
1.3 Supervisory briefing on triangular passporting under MiFID II
On 7 July 2026, ESMA published a supervisory briefing setting out its expectations for firms and national competent authorities (NCAs) in relation to triangular passporting under MiFID II.
Triangular passporting arises where an investment firm uses a branch or tied agent established in one host Member State to provide investment services into another host Member State. ESMA notes that while MiFID II neither expressly provides for nor prohibits this practice, it can raise supervisory and investor protection concerns.
The supervisory briefing sets out the following:
Firms using triangular passporting should clearly identify this arrangement in their passporting notifications and specify the services and activities to be provided in the third Member State;
Firms are expected to assess and regularly review the risks arising from this cross-border operating model;
Triangular passporting should not be used to circumvent supervisory requirements or facilitate regulatory arbitrage;
Firms should clearly inform clients in the third Member State that services are being provided through a branch or tied agent established in another Member State; and
Firms must ensure that clients can effectively access complaints procedures, alternative dispute resolution mechanisms and relevant compensation schemes.
The supervisory briefing can be accessed here.
1.4 Supervision of cross-border activities
On 20 July 2026, ESMA published a follow-up report[6] to its 2022 peer review on the supervision of cross-border activities of investment firms and credit institutions providing services to retail clients under MiFID II.
The report assesses the progress made by the Netherlands, Germany, the Czech Republic, Luxembourg, Cyprus and Malta in implementing ESMA's 2022 recommendations. ESMA found that the peer review had a positive impact, with NCAs placing greater focus on cross-border services as a distinct supervisory area, strengthening authorisation processes and adopting more data-driven supervisory approaches.
The report also notes increased use of targeted supervisory actions, reported enforcement cases where appropriate and enhanced cooperation between authorities.
However, ESMA acknowledges that certain risks remain and it advises NCAs with significant outward cross-border activity to ensure that their supervisory and enforcement approaches remain proportionate to the scale and complexity of those activities.
The follow-up report can be accessed here.
1.5 Retail Investment Strategy Implementation
On 30 July 2026, the European Commission requested[7] ESMA's technical advice on the implementation of amendments to MiFID II, the UCITS Directive and AIFMD under the Retail Investment Strategy (RIS).
The mandate covers a range of areas, including value for money, inducements, simplification of the retail investor journey, suitability and appropriateness assessments, simple advice, marketing communications and undue costs.
ESMA is required to submit its technical advice to the European Commission by 1 October 2027.
The Commission's request for technical advice can be accessed here.
1.6 Order execution policies
On 23 July 2026, Commission Delegated Regulation (EU) 2026/825 supplementing MiFID II was published in the Official Journal of the European Union. The Delegated Regulation contains regulatory technical standards (RTS) specifying the criteria to be considered by investment firms when establishing and assessing the effectiveness of their order execution policies.
Criteria for consideration include the content of order execution policies, the selection of execution venues and the monitoring and periodic assessment of the effectiveness of those policies. The RTS were developed under Article 27(10) of MiFID II, as amended by MiFID III[8], and are based on draft RTS submitted by ESMA in April 2025.
The Delegated Regulation entered into force on 12 August 2026 and will apply from 12 February 2028, giving firms time to update their policies, procedures and systems.
For further analysis, see the Dillon Eustace briefing paper here.
The Delegated Regulation can be accessed here.
1.7 Commodity derivatives reporting framework
On 3 September 2026, ESMA launched the new weekly commodity derivatives position reporting framework. Market participants are now required to submit weekly position reports for commodity derivatives in accordance with the revised reporting requirements under Article 58 of MiFID II, as amended by MiFID III.
The reporting requirements apply to market operators and investment firms operating trading venues that trade commodity derivatives or derivatives on emission allowances.
The Interface Specifications Document can be accessed here.
The XML schema can be accessed here.
1.8 ESMA publishes its 2027 Annual Work Programme
On 28 September 2026, the European Securities and Markets Authority (ESMA) published its 2027 Annual Work Programme, setting out its planned workstreams and deliverables for the year. Planned activities include:
Integrated funds reporting framework: As part of its work to develop a single integrated funds reporting framework under the UCITS and AIFMD regimes, ESMA plans to publish draft RTS and implementing technical standards (ITS) in Q2 2027, and to begin a dedicated IT project for funds reporting;
EU Retail Investment Strategy: ESMA is to deliver technical advice to the European Commission in Q4 2027, supplementing the new framework's requirements on undue costs and Value for Money assessments;
SFDR 2.0 and fund naming guidelines: Subject to the outcome of the SFDR 2.0 trilogue negotiations, ESMA will (with the other European Supervisory Authorities) prepare RTS supplementing the revised SFDR, carry out consumer testing and review its guidelines on the use of ESG or sustainability-related terms in fund names;
PRIIPs framework: If the PRIIPs Regulation revisions under the Retail Investment Strategy are adopted, ESMA will prepare related RTS on parts of the revised key information document (KID), including the new dashboard and performance sections;
Transaction reporting: ESMA will undertake a holistic review of transaction reporting under EMIR, SFTR and MiFIR, aimed at an integrated, simplified system based on a "report once" approach; and
Risk monitoring: ESMA expects to examine fund leverage, liquidity, stress testing and the interconnectedness of funds with the wider financial system.
ESMA notes that its planned 2027 activities remain subject to adjustment depending on the progress and outcome of the Market Integration and Supervision Package currently being negotiated by the co-legislators.
1.9 EU code of conduct for issuer-sponsored research
On 4 September 2026, Commission Delegated Regulation (EU) 2026/1092, containing RTS that establish an EU code of conduct for issuer-sponsored research, was published in the Official Journal of the European Union.
The RTS are intended to encourage wider use of high-quality issuer-sponsored research, while balancing regulation against the removal of obstacles for issuers.
The code of conduct itself is set out in the Annex to the Delegated Regulation and introduces a harmonised definition of "issuer-sponsored research", confining that label to investment research which the issuer has paid for in whole or in part and which complies with the code.
The Delegated Regulation is based on draft RTS submitted by ESMA in October 2025 and adopted by the European Commission on 21 May 2026. It entered into force on 7 September 2026.
The Delegated Regulation can be accessed here.
2 DORA
2.1 ESAs publish operational instructions for DORA incident reporting
On 16 September 2026, the European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) published operational instructions to support competent authorities in their supervisory engagement with financial entities on the reporting of major information and communication technology (ICT)-related incidents under the Digital Operational Resilience Act (DORA)[9], with the aim of enhancing data quality and consistency across jurisdictions.
The instructions clarify recurring practical points for completing the reporting templates and are provided by staff of the ESAs on a "best efforts" basis, representing neither a legal interpretation nor the official stance of the ESAs.
The operational instructions can be accessed here.
3 Central bank of ireland
3.1 Thematic assessment of the Fitness and Probity Regime
In September 2026, the Central Bank of Ireland published a thematic assessment report on the implementation of key aspects of the Fitness and Probity (F&P) Regime within the MiFID investment firm sector.
The report finds that while many firms have appropriate F&P policies and procedures in place, several firms demonstrate weaknesses in the practical application of those requirements. Common issues include insufficient due diligence at the onboarding stage and deficiencies in the annual certification process for Pre-Approved Controlled Function (PCF) role holders.
The Central Bank of Ireland also assessed firms' implementation of the Individual Accountability Framework (IAF) and, where applicable, the Senior Executive Accountability Regime (SEAR), noting that while many firms have made good progress, some firms' governance frameworks, policies and management responsibility maps require further enhancement.
The Central Bank of Ireland expects MiFID investment firms to review their arrangements, policies and procedures against the findings set out in the report.
The report can be accessed here.
3.2 Authorisation applications moved to the Central Bank Portal
With effect from 24 September 2026, firms seeking authorisation under MiFID and firms making post‑authorisation submissions are required to submit the related documentation through the Central Bank of Ireland's Central Bank Portal. Submissions are no longer made through the previous channels, and applicants should use the Portal for the full suite of MiFID application and notification forms.
The forms to be submitted through the Portal include the following:
MiFID Investment Firm Authorisation Application Form;
MiFID II Application Form for Data Reporting Services Providers (DRSPs)
DLT Pilot Regime for Market Infrastructures Application Form;
Acquiring Transaction Notification Form for Authorised MiFID Investment Firms and Fund Service Providers;
Breach and Incident Reporting Forms for MiFID Firms (including Part 2 (Client Assets));
New Clients Information Schedule;
Individual Questionnaire Form for MiFID Firms and Fund Service Providers;
Notification Form under Regulation 24(3) and 24(12)(a) of the MiFID II Regulations[10]; and
Application Form for the Withdrawal (Voluntary Revocation) of a MiFID Investment Firm's Authorisation.
A completed Individual Questionnaire must continue to be submitted in respect of each proposed director and senior manager.
Further details, including the current list of relevant forms, are set out on the Central Bank of Ireland's MiFID Communications page, which can be accessed here.
The MiFID System Submission Guide for the Central Bank of Ireland Portal can be accessed here.
The Authorisation Guidance Note on Completing an Application Authorisation as a MiFID Form for Investment Firm can be accessed here.
3.3 Consultation on Industry Funding Levy Proposals
In September 2026, the Central Bank of Ireland published Consultation Paper 172 (CP172), seeking views on proposed changes to the methodologies used to determine and calculate the annual Industry Funding Levy (Levy) payable by regulated firms in certain industry categories.
The changes concern how the Levy is distributed across firms within a category. They principally involve moving certain categories of firms to an ad valorem approach and adding a user funds metric for Payment and E-Money Institutions, which will be phased in over a four-year transition period.
The consultation is open until 8 January 2027.
The consultation paper can be accessed here.
4 AML & CFT
4.1 Formats for reporting suspicions
On 2 July 2026, the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) published a consultation paper on draft implementing technical standards (ITS) specifying the format to be used for reporting suspicions and providing transaction records under Article 69(3) of the AML Regulation[11].
Key points include:
The draft ITS establish uniform formats for reporting suspicions of money laundering and terrorist financing and for providing transaction records to financial intelligence units (FIUs).
The proposals seek to address differences in reporting practices across Member States, which can create challenges for FIUs and obliged entities operating on a cross-border basis.
The draft ITS are designed to promote a high degree of convergence across the EU while accommodating sector-specific differences.
Separate annexes to the draft ITS set out the data points that may be submitted to FIUs, with reporting entities required to provide only the relevant subset based on the nature of the activity and suspicion reported.
AMLA proposes a two-phase implementation process for the reporting of suspicions, recognising differences in existing FIU practices across Member States.
The consultation closed on 20 September 2026. AMLA is required to submit the final draft ITS to the European Commission by 30 November 2026.
The consultation paper can be accessed here.
4.2 Terrorist Offences
The Criminal Justice (Terrorist Offences) (Amendment) Act 2025 (Act) was enacted on July 7, 2026. It amends the Criminal Justice (Terrorist Offences) Act 2005 to fully implement EU Directive 2017/541 on combating terrorism. This will allow for the prosecution of a broader range of terrorist activities, including terrorist acts with a cross-border element, and cyber-attacks where the aim is to cause widespread harm.
Draft RTS on pecuniary sanctions, administrative measures and periodic penalty payments
On 8 July 2026, AMLA published its final report on draft regulatory standards (RTS) on pecuniary sanctions, administrative measures and periodic penalty payments pursuant to Article 53(10) of MLD6[12]. AMLA consulted on an earlier version of the draft RTS between 9 February 2026 and 9 March 2026, and feedback received has been reflected in the draft where appropriate.
Key points include:
The draft RTS establish indicators for assessing the gravity of breaches, criteria for determining the level of pecuniary sanctions and administrative measures, and a methodology for imposing periodic penalty payments (PePPs).
Supervisors will follow a three-step approach:(a) assess the gravity of a breach using a common set of indicators, including factors such as duration, repetition and impact; (b) classify the breach into one of four categories of severity; and (c) determine the appropriate pecuniary sanction or administrative measure using specified criteria.
Supervisors will apply supervisory judgement when assessing whether, and to what extent, the relevant indicators and criteria are met.
The draft RTS also contain specific provisions relating to natural persons, including senior management and members of management bodies in their supervisory function.
Additional provisions address procedural aspects of periodic penalty payments, including the right to be heard, limitation periods and minimum requirements for decisions imposing such penalties.
The draft RTS will be submitted to the European Commission for adoption before publication in the Official Journal of the European Union.
The draft RTS can be accessed here.
4.3 EDPB and AMLA to develop joint guidelines on partnerships for information sharing
On 1 July 2026, the European Data Protection Board (EDPB) and AMLA announced that they will jointly develop guidelines on information sharing partnerships for anti-money laundering and counter-terrorist financing (AML/CTF) purposes.
The joint guidelines will provide practical guidance on how information can be shared to combat money laundering and terrorist financing while ensuring compliance with data protection requirements. The initiative relates to Article 75 of the AML Regulation, which permits information sharing between obliged entities subject to AML requirements and public authorities within defined limits. The guidelines will help companies, supervisors, financial intelligence units (FIUs) and data protection authorities understand how partnerships can be established in a way that supports both effective information sharing and the protection of personal data. A joint drafting team comprising representatives from both the EDPB and AMLA will lead the work.
The EDPB and AMLA will hold a stakeholder engagement event later in 2026 and intend to launch a public consultation on the draft guidelines during the first half of 2027.
A copy of the AMLA press release is available here.
4.4 Direct supervision framework under the AML Regulation
On 21 July 2026, AMLA published its final report on draft implementing technical standards (ITS) concerning co-operation within the EU AML/CTF supervisory system for the purposes of AMLA's direct supervision under the AML Regulation.
The draft ITS establish a framework for co-operation between AMLA and national supervisors in advance of AMLA assuming direct supervision of certain high-risk cross-border financial institutions from 2028. The ITS set out the process for identifying and selecting institutions for direct supervision, as well as arrangements to ensure continuity and consistency when supervisory responsibility transfers between national authorities and AMLA.
In summary, the ITS are intended to support a coordinated and proportionate approach to AML/CTF supervision across the EU and facilitate the implementation of AMLA's direct supervisory mandate.
The draft ITS will be submitted to the European Commission for adoption. Once adopted, they will apply to the data collection and selection process leading up to AMLA's direct supervision commencing in 2028.
The Final Report can be accessed here.
Also on 21 July 2026, AMLA published a frequently asked questions (FAQ) document addressing common questions relating to the reporting package on the identification of provisionally eligible obliged entities for direct AMLA supervision.
The FAQ is intended to support reporting obliged entities during data collection exercises conducted at national level. It brings together questions received from national financial supervisors and provides clarification on key areas of interpretation, operational issues and practical implementation matters. The document is designed to assist entities in preparing and submitting reporting information accurately and efficiently.
In summary, the FAQ provides practical guidance to support firms and supervisors in the implementation of AMLA's reporting requirements for the identification of entities that may fall within its direct supervisory remit.
The FAQ can be accessed here.
4.5 Access to Beneficial Ownership Central Register
On 7 August 2026, the European Union (Anti-Money Laundering: Beneficial Ownership of Corporate Entities) (Amendment) Regulations 2026 (Regulations) were published, amending the access regime for the Central Register of Beneficial Ownership of Corporate Entities.
The Regulations can be accessed here.
A Dillon Eustace briefing entitled “AMLD6 and Beneficial Ownership Central Registers: New Access Rules in Ireland” can be accessed here.
4.6 The National AML/CFT Strategy 2026
On 12 August 2026, the Anti-Money Laundering Steering Committee (AMLSC), chaired by the Department of Finance, published Ireland's National Anti-Money Laundering, Countering the Financing of Terrorism and Countering Proliferation Financing (AML/CFT/CPF) Strategy 2026–2030 (Strategy).
The Strategy sets out the Government's approach across five Strategic Goals — national coordination, risk assessment and understanding, regulatory framework, capacity building and outreach, and international cooperation — supported by a Priority Action Plan of 30 actions, with delivery to be driven across relevant departments and agencies over the 2026–2030 period.
The Strategy can be accessed here.
4.7 AMLA finalises three sets of regulatory technical standards (RTS)
AMLA has finalised three sets of RTS defining key measures that companies and professionals must apply to reduce money laundering and terrorist financing risks:
The RTS on customer due diligence under Article 28(1) of the AMLR (CDD RTS),
The RTS on criteria for identifying business relationships, occasional and linked transactions and lower thresholds under Article 19(9) of the AMLR (Business Relationships RTS), and
The RTS on group-wide minimum requirements and additional measures for subsidiaries and branches in third countries under Articles 16(4) and 17(3) of the AMLR (Group-wide RTS).
A Dillon Eustace briefing paper can be accessed here.
The final draft standards have been submitted to the European Commission and, once adopted and published in the Official Journal of the European Union, are proposed to apply (subject to certain exemptions for the non-financial sector) six months after their entry into force.
Each of the RTS can be accessed here.
5 EMIR
5.1 New clearing thresholds
On 14 July 2026, the European Commission adopted a Delegated Regulation[13] amending Delegated Regulation (EU) No 149/2013 as regards the clearing thresholds and the mechanisms triggering their review.
The Delegated Regulation establishes:
new clearing thresholds for aggregate positions for financial counterparties under Article 11;
new clearing thresholds for uncleared positions under Article 11a; and
a new review mechanism under Article 11b requiring ESMA to monitor specified market indicators and initiate a review of the thresholds where significant changes are identified.
The Council of the EU and the European Parliament will now scrutinise the Delegated Regulation and, if neither objects, it will enter into force on the 20th day following its publication in the Official Journal of the European Union.
The Delegated Regulation can be accessed here.
A Dillon Eustace briefing entitled “EMIR 3.0: Changes to the Clearing Threshold Regime” explaining the changes can be accessed here.
5.2 Amendments to bilateral margin requirements
On 31 July 2026, the ESAs published a final report on draft RTS[14] that would ease the bilateral margin regime in Commission Delegated Regulation (EU) 2016/2251.
The proposals target counterparties that are in scope of initial margin requirements but sit below the €8 billion threshold set under EMIR, smoothing the phase-out of initial margin for that cohort and aligning the EU treatment more closely with other jurisdictions.
At present, a below-threshold counterparty need not post initial margin on new uncleared over-the-counter (OTC) derivatives but remains obliged to do so for contracts already on its books. The draft RTS would remove that residual obligation, so that such counterparties exchange no initial margin on either new or legacy contracts. The ESAs describe the change as a response to market participant requests and as part of their wider simplification and burden-reduction agenda.
The ESAs have submitted the Final Report and draft RTS to the European Commission for endorsement. Once the Commission has completed its adoption process, the RTS will pass to the European Parliament and the Council of the EU for scrutiny before publication in the Official Journal of the European Union.
The final report can be accessed here.
5.3 New initial margin requirements
On 31 July 2026, the ESAs published a final report on draft RTS amending the initial margin requirements for certain uncleared OTC derivatives under EMIR.
The draft RTS propose extending the existing derogation from initial margin requirements to existing OTC derivative contracts where one counterparty falls below the EUR 8 billion threshold for non-centrally cleared OTC derivatives. The amendments are intended to simplify the treatment of counterparties falling below the threshold and align the EU framework with approaches adopted in other jurisdictions.
The draft RTS have been submitted to the European Commission for endorsement and will subsequently be subject to scrutiny by the European Parliament and the Council.
The final report can be accessed here.
5.4 EBA Fees for Validation of Pro Forma Models
On 17 August 2026, Commission Delegated Regulation (EU) 2026/1000 was published in the Official Journal of the European Union (Delegated Regulation). The Delegated Regulation supplements EMIR by specifying how the EBA will determine and collect fees for the validation of pro forma models used by certain counterparties to calculate collateral requirements for non-centrally cleared OTC derivatives.
The Delegated Regulation sets out the methodology for calculating fees, including how the EBA will estimate its validation costs and how counterparties must calculate their average outstanding notional amounts for fee purposes. It also establishes the fees payable by counterparties on an ongoing basis and the arrangements applicable to existing and newly introduced pro forma models.
In summary, the Delegated Regulation provides the framework for the EBA's fee regime in relation to its new validation responsibilities under EMIR 3.
The Delegated Regulation entered into force on 6 September 2026.
The Delegated Regulation can be accessed here.
5.5 Reporting framework for clearing activity
On 18 August 2026, ESMA published a consultation paper on draft RTS and ITS relating to annual reporting requirements for clearing activity under EMIR 3.0.
The proposals set out the content and format of annual reports to be submitted by clearing members and clients on their activity at recognised third-country central counterparties (TC-CCPs). The reporting framework is intended to provide supervisors with a consistent overview of the scale, characteristics and risk profile of EU firms' exposures to TC-CCPs.
The consultation closed on 12 October 2026. ESMA expects to publish a final report in Q4 2026.
The consultation paper can be accessed here.
6 MISCELLANEOUS
6.1 ESMA calls on firms to finalise preparations ahead of T+1 settlement deadlines
On 20 July 2026, ESMA published a statement reminding market participants of the preparations required ahead of the EU's transition to a T+1 settlement cycle on 11 October 2027.
Key points include:
ESMA noted that industry readiness has improved, although implementation progress remains uneven across sectors, firms and Member States.
Market participants should accelerate implementation efforts and consider the requirements contained in the proposed amendments to Commission Delegated Regulation (EU) 2018/1229 alongside the recommendations of the EU T+1 Industry Committee.
Firms will be required to comply with a first set of requirements by 7 December 2026, including enhanced timelines for allocations and confirmations and the use of international communication standards.
A second set of requirements will apply from 11 October 2027, including earlier submission of settlement instructions and the use of certain settlement optimisation functionalities such as auto-partial settlement, hold and release, and auto-collateralisation.
ESMA emphasises the importance of automation, standardisation, data quality and end-to-end readiness across the trading and settlement chain.
The statement warns that inadequate preparation could result in operational, compliance and reputational risks, including increased settlement failures and disruption to trading activities.
In summary, ESMA is urging firms to prioritise T+1 transition planning and implementation to ensure readiness ahead of the October 2027 go-live date.
Firms should ensure compliance with the first implementation deadline of 7 December 2026 and be fully prepared for the transition to T+1 settlement on 11 October 2027.
The statement can be accessed here.
6.2 Savings and Investments Union
The European Commission adopted a package[15] of measures aimed at removing barriers within the EU single market for financial services as part of its Savings and Investments Union (SIU) strategy.
The package includes:
Measures to improve market integration in trading, post-trading and asset management, including enhanced passporting opportunities for Regulated Markets (RMs) and Central Securities Depositories (CSDs), the introduction of a Pan-European Market Operator (PEMO) status, and streamlined cross-border distribution of UCITS and AIFs;
Measures to facilitate innovation by adapting the regulatory framework for distributed ledger technology (DLT) and amending the DLT Pilot Regulation to increase flexibility and legal certainty;
Reforms to the supervisory framework, including proposals to transfer direct supervisory responsibilities for certain market infrastructures and all Crypto-Asset Service Providers (CASPs) to ESMA, while enhancing ESMA's coordination role in the asset management sector; and
Simplification measures aimed at reducing regulatory burdens through the increased use of regulations, streamlined Level 2 mandates and reduced national options and discretions.
In summary, the package seeks to reduce fragmentation in EU financial markets, support cross-border activity, promote innovation and strengthen the competitiveness of the EU financial services sector.
The proposals must be negotiated and approved by the European Parliament and the Council before they can be adopted.
The European Commission proposals can be accessed here.
6.3 Management of third-party risk related to non-ICT services
On 18 September 2026, the European Banking Authority (EBA) published a final report[16] with new guidelines on managing the risks arising from firms' use of external providers of non‑ICT services. The guidelines align the EBA's 2019 outsourcing framework with the digital operational resilience regime under DORA and will replace the previous guidelines from 2019 on commencement.
The guidelines apply to arrangements with third‑party service providers and their subcontractors, focusing on those supporting critical or important functions. For these, the EBA sets out the expected approach across the life cycle of the arrangement, applies proportionality criteria, and aligns the framework with the DORA register so that firms may record ICT and non‑ICT arrangements consistently, including in a single register.
The application date and the date for competent authorities to confirm compliance remain to be fixed, but a two‑year transition period will apply to allow firms to revise existing contracts and update their registers for non‑ICT arrangements.
The EBA final report can be accessed here.
6.4 ESMA publishes updated Q&As 2026 (updated 21 September 2026)
During the third quarter of 2026, the European Securities and Markets Authority (ESMA) published answers to four Q&As of relevance to investment firms and other market participants. Three of the Q&As related to the ESG Rating Regulation[17] and the other related to MiFIR.
The ESMA Q&As can be accessed here.
6.5 Distance Contracts for Financial Services
On 3 July 2026, European Union (Distance Contracts for Financial Services) Regulations 2026 were published, These Regulations transpose Directive (EU) 2023/2673 (DMD II) into Irish law.
The Regulations amend the Consumer Rights Act 2022 and introduce a new framework for certain financial services contracts concluded at a distance. Key measures include:
New online cancellation rights, including a requirement for firms to provide a prominently displayed online cancellation function.
A 14-day cooling-off period for most distance financial services contracts and a 30-day cooling-off period for personal pension products.
Enhanced pre-contractual information requirements and obligations to provide adequate explanations to consumers.
A right for consumers to request human intervention before entering into certain contracts.
New protections against certain forms of online manipulation ("dark patterns").
Enforcement powers for the Competition and Consumer Protection Commission and the Central Bank of Ireland.
The Regulations can be accessed here.
6.6 Commission adopts digital package to simplify EU digital rules
The European Commission adopted a digital package intended to reduce the administrative and compliance burden on EU businesses, with simplification measures estimated to save up to €5 billion in administrative costs by 2029 and the European Business Wallets potentially unlocking a further €150 billion in savings for businesses each year. The package comprises:
A digital omnibus, which simplifies existing rules on artificial intelligence (AI), cybersecurity and data, including linking the application of the high-risk AI system rules under the AI Act to the availability of supporting standards and tools (adjusted to a maximum of 16 months), targeted amendments to the AI Act for small and medium-sized enterprises (SMEs) and small mid-cap companies (SMCs), a single entry point for cybersecurity incident reporting across the NIS2 Directive, the General Data Protection Regulation (GDPR) and the Digital Operational Resilience Act (DORA), targeted amendments to the GDPR, modernised cookie-consent rules, and consolidation of EU data rules through the Data Act;
A Data Union Strategy, which sets out further measures to unlock high-quality data for AI, including a Data Act Legal Helpdesk and measures to strengthen Europe's data sovereignty; and
A European Business Wallet, providing companies and public bodies with a single digital identity to sign, timestamp, store and exchange verified documents and communicate securely with businesses and public authorities across all 27 Member States.
The digital omnibus legislative proposals will now be submitted to the European Parliament and the Council of the EU for adoption. In parallel, the Commission has launched a consultation on a Digital Fitness Check, open until 11 March 2026, to assess the coherence and cumulative impact of the EU's digital rules.
The digital package can be accessed here.
Footnotes:
[1] ESMA12-1406959660-3235
[2] 600/2014
[3] 648/2012
[4] (EU) 2015/2365
[5] ESMA35-243228190-8148
[6] ESMA42-2004696504-8471
[7] Ares(2026)7504292
[8] (EU) 2024/790
[9] Regulation (EU) 2022/2554
[10] S.I. No. 375 of 2017
[11] Regulation (EU) 2024/1624
[12] Directive (EU) 2024/1640
[13] Delegated Regulation (C(2026) 4861
[14] Final Report ESA 2026 07
[15] COM(2025) 942 final / 2025/0382 (COD)
[16] EBA/GL/2026/09
[17] Regulation (EU) 2024/3005
DISCLAIMER: This document is for information purposes only and does not purport to represent legal advice. If you have any queries or would like further information relating to any of the above matters, please refer to the contacts above or your usual contact in Dillon Eustace.
Copyright Notice: © 2026 Dillon Eustace LLP. All rights reserved.
)
)
)