Fintech Regulatory Updates

We are pleased to highlight below some key regulatory developments and events from the recent months, affecting various sectors in the fintech industry, including crypto, online trading and derivatives, payments and financial services. In the weeks since President Trump’s inauguration, the US administration is undergoing a broad shift in its economic and regulatory policy, affecting the entire fintech ecosystem. This seminal change is reflected in the decisions and developments discussed in this update. Our fintech and crypto team is helping our clients in monitoring and navigating the evolving regulatory environment for cross-border activities. We will be happy to further review and elaborate on each of these updates, their implications and any other questions you may have. Ariel Yosefi, Eden Lang, Dima Zalyalyeyev, Yonatan Glatt and Gal Mechtinger.  

Crypto, Forex and Derivatives

United States

 

After Years of Cracking Down on the Industry, the US Makes a Pivot to Crypto	The first months of 2025 brought a drastic change in the US crypto policy. Promising to make America “crypto capital of the planet”, President Trump’s administration has moved to overhaul regulations and governmental agencies to adopt a more favorable and “innovative” approach towards the industry. Here are some of the key decisions and events signalling this 180-degree shift from recent weeks: ● Executive Order on Strengthening American Leadership in Digital Financial Technology (link) ○ On 23 January 2025, President Donald J. Trump signed an Executive Order aiming to enhance the United States’ position as a global leader in digital assets and financial technology. The Executive Order establishes the President’s Working Group on Digital Asset Markets, which is directed to recommend, within 180 days, a federal regulatory framework for digital assets, including stablecoins, and evaluate the creation of a strategic national digital asset stockpile (crypto reserve). Key objectives of the executive order are to ensure individuals’ rights to use public blockchain networks for lawful purposes, such as software development, mining, self-custody of assets, and uncensored transactions. The order also prohibits the establishment and use of Central Bank Digital Currencies (CBDCs) in the US, citing concerns regarding financial stability, privacy, and national sovereignty. It repeals previous executive actions on digital assets that were put in place by the Biden administration, and directs the Treasury to rescind its international engagement framework on digital assets. ● SEC Establishes Task Force “To Do Better” on Crypto, Overhauls Enforcement Team (link) (link) ○ On 21 January 2025, the US Securities and Exchange Commission (SEC) announced the formation of a dedicated crypto task force to establish a clear regulatory framework for digital assets. Commissioner Hester Peirce, known for her supportive stance on cryptocurrency and often referred to as “Crypto Mom,” will lead this initiative.  The SEC’s own press release admits that the commission has to date “relied primarily on enforcement actions to regulate crypto retroactively and reactively,  often adopting novel and untested legal interpretations along the way”. This resulted in market confusion and created “an environment hostile to innovation and conducive to fraud. The SEC can do better.” The purpose of the task force will be “to help the Commission draw clear regulatory lines, provide realistic paths to registration, craft sensible disclosure frameworks, and deploy enforcement resources judiciously”, signaling a 180-degree shift to the Commission’s traditional approach. ○ On 20 February 2025, the SEC announced that the “Crypto Assets and Cyber Unit” responsible for crypto enforcement, will be replaced with a smaller team called “Cyber and Emerging Technologies Unit”. The removal of the term “crypto” indicates the unit will likely focus more on securities violations committed using other emerging technologies, such as artificial intelligence, social media or the dark web. The SEC acting chairman, Mark Uyeda, said that the unit’s task will not only be to protect investors but also “to facilitate capital formation and market efficiency by clearing the way for innovation to grow”. ● After Interim Court Losses, SEC Drops Landmark Case Against Coinbase (link) (link) ○ Crypto exchange Coinbase announced that the SEC staff has agreed to dismiss its enforcement case against the company, subject to the SEC commissioner’s approval. Coinbase has not provided further details about the agreement, but in a later interview, Paul Grewal, Coinbase’s chief legal officer, said that it is “nothing short of a complete win”, and that Coinbase would not have to admit to any wrongdoing or pay a fine. ○ The SEC decision comes amid the agency’s policy realignment regarding crypto and two setbacks in the legal battles against Coinbase. In June 2023, the SEC sued Coinbase, largest crypto exchange in the US, alleging that Coinbase’s business amounts to the operation of an unregistered broker, exchange, and clearing agency in securities. Coinbase claimed that the cryptoassets traded on its platform were “not within the SEC’s authority” because they are not investment contracts per the Howey test and, therefore, not securities. On 27 March 2024, in a victory for the SEC, the District Court of the Southern District of New York declined Coinbase’s request to dismiss the case, holding that Coinbase failed to prove, as a matter of law, that the tokens did not qualify as investment contracts. However, on 7 January 2025, the same court allowed Coinbase to appeal the decision to the US District Court of Appeals for the Second Circuit (“2nd Circuit”). A motion for an interlocutory appeal of the court’s prior ruling is rarely given, marking a significant win for Coinbase that effectively halted the SEC’s lawsuit. (The legal question at the heart of the case, which was supposed to be referred to the 2nd Circuit, is whether the Howey test requires a direct promise or contract between the issuer and the purchaser or does not require such a link. The former proposition was adopted by the SDNY in the Ripple case, and endorsed by Coinbase – while the latter was ruled in the Terraform case, supported by the SEC. With the Coinbase lawsuit now being dropped, this question will be left undetermined in the meantime.) ○ Separately, the US Court of Appeals for the Third Circuit required the SEC to provide a more complete explanation for its refusal to issue rules on the application of securities laws to crypto assets. In July 2022, almost a year before the SEC sued Coinbase in SDNY (as discussed in previous paragraph), Coinbase petitioned the SEC to propose tailored rules to the industry, arguing that the existing framework is incoherent and “fundamentally incompatible with the operation of digital asset securities”. The SEC denied the request, arguing  (in a single paragraph) that it has wide discretion to determine the timing and priorities of its regulatory agenda, including with respect to rulemaking. The 3rd Circuit court found the SEC’s denial of Coinbase’s petition to be  insufficiently reasoned, and thus arbitrary and capricious under the Administrative Procedure Act (APA). In a majority opinion, the judges asserted that while the SEC is not mandated to draft new rules, it  must provide a more detailed and reasoned explanation on why it is appropriate to favor enforcement over rulemaking. ● SEC Drops Uniswap, Robinhood and OpenSea Investigations (link) (link) (link) ○ On 26 February 2025, Uniswap Labs, developer of the decentralized exchange Uniswap, announced that the SEC has closed its investigation against the company. The SEC previously sought to sue Uniswap for allegedly operating as an unregistered broker, exchange, and clearing agency due to its role in the Uniswap Protocol. “Labs” strongly denied these allegations, arguing that Uniswap is a DeFi platform not maintained by any centralized party. The case could have potentially brought DeFi network into the purview of the SEC, an outcome feared by most industry participants. Two days earlier, the SEC reportedly closed another two high profile cases: one against Robinhood, a licensed broker, for allegedly listing tokens considered as securities; and against OpenSea, a marketplace for non-fungible tokens (NFT), potentially signaling that the Commission is backing away from previous stance on classifying NFTs as securities. ● SEC cancels crypto rule SAB 121 (link) ○ In January 2025, the SEC rescinded Staff Accounting Bulletin No. 121 (SAB 121), which was a rule introduced in March 2022 that required financial institutions holding cryptocurrencies on behalf of clients to record these assets as liabilities on their balance sheets. This rule was criticized for making it administratively challenging and costly for banks to offer crypto custody services. Industry leaders and policymakers have welcomed this change, noting that it removes barriers for banks to serve as custodians for digital assets, promoting innovation and broader adoption within the financial sector.
Institutional Investors Could Be Held Liable for DAO Actions: US Court (link)	On 18 November, 2024, the District Court for the Northern District of California provided a significant ruling on the legal status of Decentralized Autonomous Organizations (DAOs) and the potential liability of their members. The case of Samuels v. Lido involves an investor who sued the Lido DAO, a decentralized Ethereum “staking” service, after incurring losses on the DAO’s governance tokens  that he purchased via a secondary exchange. The plaintiff claimed that Lido is a general partnership and by selling the tokens as unregistered securities, it violated US securities regulations. He also sued four institutional investors holding Lido tokens – Paradigm Operations, Andreessen Horowitz (a16z), Dragonfly Digital Management, and Robot Ventures –  alleging they acted as members of the DAO general partnership and thus are jointly and severally liable for its misconduct. Defendants filed a motion to dismiss, arguing that the DAO is not a legal entity capable of being sued, and that, even if it were, token holders should not be held personally liable for its actions. In denying most defendants’ motions to dismiss and allowing the case to proceed, the court delivered several key assertions on the legal status of DAOs: 1. The court determined that Lido DAO is a legal entity, classified as a general partnership. Some defendants tried to make the case that the DAO is a mere “set of executable software programs” not owned or operated by any particular entity. This argument, while popular in the crypto industry, was widely rejected. Under California law which the court applied, a partnership is “the association of two or more persons to carry on as co-owners a business for profit forms a partnership, whether or not the persons intend to form a partnership” (emphasis added). This condition is satisfied by the fact that the DAO was formed to run a staking service for rewards (to be distributed among token holders), even if the DAO was not explicitly designated as a partnership by its founders. As a general partnership, the DAO members could be held personally liable for the DAO’s actions. 2. Since the case is still in pleading stages, the court left open the question of who exactly is considered a “member” in the partnership: only the founders (narrow view) or any token holder who had voted or purchased the tokens (broader view). However, based on preliminary evidence, it found merit in the claim that three of the defendants, Paradigm, Andreessen Horowitz and Dragonfly, were playing an active, “hands-on” role in the Lido DAO making them general partners. The court cites two examples of Lido’s website praising Paradigm’s ability to “lend its expertise to Lido DAO governance”, and of Andreessen Horowitz, when announcing its investment in Lido, saying it will “contribute as both a staker and governance participant”. Such assertions support the plaintiff’s allegations that these investors were influencing the management and control of the DAO as general partners, although they were not involved in its creation but only purchased tokens at a later stage. If this ruling stands, the three investors may face legal responsibility for their alleged sale of tokens to other investors. 3. The court accepted the assertion that Lido DAO and its investors “solicited” the sale of tokens in violation of Section 12(a)(1) of the Securities Act, which allows purchasers to file civil lawsuits against issuers of unregistered securities. The defendants argued that this provision only applies to public sales of securities and in any case, their effort should not be considered as “solicitation”. Court rejected both lines of defence, asserting that Section 12(a)(1) applies even when token holders incurred losses on tokens purchased on secondary markets as a result of the issuer’s (and its managers) promotional efforts. The ruling reflects a broadening of the potential scope of liability by DAOs and their participants to retail investors.
OFAC Targets Russian and North Korean Crypto Laundering Networks (link) (link)	The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) has imposed sanctions on five individuals and four entities linked to the TGR Group, an international sanctions evasion and money laundering network for Russian oligarchs. According to OFAC, the network comprises multiple businesses and affiliates that offered a range of services to place, layer, and integrate illicit financial schemes into the global financial system. These include: the laundering of funds associated with sanctioned entities; providing an unregistered service to exchange cash and cryptocurrency; the receipt of cash and making the value available to clients in the form of cryptocurrency; providing a pre-paid credit card service; and, obfuscating the source of funds to allow high-net worth Russian nationals to purchase property in the United Kingdom. As a result of the decision, all property and interests in property of the blocked persons that are in the United States or in the possession or control of US persons will be blocked and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. In a separate announcement, OFAC said it has imposed sanctions on two individuals and one entity involved in a money laundering network by North Korea. Lu Huaying and Zhang Jian, both based in the United Arab Emirates (UAE), were sanctioned for facilitating money laundering and cryptocurrency conversion services that funneled illegal proceeds from Pyongyang’s cybercrime operations through a UAE-based front company, Green Alpine Trading, LLC According to OFAC, Huaying, a Chinese citizen, cashed out cryptocurrency derived from North Korean illicit activities into fiat cash on behalf of another sanctioned North Korean agent, representative of DPRK’s Korea Kwangson Banking Corp (KKBC). The laundered funds were then used as payment for purchases of products and services intended for financing North Korea’s WMD and ballistic program.
New IRS Reporting Obligations for Crypto Brokers (link)	The Internal Revenue Service (IRS) released final regulations on digital asset reporting requirements for brokers. The regulations define a “broker” as any person who regularly provides services effectuating transfers of digital assets on behalf of another person, including cryptocurrency exchanges, payment processors, and certain hosting services. Starting on 1 January 2025, brokers  will be required to report customer transactions to the IRS, similar to how traditional stockbrokers share information on their customers with the IRS. The requirements do not apply to individuals using digital assets for personal transactions, miners, and validators (which are excluded from the definition of brokers).
Texas Court Reverses Sanctions on Tornado Cash in Key Crypto Privacy Ruling (link)	The Court of Appeals for the 5th Circuit ordered the US government to lift sanctions on the decentralized crypto mixer Tornado Cash. In late 2022, the Department of the Treasury’s OFAC blacklisted Tornado Cash, an open-source software protocol that facilitates anonymous crypto transactions by obfuscating the origins and destinations of the transfer. OFAC argued that Tornado Cash played a pivotal role in laundering funds for malicious cyber actors such as a North Korea-linked hacking group. Tornado Cash was added to OFAC’S list of Specially Designated National and Blocked Persons (SDN), imposing a total prohibition against any dealings with Tornado Cash “property,” a term which OFAC asserts includes smart contracts. Six users of Tornado Cash challenged the decision in courts, claiming that OFAC does not have authority to sanction smart contracts (as opposed to persons and entities that use it). In reversing an opposite decision by the lower District Court for the Western District of Texas, the Court of Appeals holded that the Tornado Cash smart contracts are not the “property” of a foreign national or entity, and therefore are not subject to OFAC’s sanctioning powers. The appellate court pointed to a lack of clear definition of the term “property” in the International Emergency Economic Powers Act (IEEPA), which governs OFAC’s authority. It contended that immutable smart contracts are not property because they are not capable of being owned. While OFAC’s concerns with the use of Tornado Cash for money laundering are “undeniably legitimate”, the court reasoned, the proper way to handle this is for Congress to update IEEPA to target modern technologies like crypto-mixing software and not by administrative interpretations. This decision is a significant win for crypto privacy advocates, as it sets a precedent for the treatment of decentralized technologies under US law. The ruling acknowledges the distinction between software and the individuals who may use it for illicit purposes, challenging the previous US administration approach to regulating decentralized finance (DeFi) tools.
BitMEX fined $100 Million for violating AML Laws (link)	The District Court of the Southern District of New York imposed a $100 million fine on crypto exchange BitMex for violating the US Bank Secrecy Act. The sentence comes after Bitmex pleaded guilty to failing to implement adequate Anti-Money Laundering (AML) and Know Your Customer (KYC) measures for US customers, at least until 2018. In addition to the fine, BitMEX was placed on probation for two years. The Illicit Finance & Money Laundering Unit of the US Attorney’s Office for the Southern District of New York prosecuted Bitmex in 2024.
KuCoin pleads guilty to US charges, agrees to pay $300M (link)	Crypto exchange KuCoin has pleaded guilty to operating an unlicensed money transmission business in the United States. The company has agreed to pay penalties totaling $300 million as part of a settlement with the US Department of Justice (Attorney’s Office for the Southern District of New York). This plea comes as a result of KuCoin’s failure to implement an effective anti-money laundering program and operating without registering as a money services business with the Financial Crimes Enforcement Network (FinCEN). Accrding to the allegations, KuCoin did not require customers to provide any identifying information for opening trading accounts at least until August 2023, while KuCoin employees repeatedly stated on public social media sites that KYC was not mandatory on KuCoin, including in response to posts from customers who had identified themselves as being in the US Even after KuCoin adopted a KYC program, it did not impose necessary KYC procedures on customers that use KuCoin’s services only to withdraw or close positions, as required, or failed to report any suspicious transactions. As part of the agreement, KuCoin will be required to enhance its compliance procedures and exit the US market for two years, and the exchange’s founders will also forfeit $2.7 million and will no longer have any role in KuCoin’s management or operations.

 

European Union

 

Markets in Crypto-Assets (MiCA) Regulation Fully Effective (link)	The European Union’s Markets in Crypto-Assets (MiCA) Regulation fully came into effect on 30 December 2024, marking a significant milestone in crypto regulation across the EU. This date saw the implementation of the remaining parts of MiCA, including the licensing regime for Crypto Asset Service Providers (CASPs) and market abuse prevention mechanisms. While provisions for stablecoins (asset-referenced tokens and e-money tokens) had already been applied since 30 June 2024, this final phase introduces comprehensive requirements for other crypto-assets and service providers. CASPs are now required to obtain authorization from their national competent authorities to offer services in the EU market, implement robust operational and compliance controls, and adhere to strict AML and counter-terrorist financing measures.
ESMA Finalizes Guidelines on Qualification of Crypto Assets as Financial Instruments (link)	The European Securities and Markets Authority (ESMA) published its final report on “Guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments”. These guidelines, mandated under Article 2(5) of MiCA, aim to provide clarity and consistency across the EU regarding the classification of crypto assets as financial instruments, the latter falling outside MiCA and being subject to the existing regime of the second Markets in Financial Instruments Directive (MiFID II). Key aspects of the guidelines include: ● A case-by-case approach for determining whether a crypto-asset qualifies as a financial instrument, emphasizing the importance of considering specific rights conferred by each asset; ● Clarification on the cumulative criteria for qualifying as a “transferable security” (a subcategory of a financial instrument): (i) not being an instrument of payment, (ii) being a “class of securities,” and (iii) being negotiable on the capital market; ● Alignment with MiFID II’s approach to financial instruments, particularly regarding the interpretation of “negotiability” and “transferability”; ● Emphasis on a principle-based approach while providing more concrete criteria to enhance clarity and consistency; ● Further elaboration on what constitutes a “class of securities” and differentiation between tokens providing access to services and those conferring security-like rights.
New ESMA Rules on CASPs Conflict-of-Interest (link)	ESMA has released a new opinion outlining significant changes to conflict-of-interest requirements for CASPs under MiCA. A key modification is the potential need for CASPs to segregate conflicting crypto-asset services into separate legal entities with independent management when standard policies and procedures are insufficient to manage acute conflicts of interest. This legal entity separation aims to enhance investor protection and market integrity. Additionally, ESMA has introduced new requirements for personal transaction monitoring, mandating close scrutiny of transactions by connected persons, including documentation and approval processes. The definition of remuneration has also been expanded to cover all forms of payment, including financial and non-financial benefits. These changes require CASPs to implement stronger internal controls, maintain clearer separation between potentially conflicting activities, and establish comprehensive policies for monitoring personal transactions and remuneration disclosure.

 

United Kingdom

 

FCA Warning to Regulated Firms Partnering with Unregistered Crypto Exchanges  (link)

The UK’s Financial Conduct Authority (FCA) has published guidance on crypto asset financial promotions and fiat to crypto ramp (conversion) services, addressing concerns about regulated firms partnering with unregistered crypto asset entities. The FCA emphasizes that regulated firms may be inadvertently supporting illegal promotions by providing on/off ramp services to unregistered crypto asset companies. This could expose them to legal and reputational risks, including potential violations of the Proceeds of Crime Act 2002. To mitigate risks, the FCA encourages regulated firms to implement robust due diligence processes, enhance monitoring of partner activities, and consider restricting services to unregistered crypto asset firms, especially those subject to FCA consumer warnings. The guidance applies to crypto asset firms registered under MLRs, payment services and e-money firms, and FSMA authorized firms. The FCA stresses the importance of carefully considering commercial relationships with unregistered crypto asset firms to ensure compliance with regulatory obligations and maintain market integrity.

FCA Proposes New Measures for Crypto Market Transparency (link)

The FCA has released a discussion paper (DP24/4) outlining new proposals to improve transparency and integrity within the UK’s crypto markets. These initiatives aim to protect consumers and reduce risks by introducing stronger admission and disclosure rules and market abuse frameworks. The FCA is seeking input from industry participants on how to enhance risk disclosures, ensuring that investors are well-informed before making decisions. The paper also emphasizes the importance of collaboration, proposing that authorized crypto trading platforms share information to combat fraud and market abuse more effectively. This discussion builds on insights gathered from industry roundtables and prior government consultations.

 

Asia

 

South Korea Investigates Upbit for Massive KYC Violations (link)

South Korean cryptocurrency exchange Upbit is currently under investigation by the Financial Intelligence Unit (FIU) of the Financial Services Commission (FSC) for allegedly violating KYC procedures. The FIU has identified between 500,000 to 600,000 potential KYC violations, including the acceptance of blurred IDs and other improper documentation. These violations could result in significant fines, estimated at $71,500 per case, and may also impact Upbit’s ability to renew its business license. This investigation is part of a broader scrutiny of Upbit’s operations, following a previous anti-monopoly probe related to its relationship with K-Bank. K-Bank has a high exposure to cryptocurrency exchanges, raising concerns about potential conflicts of interest and market dominance. The outcome of these investigations could have substantial implications for Upbit’s business practices and regulatory compliance in the future. Upbit has reportedly received a suspension notice for alleged KYC violations. The FIU of South Korea’s FSC has notified Upbit of possible punitive measures, according to its latest report.

Hong Kong Courts Serve Legal Notices on Blockchain to Freeze Illicit Crypto Wallets (link)

Hong Kong courts have reportedly begun serving tokenized legal notices via blockchain to anonymous owners of illicit cryptocurrency wallets. According to Cointelegraph, a recent court injunction targeted two Tron-based wallet addresses, delivering tokenized notices to freeze assets linked to an online scam involving 2.65 million USDT. This method ensures that defendants cannot claim ignorance of legal actions, as the notices are embedded directly into the blockchain. By this approach, HK regulators aim not only to deter unauthorized transactions but also to discourage centralized exchanges from engaging with flagged wallets. This initiative marks a significant advancement in legal enforcement within the digital asset space, setting a precedent for integrating blockchain technology into judicial procedures.

 

Payments

European Union

 

EU Instant Payments Regulation Deadline Approaching

The European Union’s new Instant Payments Regulation is set to take effect, with a compliance deadline in January 2025. This regulation requires payment service providers (PSPs) across the EU to ensure the availability of instant payment services in euro, aiming to enhance the speed, efficiency, and accessibility of payments within the region. Under the regulation, PSPs must process euro payments within 10 seconds, 24/7, and ensure transparency in fees. The new rules also include provisions to prevent fraud, such as verifying account details before processing payments. Additionally, PSPs are required to align their charges for instant payments with those of standard credit transfers, making instant payments more affordable for consumers and businesses. This regulation marks a significant step toward modernizing Europe’s payment infrastructure, improving cash flow management for businesses and fostering greater financial inclusion.

 

Canada

 

FINTRAC Guide on Laundering Illicit Fentanyl Proceeds (link)

On 23 January 2025, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) issued an Operational Alert titled “Laundering the Proceeds of Illicit Synthetic Opioids.” This alert aims to assist businesses in identifying and reporting financial transactions related to the laundering of proceeds from the importation, production, and distribution of fentanyl and other illegal synthetic opioids. The alert is a result of collaboration between FINTRAC, the FinCEN in the United States, and Mexico’s Unidad de Inteligencia Financiera. The alert highlights the increasing involvement of organized crime groups in the illegal supply of synthetic opioids in North America. These groups are importing or diverting essential precursor chemicals and laboratory equipment from China and other Asian countries for production purposes. They also utilize darknet marketplaces and virtual currencies to distribute these drugs and facilitate international payments. The alert lays out criteria for Canadian financial entities to determine whether to submit a suspicious transaction report to FINTRAC if linked to illegal synthetic opioids.

 

Financial Services

European Union

 

EBA Harmonizes Guidelines on Internal Compliance to EU Sanctions and Restrictions (link)	The European Banking Authority (EBA) has issued two sets of final guidelines on 14 November 2024, establishing common EU standards for financial institutions’ compliance with Union and national restrictive measures. These guidelines, set to take effect on 30 December 2025, aim to strengthen the EU’s financial system by addressing potential weaknesses in internal policies, procedures, and controls that could lead to legal and reputational risks, as well as undermine the effectiveness of EU sanctions regimes. The first set of guidelines applies to all institutions under EBA’s supervision, focusing on governance arrangements and risk management systems to prevent sanctions breaches or evasion. The second set specifically targets PSPs and CASPs, outlining compliance measures for fund and crypto-asset transfers. These Guidelines are part of a broader EU initiative to reform its anti-money laundering and countering the financing of terrorism (AML/CFT) framework, stemming from the European Commission’s 2021 legislative package. They complement Regulation (EU) 2023/1113, which applies from 30 December 2024, and clarify how restrictive measures policies interact with financial institutions’ wider governance and risk management frameworks. Key aspects include implementing robust screening systems, conducting tailored risk assessments, and allocating clear accountability for sanctions compliance. Financial institutions are expected to review and update their existing policies, procedures, and controls to align with these new standards, ensuring a harmonized approach to sanctions compliance across the EU.
AML Obligations Prevail over GDPR Rights, say Dutch Court (link)	On 9 September 2024, The Hague District Court ruled in favor of Bunq B.V., a Dutch  digital bank, in a case concerning a customer’s request under the General Data Protection Regulation (GDPR). The customer had sought access to personal data related to Bunq’s decision to temporarily block his account during a due diligence process. Bunq had requested additional documentation to verify the source of the customer’s income, citing compliance with AML regulations. The customer provided the requested documents, leading to the unblocking of his account on the same day. Subsequently, he filed a GDPR access request seeking detailed information about the decision-making process, including the logic behind any automated systems used. Bunq responded by providing certain personal data but withheld specific details about its transaction monitoring system, arguing that disclosing such information could compromise the effectiveness of its AML measures. The bank also clarified that while its system flags transactions automatically, any subsequent actions involve human decision-making, thereby not constituting solely automated decision-making under the GDPR (Article 22). The Court upheld Bunq’s position, recognizing that the bank’s obligations under AML laws can take precedence over a customer’s GDPR access rights. It agreed that revealing the inner workings of Bunq’s monitoring system could undermine efforts to prevent financial crimes. Additionally, the Court determined that the process did not involve solely automated decision-making, as human intervention was present in the decision to block the account. This ruling underscores the balance between data protection rights and the necessity of adhering to AML regulations within the financial sector.
Digital Operational Resilience Act Now Effective (link)	The Digital Operational Resilience Act (DORA) fully came into effect across the European Union on 17 January 2025, marking a significant milestone in the regulation of digital operational resilience in the financial sector. DORA introduces a comprehensive framework aimed at strengthening the ICT security and operational resilience of financial entities and their critical third-party service providers, encompassing robust ICT risk management frameworks, standardized incident reporting procedures, regular advanced testing of ICT systems, comprehensive third-party risk management, and clear governance structures with active senior management involvement. For more information about DORA, read our guide (link).
EU Regulators to Collect Information for the Designation of Critical ICT Vendors (link)	The European Supervisory Authorities (ESAs) have announced key timelines for the implementation of the DORA, which came into force on 17 January 2025. Competent authorities are required to report registers of information on contractual arrangements between financial entities and ICT third-party service providers by 30 April 2025. ESAs expect competent authorities to collect the registers of information from the financial entities under their supervision in advance, following their own timelines. This information will be used to designate critical ICT third-party service providers (CTPPs) for oversight under DORA. The ESAs have published a Decision outlining the framework for annual reporting, including timelines, procedures, and data quality assurance. To support industry preparations, the ESAs conducted a voluntary Dry Run exercise in 2024 with around 1,000 financial entities and have published validation rules for analyzing the registers of information. Financial entities are encouraged to begin preparing their registers early, especially for information that may not be immediately available.
Italy Regulator Blocks Four Unauthorized Investment Websites (link)	Italy’s Companies and Exchange Commission (CONSOB) has ordered the blocking of four unauthorized investment websites offering financial services illegally. The targeted websites include BVTBanco Limited, INCORE INVESTMENT, WoodcCapital, and Reloft Srl SB. This action is part of CONSOB’s ongoing efforts to protect investors, bringing the total number of blocked websites to 1,188 since July 2019 when the regulator gained the authority to order such blockages. CONSOB called investors to verify the authorization status of operators offering financial services and to ensure that a prospectus has been published for financial product offerings.