On 5 November 2026, the European Banking Authority (EBA) published its revised Guidelines on internal governance under the Capital Requirements Directive (EBA/GL/2026/10). The revision reflects changes introduced by CRD VI, strengthens the connection between governance and operational resilience, and introduces more detailed expectations for individual accountability and third-country branches. It also simplifies certain requirements and removes duplication with other regulatory frameworks. For institutions within scope, the practical task is to identify where existing governance arrangements need to be strengthened, documented more clearly or aligned with the revised requirements. Who is affected The Guidelines concern institutions within the CRD governance framework, including credit institutions, relevant approved financial holding companies and mixed financial holding companies, and investment firms subject to CRD Title VII under Article 1(2) or (5) of the Investment Firms Regulation. They also introduce a defined scope of application for EU branches of third-country credit institutions. For Cyprus Investment Firms, prudential classification remains essential. These CRD Guidelines should not automatically be treated as replacing the separate internal governance framework applicable to investment firms under the Investment Firms Directive. The Guidelines are final, but not yet applicable. As at 7 November 2026, the EBA identifies the Guidelines as final, awaiting translation and not yet applicable. The latest published report specifies application two months after publication in all EU official languages. A definitive calendar date has not yet been stated, and the repeal provision for EBA/GL/2021/05 still contains a date placeholder. Institutions should therefore monitor the definitive dates and relevant supervisory communications. Existing obligations under CRD VI, DORA and other applicable legislation must also be considered separately. 1. Individual accountability becomes more explicit One of the most significant developments is the requirement to maintain a mapping of duties, supported by individual statements of roles and responsibilities. The mapping should explain how governance operates, identify reporting lines and shared responsibilities, and help reveal gaps in the allocation of duties. It requires management-body approval and must be available to competent authorities upon request. Individual statements are required for executive members of the management body, members of senior management and key function holders. They should be sufficiently clear, kept updated and signed by the individuals concerned. The distinction matters: the overall mapping includes the roles of all management-body members, while the express individual-statement requirement has a narrower population. The EBA provides an optional template. Institutions may use another suitable format, but the underlying requirement to maintain the statements remains. In practice, institutions should reconcile their organisation charts, committee mandates, job descriptions, reporting lines and delegated authorities. 2. Board conflicts and leadership arrangements require closer attention The revised Guidelines remove the previous exception permitting the supervisory Chair and CEO roles to be combined within the same institution with competent-authority authorisation. They also address conflicts where a CEO holds a supervisory-board position, including as Chair, in another institution within the same group. Specific safeguards apply where a former CEO becomes Chair within two years of leaving the executive role. These address the risk of overseeing earlier decisions, performance or remuneration. This is not an unconditional two-year appointment ban. The Guidelines require appropriate identification and management of the resulting conflicts, without prejudice to national law. Institutions should review succession arrangements, intragroup appointments, recusal procedures and the evidence recorded in board minutes. 3. Internal control functions retain independence, with clearer safeguards The revised framework reinforces the authority, independence and direct access of Risk Management, Compliance and Internal Audit to the management body in its supervisory function. Prior supervisory-board approval before removal is expressly required for the heads of internal control functions. Combining Risk Management and Compliance remains possible under proportionality. However, institutions should be able to demonstrate why separate appointments are not justified, assess and mitigate conflicts, document the decision, and establish that the responsible person has sufficient suitability and time. Internal Audit remains separate. For institutions operating combined roles, the practical question is whether the arrangement is supported by a current, documented assessment of independence, capacity and effectiveness. 4. ESG and operational resilience are more firmly embedded in governance ESG risks were already addressed in the 2021 Guidelines. The revised framework strengthens their integration into board responsibilities, risk management and remuneration. The risk management framework expressly addresses ESG risks over short- and medium-term periods and a long-term horizon of at least ten years. The Risk Committee should also provide input on relevant ESG factors, targets and performance indicators for remuneration. Operational resilience receives greater emphasis through explicit links to DORA, the continuity of critical or important functions, and coordinated preparedness across functions, resources and third-party arrangements. Business continuity provisions also expressly address internal audit review and reporting of testing results to the management body. Institutions should assess whether their board reporting connects these risks to decisions, resources and remedial action. 5. Third-country branches receive a dedicated governance framework The Guidelines introduce specific provisions addressing: Local management, sufficient time commitment and effective presence. Clear responsibilities and management of conflicts arising from multiple roles. Internal control arrangements and safeguards over control-function heads. Adequate substance, resources and oversight of third-party dependencies. ICT risk management and remuneration requirements. Risk management of back-to-back and remote booking arrangements. The approach differentiates between branch categories and recognises proportionality. Institutions should assess the provisions applicable to their branch structure rather than assume that every requirement for an EU-incorporated bank applies identically. 6. Simplification does not mean that underlying controls disappear The standalone outsourcing-policy section and the previous governance-policy checklist annex are removed. This does not remove responsibility for third-party risk management. Relevant expectations remain within the revised governance text and dedicated regulatory frameworks, including DORA. There are also targeted changes to committee composition. For nomination committees of global and other systemically important institutions, the requirement for a majority of independent members becomes a sufficient number, while an independent Chair remains required. The independent-majority requirement for their risk committees is retained. Institutions should distinguish genuine changes from requirements that have simply been relocated or consolidated. 7. Equality and inclusion expectations are strengthened The revised text expressly addresses an organisational culture of equality, diversity and inclusion, together with the prevention of harassment. It also strengthens expectations concerning recruitment panels, gender-neutral policies and internal monitoring of representation and equal treatment. Although the final Guidelines reduce the detail proposed during consultation, institutions still need a proportionate approach to monitoring and responding to the results. What should institutions do now? A focused preparation exercise should: Confirm applicability, including the relevant entities, consolidation levels and branch arrangements. Map the changes against existing policies, separating additions from relocations and simplifications. Prepare or update duties maps and individual statements, ensuring consistency with actual decision-making. Review board conflicts, succession and committee arrangements. Reassess control-function independence and combined roles. Align governance reporting with ESG, operational resilience and third-party risks. Assign responsibilities and a realistic implementation timetable, informed by the definitive application date. ENAH Services Ltd can assist with applicability and gap assessments, governance-policy reviews, duties mapping, internal control arrangements and tailored training for boards, senior management and control functions.

Introduction Cyprus has published a draft law that sets out how the EU Artificial Intelligence Act will be supervised and enforced locally. The draft Artificial Intelligence Law of 2026 (Ο περί της Τεχνητής Νοημοσύνης Νόμος του 2026), dated 12 August 2026, went to public consultation on the government's e-Consultation platform until mid-September 2026. The AI Act (Regulation (EU) 2024/1689) applies directly in every Member State. What it leaves to national law is the machinery: who supervises, what powers they hold, how penalties are imposed and how firms can test AI under regulatory oversight. The Cyprus draft fills that gap. For CySEC- and CBC-regulated firms, it also confirms who will be knocking on the door when AI is used in high-risk financial processes. The Big Picture The draft is an enforcement statute, not a second AI rulebook. It adds no new Cypriot obligations on AI; it designates the authorities, gives them powers and sets the penalty regime the AI Act requires Member States to adopt. Scope (Article 3): the law applies to the persons and sectors defined in Article 2 of the AI Act as providers, deployers, importers, distributors and authorised representatives of AI systems. Primacy of the AI Act (Article 4): terms not defined in the law take their AI Act meaning, and where the two conflict, the Regulation prevails. Structure: 25 articles covering competent authorities, the notifying authority, market surveillance, serious-incident reporting, information and investigation powers, sanctions, registration of high-risk systems, appeals, complaints, real-time biometric identification and the AI regulatory sandbox. Companion bill: an amendment to the Electronic Communications and Postal Services Regulation Law creates a new AI Regulation Directorate within the Office of the Commissioner of Communications to carry out these functions. Entry into force (Article 25): on publication in the Official Gazette of the Republic. Who Will Supervise AI in Cyprus Article 5 of the draft spreads supervision across three named authorities, with the Commissioner of Communications at the centre. Supervisory Powers and Penalties The competent authorities would receive familiar supervisory tools, backed by fines that mirror the AI Act ceilings. Powers Information requests (Article 12): authorities may require technical, financial and other information from any natural or legal person. The information is confidential, subject to proportionate disclosure. Investigations (Article 13): on-site inspections and audits of any premises other than a dwelling, at any reasonable time, and summoning witnesses for oral or written statements. Obstruction: obstructing an official is a criminal offence, punishable by up to six months’ imprisonment, a fine of up to €10,000, or both. Administrative measures and fines Measures scale with severity: a written warning with a deadline to remedy, withdrawal of the AI system from the market, or recall (including deactivation and return to the provider). For undertakings the higher of the fixed amount and the turnover percentage applies. For SMEs and start-ups it is the lower, and the lower-of rule also extends to small mid-caps for the second and third tiers. Due process: before a decision, the firm must be notified and given at least 10 working days to make written submissions or request a hearing. Decisions are reasoned and may be published. In urgent cases, measures can be taken first and the firm heard promptly afterwards. The listed factors for setting a fine reward good conduct: self-reporting, cooperation, mitigation of harm and the technical and organisational measures already in place all count. Documented AI governance is therefore a direct mitigant. Sandbox, Complaints, Appeals and Timing AI regulatory sandbox (Article 22): run jointly by the Commissioner of Communications and the Commissioner for Personal Data Protection, with priority access for SMEs, start-ups and small mid-caps established in the EU. The authorities must also provide training, guidance channels and support for SME participation in standard-setting. Complaints (Article 19): any person may complain about a suspected infringement. Appeals (Article 18): decisions can be challenged before the Administrative Court under Article 146 of the Constitution. Serious incidents and registration (Articles 11 and 16): the draft sets national arrangements for reporting serious incidents and registering high-risk AI systems. The national law arrives against an EU timetable that the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) has moved back: The extra time for high-risk systems is a window to prepare, not a reason to wait. Prohibitions and AI literacy duties already apply, and once the law is enacted Cyprus will have authorities empowered to enforce them. What Firms Should Do Now Build an AI inventory. Record every AI system you develop, buy or use, including AI features embedded in vendor platforms, and your role for each (provider, deployer, importer or distributor). Classify by risk. Confirm that nothing falls under the Article 5 prohibitions, and flag Annex III uses such as creditworthiness assessment, life and health insurance pricing, recruitment and employee monitoring. Identify your supervisor. CBC-supervised entities should expect CBC oversight of high-risk financial uses. CySEC-regulated firms should monitor how the final law allocates their supervision. Close the AI literacy gap. Article 4 of the AI Act already requires staff who operate or use AI to have sufficient AI literacy. Document the training. Embed AI in governance. Assign board-level accountability, add AI to the risk register, and align it with your DORA ICT-risk, outsourcing and GDPR frameworks. Prepare the evidence file. Keep the technical documentation, risk assessments, human-oversight arrangements and transparency notices that an inspector would request under Articles 12 and 13 of the draft. Review vendor contracts. Secure information, audit and cooperation rights from AI suppliers, so you can answer an authority’s request on time. How ENAH Can Help ENAH Services supports regulated firms with AI Act gap assessments, AI inventories and risk classification, AI governance policies, and AI Act training for boards and staff. Contact us to discuss your readiness.

ENAH Business & Executive Insights Growth is usually a sign of success. Rising turnover, new customers, more employees, wider operations and new markets all point to commercial progress. But growth also brings complexity. Processes that worked when a company had 15 employees may not work when it has 150. Approval arrangements designed for one office may not hold when operations spread across several locations or countries. The challenge is not only to grow the business. It is to make sure its structures, processes and internal controls grow with it. For owners and CEOs, this deserves attention before weaknesses start to affect performance. When yesterday's processes no longer work In smaller businesses, owners and senior executives are close to daily operations. They know customers and suppliers, approve important transactions themselves and talk directly to the people running key activities. That level of oversight is hard to keep as the organisation grows. Growth brings more departments, management levels, reporting lines, systems and external providers. Decisions are delegated and activities spread out. Yet companies do not always reassess their processes at the same pace. Arrangements designed for a smaller business keep running long after the business has outgrown them. The result can be inefficient processes, inconsistent approvals, unreliable information, weak supervision and unclear responsibilities. What was once a practical way of working can gradually become a source of business risk. Growth without adequate controls can become expensive Weak controls rarely cause sudden, dramatic failures. More often, the cost shows up in everyday activity. A growing company may experience: •Unnecessary spending: purchases made without clear approval limits, budget monitoring or review. •Inventory losses or discrepancies: stock movements not consistently recorded, reconciled or monitored across locations. •Unreliable management information: departments report in different ways, creating inconsistencies or delays. •Operational inefficiency: responsibilities overlap, work is duplicated or tasks stay unresolved because no one is clearly accountable. •Greater exposure to errors or irregularities: weak segregation of duties or limited transaction monitoring lets mistakes or inappropriate activity go undetected. Imagine a company that opens a second warehouse. Stock is transferred between the two sites by email and phone, and no one reconciles the movements. The differences surface at the year-end stock count, months after they began. (Illustrative scenario.) Each of these issues may look manageable on its own. Together, they affect operating costs, profitability, how resources are allocated and management's ability to make informed decisions. A company can be growing commercially while losing efficiency in how it operates. Are responsibilities still clearly defined? As businesses expand, structures change. New roles are created, people take on additional duties and management responsibilities are redistributed. Reporting lines, approval authorities and documented responsibilities are not always updated to match. The result: several people assume someone else is responsible for an activity, or decisions are made without proper authorisation. One area worth examining is segregation of duties. Where practical, incompatible responsibilities should be separated so that no single person controls a critical process from start to finish without oversight. For example, the same person should not normally be able to set up a new supplier, approve its invoice and authorise the payment, unless there are compensating controls such as an independent review. In smaller organisations, full separation is not always possible. In that case, alternative review and supervision arrangements fill the gap. The aim is not bureaucracy. It is responsibilities and controls that match how the company actually operates. Internal controls should support growth, not restrict it Internal controls are sometimes seen as obstacles to efficiency, especially in commercially driven companies where speed matters. Extra approvals, reports and reviews can feel like an administrative burden. Well-designed controls do the opposite. Clear procedures reduce duplication and uncertainty. Sensible approval limits speed up routine decisions while making sure significant ones get proper attention. Reliable management information helps executives spot problems earlier, allocate resources better and respond with more confidence to change. The key is proportionality. A fast-growing company does not need the control structure of a multinational group. It does need arrangements that fit its size, complexity and risk. Effective internal controls should help a business grow with confidence, not hold it back. When should a growing company reassess its controls? Controls should not be reviewed only after a loss, a disruption or a significant irregularity. Certain developments should prompt management to check whether existing arrangements are still adequate: •Significant increases in turnover, staff or transaction volumes. •Expansion into new markets, countries or business activities. •Acquisitions, mergers or restructuring. •New technology or major changes to business systems. •Greater reliance on external service providers. •Recurring errors, delays, customer complaints or unexplained financial differences. For owners who live abroad, or who are stepping back from daily management, the moment they hand over day-to-day control is itself a good time to reassess. Each of these developments changes the company's risk profile and puts new demands on existing processes. A targeted review of key operational and financial controls can identify improvements without a full organisational redesign. Independent internal audit can provide objective assurance that important controls are well designed and working in practice. A question worth asking Growth creates opportunities, but it also tests the structures that support the organisation. For owners and CEOs, staying in control does not mean supervising every activity personally or adding ever more complicated procedures. It means making sure the business has the information, responsibilities and safeguards it needs to operate well as it grows. The question every growing business owner should ask: "My business has grown significantly. But have the systems, processes and controls protecting it grown with it?" The answer should rest on more than past success. It needs an objective view of how the business operates today, and of whether its arrangements will still be right tomorrow. Because sustainable growth is not only about expanding a business. It is about building an organisation that can support that expansion. How ENAH can help ENAH helps growing businesses, including those owned from abroad, make sure their internal controls keep pace with their growth. We review approval limits, segregation of duties, reporting lines and key operational and financial controls, proportionate to the size of the business, and we provide independent internal audit support. If your business has grown and you are not sure your controls have, we would welcome a confidential conversation. Contact us at: consulting@enaservicesltd.com.

ENAH Business & Executive Insights Trust is fundamental to every successful business. Owners trust their management teams to make the right decisions. CEOs rely on executives to run operations, on employees to do their jobs, and on partners to deliver. Without trust, delegation stalls, decisions slow down and relationships suffer. But trust alone does not tell you whether your business is operating as intended. The real question is not whether you trust the people running your business. It is whether you can see clearly enough to know that it is running effectively, responsibly and the way you expect. Trust and oversight are not opposites Many owners see additional controls as bureaucracy, extra cost or a signal that they doubt their people. Oversight is not distrust. Good internal controls support management. They give clear responsibilities, proper approvals, reliable information and a way to spot and fix problems early. Take a growing company where purchasing, supplier relationships and payment approvals sit with a few experienced executives. They may be highly competent and entirely honest. But if their duties are not separated, transactions are not independently reviewed and management reports are incomplete, errors and irregularities can go unnoticed. Imagine a supplier contract that keeps being invoiced at an old, higher rate for two years. The person who manages the supplier is also the person who approves the invoices, and no one compares the two. Or imagine a weakness that surfaces only when a bank, investor or buyer carries out due diligence, at the worst possible moment. (Illustrative scenarios.) The issue is rarely integrity. It is whether the business has arrangements that work regardless of who sits in each seat. Business growth changes the nature of control Illustrative: when governance does not keep pace with growth, a gap opens. In the early years, owners are involved in every important decision. They know their people, approve significant spending themselves and see operations first-hand. As the business grows, that model stops working. New departments, management layers, subsidiaries, outsourced providers and locations add complexity. Decisions are made further from the owners, and information reaches them through several reporting lines. At this stage, personal oversight needs the support of structured governance, clear responsibilities and reliable internal controls. A business can grow considerably in size and turnover while its governance and controls stay where they were. That gap creates vulnerabilities that often stay hidden until something significant goes wrong. Owning a business from a distance For owners who live abroad, the gap is wider. The same applies to owners who hold a business in Cyprus, Greece or elsewhere while based in another country. They cannot be on site every day, sit in on supplier meetings or sense that something is not right. They rely on reports, calls and the people on the ground, which means they rely on trust more than anyone. That is exactly why they need independent, structured visibility: a clear view of what is actually happening, not only of what is being reported. What does the CEO actually know? Senior executives receive management reports, financial information, KPIs and updates from department heads. But having information is not the same as having complete and reliable information. Five questions worth asking: · Are reported figures reviewed and reconciled? · Are material operational risks reported to you promptly? · Can employees raise concerns outside their immediate reporting line? · Are exceptions, control weaknesses and recurring problems investigated? · Is there independent assurance that key controls work as intended? These questions matter even when results are strong. Good financial results do not prove that controls are effective. The absence of reported incidents does not mean there are no weaknesses. Internal audit: Beyond detecting problems Many people think of internal audit as a function that looks for mistakes and non-compliance. Its value goes much further. For larger companies this means internal audit. For smaller and owner-managed businesses it can be an independent review of governance and controls. Either way, it gives owners an objective view of how risks are managed and whether key procedures work in practice. It identifies weaknesses and recommends improvements before they become serious problems. For owners, boards and CEOs who have delegated day-to-day operations, that independent view is particularly valuable. It does not replace management's responsibilities, and it cannot remove business risk. It gives you better information to oversee the business and make decisions. Building confidence through effective governance Good governance should fit the company's size, complexity, business model and risk. It does not require thick policy manuals, extra management layers or complicated approvals. What matters is that arrangements are appropriate, clearly understood and consistently applied. You should be able to answer four questions: · Who is responsible for significant decisions? · How are risks identified and reported? · Do key controls work? · How do concerns reach the right people? Done well, governance gives management control without slowing the business down. A question worth asking For owners and CEOs, the choice is not between trusting people and implementing controls. You need both. Trust supports relationships, delegation and effectiveness. Governance, internal controls and independent assurance provide the basis for oversight and accountability. The question every business owner should ask: "If something important were going wrong in my business today, would I know about it in time to act? And what gives me that confidence?" The answer should rest on reliable information, effective controls and independent assurance, not on assumptions. Because protecting a business starts with knowing what is really happening within it. How ENAH can help ENAH works with business owners, boards and CEOs, including owners based abroad, to give them an independent view of how their business really operates. Our Governance Health Check reviews governance arrangements, internal controls and reporting lines. We also provide internal audit support proportionate to the size of the business. If the question above gave you pause, we would welcome a confidential conversation. Contact us at consulting@enaservicesltd.com. ENAH Services Ltd | Governance, Risk, Compliance & Internal Audit Advisory

ENAH Business & Executive Insights A company can be profitable, growing and ahead of its targets. Sales are rising, new customers are coming in, and management reports say the business is heading in the right direction. But does strong performance mean the business is well protected? Not always. Some of the most significant business risks do not show up in financial results or routine management reports. They build up gradually, fall between departments, or surface only when an unexpected event exposes the weakness underneath. For owners and CEOs, the challenge is not only to manage the risks they already know about. It is to find the vulnerabilities that sit outside their direct line of sight. Here are five areas worth examining. 1. Strong results can hide operational weaknesses Good financial results matter. But profitability alone does not show that operations are under control. A company can hit its revenue targets while weaknesses build up in purchasing, inventory, expense approvals, payments or contracts. Purchasing without proper review can lead to unnecessary spending, poor supplier terms or missed opportunities. Where departments do not work together, operational data and financial reports can drift apart without anyone noticing. None of this threatens the company overnight. Over time, however, it erodes profitability, efficiency and management's ability to make sound decisions. The question: Beyond the financial results, how do I know that my business runs efficiently and that its resources are properly managed? 2. Dependence on key people can leave the business exposed Every business relies on experienced, capable and trusted people. In many organisations, however, critical knowledge, decisions or processes end up concentrated in a few individuals. A senior executive may be the only person who fully understands a major customer relationship. A finance manager may control essential payment processes. An IT specialist may hold knowledge that has never been written down. These arrangements can work well for years. Then a key person leaves or is suddenly unavailable, and the business discovers that information, processes or relationships cannot be handed over easily. Imagine the only person who knows the system access, bank mandates and supplier arrangements behind the company's payments resigning with one month's notice. (Illustrative scenario.) For owners based abroad, the exposure is often greater, because the person on the ground may also be their main source of information about the business. This is not a question of performance or integrity. It is a question of resilience: is critical knowledge documented, can responsibilities be reassigned, and can essential activities continue without serious disruption? The question: Are there people in my organisation whose sudden absence could seriously affect our ability to operate? 3. Contracts can commit the business to more than management realises Commercial agreements are fundamental to any business. Yet contracts are often treated as documents to negotiate and sign, rather than as obligations to manage. A company may sign agreements with significant financial commitments, restrictive termination terms, indemnities, performance obligations or limits on its commercial freedom. The risk is usually not the terms themselves. It is that no one has assessed what they mean in practice, or set up a way to monitor them. Consider a business that depends heavily on one supplier or partner. If that relationship deteriorates, how easily can the company exit, find an alternative and keep operating? Where different departments manage different contracts, management may also lack a single view of the company's material commitments. The question: Do I know which contracts and commercial relationships could materially affect my business if something went wrong? 4. Technology and external providers bring risks outside your direct control Cloud services, digital systems, outsourced operations and technology providers can make a business far more efficient. They also create dependencies that senior management does not always see. A company may rely on external providers for payments, customer data, core systems or cybersecurity. Outsourcing an activity does not outsource the risk. A system outage, a data breach or a provider's declining performance can directly affect operations, customers and reputation. The exposure is greatest where the business does not know which services are critical, how providers are monitored or what the alternative is if a service stops. The question: If one of my critical systems or service providers failed tomorrow, how prepared would my business be? 5. Culture can stop bad news from reaching the top Culture is usually discussed in terms of engagement, leadership and values. It is also central to risk management and governance. Where employees hesitate to challenge decisions, raise concerns or share unwelcome information, senior management receives an incomplete picture. This can happen even where formal reporting channels and policies exist. People stay silent because they expect to be ignored, fear the consequences or do not know where to turn. Middle managers may hold back operational problems when the environment puts too much weight on hitting targets and avoiding bad news. So the absence of reported problems is not proof that there are none. Owners and CEOs should ask whether their organisation encourages transparency, makes escalation easy and treats concerns objectively. The question: Does my company's culture allow difficult information to reach me, even when it challenges senior management's decisions or performance? Seeing beyond the management report These five risks have one thing in common: they can exist in businesses that look successful. Finding them does not require complicated procedures or an extra layer of management. It requires a proportionate approach that helps the company understand its material exposures, test whether its existing arrangements work and fix weaknesses where needed. Management self-assessments, targeted reviews, legal and contract reviews, risk management processes and independent internal audit can all contribute. For smaller and owner-managed businesses, a focused independent review is often the most practical first step. The right mix depends on the size, complexity, activities and risk profile of the business. Finding weaknesses is not only a response to failure. A business that identifies and addresses vulnerabilities before they cause losses or disruption is better placed to make informed decisions, protect its resources and grow sustainably. A question worth asking No owner or CEO can identify every risk or anticipate every adverse event. But they should have a sound basis for understanding the risks that could materially affect their business. Financial performance is important, but it does not tell the whole story. The question every business leader should consider: "What could be happening in my business today that is not reflected in the reports I receive, and what have I done to find out?" Because understanding a business means looking beyond what is immediately visible. How ENAH can help ENAH helps business owners, boards and CEOs, including owners based abroad, see what their reports may not show. We carry out independent reviews of operations, key-person dependencies, material contracts, technology and outsourced providers, and governance and reporting culture, proportionate to the size of the business. We also provide internal audit support. If one of the five questions above gave you pause, we would welcome a confidential conversation. Contact us at consulting@enaservicesltd.com. ENAH Services Ltd | Governance, Risk, Compliance & Internal Audit Advisory

ENAH Business & Executive Insights Every CEO wants to believe that important problems in the organisation will eventually reach them. After all, companies have managers, reporting lines, meetings, policies and procedures designed to move information through the organisation. But what if employees know something is wrong and choose to say nothing? What if operational weaknesses, inappropriate conduct or questionable decisions go unreported, not because nobody noticed them, but because people are reluctant to raise them? The risk is not only what management does not know. It is what others in the organisation know but are unwilling to say. For owners, CEOs and boards, this is not just a matter of employee relations. I t is a question of corporate governance, organisational culture and effective risk management. Silence does not mean that everything is working In many organisations, the absence of complaints, reported incidents or internal disagreement is read as a sign of stability. Employees seem satisfied. Management reports are positive. Operational problems appear limited. But a lack of reported concerns does not mean there are no concerns. People hesitate to speak up for different reasons. They may fear damage to their working relationships or career prospects. They may believe management will not take them seriously, or that reporting a problem will be seen as disloyalty. Or they may simply not know whom to approach, or whether the issue is important enough. The result can be an organisation where information is filtered, concerns stay unresolved and senior management sees an incomplete picture. For owners based abroad, the effect is stronger. They miss the informal conversations through which problems often surface first, so whatever is not formally reported may never reach them. A company can appear to have open communication while significant issues remain unspoken. When corporate culture becomes a business risk Culture is usually associated with employee satisfaction, teamwork, values and leadership. I t also shapes how people respond when something goes wrong. Consider an employee who notices unusual transactions, repeated departures from procedure or inappropriate behaviour by a senior colleague. They know the matter deserves attention but feel uncomfortable raising it with their manager, especially if that manager is involved. If alternative channels are unclear, ineffective or not trusted, the issue stays where it is. Imagine an accounts assistant who notices that a department head regularly splits large purchases into smaller orders that stay just below the approval limit. Unsure whom to tell, and wary of the consequences, the assistant says nothing. The pattern surfaces a year later during an audit. (Illustrative scenario.) Similarly, where management puts excessive pressure on hitting financial or operational targets, people may hold back information that could be seen as undermining performance. In these conditions, errors, misconduct or control weaknesses can continue without timely intervention. Not every unreported concern involves wrongdoing. But this shows how culture can determine whether governance and internal controls actually work. Leadership is reflected in how concerns are received A company may have comprehensive policies encouraging employees to report concerns. Their existence does not mean employees feel comfortable using them. The attitude and behaviour of senior management matter most: How does a manager respond when an employee challenges a decision? Are concerns examined objectively, or dismissed straight away? Can employees ask difficult questions without being seen as uncooperative? When mistakes come to light, does management look for causes, or for someone to blame? The answers shape whether employees believe that speaking up is worthwhile. An organisation's culture shows not only in the values it communicates, but in how management responds when those values are tested. For business leaders, creating an environment in which concerns can be raised properly is therefore a key part of effective oversight. Whistleblowing: More than a legal obligation Whistleblowing arrangements are part of the wider mechanisms through which concerns about wrongdoing can be reported and addressed. In the European Union, Directive (EU) 2019/1937 protects persons who report breaches of Union law. I t was transposed in Cyprus by Law 6(I)/2022 and in Greece by Law 4990/2022. In broad terms, private-sector employers with 50 or more workers, and certain smaller entities in sectors such as financial services, must have internal reporting channels. The exact obligations depend on the applicable national law and the circumstances. Not every employee complaint or operational concern is a protected whistleblowing report. For businesses, the practical issue goes beyond formal compliance. A reporting channel should be well designed, accessible to those entitled to use it, and supported by safeguards for confidentiality, impartial handling and protection against unlawful retaliation, where applicable. The organisation should also distinguish between protected whistleblowing reports, ordinary employment grievances, operational incident reporting and other internal escalation routes. They serve different purposes, but together they support a more transparent and accountable workplace. A reporting channel that exists only on paper has little value if the people expected to use it do not understand or trust it. What should CEOs and boards be asking? Business leaders do not need to be involved in every workplace concern. They should, however, have reasonable assurance that material issues can be identified, escalated and addressed. Questions worth asking: Do employees know how and where to raise concerns? Are there suitable alternatives when the concern involves an immediate manager or a senior executive? Are reported matters assessed impartially and handled with appropriate confidentiality? Does the company have arrangements to prevent and address retaliation where the law requires protection? Are significant findings, recurring issues and control weaknesses reported to the right level of management or to the board? Is there a process for following up corrective actions and confirming that problems have been resolved? The answers should come from how reporting arrangements work in practice, not from the existence of written policies. Depending on the organisation, internal audit or another independent review can provide valuable assurance on the design and effectiveness of these arrangements, while respecting confidentiality and independence requirements. A culture that supports informed decisions An effective culture does not require employees to agree with every management decision, and not every concern raised will prove justified. I t requires an environment where relevant information can be shared responsibly, assessed fairly and addressed at the right level. For owners and CEOs, this improves visibility over risks and the quality of the information behind decisions. I t also helps catch procedural weaknesses, inappropriate practices and emerging problems before their consequences grow. The aim is not an organisation in which everyone questions every decision. I t is one in which significant concerns are not suppressed, ignored or unnecessarily delayed. A question worth asking Owners and senior executives often measure effectiveness by performance, financial results and operational achievements. Equally important is whether the organisation lets difficult information reach the people responsible for acting on it. The question every CEO should ask: "If someone in my company knew about a serious problem today, would they feel confident enough to report it? And could they trust that it would be addressed properly?" If the answer is uncertain, the issue deserves attention. Because a business cannot manage risks it never hears about. How ENAH can help ENAH helps business owners, boards and CEOs, including owners based abroad, find out whether important concerns can reach them. We review the design and operation of speak-up and whistleblowing arrangements, escalation routes and the handling of reported matters, proportionate to the size of the business and the applicable legal requirements. We also provide independent internal audit support. If the question above gave you pause, we would welcome a confidential conversation. Contact us at consulting@enaservicesltd.com. ENAH Services Ltd | Governance, Risk, Compliance & Internal Audit Advisory

What entities in Cyprus need to know Commission Implementing Regulation (EU) 2026/2354 - A common EU framework for BO submissions Commission Implementing Regulation (EU) 2026/2354 introduces common formats for submitting beneficial ownership information. Adopted on 16 October 2026 and published in the Official Journal on 22 October 2026, the Regulation applies from 10 July 2027. The measure harmonises the formats used to submit beneficial ownership (BO) information to central registers across the EU. For entities in Cyprus, it warrants consideration in relation to their own reporting obligations and, where relevant, the information they maintain about client ownership and control. What the Regulation does The Regulation establishes common submission formats and minimum acceptance requirements for central registers. Its purpose is to improve data quality, consistency and interoperability. It operates within the wider EU AML framework, including Regulation (EU) 2024/1624 and Directive (EU) 2024/1640; it does not itself redefine who qualifies as a beneficial owner. The Key Changes Consistent identification and control information The formats cover personal identification details, country of residence, nationalities and identity-document information, including the issuing country. They also distinguish direct and indirect ownership and different means of control. Separate formats address trusts and similar arrangements, nominees and nominators, and beneficial interests in collective investment undertakings. Clearer presentation of ownership structures Articles 2 and 3 and Annex I address ownership and control information through file uploads or structured data. Organisational charts are a central feature, but the text also accommodates alternative collection methods and proof of dispersed ownership where relevant. Structured explanations and acceptance requirements Article 1(6) specifies minimum selectable reasons where a beneficial owner cannot be identified. This should not be treated as a substitute for a properly supported assessment. Article 5 establishes minimum conditions that submissions must satisfy before central registers may accept them. What this means for entities in Cyprus The practical significance extends beyond the presentation of a register submission. More consistent information should make ownership records easier to interpret and compare. In our view, this increases the importance of ensuring that the ownership position reflected in an entity’s records can be explained and supported. The implications will differ according to each organisation’s role. Companies should consider their own BO reporting obligations, where applicable, while firms providing corporate administration, trustee or other relevant services should also assess the effect on the structures they service. Entities subject to AML obligations should consider how register information interacts with their customer due diligence records. These are related but distinct responsibilities. A register submission and a firm’s assessment of its customer’s ownership and control serve different purposes. Preparation should therefore reflect the organisation’s actual obligations, activities and, where relevant, client profile. Timing and existing registrations The application date is 10 July 2027. Recital 10 indicates that existing registrations should not be immediately affected by the new formats and envisages their use when existing information is updated. This does not amount to a blanket requirement to re-file all existing registrations on that date. Further guidance from the relevant Cyprus registers will be important for operational implementation. The wider AML Regulation also contains obligations concerning the maintenance, verification and updating of BO information. Those obligations should be distinguished from the submission formats introduced by this implementing measure. Preparing for July 2027 Assess the implications for the organisation’s own reporting obligations and, where relevant, the client structures or arrangements it services. Review the completeness and consistency of BO information and supporting records, with particular attention to complex ownership and control arrangements. Consider the procedural, system and staff-awareness changes needed ahead of July 2027, taking account of further guidance from the relevant registers. ENAH Services Ltd can support organisations in assessing the implications of the new formats and identifying proportionate changes to their BO records, processes and, where applicable, AML framework. Please contact us to discuss how the requirements affect your organisation.

On 18 September 2026, the European Banking Authority (EBA) published its final Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09). The Guidelines broaden the existing outsourcing framework to cover a wider range of relationships with third-party service providers. For affected firms, this means reviewing whether their current governance arrangements, policies, registers and contracts adequately capture their reliance on external providers. They will replace the EBA’s 2019 Guidelines on outsourcing arrangements once applicable. Their application date remains to be confirmed. EBA Final Report. The main change is the broader scope of third-party risk management. The new framework covers arrangements under which a third party provides non-ICT services supporting a firm’s functions on a recurring or ongoing basis. Outsourcing forms part of this broader category. A service may therefore fall within scope even where the firm has not previously classified it as outsourcing. Firms will need to examine the service provided, the function it supports and the consequences of disruption. The framework also covers relevant arrangements with group companies and providers located outside the EU. Intragroup arrangements remain subject to appropriate risk assessment and oversight. Specified exclusions apply, including statutory audit and services without a material impact on the firm’s risk exposure or operational resilience. Firms should document their classification decisions and continue to manage the risks associated with excluded relationships. Applicability depends on the firm’s regulatory status. The Guidelines cover, among others: Credit institutions. Class 1 minus and Class 2 investment firms. Payment institutions and electronic money institutions. Issuers of asset-referenced tokens. They also address relevant EU branches of third-country credit institutions, approved financial holding companies and mixed financial holding companies, and certain mortgage creditors that qualify as financial institutions. Small and non-interconnected Class 3 investment firms and providers offering only account information services are excluded from the direct scope. For Cyprus Investment Firms, prudential classification is therefore an essential starting point. Existing outsourcing requirements under MiFID II and Commission Delegated Regulation (EU) 2017/565 continue to apply. The Guidelines are final, but they are not yet applicable. As at 19 September 2026, the EBA identifies the Guidelines as final and awaiting translation into the EU official languages. The published report retains placeholders for the application and repeal dates. EBA publication status. The implementation provisions distinguish between the following arrangements: Arrangements Implementation approach Arrangements entered into, reviewed or amended on or after the application date The new Guidelines apply from that date. Existing arrangements supporting critical or important functions A two-year transition from the application date applies to their review and documentation. If this work remains incomplete, firms should inform their competent authority, including the planned completion measures or possible exit strategy. Other existing arrangements within scope Review and documentation may take place upon renewal. The two-year transition runs from the application date. The published report does not establish publication of the translations as the starting point for that period. Once applicable, the new Guidelines will repeal the EBA Guidelines on outsourcing arrangements of 25 February 2019 (EBA/GL/2019/02). Firms should monitor the EBA’s publication of the definitive dates when planning implementation. Several areas will require particular attention. The register must capture the broader scope.Firms should maintain a register covering all non-ICT third-party arrangements within scope, distinguishing those supporting critical or important functions. An existing outsourcing register may therefore need to be expanded. Additional information is required for arrangements supporting critical or important functions, including relevant subcontractors, substitutability, recovery objectives and the existence of an exit plan. Classification drives the level of oversight.More demanding requirements apply where a service supports a critical or important function. The assessment considers whether disruption or failure would materially impair financial performance, service continuity or compliance with authorisation requirements and applicable financial services law. Governance and accountability remain with the firm.The management body should approve and regularly review the third-party risk strategy. The policy covering non-ICT services supporting critical or important functions should be reviewed at least annually. Responsibilities, reporting lines and internal resources should support effective oversight throughout the relationship. Contracts require a differentiated review.Baseline contractual provisions apply to all arrangements within scope. These address matters such as service descriptions, service and data locations, data protection and recovery, service levels, cooperation with authorities and termination. Additional safeguards for critical or important functions include measurable performance targets, access and audit rights, business continuity requirements and adequate transition arrangements. Subcontracting requires visibility and control.For services supporting critical or important functions, firms should understand the relevant subcontracting chain and the dependencies it creates. Contracts should address whether subcontracting is permitted, notification of proposed changes, approval or objection rights, and the safeguards necessary to maintain effective oversight. Continuity and exit arrangements must work in practice.Firms should assess their ability to respond to provider failure, severe disruption or service deterioration. Exit plans for arrangements supporting critical or important functions should be documented, realistic and sufficiently tested where appropriate, taking account of alternative providers, internal capabilities and transition requirements. Many of these controls already featured in the 2019 outsourcing framework. The preparation exercise should identify where existing controls need to be extended or refined to meet the new scope and requirements. DORA remains relevant where an arrangement also involves ICT services. These Guidelines address non-ICT services. ICT services fall under the DORA framework. Where providing a non-ICT service also involves ICT services, paragraph 32 requires the financial entity to assess whether that ICT component is material to the service provision and triggers DORA requirements. For mixed arrangements, firms should therefore document which requirements apply to the respective services. The Guidelines allow coordinated policies and registers across the two frameworks, provided the relevant requirements are met. Firms can begin with a focused applicability and gap assessment. We recommend: Mapping non-ICT third-party arrangements, including those currently outside the outsourcing register. Confirming which arrangements fall within scope and whether they support critical or important functions. Where an arrangement combines non-ICT and ICT services, assessing whether the ICT elements trigger requirements under DORA. Reviewing policies, registers, contracts and subcontracting controls against the revised requirements. Prioritising arrangements supporting critical or important functions, including continuity and exit planning, with clear responsibilities and a realistic remediation timetable. Early preparation will help firms identify the extent of the work required, engage providers where contractual changes are necessary, and plan implementation once the definitive application date is published. ENAH Services Ltd can assist with applicability and gap assessments, reviews of third-party registers and contracts, and the development of proportionate governance, continuity and exit arrangements.

The European Securities and Markets Authority (ESMA) has issued a new Statement on T+1 preparations, urging EU market participants to accelerate the operational and technical work required for the transition to a shorter securities settlement cycle. EU financial markets will move to T+1 settlement on 11 October 2027. This means that, for transactions within scope, settlement will generally take place one business day after the trade date instead of two. Although the final transition remains more than a year away, ESMA makes clear that 2026 is a critical implementation year—and that an earlier regulatory deadline will apply from December 2026. Why has ESMA issued this statement now? Readiness surveys conducted by the EU T+1 Industry Committee indicate increasing awareness and commitment across the market. However, ESMA notes that implementation remains uneven between markets, sectors and firms. The message is therefore straightforward: awareness is no longer enough. Firms should now be progressing through detailed impact assessment, remediation, system development, engagement with counterparties and service providers, and end-to-end testing. ESMA also warns that insufficient preparation may create material operational and reputational risks. These include settlement failures, disruption caused by dependencies on market infrastructures and technology providers, an inability to meet client expectations, and higher costs arising from last-minute remediation. The two key deadlines 7 December 2026: allocations and confirmations The first deadline concerns improvements to the initial post-trade process. Firms will need to comply with requirements relating to the timely exchange of allocations and confirmations and the default use of international communication standards. This is not simply a documentation exercise. Firms should consider whether their current processes are sufficiently electronic, standardised and timely, and whether manual steps or late instructions could prevent completion within the shorter settlement timetable. 11 October 2027: full transition to T+1 The final deadline is the EU-wide transition to T+1 settlement. By this date, firms must also be ready for requirements intended to optimise the settlement layer, including the timely transmission of settlement instructions and the broader use of relevant central securities depository functionalities, such as auto-partial settlement, hold and release, and auto-collateralisation. What should firms be doing now? ESMA highlights automation, standardisation and timely data quality as essential components of T+1 readiness. In practical terms, firms should: map the complete trade and settlement lifecycle and identify activities affected by the shorter cycle; assess whether allocations, confirmations and settlement instructions are exchanged within the required timeframes; identify manual interventions, batch processes, cut-off times and exception-handling arrangements that may cause delays; review the accuracy and availability of settlement data, including Standard Settlement Instructions and relevant reference data; assess system capacity, interfaces and operational resilience under a compressed timetable; review agreements, procedures, governance arrangements and escalation mechanisms; establish a structured testing and remediation programme well before go-live. A compliance and operational priority for 2026 The move to T+1 is not only a technology project. It affects governance, operations, client arrangements, data management, outsourcing, risk management, compliance oversight and business continuity. Senior management should have clear visibility of the firm’s readiness status, material gaps, external dependencies, testing progress and remediation deadlines. With the first compliance milestone on 7 December 2026, firms should now be moving from high-level planning to evidenced implementation. How can ENAH Services Ltd assist? ENAH Services Ltd can support regulated firms and other market participants through: T+1 regulatory and operational readiness assessments; end-to-end process and dependency mapping; gap analysis against the applicable requirements and ESMA expectations; review of governance, policies, procedures and client or service-provider arrangements; development of prioritised remediation and implementation roadmaps; and independent review of implementation and testing readiness ahead of the applicable deadlines. Early assessment provides firms with the time needed to address weaknesses in a controlled and proportionate manner, while reducing the operational risk and cost of late remediation.

The European Supervisory Authorities—the EBA, EIOPA and ESMA—have published a Final Report proposing targeted amendments to the bilateral margin requirements for uncleared OTC derivatives. The proposed changes are intended to simplify the treatment of counterparties that fall below the €8 billion initial margin threshold. Most importantly, the exemption from exchanging initial margin would be extended from new transactions to existing uncleared OTC derivative contracts. This would allow affected counterparties to release initial margin already collected for outstanding contracts, subject to their contractual arrangements and operational readiness. The proposed amendments represent targeted regulatory relief, but they have not yet entered into force. The existing bilateral margin framework Commission Delegated Regulation (EU) 2016/2251 establishes risk-mitigation requirements for OTC derivative contracts that are not cleared through a central counterparty. Among other matters, the Regulation establishes requirements concerning: the calculation and exchange of variation and initial margin; the types of collateral that may be used; collateral valuation and haircuts; segregation of initial margin; risk-management procedures; and operational and legal arrangements between counterparties. Initial margin protects counterparties against potential future exposure arising between the default of a counterparty and the close-out or replacement of the relevant derivative portfolio. Unlike variation margin, which reflects changes in the current market value of a contract, initial margin is intended to cover potential changes in exposure during the period required to close out or replace positions following a default. What is the €8 billion threshold? The initial margin requirements apply by reference to a counterparty’s aggregate month-end average notional amount, commonly referred to as AANA, of non-centrally cleared OTC derivatives. The calculation is based on the month-end amounts for March, April and May. Where a counterparty belongs to a group, the calculation is performed at group level. This means that entities cannot consider only their individual derivative portfolios where the applicable rules require the exposures of the wider group to be included. The €8 billion threshold is separate from the EMIR clearing thresholds. The two regimes cover different transaction populations and serve different regulatory purposes. What is the problem with the current rules? Under the existing framework, where one of the two counterparties falls below the €8 billion threshold, the counterparties may stop exchanging initial margin for new uncleared OTC derivative contracts entered into during the relevant period. However, the exemption does not extend to contracts already outstanding. Consequently, counterparties must continue: calculating initial margin for existing contracts; exchanging or maintaining collateral; operating segregation arrangements; maintaining custodial accounts and relationships; and supporting the related legal, reconciliation and operational processes. This may continue for the remaining duration of the outstanding contracts, even though new transactions between the same counterparties are no longer subject to initial margin. The ESAs consider this outcome unnecessarily complex and burdensome. It is also inconsistent with the approach followed in certain other jurisdictions, potentially affecting the international level playing field. The principal proposed change The draft RTS would extend the initial margin exemption to both new and existing contracts. Where one of the two counterparties has an AANA below €8 billion for March, April and May of a given year: initial margin would not be collected for uncleared OTC derivative contracts between the two counterparties; and initial margin already collected for outstanding contracts would be released. The exemption could be implemented as early as 1 June of the year in which the relevant March, April and May calculation is performed. This would allow counterparties to benefit from the exemption shortly after demonstrating that one of them is below the applicable threshold. What happens when the threshold is exceeded? The draft RTS also clarify the position where both counterparties have an AANA above €8 billion. In that case, the counterparties would become subject to initial margin requirements for new uncleared OTC derivative contracts entered into between them. The requirements would apply no later than 1 January of the following calendar year. This preserves a preparation period for counterparties entering the initial margin regime, allowing them time to establish or update: collateral documentation; initial margin calculation processes; eligible collateral arrangements; segregation and custody structures; dispute-resolution procedures; and operational and systems capabilities. Counterparties may nevertheless begin collecting initial margin earlier if they choose to do so. The proposed relief is optional The draft wording allows counterparties to provide for the exemption in their risk-management procedures. It does not prevent them from continuing to collect and exchange initial margin voluntarily. Counterparties that become eligible for the exemption may therefore decide: whether to apply the exemption; when to stop collecting initial margin; how and when existing collateral should be released; and whether some contractual or risk-management arrangements should remain in place. The ESAs expressly recognise that the release of initial margin should be managed in accordance with the counterparties’ contractual arrangements and operational readiness. Eligibility for relief should therefore not result in the immediate or uncontrolled release of collateral. Affected firms will need a coordinated process covering legal documentation, internal approvals, counterparty agreement, custodian instructions, reconciliations and operational controls. What about single-stock and equity-index options? EMIR 3 introduced Article 11(3a) into EMIR, exempting non-centrally cleared single-stock options and equity-index options from requirements concerning the timely, accurate and appropriately segregated exchange of collateral. The draft RTS therefore propose deleting outdated transitional provisions in Delegated Regulation (EU) 2016/2251. This is primarily a technical alignment of the Level 2 rules with the exemption already established under the Level 1 EMIR framework. These options would continue to remain exempt from the relevant margin requirements. Practical implications for affected counterparties The proposed change may reduce the cost and operational burden associated with maintaining initial margin arrangements for legacy portfolios. Potential benefits include: release of collateral held against existing contracts; reduced funding and liquidity costs; reduced initial margin calculation and reconciliation activity; simplification of custody and segregation arrangements; reduced operational complexity for legacy portfolios; and greater alignment with the approach applied in other jurisdictions. However, firms should not consider the change purely as automatic regulatory relief. Several practical issues will need to be addressed before initial margin is released. These include: confirming the accuracy and scope of the AANA calculation; determining whether the threshold is assessed at entity or group level; confirming the counterparty’s threshold status; reviewing contractual rights and obligations; agreeing the timing and mechanics of collateral release; assessing whether custody arrangements should be amended or terminated; updating risk-management procedures; obtaining appropriate internal approvals; and maintaining evidence supporting the decision to apply the exemption. What should firms do now? The amendments are not yet legally applicable. The Final Report and draft RTS have been submitted to the European Commission for endorsement. Following Commission adoption, the Regulation will be subject to scrutiny by the European Parliament and the Council. It will then be published in the Official Journal of the European Union and enter into force on the twentieth day following publication. In preparation, potentially affected firms should: identify counterparties and portfolios currently subject to initial margin; validate their AANA calculation methodology and group perimeter; estimate which relationships may fall below the €8 billion threshold; quantify the collateral and liquidity impact of the proposed relief; review credit support documentation and custodian arrangements; establish governance for deciding whether the exemption will be applied; define an orderly collateral-release process; and monitor the endorsement and legislative scrutiny process. Firms approaching or fluctuating around the threshold should pay particular attention to annual monitoring, documentation and operational readiness. They may move into or out of the initial margin regime depending on the relevant AANA calculation. Early preparation will allow affected firms to benefit from the proposed simplification in a controlled manner while maintaining appropriate legal, operational and risk-management safeguards.

Introduction Commission Delegated Regulation (EU) 2026/825 introduces new Regulatory Technical Standards concerning the establishment, implementation and assessment of investment firms’ Order Execution Policies under MiFID II. The Regulation was published in the Official Journal of the European Union on 23 July 2026, enters into force on 12 August 2026 and will apply from 12 February 2028. It represents an important development in the EU best execution framework, introducing significantly more detailed requirements regarding execution-venue selection, order-routing arrangements, execution-quality monitoring, governance and the assessment of whether firms consistently achieve the best possible result for their clients. The best execution obligation remains unchanged Investment firms remain subject to the obligation under Article 27 of MiFID II to take all sufficient steps to obtain the best possible result for their clients. In doing so, firms must consider relevant execution factors, including: price; costs; speed; likelihood of execution and settlement; size; nature of the order; and any other consideration relevant to its execution. Commission Delegated Regulation (EU) 2026/825 does not change this fundamental obligation. Instead, it establishes a more structured framework for demonstrating how the obligation is embedded within a firm’s policies, governance arrangements, execution processes and monitoring systems. Key requirements under the new Regulation Governance over the selection of execution venues Investment firms will be required to describe within their Order Execution Policy the internal governance procedures applied when selecting execution venues. Firms must also maintain an internal and up-to-date list of approved execution venues. The list should include relevant information concerning: the identity of the venue; the date on which it was approved; the person or governance body responsible for its approval; the classes of financial instruments for which it may be used; the types of transactions permitted; the relevant client categories; and any applicable restrictions or limitations. This introduces clearer expectations regarding ownership, accountability, approval and periodic review of execution-venue arrangements. More structured venue-selection criteria The selection of execution venues must be based on an assessment of the characteristics and needs of the firm’s clients, as well as the characteristics of the relevant financial instruments and orders. Relevant considerations may include: the order types supported by the venue; typical client order sizes and frequency; available execution prices; trading and membership costs; connectivity costs; clearing, settlement and custody costs; and other administrative or operational costs associated with using the venue. Where costs incurred by the investment firm are passed on to clients, whether directly or indirectly, those costs must also be considered in the venue-selection process. Use of reliable reference and market data The Regulation places increased emphasis on the quality of data used to select venues and assess execution outcomes. Investment firms must use reliable and accurate reference data that provides a sufficiently complete representation of available market prices and execution conditions. The data used should include information from the most liquid venues relevant to the applicable class of financial instruments. Where available and appropriate, firms may also use consolidated market data. For instruments executed outside a trading venue, including bespoke or less liquid products, firms must use appropriate data to assess whether the proposed price is fair and supports the best possible result for the client. Single-venue execution arrangements Where an investment firm uses only one execution venue for a particular class of financial instruments, the Order Execution Policy must explain how that venue enables the firm to obtain the best possible result for clients on a consistent basis. Firms must be able to substantiate this conclusion and periodically compare the execution outcomes achieved through the selected venue against those potentially available through alternative venues. This requirement is particularly relevant to firms that rely on: a single broker; a single liquidity provider; a group company; a single market maker; or another exclusive execution counterparty. A single-venue model is not prohibited, but it must be supported by an objective, documented and periodically reviewed assessment. Clear order-routing methodology Where more than one execution venue is available, the firm must establish the criteria used to determine where individual client orders will be executed. The Order Execution Policy must explain the relative importance assigned to the relevant execution factors and how those factors are applied in practice. The assessment should take into account matters such as: the class of financial instrument; whether the client is retail or professional; the costs directly associated with execution; the size and nature of the order; prevailing market conditions; and current and historical execution data. Where automatic order-routing systems are used, the policy should explain the principal characteristics of the system and the controls ensuring that the routing methodology properly reflects the firm’s best execution obligations. Specific client instructions The Order Execution Policy must clearly explain what constitutes a specific instruction from a client and how such an instruction may affect the firm’s ability to apply its standard execution arrangements. Where the instruction relates only to a particular element of the order, only that element should be treated as subject to the client’s instruction. The firm must continue to apply its Order Execution Policy to all remaining elements of the order. Firms should therefore avoid treating a limited client instruction as removing the best execution obligation in respect of the entire transaction. Dealing on own account and OTC execution Investment firms executing client orders by dealing on own account must explain how they ensure that clients continue to receive the best possible result. The Order Execution Policy should address: how the execution outcome is assessed; how conflicts of interest are identified and managed; how potential risks or disadvantages to the client are evaluated; and how the fairness of the proposed price is verified. For financial instruments executed outside a trading venue, firms must compare the proposed price against relevant market information, comparable transactions or similar financial instruments. Where reliable external pricing information is unavailable, the firm should use an appropriate internal valuation or pricing model based on accurate and reliable market data. Quantitative monitoring of execution quality The Regulation introduces more structured expectations for the ongoing monitoring of execution outcomes. For representative samples within each class of financial instruments, firms will need to establish predetermined indicators and thresholds against which execution quality can be assessed. These may include: acceptable deviations between execution prices and relevant reference prices; the proportion of executed volume meeting predetermined execution standards; the number or percentage of client orders meeting the applicable thresholds; execution speed; likelihood of execution; settlement performance; and total execution costs. The monitoring framework should be capable of identifying material exceptions, deteriorating execution quality and situations in which the firm may no longer be obtaining the best possible result consistently. This will require firms to move beyond high-level or primarily narrative policy reviews and establish measurable, data-supported monitoring arrangements. Annual and event-driven effectiveness assessments Investment firms must assess the effectiveness of their Order Execution Policy and execution arrangements at least annually. An additional assessment must be carried out where: monitoring identifies a material deficiency; a material change affects the firm’s ability to achieve best execution; market or liquidity conditions change significantly; a new execution venue or execution functionality becomes available; relevant fee structures change; liquidity shifts between venues; an existing venue ceases operating, merges or becomes unavailable; or another development materially affects the firm’s execution arrangements. The assessment should examine whether the venues included in the policy continue to support the best possible result and whether the firm’s routing methodology, monitoring indicators and governance controls remain effective. Any identified deficiencies must be addressed as soon as reasonably possible, taking into account their seriousness and potential impact on clients. Practical implications for investment firms Although the Regulation will apply from 12 February 2028, firms should not underestimate the implementation work that may be required. The new requirements may affect not only the wording of the Order Execution Policy, but also the underlying operational, technological and governance arrangements through which orders are routed, executed, monitored and reviewed. Investment firms should consider: performing a detailed gap assessment against Commission Delegated Regulation (EU) 2026/825; reviewing the governance and approval process for execution venues; establishing or updating the internal inventory of approved venues; documenting the methodology used to select and periodically reassess venues; reviewing arrangements involving a single broker, venue or liquidity provider; evaluating the availability, quality and completeness of execution and reference data; developing quantitative execution-quality indicators and thresholds; reviewing automatic order-routing logic and related controls; strengthening OTC price-fairness and valuation procedures; updating the methodology for annual and event-driven effectiveness assessments; establishing clear escalation and remediation procedures for identified deficiencies; and assessing whether related client disclosures, procedures and governance documents require amendment. A shift towards demonstrable best execution The new framework reinforces the expectation that best execution must be demonstrable in practice and not merely described at a policy level. Investment firms will be expected to show, through appropriate governance, data, quantitative analysis, documented decisions and effective monitoring, that their execution arrangements are designed and operated to achieve the best possible result for clients on a consistent basis. The implementation period therefore provides an opportunity for firms to review not only their formal Order Execution Policy, but the complete control framework supporting venue selection, order routing, pricing, monitoring, escalation and governance. Early preparation will be particularly important for firms with limited execution data, single-venue arrangements, manual monitoring processes or significant reliance on third-party brokers and liquidity providers. This publication is provided for general information purposes only and does not constitute legal, regulatory or other professional advice.

What's changing, why it matters, and what CIFs, PIs and insurers active in uncleared OTC derivatives should do now On 31 July 2026, the European Supervisory Authorities (EBA, EIOPA and ESMA) published their Final Report (ESA 2026 07) proposing amendments to the RTS on risk-mitigation techniques for uncleared OTC derivatives under Commission Delegated Regulation (EU) 2016/2251. The changes are limited in scope but operationally significant for any counterparty whose derivatives activity sits near the EUR 8 billion AANA threshold. The problem the ESAs are fixing Under the current rules, a counterparty whose aggregate month-end average notional amount (AANA) of non-centrally cleared OTC derivatives, measured over March, April and May of the preceding year, falls below EUR 8 billion is exempt from posting initial margin, but only on new trades. Existing contracts remain subject to initial margin obligations for as long as they run. That means firms still have to maintain margin calculation processes, exchange collateral, and keep custodial and segregation arrangements in place for legacy trades, even after they've genuinely dropped below the threshold. It also puts EU counterparties at a disadvantage relative to other jurisdictions, which already exempt existing contracts once a firm falls below the equivalent threshold, creating an incentive to trade with non-EU counterparties instead. What the draft RTS actually change 1. Existing contracts get relief too, across the whole bilateral portfolio. Where the March to May AANA of either counterparty falls below EUR 8 billion, no initial margin needs to be collected on new or existing uncleared OTC derivative contracts between them, not just new trades as today. 2. Already-posted margin may be released. Where the exemption applies, initial margin already collected on outstanding contracts can be released, freeing up liquidity previously locked up in legacy trades. Importantly, this is elective, not automatic: counterparties don't have to release collateral precisely on the trigger date. They can time the release to suit their operational readiness, agree the release process between themselves, or simply choose to keep collecting margin voluntarily if that's more convenient. 3. Faster exit, slower entry, an intentional asymmetry. Falling below the threshold: firms may implement the exemption as early as 1 June of the relevant year (rather than waiting until year-end), based on the March to May AANA calculation. Rising above the threshold: firms only become subject to margin requirements on new trades from 1 January of the following year, preserving the existing preparation runway for firms moving into scope. Existing contracts aren't retrospectively pulled back into scope just because the threshold is exceeded again. 4. AANA calculation methodology is unchanged. The threshold test still runs off the March, April and May month-end average notional amount, and is still calculated at counterparty level, or at group level where the counterparty belongs to a group. This EUR 8 billion test is separate from the EMIR clearing thresholds, which are set by asset class, and the two shouldn't be confused. 5. A related tidy-up for equity options. Following EMIR 3 (Regulation (EU) 2024/2987), which already exempts single stock options and equity index options from collateral-exchange requirements, Article 38(1) of the RTS, which contained now-obsolete transitional wording for these instruments, is deleted. The underlying exemption for these instruments is unaffected; this is purely a technical clean-up. What this doesn't change It's worth being precise here: the amendment is about initial margin specifically. It doesn't touch the other EMIR risk-mitigation obligations that continue to apply regardless of where a counterparty sits against the AANA threshold, including variation margin, timely confirmation, portfolio reconciliation, dispute resolution, and portfolio compression requirements. Why it matters in practice For treasury and collateral management functions, this removes a real operational drag: no more running parallel margin, custody and reconciliation processes for counterparty relationships that have genuinely fallen below the relevant activity threshold. For insurers in particular, who per feedback from EIOPA's Stakeholder Groups tend to sit closer to this threshold than banks given the more targeted, hedging-driven use of derivatives, the relief may be proportionally more relevant than for larger banking counterparties with consistently high derivatives volumes. The ESAs opted for a light-touch consultation (Stakeholder Groups only, no open public consultation or impact assessment) given the narrow scope of the amendment, a route several stakeholders accepted as appropriate here, while flagging it shouldn't become the default approach for future RTS changes. What's next The Final Report has been submitted to the European Commission for endorsement as a Commission Delegated Regulation. It will then go through non-objection by the European Parliament and Council before publication in the Official Journal, entering into force 20 days after publication. No firm date has been set yet, so this is one to watch rather than act on immediately, but firms with derivatives activity near the threshold should start reviewing their margining, custodial and collateral-release processes now so they're ready to apply the exemption as soon as it takes effect.