Inside FinTech blog

The EU AI Act’s obligations begin to apply from 2 February. The first obligations to apply are the prohibitions, which ban the provision or use of AI in some scenarios. Fines are up to 7% of total worldwide annual turnover for non-compliance.

Key Takeaways:
• The SEC settles with Digital Currency Group
• Civil lawsuit initiated against memecoin exchange
• Outgoing SEC administration issues a slew of actions before inauguration

Key Takeaways:
• CFPB proposes Regulation E rule including cryptocurrencies
• IRS finalizes DeFi broker rule, industry challenges
• CFTC settles its case against Gemini

The final days of 2024 were very eventful in the world of AI and data protection: the European Data Protection Board (EDPB) published its Article 64 General Data Protection Regulation (GDPR) opinion on training AI models using personal data (the EDPB Opinion).

The European Data Protection Board (EDPB) was asked by the Irish supervisory authority to issue an Opinion under Article 64(2) General Data Protection Regulation (GDPR) on AI models and processing personal data (the Opinion). The Opinion sets out the EDPB’s answers to the four questions the Irish supervisory authority put to it.

Key Takeaways:
• SEC responds in Binance enforcement action on securities claims
• David Sacks to be U.S. crypto, A.I. czar

To American lawyers it has been fairly obvious that digital assets are “property” for legal purposes, but the English have not been so sure.

On 4 December 2024, the European Supervisory Authorities (ESAs) issued a statement on the application of the Digital Operational Resilience Act (DORA).

On 2 December 2024, there was published in the Official Journal of the EU Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024 laying down implementing technical standards for the application of the Regulation on digital operational resilience for the financial sector (DORA) with regard to standard templates for the register of information. The Implementing Regulation enters into force on the twentieth day following that of its publication in the Official Journal of the European Union (22 December 2024).

On November 25, 2024, the New York State Department of Financial Services (“NYDFS”) announced it settled with two large insurance companies over allegations of inadequate data security practices in violation of New York’s cybersecurity regulation (23 NYCRR Part 500) (the “Cybersecurity Regulation”) that led to the compromise of more than 120,000 New Yorkers’ personal information.