Thoughts, articles, and resources on software development, SaaS, and digital growth.
ESMA's February 2026 supervisory briefing on algorithmic trading sets out concrete expectations for pre-trade controls, conformance testing, stress testing, and AI oversight. Here is what the briefing actually requires and where firms have historically fallen short.
Reverse solicitation allows non-EU crypto firms to serve EU clients without MiCA authorisation, but only in circumstances that are far narrower than most firms assume. This article explains the legal conditions, how ESMA and national authorities are interpreting them, and why firms relying on the exception are taking on more risk than they realise.
Threat-led penetration testing under DORA is mandatory only for entities designated by their national competent authority. This guide explains the designation criteria in the final RTS, what the testing process requires, and how to determine whether your firm is in scope.
DORA's major incident reporting obligation requires an initial notification within 4 hours of classification. That deadline is only achievable if the detection, classification, and data assembly steps upstream of it are engineered to run in sequence without manual bottlenecks. This article maps the full data flow from first awareness to submission.
The EU's list of high-risk third countries for AML purposes is not static. It is updated by delegated regulation, changes without a fixed schedule, and triggers enhanced due diligence obligations across both policies and systems. Managing geographic risk classifications dynamically is a continuous operational function, not a one-time setup task.