Europe's New Payments Rules Are Changing Fast — Here's What Matters

Alejandro Martínez · 2026-09-22

The MFSA dropped three notable updates in August 2026. And if you're working anywhere near European payments, crypto-assets, or fintech compliance, you'll want to pay attention. The message? Strengthen operational resilience, streamline regulatory requirements, and modernise how firms report to supervisors. That's the direction of travel — and it's picking up speed. Let's break down what actually changed and why it matters. ### AI-Driven Cyber Threats Are Now on the Regulator's Radar The MFSA is flagging something that keeps a lot of compliance officers up at night: Frontier Artificial Intelligence Models, or FAIMs. Here's the concern. AI is making cyberattacks faster and more sophisticated. What used to take a skilled human team hours or days can now happen in minutes. Licence Holders are being urged to ask themselves a tough question — are your existing ICT risk management, cybersecurity, incident response, and third-party risk frameworks still fit for purpose? No new regulatory requirements were introduced. But that's not a free pass. Firms are expected to fold these developments into their existing frameworks. In other words, the regulator is watching how seriously you take this. > "The threat isn't coming. It's already here. The question is whether your defences moved as fast as the attackers." ### Investment Services Rules Get a Major Trim This is where things get interesting for CFD and rolling spot forex firms. The MFSA has amended the Investment Services Rules to significantly streamline requirements. Here's what's been removed: - The €750,000 capital requirement (roughly $810,000) - The 10% regulated shareholder requirement - Certain proprietary IT requirements - The "Trading Organisation" definition That's a meaningful reduction in the regulatory burden. But don't mistake streamlining for loosening. At the same time, the MFSA is raising expectations around competence, independent risk management, and due diligence over liquidity providers and counterparties. So the trade-off is clear: less prescriptive box-ticking, more accountability for how you actually run your business. ### HRRF and the Shift to Digital Reporting The MFSA and FIAU have released draft technical documentation for the Home Grown Returns Framework, or HRRF. This marks a transition toward JSON-based regulatory reporting for Financial Institutions and CASPs. A converter tool and early release of the specifications are designed to give firms — and their technology providers — time to prepare. That's a smart move. Nobody wants a last-minute scramble when reporting architecture changes. If you're running a financial institution or a crypto-asset service provider, this is your heads-up. Start talking to your tech team now. ### What This All Means for You Step back and a clear supervisory direction emerges. Greater technological resilience and accountability. More proportionate regulatory requirements. And reporting processes that are increasingly digitalised. For payments and fintech professionals across Europe, the takeaway is simple: the rules are evolving, and the firms that adapt early will have the advantage. Whether you're dealing with AI-driven threats, investment services compliance, or the new reporting framework, the message from the MFSA is consistent — get ready, stay sharp, and don't wait for a deadline to force your hand. The European payments landscape is changing. The question is whether you're changing with it.