News

Entro il 29 ottobre 2026 aziende, piattaforme e newsletter dovranno adeguare informative, consensi e sistemi di revoca alle Linee guida del Garante sull’utilizzo dei tracking pixel nelle comunicazioni di posta elettronica. I tracking pixel sono minuscole immagini trasparenti, praticamente invisibili, inserite nelle email per rilevarne l’apertura e raccogliere informazioni sui comportamenti degli utenti. Per i tracking pixel è quindi necessario acquisire preventivamente un consenso libero, specifico e informato, mentre sono previste specifiche eccezioni, ad esempio per finalità di sicurezza, esigenze tecniche strettamente necessarie o comunicazioni istituzionali e di servizio, sempre nel rispetto dei principi di proporzionalità e minimizzazione dei dati. Gli utenti devono inoltre ricevere un’informativa chiara e trasparente e poter revocare il consenso con modalità semplici, anche selettivamente. Le Linee guida richiamano infine l’attenzione sull’adozione di misure di privacy by design e by default, volte a ridurre il rischio di identificabilità degli utenti e a limitare la circolazione dei dati personali. La verifica dell’applicazione delle Linee guida sui tracking pixel nelle email rientra tra le attività ispettive previste dal Garante per il secondo semestre 2026

Leggi dettaglio →

AMF Italia è lieta di segnalare la newsletter LuxXPrime di Luxembourg Stock Exchange

Leggi dettaglio →

AMLA has finalised three sets of regulatory technical standards (RTS) defining key measures companies and professionals must apply to reduce money laundering and terrorist financing risks. The three standards each cover a distinct area of AML/CFT requirements for the private sector: Business relationships and occasional transactions: how companies and professionals should distinguish between the two, and how to identify linked transactions, so that customer due diligence thresholds are applied consistently. Customer due diligence: the information companies and professionals must collect and verify, including proportionate measures for lower-risk situations, non-face-to-face verification, electronic identification, and screening of politically exposed persons (PEPs), their family members and close associates. Group-wide arrangements: minimum requirements for effective group-wide AML/CFT arrangements, including governance, risk management, internal controls and secure information sharing. The final draft standards have now been submitted to the European Commission. Once adopted and published in the Official Journal of the EU, they are proposed to apply six months after their entry into force. For football agents and professional football clubs, they will apply from 10 July 2029

Leggi dettaglio →

L'Unità di Informazione Finanziaria per l'Italia comunica che in seguito alle verifiche svolte in materia di comunicazioni oggettive, sono stati rilevati dati non conformi alle istruzioni, con riguardo alla: i) localizzazione geografica delle operazioni; ii) comunicazione di operazioni riconducibili al c.d. “contante virtuale”; iii) comunicazione di operazioni di importo particolarmente elevato. Con l’obiettivo di favorire l’applicazione corretta e uniforme delle istruzioni in materia, la UIF ha aggiornato le FAQ pubblicate sul proprio sito istituzionale, integrandole con specifici chiarimenti. Le modifiche alle procedure segnaletiche dovranno essere applicate a partire dalle comunicazioni oggettive relative alle operazioni contabilizzate dal 1° gennaio 2027 e da trasmettere alla UIF entro il 15 marzo 2027.

Leggi dettaglio →

ESMA published its annual Work Programme for 2027. Guided by ESMA’s multi-annual strategy for 2023–2028, the programme is marking a shift from preparation to the delivery of several major initiatives.

Leggi dettaglio →

Modifiche alle Istruzioni al Regolamento dei Mercati: avvio della negoziazione delle "Opzioni MIBO giornaliere" - in vigore dal 28 Settembre 2026.

Leggi dettaglio →

Il coefficiente della riserva di capitale anticiclica (countercyclical capital buffer, CCyB) resta invariato allo zero per cento per il quarto trimestre del 2026

Leggi dettaglio →

EBA started a public consultation on proposed revisions to the Implementing Technical Standards (ITS) governing the joint decision process for institution-specific prudential requirements foreseen by Article 113 of the Capital Requirements Directive. The revised ITS:(i)support a more holistic and coordinated assessment of institutions' prudential requirements and guidance; (ii) streamline and simplify templates, by introducing a single, reduced and integrated risk assessment report; (iii) align the joint decision process with the revised SREP framework and current supervisory practices; (iv) more clearly incorporate qualitative supervisory measures into the joint decision process; and (v) update the scope of joint decisions to include Pillar 2 Guidance and leverage ratio-related Pillar 2 requirement and guidance. The consultation will run until 4 January 2027 at 23:59 CEST. The EBA will hold a virtual public hearing on 10 November 2026 from 10:00 to 11:00 CEST

Leggi dettaglio →

The EDPB has adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR. Data Protection Authorities (DPAs) should follow a five-step methodology when deciding whether to impose an administrative fine: (i) the DPA checks if the infringement can lead to a fine, by finding support either directly in the GDPR or in national law; (ii) the DPA determines whether the party under investigation may be fined for the infringement in question. Whether the controller or the processor is liable depends on who is bound by the breached provision; (iii) the DPA assesses whether the infringement has been committed intentionally or negligently, since a culpable infringement is a condition for the imposition of a fine; (iv) the DPA assesses possible aggravating and mitigating factors. If the infringement is minor, there will generally be no fine and a reprimand may be issued instead; if it is not minor, there is a strong presumption that a fine should be imposed and (v) the DPA assesses whether imposing an administrative fine would be effective, proportionate and dissuasive. In doing so, the DPA may consider whether, in the specific case, there is a reason to deviate from the standard approach. The guidelines also provide an overview of the corrective powers within the remit of national DPAs and explain their purpose, scope, and how they relate to one another. Corrective measures include warnings, reprimands, orders, limitations (including bans), and the withdrawal of certification. The Board also provides 14 practical examples illustrating how DPAs can assess the specifics of a case and decide which corrective measures should be imposed, if any. The guidelines will be subject to public consultation until 13 November 2026

Leggi dettaglio →

The Guidelines focus on third-party arrangements supporting critical or important functions (CIFs) namely the disruption of which would materially impair the performance of a financial entity. By concentrating on these higher-risk arrangements, the Guidelines reduce unnecessary operational and supervisory burdens for less material ones while maintaining sound risk management. The Guidelines promote a holistic approach to third-party risk management across ICT and non-ICT services and cover the full lifecycle of third-party arrangements, including risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies. They reflect stakeholders feedback received during the public consultation and through targeted outreach activities and take into account international standards, including the Basel Committee on Banking Supervision (BCBS) Principles for the Sound Management of Third-Party Risk. A two-year transitional period will support a smooth and proportionate implementation

Leggi dettaglio →

The ESAs published a document providing operational instructions intended to support competent authorities in their supervisory engagement with financial entities regarding the reporting of information on the major ICT-related incidents under Regulation (EU) 2022/2554 (DORA), to enhance data quality and promote greater consistency across jurisdictions. The instructions have been agreed with the relevant competent authorities. They will be updated regularly, based on the experience of the ESAs and of the competent authorities with the DORA major ICT-related incident reporting.

Leggi dettaglio →

Pubblicato in G.U. n. 214 del 15 settembre 2026 il Decreto legislativo 9 settembre 2026, n. 160 recante l'adeguamento della normativa nazionale alle disposizioni del regolamento (UE) 2024/1689 del Parlamento europeo e del Consiglio, del 13 giugno 2024, che stabilisce regole armonizzate sull'intelligenza artificiale, in materia di utilizzo dei sistemi di intelligenza artificiale per l'attività di polizia e di responsabilità civile e penale Il Decreto entrerà in vigore il 30 settembre 2026

Leggi dettaglio →

In un intervento Luigi Montuori, Segretario generale del Garante per la protezione dei dati personali sottolinea come le recenti sentenze della Cassazione abbiano chiarito la regola dei 120 giorni a disposizione del Garante privacy: il termine di 120 giorni non segna la fine del potere sanzionatorio, ma disciplina il momento in cui l’illecito deve essere contestato. Reclamo e procedimento sanzionatorio seguono infatti tempi, funzioni e garanzie ben differenti

Leggi dettaglio →

ESMA has published a package of materials under the Prospectus Regulation to reflect changes introduced by the Listing Act. The measures aim to promote supervisory convergence and contribute to ESMA’s simplification and burden-reduction efforts. The package includes: (i) a Consultation Paper on the update of the Guidelines on disclosure requirements. The Consultation Paper (open until 9 November 2026) seeks stakeholder feedback on updates intended to help issuers and their advisers better understand expected disclosure under the revised Prospectus Regulation; (ii) updated Q&As; (iii) a Final Report on Guidelines for supplements. The Guidelines (applicable once the translations into all official EU languages become available) establish a common approach for assessing whether a supplement introduces new securities to a base prospectus; and (iv) a Final Report on RTS on key financial information to be included in prospectus summaries. ESMA has submitted the Final Report to the European Commission for a decision on whether to adopt the RTS updating Commission Delegated Regulation 2019/979

Leggi dettaglio →

Il Regolamento delegato (UE) 2026/1221 della Commissione modifica il regolamento (UE) n. 575/2013 del Parlamento europeo e del Consiglio per quanto riguarda misure mirate temporanee di sostegno operativo e moltiplicatori mirati per il calcolo dei requisiti di fondi propri dell’ente per il rischio di mercato

Leggi dettaglio →

The BIS Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) today published the Cyber resilience toolkit: practical considerations for FMIs (toolkit) and FMIs’ reliance on third-party service providers: challenges and risks (discussion paper). The toolkit provides practical considerations to support FMIs in strengthening their cyber resilience frameworks and implementing operational resilience-related components of the CPMI-IOSCO Principles for Financial Market Infrastructures (PFMI). It comprises a set of voluntary, non-binding tools covering several broad topics relevant to cyber resilience and is designed to complement the 2016 CPMI-IOSCO Guidance on cyber resilience for financial market infrastructures. The discussion paper identifies and examines several key challenges related to the provision of third-party services to FMIs, especially for the delivery of critical services. The paper sets out several questions for stakeholders to provide feedback on the identified risks and on potential further engagement. Comments on the toolkit and discussion paper should be submitted by 01 December 2026

Leggi dettaglio →

ESMA issued an Opinion in response to the Commission's proposed amendments to the RTS on buy-back programmes and stabilisation measures, received on 24 July 2026. In February 2026, ESMA submitted to the Commission a draft RTS amending CDR 2016/1052 to reflect the changes introduced by the Listing Act to the buy-back regime under Article 5 of MAR. As the Listing Act did not amend the MAR framework applicable to stabilisation measures, ESMA's draft RTS did not propose any changes to the corresponding provisions of CDR  2016/1052. The Commission now proposes introducing similar reporting and public disclosure arrangements for stabilisation transactions as those suggested for buy-back transactions in the ESMA draft RTS. In particular, the proposed amendments provide for the reporting and public disclosure of stabilisation transactions in an aggregated form, i.e. indicating the aggregated volume and weighted average price per day and per trading venue, and for the centralisation of reporting to the competent authority of Most Relevant Market in Terms of Liquidity as referred to in Article 26(1) of MiFIR . In ESMA's view, they would contribute to maintaining a consistent approach to the reporting and public disclosure of buy-back and stabilisation transactions and support the objective of reducing administrative burden for entities undertaking stabilisation measures, while preserving the ability of competent authorities to monitor trading activity. Accordingly, ESMA supports the amendments proposed by the Commission  

Leggi dettaglio →

ESMA published, on 7 September, an updated version of its Public Statement on the transitional provisions under the BMR Review. In particular, ESMA stated the administrators of benchmarks that are already in the register as authorised, registered, recognised or endorsing shall retain their status until 30 September 2026 and are not obliged to re-apply in the EU if they fall within the scope of the revised BMR on or before such date

Leggi dettaglio →

La Comunicazione dell'Autorità richiama l'attenzione degli intermediari vigilati sull'esigenza di assicurare l'adeguatezza dei presìdi adottati per l'individuazione di rapporti e operazioni riconducibili a soggetti sanzionati, soffermandosi sulle previsioni degli Orientamenti dell’EBA 2024/15 che disciplinano i controlli sulla clientela e sui trasferimenti di fondi e di cripto-attività e forniscono indicazioni sulla configurazione e sulla calibrazione dei sistemi utilizzati per il loro svolgimento.

Leggi dettaglio →

Il Regolamento delegato (UE) 2026/1092 della Commissione integra la direttiva 2014/65/UE del Parlamento europeo e del Consiglio per quanto riguarda le norme tecniche di regolamentazione sull’istituzione di un codice di condotta dell’UE per la ricerca sponsorizzata dall’emittente

Leggi dettaglio →