The European Commission is preparing to examine whether two of its most important digital-finance regulations have imposed disproportionate compliance obligations on banks, cryptocurrency businesses and other financial institutions.
Commissioner for Financial Services Maria Luís Albuquerque will chair an implementation dialogue in Brussels on 27 October, bringing together industry representatives to discuss practical difficulties arising from the Markets in Crypto-Assets Regulation (MiCA) and the Digital Operational Resilience Act (DORA).
The meeting reflects growing pressure on European institutions to reduce administrative complexity while maintaining safeguards against financial misconduct, technology failures and cyberattacks.
According to the Commission’s official meeting programme, participants will examine how the two regulatory frameworks operate in practice and identify areas where requirements may be simplified or better tailored to the risks facing different businesses.
The discussions are not equivalent to a decision to weaken either regulation. They are intended to inform future policy assessments, with a summary of conclusions expected after the meeting.
MiCA faces its first substantial review
MiCA established a comprehensive European framework for issuing, marketing and providing services involving crypto-assets.
Its provisions address areas such as authorisation, disclosure, governance, consumer protection and the operation of cryptocurrency service providers.
The regulation was intended to replace fragmented national approaches with more consistent rules across the European Union.
For businesses operating internationally, a common legal framework can simplify expansion by establishing shared regulatory standards.
However, compliance requirements can also be demanding, particularly for smaller businesses with limited legal and administrative resources.
The Commission’s review will assess whether MiCA is functioning as intended and whether some obligations can be reduced without weakening investor protection.
The European Securities and Markets Authority has already identified several areas requiring attention.
In its recommendations published on 30 September, ESMA proposed improvements to rules governing crypto-asset marketing, cost transparency and emerging activities including decentralised finance, staking, lending and borrowing.
The regulator also called for measures addressing risks associated with promotional activity by influencers and third parties.
These recommendations illustrate the difficulties of simplifying regulation while responding to new financial products that may create additional risks for consumers.
DORA introduces a different challenge
DORA addresses the technological resilience of financial institutions rather than the regulation of cryptocurrency markets.
Applicable since January 2025, it establishes requirements intended to ensure that financial businesses can withstand, respond to and recover from information technology disruptions.
The legislation covers ICT risk management, incident reporting, operational resilience testing and oversight of important external technology providers.
Its relevance has increased as banks, insurers, payment companies and investment firms have become more dependent on cloud infrastructure, software platforms and third-party digital services.
A disruption affecting a major technology supplier can potentially interrupt operations across several financial institutions simultaneously.
DORA seeks to reduce these risks by establishing common standards for managing technological dependence.
The difficulty is that organisations vary considerably in size, operational complexity and exposure to risk.
A requirement appropriate for a major international bank may be expensive or unnecessarily complicated for a smaller financial enterprise.
The Commission’s forthcoming dialogue will therefore consider whether DORA’s obligations are proportionate to the businesses required to implement them.
This does not mean that smaller institutions can disregard cybersecurity or operational resilience.
Rather, the question is whether comparable levels of protection can be achieved through requirements more closely aligned with their actual risks.
Compliance costs and European competitiveness
The review comes amid a broader European debate over regulation and economic competitiveness.
Businesses have repeatedly argued that overlapping reporting obligations, administrative procedures and differing interpretations of EU legislation increase costs and discourage investment.
The Commission has responded by making simplification a central element of its regulatory agenda.
Its 2026 implementation-dialogue programme includes discussions across several economic sectors, from industry and trade to financial services and digital regulation.
The challenge is to identify genuine duplication without abandoning safeguards introduced to address established problems.
Financial technology businesses, for example, may benefit from more predictable licensing and reporting procedures. Customers nevertheless require protection against misleading promotion, misuse of assets and operational failures.
Similarly, reducing unnecessary administrative requirements for financial institutions may free resources for investment, but weakening essential cybersecurity obligations could expose customers and markets to greater risks.
The distinction between simplification and deregulation will therefore be central to the discussions.
Implications for European businesses
The potential consequences extend beyond specialist financial institutions.
Businesses using digital payment providers, cryptocurrency services or outsourced financial technology rely on the stability and regulatory compliance of those services.
Changes in licensing, operational resilience or reporting requirements could influence costs and the availability of financial products.
Smaller technology companies may also be affected by obligations imposed on financial-sector clients that purchase their software or infrastructure services.
The discussion is connected to the EU’s wider attempt to improve conditions for business expansion.
As QuestComms recently reported, Brussels is examining ways to make operating across national markets less complicated.
Meanwhile, the site’s coverage of proposed changes to GDPR and cybersecurity reporting highlights the increasing importance of reducing overlapping obligations without compromising security.
What happens after the dialogue?
The Commission has not announced a specific legislative package arising from the 27 October meeting.
Any substantial amendments to MiCA or DORA would require appropriate legislative procedures, including involvement by the European Parliament and Council where applicable.
The immediate outcome is expected to be a clearer understanding of the operational difficulties faced by regulated businesses.
The Commission will publish a summary of the dialogue and a list of participating organisations after the event.
The political significance lies in the direction of European financial regulation.
Brussels is attempting to demonstrate that its regulatory framework can evolve as technology changes and implementation problems become apparent.
Whether that approach improves competitiveness will depend on identifying obligations that create costs without delivering proportionate benefits, while preserving the protections that originally justified the legislation.
