European Union: Technology

The commercial agent exclusion in EU payments regulation has evolved from a narrow carve-out for genuine sales intermediaries into a structure that regulators increasingly view as a means of circumventing licensing requirements. This regulatory tension, which predates PSD3, is now being directly addressed through the forthcoming Payment Services Regulation (PSR). How will these reforms reshape the landscape for payment service providers and commercial agents operating within the European Union?

FinXP and Buckzy Payments have formed a strategic partnership to enhance cross-border payment capabilities for internationally-active businesses. The collaboration combines FinXP's regulated European infrastructure with Buckzy's real-time international payment network and stablecoin technology. This integration aims to streamline European account management, SEPA payments, and global payment operations while reducing operational complexity for clients of both platforms.

Malta's financial regulator has issued two significant circulars that reshape how payment and e-money institutions safeguard client funds and how firms report regulatory data.

The European Commission has published comprehensive guidelines on AI transparency obligations under Article 50 of the EU AI Act, with enforcement beginning August 2, 2026. These guidelines establish how organizations must disclose AI systems, mark synthetic content, label deepfakes, and demonstrate compliance, with significant penalties for non-compliance reaching up to €15 million or 3% of global turnover.

Le Figaro reports on the multiplication of legal proceedings initiated by the main publishers against companies developing artificial intelligence models, believing that their works have been used without authorization to train these systems.

The Malta Financial Services Authority has issued comprehensive guidance on artificial intelligence governance for financial firms, establishing clear expectations for board accountability, risk management frameworks, and third-party oversight. As AI adoption accelerates across the sector, regulated entities must now demonstrate robust control mechanisms, model validation processes, and data governance standards that align with both the EU AI Act and prudential requirements.

The Malta Financial Services Authority has issued new ICT circulars highlighting critical deficiencies in digital operational resilience among financial firms, particularly in authorisation applications and DORA compliance.

On 30 June 2026, the Irish Data Protection Commission (“DPC”) published its annual case studies booklet (“Booklet”) alongside its 2025 annual report (“Report”).

Herbert Smith Freehills Kramer's Frankfurt Corporate Crime & Investigations team hosted a conference examining cybercrime threats, AI-driven attacks, and the evolving responsibilities of corporate leadership in building cyber resilience. Senior representatives from law enforcement, industry leaders, and global legal partners explored prevention strategies, incident response protocols, and the complex liability landscape facing organizations in an increasingly digital threat environment.