EU financial regulation tracker

DORA sets EU-wide rules on ICT risk management, the reporting of major ICT-related incidents, digital operational resilience testing, ICT third-party risk and information sharing. It applies to 20 types of financial entities, including banks, insurers, investment firms, payment and e-money institutions and crypto-asset service providers, with exclusions such as small insurers and insurance intermediaries that are SMEs. ICT providers designated as critical are overseen directly by the European Supervisory Authorities (ESAs).

MiCA sets harmonised EU rules for crypto-assets that are not covered by existing financial services legislation. It covers public offers and admission to trading of crypto-assets, issuers of asset-referenced tokens (ARTs) and e-money tokens (EMTs), crypto-asset service providers (CASPs) and market abuse in crypto-assets. The rules on ARTs and EMTs have applied since 30 June 2024 and the rest of the Regulation since 30 December 2024. The transitional period for CASPs operating under national law ended on 1 July 2026 at the latest, and ESMA has said that providers without authorisation must wind down their EU activities in an orderly manner. ESMA finalised its three packages of draft technical standards and guidelines in 2024, and the Commission's delegated regulations supplementing MiCA were published in the Official Journal in 2024 and 2025.

The Retail Investment Strategy is a package of two Commission proposals on the rules for selling investment products and insurance-based investment products to retail investors in the EU: a directive amending MiFID II, the Insurance Distribution Directive (IDD), Solvency II, UCITS and AIFMD, and a regulation amending the PRIIPs Regulation on key information documents. The Parliament and the Council reached a provisional agreement on both on 18 December 2025. On 12 November 2026 the Parliament's plenary rejected the provisional agreement on the directive and adopted the regulation. The agreement on the directive would have introduced value-for-money rules, under which firms identify and quantify all costs and compare them with peer groups or, for insurance-based investment products, with supervisory benchmarks; a test for inducements, with their cost shown separately; a simpler suitability assessment for diversified, non-complex and cost-efficient products; rules for firms that work with financial influencers; and revised criteria for treating retail clients as professional clients. These changes have not been adopted, so the five laws apply as they stand. The regulation updates the key information document.

The Financial Data Access Regulation (FiDA) is a Commission proposal for rules on access to, sharing and use of customer data in financial services beyond payment accounts, which PSD2 already covers. On 4 November 2026 the Commission listed it among the pending proposals it intends to withdraw. Under the proposal, with the customer's permission, data holders such as banks, insurers and investment firms would have to make customer data available to data users, including newly authorised financial information service providers (FISPs), through standardised interfaces agreed in financial data sharing schemes. The proposal covers data on mortgages, loans and accounts other than payment accounts; savings, investments, insurance-based investment products and crypto-assets; pension rights in occupational pension schemes and PEPPs; non-life insurance other than sickness and health insurance; and data used to assess the creditworthiness of firms.

The Digital Fairness Act is a Commission proposal of 11 November 2026 for a regulation on fair business-to-consumer commercial practices. It would repeal the Unfair Commercial Practices Directive (Directive 2005/29/EC) and apply directly in all Member States. The Commission presented it together with a Simplification Directive, which amends the Consumer Rights Directive, and a proposal to revise the Consumer Protection Cooperation Regulation. According to the Commission, the key novelties are a ban on manipulative marketing tactics (dark patterns); clear and transparent pricing, in particular for purchases made with virtual in-app currencies and for dynamic pricing of cultural and sports events; the option for consumers to turn off addictive design features; clear disclosure of influencer marketing; a restriction on personalised advertising and prices that target minors or take advantage of sensitive data; and digital contracts and subscriptions that are easier to cancel. Consumers would also have the right to communicate with a human in customer service, and rights when they use an AI agent to buy on their behalf. Annex I lists 62 commercial practices that are unfair in all circumstances. Financial services are not excluded from the proposal. Member States may impose stricter requirements for financial services (Article 2(8)), and the article on automated systems that contract on behalf of a consumer does not apply to financial services (Article 26(10)).

The Savings and Investments Union (SIU) is the Commission's strategy of 19 March 2025 to improve how the EU financial system channels savings into productive investment. It builds on the capital markets union and the banking union and has four strands: citizens and savings, investments and financing, integration and scale, and efficient supervision. It combines legislative proposals on securitisation (June 2025), supplementary pensions (reviews of IORP II and PEPP, November 2025) and market integration and supervision (December 2025) with non-legislative measures: the Recommendation on savings and investment accounts and the financial literacy strategy (September 2025), the Recommendation on pension tracking systems, pension dashboards and auto-enrolment (November 2025) and a Communication on the competitiveness of the banking sector (July 2026). The securitisation review was the first SIU file to reach a provisional agreement between the Parliament and the Council, on 21 October 2026.

Commission Recommendation (EU) 2025/2029 of 30 September 2025 asks Member States to set up savings and investment accounts (SIAs), or align existing ones, with simplified and advantageous tax treatment. It is not binding and offers a European blueprint based on existing national schemes. Under the Recommendation, SIAs should be available from any provider authorised in the EU, including providers from other Member States; have no minimum amount; allow several accounts and transfers between providers at no more than administrative cost and without a taxable event; give access at least to shares, bonds and UCITS funds while excluding highly risky or complex products; be simple to use online and offline; let the provider collect the tax or have the tax return pre-filled; and receive at least the most favourable tax treatment available nationally.

Regulation (EU) 2019/1238 created the pan-European Personal Pension Product (PEPP), a voluntary personal pension product that can be offered across the EU. It has applied since 22 March 2022, but take-up has been very limited: the Commission counted two active providers. On 20 November 2025, in its supplementary pensions package, the Commission proposed amendments (COM(2025) 840). They would remove the 1% cost cap on the Basic PEPP and rely instead on a value-for-money test checked by national supervisors, base the Basic PEPP on a life-cycle investment strategy, allow it to be sold without advice, allow employer contributions, including in auto-enrolment schemes where national law permits, and ask Member States to tax PEPPs like national personal pension products. The Council agreed its negotiating position on 24 June 2026: it keeps the removal of the cap but deletes the provisions on tax treatment, EU-level supervision and value for money.

Directive (EU) 2016/2341 (IORP II) sets EU rules on the activities and supervision of institutions for occupational retirement provision (occupational pension funds). Article 62 required the Commission to review it by 13 January 2023. EIOPA gave technical advice on 28 September 2023 on governance and prudential standards, cross-border activities and transfers, information to members and beneficiaries, the shift from defined benefit to defined contribution, sustainability, and diversity and inclusion, and further technical input in September 2025. On 20 November 2025 the Commission proposed a directive amending IORP II and the Insurance Distribution Directive (COM(2025) 842). It would require IORPs to be authorised, replace detailed investment rules with a principles-based prudent person principle, simplify cross-border activity and scheme transfers, require regular stress tests for IORPs that cover biometric risks or offer guarantees, introduce a duty of care and require data sharing with pension tracking systems. The Council agreed its negotiating position on 26 June 2026.