European Union: Compliance

The introduction of Public Country-by-Country Reporting in Malta imposes new obligations on multinational groups, representing a significant shift towards enhanced corporate tax transparency across the European Union. This EU transparency measure requires certain multinational groups to publicly report specified tax and business information for each jurisdiction in which they operate, with the first publication expected in 2026.

What ultimately determines whether a compliance programme succeeds or fails? This article explores the critical role of leadership, accountability and employee engagement in fostering a culture of compliance, examining how ethical conduct and organizational values influence the practical implementation of compliance measures and what distinguishes effective programmes from those that exist only on paper.

The Cyprus Tax Department has issued new guidance strengthening due diligence requirements for financial institutions under DAC2/CRS, specifically targeting potential misuse of Citizenship by Investment and Residence by Investment schemes. Financial institutions must now implement enhanced verification procedures to ensure accurate reporting of account holders' tax residency, with immediate application to new clients and a six-month compliance window for existing accounts.

From June 19, 2026, all online traders active within the EU are required to provide a “withdrawal button” on their websites and apps.

The European Commission has published draft guidelines interpreting the AI Act's transparency obligations, establishing when and how organizations must disclose AI-generated content, deepfakes, and automated interactions. These guidelines clarify that deepfake labeling applies regardless of intent to deceive, that AI systems must identify themselves at the point of interaction, and that the editorial review exception for AI-generated text requires substantive human oversight with clear accountability.

The Italian Data Protection Authority has ruled against a company that denied a former employee complete access to their corporate email account, clarifying that work-related emails constitute personal data under GDPR. The decision addresses the boundaries of employee data access rights and establishes that employers cannot arbitrarily obscure or withhold work-related correspondence without specific legal justification.

The French Competition Authority has opened a public consultation to evaluate its two-year-old informal guidance framework that helps organizations determine whether their sustainability initiatives comply with competition law. Since its introduction in May 2024, the framework has issued five guidance letters covering diverse environmental projects, from carbon footprint platforms to retail sector sustainability commitments.

Malta's Financial Services Advisory Council is transitioning from foundational infrastructure development to an aggressive market capture strategy, aiming to convert regulatory advances and institutional coordination into measurable foreign investment and competitive positioning.

Cyprus has introduced significant amendments to its trust beneficial ownership register framework through Policy Statement PS-02-2026, strengthening transparency requirements while maintaining legitimate privacy protections. These reforms clarify reporting obligations for trustees, enhance beneficial ownership identification standards, and align Cyprus with evolving European AML frameworks following landmark CJEU decisions on privacy rights.