The European regulations and national laws that govern blockchain, crypto-assets, payments, AI and cybersecurity — with their application dates, a plain-language summary and a link to the official text.
Repository last updated: 7 October 2026Create an account to receive by email the latest updates of the laws you choose to follow — create my account.From the most established to the most recent. Each entry links to the official text on EUR-Lex and flags upcoming deadlines.
Requires authorisation for crypto-asset service providers and a white paper for issuers. Governs stablecoins, reserves, governance and market abuse.
Every crypto-asset transfer must carry originator and beneficiary data. Transfers from or to self-hosted wallets must be screened.
ICT risk management, major-incident reporting, resilience testing and contractual control of ICT providers across the financial sector, CASPs included.
Classifies AI systems by risk level: prohibited practices, mandatory transparency, human oversight and documentation for high-risk systems.
Legal basis, minimisation, security, 72-hour breach notification and data-subject rights. Writing personal data to a public blockchain requires specific safeguards.
Cyber-risk management, 24-hour then 72-hour incident notification, management liability. Applies through national transposition laws — see Belgium, Luxembourg and France below.
Creates European digital-identity wallets, qualified electronic ledgers and attribute attestations. Qualified timestamps carry a legal presumption across the Union.
Data sharing for connected products, cloud switching portability, and safe-termination requirements for smart contracts (Article 36).
Allows trading and settlement venues for tokenised securities under derogations, subject to authorisation. A broadening has been proposed since December 2025.
Security by design for any digital product — wallets, nodes, delivered software — vulnerability handling and CE marking.
Software — including AI and updates — becomes a “product”: presumptions of defect and evidence disclosure in favour of claimants.
Crypto providers identify their users and report transactions to tax administrations, with automatic exchange between Member States.
Single, directly applicable anti-money-laundering rulebook, crypto providers in scope, new European supervisory authority (AMLA).
Platform moderation and transparency duties; fairness rules for gatekeepers (access to app stores and wallets).
PSD2: payment-institution licensing, strong customer authentication, open banking. PSD3/PSR will strengthen fraud rules and payee verification.
Also tracked: MiFID II (tokenised securities) · ePrivacy · Data Governance Act (merger into the Data Act proposed) · Instant Payments Regulation (EU) 2024/886 · “Digital Omnibus” proposal (GDPR / Data Act / NIS2 / DORA simplification) · market-integration package (ESMA supervision of CASPs, broader DLT pilot) · FIDA.
Designates the Belgian authorities: FSMA for conduct and offers, NBB for prudential matters, FPS Economy for e-money. The VASP registration regime ends.
Customer due diligence, suspicious-transaction reporting, cash-payment limits. Crypto providers are in scope since the Belgian MiCA Act.
Cyber-risk management, 24/72-hour incident notification, registration with the Centre for Cybersecurity Belgium, management liability. CyberFundamentals framework.
Reform of contract and liability law. Article 5.71 grounds the effect of contracts vis-à-vis third parties — the doctrinal basis of certified structural reliability.
Crypto providers report users and transactions to the FPS Finance for automatic exchange between tax administrations. Records kept for ten years.
Also in the repository: Book 8 of the Civil Code (law of evidence, electronic records) · Companies and Associations Code · Act of 30 July 2018 (data protection, DPA) · DORA implementing act (NBB/FSMA powers) · Act of 19 December 2025 on the resilience of critical entities.
From DLT securities ledgers (I) to the “control agent” and tokenised equity (IV): one of Europe's most complete frameworks for securities on blockchain.
The CSSF authorises and supervises crypto-asset service providers, with a full sanctions regime. VASP registration has lapsed.
Gives the CSSF and the CAA the supervisory and sanctioning powers under DORA and adapts sectoral laws.
Risk management and incident notification across eighteen sectors; regulators: ILR, and the CSSF for the financial sector.
Also in the repository: amended Act of 12 November 2004 (AML/CFT) · Act of 6 April 2013 on dematerialised securities · DAC8 Act (voted 19 March 2026, applying from 1 January 2026) · Act of 1 August 2018 (CNPD, data protection).
The AMF and ACPR share authorisation and supervision of crypto-asset service providers. The PACTE-era PSAN regime lapsed on 1 July 2026.
Adapts French law to the DSA: protection of minors, age verification, cloud rules (switching fees, interoperability).
Crypto providers collect user identities and report transactions to the French tax authority, for automatic European exchange.
France has not yet transposed NIS2: the bill was withdrawn from the agenda on 6 October 2026. Our watch tracks its rescheduling week by week.
Also in the repository: Ordinance No. 2017-1674 (DEEP — financial securities on blockchain) · PACTE Act No. 2019-486 (PSAN regime, phased out) · Data Protection Act No. 78-17 (CNIL) · Monetary and Financial Code, Book V (PSCA, payments, AML/CFT).
Monitoring analyses the repository above and answers your questions according to your stakes and your context: your business, your jurisdictions, your assets. In French or English, with sources cited.
Our automated watch monitors EUR-Lex and the national official journals. As soon as a provision, delegated act or new directive is published, the event is recorded, verified by our team, then published here — and notified to the subscribers concerned.
The repository above is freely accessible. The AI assistant, contextualised answers and file-specific watch are activated by subscription when you create your space.
No-commitment subscription · included for 12 months with any self-certification