The delegated acts are the first of a series to complement and complete the EU regulatory frameworks on cybersecurity matters for the financial sector and cryptoassets.

According to the press release, the new EU Directive will provide for:

• "Direct access to bank account information across the Union: Law enforcement authorities and Asset Recovery Offices will have direct access to bank account information across the Union, through the single access point interconnecting bank account registries. This will enable the authorities to identify the banks in which suspects hold their accounts. Data protection safeguards will ensure that only limited information on the identity of the bank account holder would be made available.
• A common format for transaction records: the Directive will establish a common format for banks and crypto companies to provide the information on transactions – i.e., transaction records – to law enforcement authorities. The specifics of the format will be defined in an implementing act. Access to this information will be granted in accordance with national rules and procedural safeguards."

For further information, see the Proposal for a Directive on the access of competent authorities to centralised bank account registries through the single access point; and the staff working document.

Based on a Commission proposal, the new rules complement the Markets in Crypto-assets Regulation (MiCA) and transfer in funds Regulation, and are consistent with the OECD initiative on the Crypto-Asset Reporting Framework.

The Directive will "improve Member States’ ability to detect and counter tax fraud, tax evasion and tax avoidance", by requiring "all cryptoasset providers based in the EU – irrespective of their size – to report transactions of clients residing in the EU." 

The updated Directive has been extended in scope to include reporting obligations of "financial institutions regarding e-money and central bank digital currencies (CBDCs) and the automatic exchange of information on advance cross-border rulings used by natural persons."

The new reporting requirements on cryptoassets, e-money and CBDCs will enter into force on 1 January 2026.

The proposal, which would amend the Directive for Administration Cooperation (DAC), will improve Member States' ability to detect and counter tax fraud, tax evasion and tax avoidance, by requiring all cryptoasset service providers – irrespective of size or location – to report transactions of clients residing in the EU.

The Directive also aims to establish a common minimum level of penalties for situations of serious non-compliance, such as the complete absence of reporting despite administrative reminders. Moreover, the Commission suggested extending both reporting obligations of financial institutions to cover e-money and digital currencies and the scope of the automatic exchange of information to advance cross-border rulings used by high net-worth individuals.

The draft text will be submitted to the European Parliament for consultation and to the Council for adoption. It is foreseen that the new reporting requirements with regard to cryptoassets, e-money and digital currencies would enter into force on 1 January 2026.

McGuinness said behind crypto is a technology with "huge potential" that could make "trading and settlement of securities more efficient. The use of tokenised electronic money could make payments more efficient and increase competition."

However, she explained it was necessary to "root out bad actors, provide consumer protection and ensure financial stability and market integrity".

McGuinness talked about MiCA, saying the regulation will "give legal certainty to market participants and promote innovation in the market," while ensuring that "cryptoassets and cryptoasset service providers are subject to regulation and supervision".

She said: "MiCA will set the necessary organisational, operational and prudential requirements for cryptoasset service providers, like exchanges or wallet providers. And the regulation will set out strict requirements on establishment, authorisation and reserve management for so-called ‘stablecoins' which refer to an official currency or a basket of assets.
MiCA will also require actors in the cryptoasset market to disclose information on the environmental and climate footprint of cryptoassets."

Referring to the Digital Operational Resilience Act, McGuinness said crypto firms will be required to manage the risks of hacks or technology failures.

Section 6 covers the energy consumption of the ICT sector, with subsection 6.4  looking specifically at energy consumption of cryptocurrencies. 

Given the current energy crisis and the heightened risks for the coming winter, the Commission is urging Member States to "(i) implement targeted and proportionate measures to lower the electricity consumption of cryptoasset miners, in line with the proposed Council Regulation on an emergency intervention to address high energy prices, and (ii), also in a longer term perspective, to put an end to tax breaks and other fiscal measures benefitting cryptominers currently in force in certain Member States. In case there is a need for load shedding in the electricity systems, the Member States must also be ready to stop cryptoassets mining."

The Commission said it will develop a report by 2025 that includes a description of the environmental and climate impact of new technologies in the cryptoasset market. The report will also include an assessment of policy options to "mitigate adverse impacts on the climate of technologies used in the cryptoasset market, in particular in relation to consensus mechanisms."

The Commission also published FAQS on the action plan.