DData Protection
Datenschutz im Zahlungsverkehr – Rechtliche Grundlagen und Besonderheiten Data Protection in Payment Services – Legal Framework and Key Particularities
Read More
  • 10 minute read

Data Protection in Payment Services – Legal Framework and Key Particularities

Data protection in payment services operates within the complex interplay of the GDPR, PSD2 and the German ZAG. A key challenge lies in the legal classification of payment data, as transaction data may reveal highly sensitive insights into individuals’ private lives. This article analyses the principal legal bases for data processing as well as the allocation of data protection responsibilities among payment service providers, PISPs and AISPs.
Read More
PPodcast
KI-Regulierung in der Praxis: Was die Aufsicht zu KI im Finanzsektor wirklich sehen will | ALLES LEGAL #126 AI Regulation in Practice
Read More
  • 2 minute read

AI Regulation in Practice: What Supervisors Really Expect to See from AI in the Financial Sector | ALLES LEGAL #126

Annerton partner Josefine Spengler explains how supervisory authorities assess AI systems in the financial sector in practice. AI is not treated as a regulatory special case but as an ICT system embedded within existing frameworks, particularly DORA. The focus lies on governance, accountability, traceability and ongoing monitoring. The interaction between DORA and the EU AI Act adds further complexity. The key takeaway: AI is not merely an IT issue – it is a management responsibility.
Read More
LLegal
Von Outsourcing zu Third Party Arrangements: Die neuen EBA-Leitlinien zum Drittparteienmanagement • Teil 1: Überblick über die wichtigsten Neuerungen
Read More
  • 7 minute read

From Outsourcing to Third Party Arrangements: The New EBA Guidelines on Third-Party Risk Management 1/2

On 8 July 2025, the European Banking Authority (EBA) published a new consultation paper on the EBA Guidelines for third-party risk management. The draft goes well beyond the previous Outsourcing Guidelines from 2019. The objective is to establish a harmonised European framework for managing third-party risks, aligned in particular with the Digital Operational Resilience Act (DORA). Part 1 of the analysis highlights the key innovations and main content; a practical assessment will follow in Part 2.
Read More
FFinTech
From Onboarding to Offboarding: Lifecycle Management of ICT Third-Party Relationships under DORA 3
Read More
  • 5 minute read

From Onboarding to Offboarding: Lifecycle Management of ICT Third-Party Relationships under DORA

The DORA Regulation (EU) 2022/2554 obliges financial institutions to manage their ICT third-party relationships in a structured way across the entire lifecycle – from selection to exit. For FinTechs, this means that ad hoc purchases of IT services are a thing of the past. Instead, documented and auditable processes are required, taking into account risks, supervisory requirements, and exit strategies.
Read More
DDORA & IT Security
The new DORA-RTS SUB is here! 4
Read More
  • 4 minute read

The new DORA-RTS SUB is here!

On 2 July 2025, the European Commission adopted the Regulatory Technical Standard RTS SUB (Delegated Regulation (EU) 2025/532). It specifies the requirements that financial institutions must meet when (sub-)contracting ICT services that support critical or important functions – particularly with regard to risk assessment and the management of sub-service providers.
Read More