The preliminary reference procedure under Article 267 of the Treaty on the Functioning of the European Union (TFEU) constitutes a mechanism by which the Court of Justice of the European Union (CJEU) ensures the uniform interpretation and application of Union law across the Member States. In the specific context of EU financial regulation, this procedural instrument assumes a distinctive function: that of enabling organic harmonisation within the internal market. By facilitating a judicial dialogue between national courts and the CJEU, the preliminary ruling mechanism operates as a decentralised yet effective method of aligning national interpretations of key provisions within directives…
On the 10th of July 2025, the European Securities and Markets Authority (ESMA) published the results of its first peer review of a Crypto-Asset Service Provider (CASP) authorisation under the Markets in Crypto-Assets Regulation (MiCA). The review, focused on Malta, marks an important milestone in the EU’s transition to a harmonised regulatory framework for crypto-assets. The review can be accessed on this link. Malta, which had already established a structured national framework through its Virtual Financial Assets (VFA) regime in 2018, was among the first jurisdictions to operationalise MiCA. The peer review confirms that the Malta Financial Services Authority (MFSA)…
As of today, 8 July 2025, the Regulatory Technical Standards (RTS) on Threat-Led Penetration Testing (TLPT) are now effective, including in Malta, following their publication in the Official Journal on 18 June 2025. These RTS supplement Article 26 of the Digital Operational Resilience Act (‘DORA’) and lay down a framework for the execution of TLPT. The RTS specify the criteria used for identifying the financial entities which are required to perform threat-led penetration tests and lay down organisational arrangements for financial entities. The RTS also include provisions on risk management and specify criteria for engaging TLPT providers. Moreover, the RTS…
