DORA Compliance For EU Financial Institutions And IT Providers

In January 2026, the European Commission unveiled its plan to overhaul the EU's Cybersecurity Act, a proposal now known as CSA2. It's the natural next step in a story that began years earlier with the EU's 2020 "5G Security Toolbox" - a set of voluntary recommendations encouraging Member States to be cautious about certain telecom suppliers. That voluntary approach produced patchy results: by most accounts, fewer than half of EU countries had actually acted on those recommendations. It is worth asking whether the adoption levels were however a failure of design, or a reflection of Member States reaching different conclusions about their risk exposures.

The EU Artificial Intelligence Act now affects businesses across Cyprus and the European Union that use AI tools for customer service, marketing, or content creation. Companies must understand their transparency obligations, disclosure requirements, and compliance responsibilities under the new regulation that became applicable in August 2026.

In June 2024 the European Parliament and European Council have adopted the Regulation (EU) 2024/1689, which will come in force in August 2nd, 2026.

Today, 7 May 2026, the EU Parliament and Council reached a provisional agreement on simplification of compliance with the AI Act earlier proposed as part of the Digital Omnibus.

Cyprus has long been recognised as a reputable international financial and corporate centre. However, in recent years, the island has also become a target for fraudulent or unlicensed investment and forex companies that exploit its good reputation and European regulatory framework.

On 2 February 2024, the EU's Artificial Intelligence Act was unanimously approved by the Council of EU Ministers.

The European Commission has unveiled the European Technological Sovereignty Package, a comprehensive legislative framework targeting four critical areas: semiconductor manufacturing through Chips Act 2.0, cloud and AI infrastructure via the Cloud and AI Development Act, digital autonomy through open source strategy, and energy sector digitalization. This ambitious initiative aims to fundamentally transform Europe's technological independence and competitive position in the global digital economy by 2030.

Crypto taxation has moved decisively from regulatory grey area to mainstream tax policy. Across Europe, the UK, the United States, and the Middle East, governments have now adopted increasingly formal positions...

Artificial intelligence is often presented as either a blessing or a curse. In reality, it has the potential to become both. While AI is transforming modern life in remarkable ways, it is also creating entirely new forms of abuse capable of violating privacy, dignity and fundamental human rights.

As artificial intelligence rapidly evolves, governments worldwide play a balancing game between fostering innovation while managing associated risks.

A UK regulator's £4.7 million penalty against Citibank reveals how operational weaknesses in payment screening and account restrictions can undermine sanctions compliance. The enforcement action identifies specific process failures that allowed nearly 1,000 prohibited transactions worth £19.72 million to proceed despite sanctions restrictions.

Cyprus has introduced an accelerated citizenship pathway for highly skilled foreign employees working for qualifying companies in the Republic. This framework, sometimes called the "Golden Knowledge" route, allows eligible professionals to obtain citizenship after four or five years of qualifying residence, depending on their Greek language proficiency. The regime represents a significant development for international professionals who have established their careers and lives in Cyprus.

The EU's Markets in Crypto Assets Regulation (MiCA) transitional period expires on 1 July 2026, marking a critical deadline for crypto-asset service providers operating in Europe. Without proper MiCA authorisation by this date, businesses must cease operations and implement orderly wind-down procedures, as pending applications do not grant permission to continue providing services. This comprehensive analysis examines the regulatory requirements, compliance obligations, and strategic considerations for cryp

The General Data Protection Regulation (GDPR) is the cornerstone of data privacy law in the European Union. It sets out strict obligations for businesses processing personal data and introduces some of the world's toughest enforcement powers.

Cyprus is evolving from a jurisdiction that simply attracts fintech licenses to one building genuine European fintech infrastructure. With new regulatory frameworks including PSD3, DORA, and MiCA converging, the country faces a critical question: can it develop the banking relationships, payment systems access, and institutional depth required to transform licensed entities into a truly interconnected financial ecosystem?

Two recent European Court judgments clarify when EU sanctions can freeze an unlisted company's funds through ownership or control by a listed person. The Inter Rao Lietuva and Abramovich cases establish different evidentiary standards and challenge routes, requiring businesses to understand the specific legal basis for any payment restriction.

Cryptocurrency fraud victims in Cyprus are increasingly targeted by sophisticated "recovery" scams involving cold calls, remote access requests, and false promises to retrieve lost digital assets. Recent court cases demonstrate that while recovery is not guaranteed, victims who preserve evidence and act quickly may have realistic legal options through Cyprus courts, including freezing orders, disclosure relief, and asset preservation measures.

In June 2024 the European Parliament and European Council have adopted the Regulation (EU) 2024/1689, which will come in force in August 2nd, 2026.

The concept of causing death by reason of a rash, reckless or dangerous act constitutes a special area of criminal liability, which is distinct from the crimes of murder/manslaughter with intent.

The Court of Justice's Jautiva ruling has clarified that EU company law does not require unrestricted online access to shareholder personal information, even when corporate transparency and anti-money laundering objectives are invoked. Cyprus businesses must now reconsider how they balance statutory filing obligations with data protection principles, particularly when shareholder records can be downloaded in bulk without safeguards. This analysis examines what the judgment means for corporate disclosure pra