Welcome to the FIG Top 5 at 5

On 8 October 2026, the Central Bank of Ireland (“Central Bank”) published a consultation paper on guidance (“Guidance”) on good practices for the sound management of third–party risks (“CP172”).

The proposed Guidance, once finalised, will replace the existing December 2021 cross-industry guidance on outsourcing (“2021 Guidance”).

Replacing the 2021 Guidance was flagged as one of the cross-sectoral initiatives in the December 2025 roadmap for more effective and efficient regulation and supervision and was also highlighted by Deputy Governor McMunn in a June 2026 speech – for more information, see FIG Top 5 at 5 dated 18 June 2026.

Reason for the consultation

The Central Bank has highlighted that outsourcing and reliance on third-party service providers has become a key strategic tool for regulated firms, enabling them to access specialised expertise, reduce costs, enhance scalability and respond to competitive pressures. However, CP173 notes that third-party dependencies also create risks which, if not effectively managed, can threaten financial stability, consumer protection, operational resilience and firm safety and soundness, particularly given increasing concentration in a small number of providers in areas such as cloud computing and artificial intelligence.

CP173 explains that the Central Bank has been engaged with outsourcing and third-party risk management for a number of years, including through a 2017 cross-sector survey, a 2018 discussion paper, an industry conference in 2019 and the 2021 Guidance. The Central Bank’s supervisory activity has, however, continued to identify recurring weaknesses, including underdeveloped oversight arrangements, concentration risk, insufficient consideration of intra-group dependencies, offshoring challenges, inadequate exit planning and limited oversight of sub-outsourcing arrangements.

The Central Bank also points to significant international regulatory developments since 2021, including the Basel Committee on Banking Supervision’s (“BCBS”) principles for the sound management of third-party risk (2024), the Financial Stability Board’s (“FSB”) toolkit on enhancing third-party risk management and oversight (2023), the European Banking Authority’s (“EBA”) guidelines on sound management of third-party non-ICT risk (2026), the European Securities and Markets Authority’s (“ESMA”) principles on third-party risks supervision (2025) and DORA.

CP173 states that updated guidance is needed to broaden the scope beyond traditional outsourcing, align with these international standards, provide enhanced clarity on key risk areas, embed a stronger operational resilience focus and support proportionate application by firms of all sizes.

Regulatory impact assessment

Given the significance of the topic, the Central Bank has carried out a regulatory impact assessment (“RIA“), notwithstanding that the Guidance is non-binding and would not normally require one. The RIA considered four options: maintaining the status quo, introducing binding regulatory requirements, issuing updated non-binding guidance, and relying solely on European guidance (such as DORA and ESA guidelines). The Central Bank has concluded that issuing updated, comprehensive, non-binding Guidance provides the optimal balance between clarity and flexibility and allows firms to apply the Guidance proportionately based on their nature, scale and complexity.

The Central Bank considers that the non-binding nature of the Guidance means it should not introduce new implementation costs, as it does not impose new or more stringent standards, though firms whose existing frameworks focus principally on traditional outsourcing may face some one-off costs in identifying and assessing a broader range of third-party dependencies.

The Guidance does not create new legal obligations and uses the word “should” throughout to indicate opinion and advice rather than a legal obligation, unless firms are already subject to specific obligations under sectoral rules.

Key features of the proposed Guidance

CP173 explains that the proposed Guidance incorporates the following key features:

• a holistic scope – addressing material third-party arrangements that create a reliance or dependency capable of giving rise to relevant risks, including outsourcing (whether to external parties or intra-group), cloud service providers, partnerships and joint ventures, technology vendors, data processors and other dependencies, not only traditional outsourcing arrangements;
• an outcomes-based approach – structured around desired outcomes rather than prescriptive requirements, allowing firms to determine how best to achieve good outcomes based on their own circumstances;
• a lifecycle perspective – sequencing the Guidance to follow the lifecycle of third-party arrangements, namely governance and organisational context, pre-engagement, engagement, ongoing management, and termination;
• tiered good practices – distinguishing between foundational good practices (core practices) and supporting good practices (additional practices), to support proportionate application; and
• alignment with international standards – including the BCBS Principles, the FSB toolkit, the EBA guidelines on sound management of third-party non-ICT risk, ESMA’s principles on third-party risks supervision and DORA (where applicable).

The Guidance itself is structured across five areas, namely:

• governance and organisational context;
• risk management and due diligence;
• contracting;
• on-going risk management and monitoring; and
• incident and termination management.

Within this structure, CP173 identifies 16 good practices, addressing matters including board accountability for outsourcing strategy and risk appetite / the assessment of criticality or importance of outsourced functions / initial and ongoing risk management frameworks / due diligence, contractual provisions and termination rights / record-keeping / exit planning / business continuity and disaster recovery / testing of incident and termination plans / data stewardship.

Addressing industry concerns 

CP173 also contains a section responding to a number of concerns raised by industry since 2021. In particular, the Central Bank addresses uncertainty as to scope and applicability by broadening the Guidance to cover all third-party arrangements creating reliance or dependency and by providing clearer definitions of key terms. This section also addresses concerns around proportionality and regulatory burden / intra-group arrangements / contractual negotiations with large service providers / concentration risk / offshoring / sub-outsourcing / alignment with other frameworks.

Consultation questions

Section 5 of CP173 sets out 13 questions for stakeholders, grouped under general questions on the proposed non-binding approach and scope, the RIA, the structure and content of the Guidance, proportionality and application, and alignment and interaction with other frameworks such as DORA and the EBA guidelines.

Next Steps

CP 173 is open for feedback until 3 December 2026. The Central Bank also plans to host an industry workshop during the consultation period and has also stated that any stakeholders that would like to request a bilateral meeting should contact the Central Bank.

CP173 sets out that the Central Bank expects to publish the final Guidance in Q1 2027, with the effective date being the date of publication.

1. Governor Makhlouf delivers speech addressing bank governance at book launch event

 

On 8 October 2026, the Governor of the Central Bank of Ireland (“Central Bank“), Gabriel Makhlouf, delivered a speech (“Speech“) at the launch of a book entitled “The Evolution of Bank Governance in the EU”, hosted by the Central Bank. While the event centred on the launch of the book, the Governor used the opportunity to comment on governance themes relevant to the financial sector generally. This update focuses on those matters.

The Governor noted that households and businesses depend on banks to safeguard their money, provide credit and support everyday activities, and observed that the financial crisis showed the damage that can result when boards do not understand the risks their institutions are taking, or when management is insufficiently challenged – lessons he said remain relevant as circumstances facing banks change.

He stated that governance is tested most when conditions become difficult, requiring information to reach the right people quickly, concerns to be heard, and boards able to take difficult decisions in time to act – which, he highlighted, requires expertise, independence of thought and a culture in which assumptions can be challenged. In this regard, he emphasised the value of diversity and inclusion.

On AI, the Governor said boards need sufficient understanding to assess the opportunities it offers, recognise its limitations, and ensure that responsibility for decisions remains clear.

He also referenced the wider European debate on simplification and the Central Bank’s “Regulating and Supervising Well” initiative, stating that the Central Bank wants to make regulation clearer, remove duplication and address unnecessary complexity, and that strong governance supports this by helping banks understand their business and make better decisions. He noted the Capital Requirements Directive as a useful basis for considering how the European framework can support those outcomes, including as banks respond to climate and environmental risks.

Regarding people and accountability, the Governor noted that the Central Bank’s fitness and probity and individual accountability frameworks address questions of suitability, responsibility and expected standards, and that, following Andrea Enria’s review, the Central Bank has worked to make its own fitness and probity processes clearer, fairer and more consistent. He added that clear responsibilities should help people take ownership of decisions and escalate concerns, while boards need the “collective ability to question the direction being taken and look beyond immediate pressures.”

The Governor concluded that governance is an area where researchers, practitioners and supervisors can learn from one another, welcoming the book’s contribution to that exchange.

 

2. Deputy Governor Colm Kincaid delivers speech on collaboration in fight against economic crime

 

On 9 October 2026, Deputy Governor of Consumer and Investor Protection at the Central Bank of Ireland (“Central Bank“), Colm Kincaid, delivered a speech (“Speech“) at the Irish Criminal Justice Agencies Conference 2026, hosted by the Revenue Commissioners. While the Speech was framed around the human and societal harm caused by economic crime, its core theme for financial services purposes was the need for clear ownership and connected action between regulators, law enforcement, policymakers and firms, and the Deputy Governor used the opportunity to set out a number of points on the Central Bank’s current and planned supervisory and regulatory activity in this area.

Central Bank’s role and current activity

The Deputy Governor outlined the Central Bank’s role in guarding the regulatory perimeter against unauthorised financial services, supervising regulated firms’ anti-money laundering and countering the financing of terrorism systems and controls (including inspections, targeted and thematic reviews, and financial crime review meetings), and overseeing compliance with financial sanctions obligations. He confirmed that the Central Bank has recently completed its thematic review of authorised push payment fraud in the banking sector and expects to communicate the outcomes to relevant firms and sectors in due course, including both good practices observed and areas of material gaps requiring remediation.

Mr. Kincaid noted that, this year, the Central Bank introduced new rules requiring firms to have better systems in place to support consumers who may fall victim to frauds, scams and other forms of financial abuse, underpinned by statutory rights of reimbursement set at EU level. He also referenced the Central Bank’s engagement with large technology platforms incorporated in Ireland to implement additional controls against unauthorised financial service providers, and noted that the Central Bank became Ireland’s first statutory trusted flagger for financial frauds and scams in 2025, a power it has used to flag suspected illegal content online for priority treatment by platforms.

Four disciplines for collaboration

Mr. Kincaid identified four disciplines he considers necessary to strengthen the collective response to economic crime. The first is seeing the problem through the eyes of the individual harmed, with reporting kept clear and accessible, immediate action focused on stopping further loss and recovering funds, and empathetic engagement with affected consumers. In this regard, he welcomed the upcoming EU Payment Services legislation intended to strengthen customer protections from fraud, including requirements for advertisers of financial services to prove they are authorised to do so.

The second discipline relates to developing a better shared understanding of the threat, combining supervisory information, firm reporting, criminal intelligence, academic research and victim-support experience. The third is more timely information-sharing, underpinned by clear legal gateways and agreed channels. Here, he referenced the National Payments Strategy’s call for a shared fraud database and a commitment to prepare the necessary legislation.

The Deputy Governor also noted that article 75 of the EU Anti-Money Laundering Regulation will permit information-sharing partnerships between obliged entities and public authorities, and that the upcoming Payment Services Regulation will require payment service providers to participate in fraud information-sharing arrangements with each other.

The fourth discipline is fostering better international cooperation and learning from other jurisdictions, given that economic crime is frequently organised, directed and executed across multiple countries.

Enforcement and other planned engagement

Looking ahead, the Deputy Governor confirmed that the Central Bank will continue to supervise firms within its remit, strengthen consumer protection, guard the regulatory perimeter, protect market integrity, contribute to policy development and work with partners across the criminal justice system. Mr. Kincaid also stated that the Central Bank will use its enforcement powers, as part of a proportionate and credible supervisory response, where regulatory failures occur.

1. General scheme of Criminal Justice (Money Laundering and Terrorist Financing) (Amendment) Bill 2026 is published

 

On 7 October 2026, the Department of Justice, Home Affairs and Migration published the general scheme (“General Scheme”) of the Criminal Justice (Money Laundering and Terrorist Financing) (Amendment) Bill 2026 (“Bill”).

The main purpose of the General Scheme is to transpose certain aspects of the EU’s sixth anti-money laundering package, comprising Directive (EU) 2024/1640 (“AMLD”) and Regulation (EU) 2024/1624 (“AMLR”). It is intended that most of the package will be transposed by statutory instrument rather than through the Bill. The General Scheme also amends the money laundering offence in the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (“Act of 2010”) to facilitate Ireland opting into Directive (EU) 2018/1673 of the European Parliament and of the Council of 23 October 2018 on combating money laundering by criminal law.

The General Scheme states that the eventual act will come into operation on 10 July 2027.

Key proposals include the following.

Money laundering offence

The General Scheme amends the definition of “criminal conduct” in section 6 of the Act of 2010 and inserts a new corporate liability provision (section 8A) to align Irish law with EU Directive 2018/1673, including abolishing dual criminality for certain predicate offences committed outside the State (participation in an organised criminal group, terrorism, human trafficking, sexual exploitation, drug trafficking and corruption) and extending corporate liability to failures of supervision or control.

Repeal of obligations now set out directly in AMLR

As AMLR is directly applicable, the General Scheme proposes to repeal the sections of the Act of 2010 that currently set out obligations on designated persons (including sections 25 to 30B, 33, 33A, 34A, 36A, 37 to 40, 42(1) to (10), 44 and 46 to 59, together with Schedules 3 and 4), with consequential amendments to cross-refer to AMLR instead.

Ministerial exemptions and sectoral scope

A new section 25 would empower the Minister, after consulting the Minister for Finance, to exempt certain classes of persons from AMLR in line with articles 4 to 6 of AMLR, and separately to extend AMLR’s application to additional sectors assessed as posing money laundering or terrorist financing risk.

Financial Intelligence Unit powers

The General Scheme expands the powers of FIU Ireland under the Act of 2010 to:

• direct the suspension of a transaction, bank or payment account, crypto-asset account, or business relationship for up to 10 or 5 working days respectively, including on request from another EU Member State’s FIU, transposing article 24 of AMLD; and
• direct a designated person to monitor transactions or activities for persons presenting a significant money laundering or terrorist financing risk, a new power transposing article 25 of AMLD, with non-compliance made a criminal offence.

New offence for breach of AMLR

A new section 107B would create an offence for an obliged entity that fails to comply with specified AMLR obligations, including business-wide risk assessment / compliance functions / customer due diligence / enhanced due diligence / politically exposed persons measures / reporting of suspicions / tipping off / record keeping.

Correspondent relationships and Central Bank cooperation

The General Scheme proposes a new provision requiring enhanced due diligence for high-risk correspondent relationships and amends the Central Bank Act 1942 to enable the Central Bank of Ireland (“Central Bank”) to cooperate and share information with the new EU Anti-Money Laundering Authority (“AMLA”) and other supervisory authorities.

Law Society of Ireland enforcement power

The General Scheme contains an empowerment for the Law Society of Ireland (“Society”) to direct a solicitor found, following investigation, to have breached their AMLR obligations, to pay the Society up to €10,000, with a right of appeal to the High Court under the existing Solicitors (Amendment) Act 1994 appeal mechanism.

Next steps

The General Scheme is in heads-of-bill form, and several provisions are expressly flagged as placeholders pending drafting.

Although not included in the General Scheme, it is also intended that the Bill will include provisions relating to the powers of the Central Bank in relation to entities it supervises for anti-money laundering purposes.

 

2. AMLA consults on draft RTS for establishing a central AML / CFT database

 

On 7 October 2026, the Anti-Money Laundering Authority (“AMLA”) published a consultation (“Consultation”) on draft regulatory technical standards (“RTS”) on the information supervisors will transmit to AMLA’s central anti-money laundering and countering the financing of terrorism (“AML / CFT”) database. The Consultation invites all stakeholders with an interest in the EU’s AML/ CFT framework to share their views.

The draft RTS are prepared under Article 11(6) of Regulation (EU)2024/1620 (“AMLA Regulation”) and address the scope, detail and timings of supervisory reporting.

Objective of the consultation

The proposed database is intended to operate as a single entry point for standardised supervisory reporting and a repository of information at both obliged-entity and supervisory-entity level.  AMLA envisages that it will facilitate the identification of money laundering and terrorist financing (“ML/TF”) risks and trends, strengthen cooperation across Member States, and support targeted, risk-based supervision.

The objective underlying this consultation is to ensure that supervisory authorities that form part of the AML / CFT supervisory system have reliable access to comprehensive data that enables them to discharge their functions effectively.

The draft RTS are intended to streamline reporting requirements and reduce the duplication of information while meeting the data needs of AMLA and supervisory authorities.  The draft RTS have been designed by AMLA to draw on information that supervisors already hold or must obtain under the new AML / CFT framework.  This means that they do not impose new reporting requirements on obliged entities and keeps the reporting burden low. Where possible, AMLA intends for reporting to be automated and streamlined.

Information to be reported

The draft RTS set out the information that is to be submitted on supervisory authorities, self-regulatory bodies and their areas of responsibility – this includes their mandate, tasks and powers and staffing. Accordingly, supervisory authorities are required to provide, and keep up to date detailed information about themselves, their supervisory responsibilities, and the sectors they oversee.

Additionally, the database will contain information to be submitted on supervisory activities, with the proposed approach being to transmit a supervisory activity when it reflects the use of a supervisory tool as part of the supervisor’s execution of its annual supervisory strategy or plan, or where such a tool is used on an ad hoc basis in response to specific events, emerging risks or concerns identified by the supervisory authority.

As regards obliged entities, the draft RTS set out the level of information to be submitted by supervisory authorities in the financial and non-financial sectors on individual obliged entities. This includes:

• the risk profile of the individual obliged entity, group affiliation and supervisory colleges;
• all administrative measures, pecuniary sanctions and periodic penalty payments; and
• information on opinions or advice given to other authorities in relation to authorisation and withdrawal of authorisation procedures, and fit and proper assessments, where these raise ML / TF concerns or constitute a negative assessment.

Additional technical provisions

The draft RTS also include provisions concerned with the transmission of information. These are aimed at ensuring confidentiality, data quality and the onward sharing of information stored in the database.

Article 7 would permit AMLA to request additional information where necessary for its statutory tasks, provided that it identifies the relevant task, explains the necessity of the request and specifies the intended use.

Article 8 and 10 address confidentiality, onward disclosure and professional secrecy. Information in the database is to be treated as confidential and various use and disclosure requirements exist, subject to specified exceptions under Union law.

Article 9 addresses technical specifications and data quality. AMLA anticipates automated transmission where possible, while supervisory authorities remain responsible for completeness, accuracy and currency of information.

Proposed implementation timeline

The draft RTS provides for a phased approach to be followed for implementation, allowing supervisors to gradually adjust their systems and approaches as each standard comes into force. This gradual timeframe includes a varied period for the non-financial sector and takes into account the particularity of authorities and bodies overseeing self-regulatory bodies.

The earliest first transmissions would be due by 15 July 2027 with later dates for the non-financial sector ranging to 31 May 2031.

These dates remain proposals and may change following the consultation and adoption process.

Next steps

The AMLA will hold a public hearing on the proposed draft RTS on 3 November 2026, where comments on the draft RTS can be made – interested parties can register here.

The Consultation invites feedback on the scope of the proposed reporting requirements, their proportionality and technical feasibility, confidentiality safeguards and the proposed implementation timetable.

Following the consultation, AMLA will consider the feedback received before finalising the draft RTS for submission through the applicable regulatory process.

On 9 October 2026, the European Council (“Council“) agreed the key elements of its negotiating position on new measures intended to strengthen EU capital markets, described as “a major step forward in unlocking private savings for investment in innovative firms, financing growth and boosting the EU’s overall global competitiveness.”

The agreement relates to the market integration and supervision package (“MISP“), the centrepiece of the savings and investments union (“SIU“) and a key part of the EU’s “One Europe, One Market” roadmap. The MISP package forms part of the EU’s broader goal of strengthening the EU’s competitiveness, resilience and strategic autonomy.

The MISP legislative package consists of three legislative proposals that amend a wide range of existing acts to fundamentally restructure the single market for capital, taking the form of a master regulation, a master directive, and a new settlement finality regulation. The package responds to the fact that an estimated €10 trillion of household savings are currently held in the EU in low-yield bank deposits rather than being invested in capital markets, a mismatch that prevents savings from being used effectively to support business investment, compounded by continuing fragmentation of EU capital markets along national lines, legal uncertainty, divergent supervisory practices and additional costs for firms operating across borders.

Welcoming the agreement, Simon Harris, Tánaiste and Minister of Finance, stated:

“…This package will help to unlock the full potential of the single market for financial services, allowing EU citizens and businesses alike to tap into well-integrated and more efficient capital markets.”

Key features

Some of the key features of the MISP package are as follows:

• direct supervision of significant market infrastructure – under the Council’s agreed position, supervision of the most significant cross-border trading venues, as well as the most significant post-trading entities such as central securities depositories (“CSDs”) and central counterparties (“CCPs”), would be transferred from national authorities to the European Securities and Markets Authority (“ESMA”), with the aim of providing more consistent oversight of the market operators considered most important to the EU’s economy while increasing market confidence;
• new pan-European market operator (“PEMO”) framework – as per the European Commission’s (“Commission”) original proposal, the text introduces a new PEMO framework, which would allow venues that do not meet the criteria for direct supervision to operate multiple venues across the EU under a single licence, supervised directly by ESMA, on a voluntary basis, with the Council’s negotiating text clarifying and broadening eligibility for this framework;
• proportionate approach to crypto-asset service providers (“CASPs”) – only the most significant cross-border CASPs would become immediately subject to ESMA supervision, replacing the blanket regime for all such providers as originally proposed by the Commission;
• new ESMA executive board – the Council’s approach modernises ESMA’s governance framework to allow the authority to respond more quickly and effectively to emerging risks and challenges and address inconsistencies or gaps in supervision, establishing a new full-time ESMA executive board, composed of a chair and five independent full-time members, which would manage operations and take entity-specific decisions concerning directly supervised operators;
• continued role for national authorities – the text ensures a role for national authorities by maintaining a separate board of supervisors, which would remain ESMA’s principal body for regulatory decisions, strategy, budget and supervisory convergence, with the executive board making recommendations for board of supervisors decisions addressed to competent authorities, including regarding dispute settlement and breaches of EU law; and
• transitional arrangements – over a two-year transition period, ESMA-led teams of EU and national experts would work together to ensure a smooth transfer of supervisory tasks, after which flexible and permanent cooperation arrangements would preserve national expertise and involvement, with ESMA remaining fully responsible for final supervisory assessments and decisions.

Harnessing new technologies

The MISP package will substantially improve the existing regulatory sandbox known as the distributed ledger technology pilot regime, helping market operators test new possibilities around digital assets by providing increased access to a controlled environment to experiment, which could help reduce costs and increase flexibility, including in the area of cryptocurrencies. To incentivise take-up by market participants, the Council’s position broadens the level of financial activity that can be channelled through the pilot system.

Next steps

The negotiating position will now be finalised in accordance with the political agreement reached, ahead of the Council’s formal adoption. Negotiations with the European Parliament (“Parliament”) can begin once the Parliament adopts its own position, with the aim of allowing the co-legislators to reach a timely agreement on the overall package in line with the “One Europe, One Market” roadmap objective.

1. EIOPA consults on more proportionate and outcomes-focused supervision of IBIP sales

 

On 8 October 2026, the European Insurance and Occupational Pensions Authority (“EIOPA”) launched a public consultation (“Consultation”) on a draft Supervisory Statement (“Statement”) regarding a more outcomes-focused supervision of the sales process and pre-contractual disclosures of insurance-based investment products (“IBIPs”), within the existing regulatory framework.

Background

EIOPA explains that its market monitoring and oversight work has identified several areas where existing consumer protection safeguards may not always operate as effectively as intended, including:

• sales processes that focus on mechanically completing procedural steps;
• lengthy or complex disclosures, which make key information difficult to identify and understand; and
• sales assessments that do not always meaningfully inform the outcome of the sales process.

The draft Statement is intended to help national competent authorities (“NCAs”) calibrate their engagement with insurance manufacturers and distributors by complementing compliance-based supervision, which continues to be the foundation for consumer protection, with a focus on the effective and proportionate application of requirements in practice. EIOPA emphasises that the Statement does not introduce new regulatory requirements, additional reporting obligations or a prescribed supervisory methodology, and operates within the existing legal framework, in particular the Insurance Distribution Directive (“IDD”) and its related delegated regulations, the PRIIPs Regulation and the Sustainable Finance Disclosure Regulation.

Supervisory expectations

The draft Statement sets out EIOPA’s supervisory expectations across the customer journey, encouraging NCAs to consider whether sales processes and disclosures operate effectively and support informed consumer decision-making, rather than focusing solely on procedural compliance. Key themes include:

• understanding consumers and gathering relevant information – supervisors should consider the relevance, sufficiency and practical usefulness of information collected for demands-and-needs, suitability and appropriateness assessments, rather than assuming that more detailed questionnaires or additional documentation necessarily lead to better outcomes;
• supporting informed consumer decision-making through disclosures – supervisors are encouraged to assess whether disclosures, taken as a whole, are presented in good time, are proportionate in volume and complexity, and are explained in a way that supports consumer understanding, rather than assessing only whether each required document was provided;
• assessing personal recommendations and suitability outcomes – supervisors should consider the substance of personal recommendations, including alignment with the consumer’s documented needs and objectives, and relevant post-sale indicators such as complaints or early lapses;
• oversight of distributors and distribution channels – supervisors should consider remuneration structures, incentive schemes, training and governance arrangements, and whether these create incentives that may adversely affect consumer outcomes; and
• governance, monitoring and post-sale assessment – supervisors should assess whether insurance undertakings and intermediaries have appropriate internal controls and monitoring arrangements to identify and address risks arising from their sales processes, using indicators such as post-sale suitability corrections, early lapse rates and complaints trends.

EIOPA notes that the scope and depth of any outcomes-focused supervisory assessment should be proportionate to factors such as product complexity, the distribution model, customer characteristics and previously identified concerns, and that the Statement is intended to support supervisory judgement and risk-based prioritisation rather than prescribe a single methodology.

Impact assessment

The Consultation includes an impact assessment in which EIOPA considered three policy options – taking no action, issuing a supervisory statement, or issuing a stronger convergence instrument such as guidelines. EIOPA’s preferred option is to issue the Statement, which it considers provides the best balance between supporting supervisory convergence, enhancing consumer protection, enabling proportionality and limiting additional implementation costs, as the identified issue relates to differences in supervisory practice rather than a regulatory gap.

Next steps

The Consultation is open for feedback until 4 January 2027, by way of an online survey, although EIOPA has indicated that early feedback by the end of November 2026 would be particularly welcome to inform its related work on the European Commission’s call for advice on retail investment. EIOPA will also hold an online public hearing during the Consultation period to discuss the proposed approach with stakeholders. EIOPA expects to finalise the Statement in the first quarter of 2027.

 

2. ESMA publishes supervisory expectations on services related to unauthorised stablecoins

 

On 8 October 2026, the European Securities and Markets Authority (“ESMA”) published an opinion (“Opinion”) clarifying supervisory expectations of crypto – asset services involving asset-referenced tokens (“ARTs”) and e-money tokens (“EMTs”) that do not comply with the requirements of the Markets in Crypto-Assets Regulation (“MiCA”).

Background

MiCA establishes the comprehensive obligations that are applicable to crypto – asset service providers (“CASPs”). Due to the crucial role played by CASPs in the functioning of the crypto – asset ecosystem, and in consideration of the possible impact on protection of investors, market stability and financial integrity, ESMA considers it necessary that further guidance is required to address additional aspects of the provision of crypto – asset services in relation to such tokens under MiCA.

In January 2025, ESMA published a statement on the provision of certain crypto – asset services in relation to non-compliant ARTs and EMTs alongside the European Commission Q&A 2024 noting the circumstances where the provision of certain crypto – asset services may constitute an offer to the public, a seeking of admission to trading or placing of an ART or EMT. For more information on the January 2026 statement, see FIG Top 5 at 5 dated 23 January 2025.  This Opinion seeks to complement that guidance by promoting a more consistent application of the MiCA framework across the European Union and is addressed primarily to national competent authorities (“NCAs“).

The Opinion

With regard to the requirements under Titles III and IV of MiCA to the offer to the public and admission to trading of ARTs and EMTs in the Union, and having regard to the obligations of CASPs under Title V of MiCA, ESMA considers that CASPs should not provide crypto – asset services in relation to ARTs or EMTs that are non-MiCA compliant to clients in the European Union.

This expectation applies to all crypto – asset services covered by MiCA, whether the relevant CASP provides them individually or in combination, including the operation of trading platforms, exchange services, execution of orders, placing of crypto – assets, reception and transmission of orders, investment advice, transfers, custody and administration, and portfolio management.

This determination does not depend on whether each individual crypto – asset service is itself an offer to the public or an admission to trading under Articles 16(1) or 48(1) of MiCA. Instead, it is a reflection of ESMA’s view that CASPs in the European Union should not maintain or facilitate the availability of ARTs or EMTs that have not been offered to the public or admitted to trading in accordance with Titles III or IV.

ESMA states that such crypto – asset services would expose clients to risks arising from non-compliant status as the required issuer-level safeguards under MiCA would not be in place. In the Opinion, ESMA notes that allowing the maintenance or facilitation of non-MiCA compliant ARTs or EMTs by CASPs to clients would undermine the objectives and effectiveness of MiCA.

It further notes that the continued maintenance of facilitation of such crypto – asset services would distort competition and create an uneven playing field between compliant and non-compliant CASPs.

Cessation of services

Authorised CASPs must stop offering comprehensive services such as trading, custody, and advice for non-compliant ARTs and EMTs. ESMA notes that risk warnings or disclaimers are not sufficient when it comes to offering non-MiCA-compliant ARTs or EMTs in terms of providing a solution to the problem because:

• it does not solve the underlying problem;
• clients cannot realistically understand what is missing, in that, extra disclosures are unlikely to properly convey how significant it is that certain safeguards simply are not in place; and
• firms themselves cannot reliably assess the risk either.

NCAs must ensure controls are in place to block new exposures. The expectation of ESMA for NCAs in the Opinion is that they will consider the guidance and assess whether any authorised CASP in their jurisdiction is providing crypto – asset services that fall within non-MiCA compliance in relation to ARTs or EMTs to clients in the EU.

ESMA’s guidance is that NCAs should consider whether a CASP’s services in practice allow for EU clients to acquire, trade, exchange, subscribe for, increase their exposure to, or otherwise access or maintain non-MiCA compliant ARTs or EMTs.

There is a further expectation by ESMA that NCAs ensure that CASPs implement appropriate technical, contractual and organisational controls to prevent the availability of non-compliant ARTs or EMTs through their services.

Remediation window

The Opinion does not prevent NCAs from allowing CASPs, who do not yet comply with this guidance, to provide strictly limited residual services where they are necessary to ensure an orderly wind-down and to avoid client detriment. Legacy exposures must be addressed by an outer deadline of 8 January 2027. Any activities during this wind-down phase are strictly limited to necessary liquidation, conversion or withdrawal under close supervision.

ESMA has stated that it will regularly monitor the timely application of the Opinion, in cooperation with relevant NCAs.