The transitional period for crypto-asset businesses operating under national regimes ended 31 December 2025. Firms without MiCAR authorisation or a live application are now operating without regulatory cover. The CBI has a pipeline of applications and is running quarterly regulatory returns from Q1 2026.
DORA has been applicable since January 2025. Supervisors are moving from implementation guidance to active assessment. Key gaps we are identifying across client portfolios: incomplete Registers of Information, weak ICT incident classification, and insufficient third-party concentration analysis.