Online platforms: Digital Services Act

Start by mapping what personal data you process, why, on which legal basis and who receives it. That produces your record of processing, which most organisations need and which every other step builds on. Then cover the basics: privacy notices, processor agreements, retention periods, security, and a procedure for requests and breaches. Pitch builds and maintains these registers with you in the client portal.

• TechnologyRecords of Processing and Compliance Registers →
• AcademyRecords of Processing Activities (RoPA) →
• SolutionsDPO as a Service →

You must answer within one month of receiving the request, extendable by two months for complex or numerous requests if you tell the person in time. Send a copy of the personal data plus the purposes, recipients, retention and source. Verify identity without asking for more than needed, and filter out other people's data and legally protected material. Pitch logs each request and its deadline in a request workflow.

• TechnologyData Subject Requests →
• AcademyData Subject Access Requests →

Contain it, then assess within hours whether it is likely to put people at risk. If so, notify the competent data protection authority (usually in the country of your main establishment, such as the GBA in Belgium) without undue delay and where feasible within 72 hours of becoming aware, in phases if needed. If the risk is high, tell the individuals too. Document every breach, including those you do not report. Pitch prepares the notification and a lawyer approves it.

• SolutionsData Breach Response →
• TechnologyData Breach Handling →
• AcademyData Breaches: the 72-Hour Rule →

Only in three cases: you are a public authority, your core activity is regular and systematic large-scale monitoring of people, or your core activity is large-scale processing of special categories or criminal data. Many SMEs are outside these, but a voluntary DPO can still help. The DPO may be external, and the GBA must be given the contact details. Pitch offers an external DPO on a service contract.

• SolutionsDPO as a Service →
• TechnologyRecords of Processing and Compliance Registers →

Only strictly necessary cookies may be set without consent. Analytics, advertising and most third-party trackers need prior, informed and specific consent, given by an active choice, with rejecting as easy as accepting. A banner that sets trackers before the visitor clicks is a typical pitfall. Check what your site really loads, then align banner, cookie policy and privacy notice. Pitch can audit the technologies on your site.

• AcademyCookies and Consent →
• AcademyWebsite Technology Audits and the GDPR →

Yes, whenever a supplier processes personal data on your behalf, such as a cloud host, payroll provider or marketing platform. Article 28 GDPR requires a written contract covering instructions, confidentiality, security, sub-processors, assistance with requests and breaches, and deletion or return at the end. Supplier standard terms often fall short or shift risk to you. Pitch drafts and reviews these agreements.

• SolutionsData Processing Agreements →
• TechnologyRecords of Processing and Compliance Registers →

Yes, but personal data may only leave the EEA under a valid transfer mechanism: an adequacy decision, such as the EU-US Data Privacy Framework for certified US companies, or standard contractual clauses with a documented transfer risk assessment. Remote access from a third country also counts as a transfer. Map where your suppliers and their sub-processors operate, and record it. Pitch reviews transfers in your contracts and registers.

• AcademyInternational Data Transfers →
• SolutionsData Processing Agreements →
• TechnologyRecords of Processing and Compliance Registers →

The GDPR sets no fixed period: you may keep data only as long as needed for the purpose you collected it for. Sector rules can impose minimum terms, such as accounting records, and limitation periods can justify keeping some files longer. The pitfall is keeping everything indefinitely. Define a retention period per category, record it in your register, and delete or anonymise on schedule.

• AcademyHow Long May You Keep Personal Data? →
• TechnologyRecords of Processing and Compliance Registers →

When processing is likely to result in a high risk for people, for instance large-scale profiling, systematic monitoring, large-scale use of sensitive data or new technologies such as AI-driven scoring. Each national data protection authority publishes a list of processing that requires one. Do it before you start, describe the risks and the measures, and consult the authority if a high residual risk remains. Pitch completes DPIAs with you as working records.

• TechnologyDPIA →
• SolutionsDPO as a Service →
• AcademyAI Act Meets GDPR: Where the Two Frameworks Overlap →

It applies if you develop AI systems, put them on the EU market under your name, or use them in a professional context in the EU. A provider develops or brands a system; a deployer uses one under its own authority. Many companies are both, for example when they build an AI feature into their own product. Roles drive the obligations, so record the role per system.

• AcademyProvider or Deployer? →
• SolutionsAI Act Compliance →
• TechnologyAI Act Register and Assessments →

A system is high-risk if it is a safety component of a product covered by certain EU product legislation, or if its purpose falls in an Annex III area such as recruitment, education, credit scoring, essential services, law enforcement or migration. Intended purpose decides, not the technology. There are narrow exceptions for systems that do not materially influence decisions. Document your reasoning per system. Pitch classifies systems with the supporting articles and evidence.

• AcademyAI Act Risk Classification →
• TechnologyAI Act Register and Assessments →

Already applying: the ban on prohibited practices and AI literacy since 2 February 2025, and the transparency duties of Article 50 since 2 August 2026. High-risk obligations were postponed to 2 December 2027 (Annex III systems) and 2 August 2028 (product-related AI), but conformity work takes months. Dates have moved before, so confirm them on EUR-Lex. Start with an inventory and classification of your systems.

• AcademyAI Act Timeline: What Applies When →
• SolutionsAI Act Compliance →
• TechnologyAI Act Register and Assessments →

Article 4 applies to providers and deployers of any AI system, not only high-risk ones, and has applied since 2 February 2025. You must take measures to promote an adequate level of AI literacy among staff and others using AI on your behalf, taking account of their role and context. There is no prescribed course, so a documented, proportionate programme is the practical answer.

• AcademyThe AI Literacy Obligation →
• AcademyBuilding an AI Governance Framework →

Generally yes. Since 2 August 2026, Article 50 requires that people are told when they interact with an AI system, unless that is obvious. Providers of generative systems must mark synthetic output in a machine-readable way, with a grace period for systems already on the market, and deployers must disclose deepfakes and certain AI-generated text on matters of public interest. Check your chatbot and marketing workflows.

• AcademyAI Act Timeline: What Applies When →
• AcademyThe EU AI Act: a Practical Overview →

Yes, as a deployer. You must ensure AI literacy, respect transparency duties, and for high-risk uses follow the provider's instructions, keep human oversight and logs. Staff may also use tools you do not know about, so an inventory and a usage policy matter. Check the supplier contract too: who bears liability, where data goes, and whether your inputs train the model.

• AcademyAI Clauses in Vendor Contracts →
• AcademyBuilding an AI Governance Framework →
• SolutionsAI Act Compliance →

Yes, but AI used to recruit, screen, evaluate, promote or monitor workers is high-risk under Annex III, and emotion recognition at work is prohibited. Deployers must use it per instructions, assign trained human oversight, inform affected workers and keep logs. The GDPR applies in parallel, including limits on solely automated decisions, and a DPIA is often needed. Involve works council or staff representatives where the rules require it.

• AcademyAI in HR and Recruitment →
• TechnologyDPIA →

They apply side by side. The AI Act regulates the system and its risk class, the GDPR regulates the personal data it uses, so one AI project can need both a conformity file and a DPIA. Lawful basis, data minimisation, transparency and automated decision rights remain with the GDPR. Aligning registers, assessments and documentation avoids doing the work twice. Pitch links both in one set of registers.

• AcademyAI Act Meets GDPR: Where the Two Frameworks Overlap →
• TechnologyRecords of Processing and Compliance Registers →
• TechnologyDPIA →

Fines scale with the breach: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and lower tiers for other obligations, with caps designed to be proportionate for SMEs. Enforcement sits mainly with national market surveillance authorities, so check which authority in each country where you operate applies to your sector. Beyond fines, customers and investors increasingly ask for proof of readiness in questionnaires and contracts.

• SolutionsAI Act Compliance →
• AcademyThe EU AI Act: a Practical Overview →

Yes, if you are the data holder of a connected product or related service placed on the EU market. Since 12 September 2025 users must be told before purchase what data is generated, can obtain readily available data on request and can have it shared with a third party. Trade secrets can be protected by agreed confidentiality measures. The design duty applies to products placed on the market after 12 September 2026.

• AcademyThe EU Data Act →
• SolutionsData Licensing and Data Sharing →

Define which data, for what purpose, for how long, and who owns what is derived from it. Where the Data Act requires you to share, terms must be fair, reasonable and non-discriminatory, and compensation reasonable. Add personal data safeguards, confidentiality, audit, warranty limits and return or deletion at the end. A standard supply agreement with the word data added rarely does this. Pitch drafts data licences and sharing agreements.

• SolutionsData Licensing and Data Sharing →
• TechnologyDocument Studio →
• AcademyThe EU Data Act →

Often, by combining rights: the sui generis database right for substantial investment in a database, copyright for original selection or arrangement, and trade secret law for data kept secret with reasonable protective steps. Contracts decide much of the rest. Note that the database right does not apply to databases holding data generated by connected products. Pitch maps what you hold and reviews the data clauses you sign.

• SolutionsData and Database Rights Protection →
• AcademyDatabase Rights and Trade Secrets →

Possibly. The unfair terms rules apply to any business that imposes data-related clauses on another business, the cloud switching rules apply to providers of data processing services, and users of connected products gain rights as customers. Check your standard contracts and cloud agreements even if you make no hardware. Pitch can review these terms against the Act.

• AcademyThe EU Data Act →
• TechnologyContract Review →

Yes, that is the aim. Providers of cloud and other data processing services must let customers switch or port data, with a maximum notice period and a transition period. Switching charges are being phased out and disappear entirely from 12 January 2027. If you are a provider, review contract terms on termination, export formats and fees. If you are a customer, check what you can claim.

• AcademyThe EU Data Act →
• TechnologyContract Review →

A term on data access and use, or on liability and remedies for it, is not binding if it was unilaterally imposed on another business and is unfair. Some terms are always unfair, such as excluding liability for intentional acts. Typical risk clauses are one-sided changes to data terms, blanket rights over derived data and no liability for data errors. It applies to contracts concluded after 12 September 2025, and to certain older long-term ones from 12 September 2027.

• AcademyThe EU Data Act →
• TechnologyContract Review →
• SolutionsData and Database Rights Protection →

The GDPR prevails. The Data Act does not create a legal basis for processing personal data, so a data holder that shares data with a user or third party still needs a lawful basis and must respect data subjects' rights. Data of several people on one device, such as a family car, needs particular care. Align your data sharing terms with your register of processing, and involve your DPO early.

• AcademyThe EU Data Act →
• TechnologyRecords of Processing and Compliance Registers →
• SolutionsData Licensing and Data Sharing →

NIS2 applies to medium-sized and large entities in the sectors of its two annexes, such as energy, transport, health, digital infrastructure, ICT services, manufacturing and online marketplaces. NIS2 is an EU directive that each Member State transposes into national law, so details and supervisors differ per country. DORA applies to financial entities and, through contracts, to their ICT providers. Smaller suppliers often meet the rules through customer requirements. Pitch helps you assess scope and contract exposure.

• AcademyThe NIS2 Directive →
• SolutionsCommercial Contracts & Transactions →

DORA (Regulation (EU) 2022/2554, applicable since 17 January 2025) is about staying operational, not only about security. Your management body must approve and oversee an ICT risk management framework, including business continuity and recovery plans. You classify ICT-related incidents and report major ones to your supervisor, test your digital operational resilience regularly (the largest entities with threat-led penetration tests), and manage ICT third-party risk, including a register of information on all your ICT contracts. Pitch helps with the governance documents, the register and the contracts.

• SolutionsCommercial Contracts & Transactions →
• TechnologyContract Management: Rights and Obligations →

Under NIS2, a significant incident goes to the national CSIRT or competent authority in stages: an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report within one month. If personal data are affected, a separate GDPR notification to the data protection authority is due within 72 hours. Addressees and content differ, so prepare both from one set of facts. Financial entities under DORA report major ICT incidents to their financial supervisor.

• AcademyThe NIS2 Directive →
• AcademyData Breaches: the 72-Hour Rule →
• SolutionsData Breach Response →

Both regimes make you responsible for your supply chain. Expect to need security requirements, incident notification duties with short deadlines, audit and information rights, sub-contractor controls, business continuity and exit or data return terms. DORA lists mandatory contract content for ICT services to financial entities. Supplier standard terms rarely cover this, so review and renegotiate them. Pitch drafts and reviews these clauses.

• SolutionsCommercial Contracts & Transactions →
• TechnologyContract Review →
• AcademyAI Clauses in Vendor Contracts →

Often yes, if you fall within NIS2 scope: Member States require in-scope entities to register or notify the national authority, but procedures, platforms and deadlines differ per country. Registration also requires you to determine whether you are essential or important, which affects supervision. If you are unsure, do a scope analysis first. Essential entities must also have their compliance assessed, with the method set nationally (often by reference to standards such as ISO/IEC 27001).

• AcademyThe NIS2 Directive →

NIS2 puts governance on the board: management bodies must approve the cybersecurity risk measures, oversee their implementation and follow training, and can be held liable for infringements. Fines can reach EUR 10 million or 2% of worldwide turnover for essential entities and EUR 7 million or 1.4% for important entities. Minutes showing that the board reviewed and approved the measures are your best evidence.

• AcademyThe NIS2 Directive →

Article 21 requires appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach. The list includes risk analysis, incident handling, business continuity and backups, supply chain security, vulnerability handling, cryptography, access control and multi-factor authentication. There is no fixed checklist, so run a gap assessment, have the board approve a plan and keep evidence. Pitch advises on the legal and contractual side, not on technical security testing.

• AcademyThe NIS2 Directive →
• SolutionsCommercial Contracts & Transactions →

DORA, applicable since 17 January 2025, binds financial entities, not you directly, unless you are designated a critical ICT third-party provider. But your bank customers must put specific terms in their contracts with you: service descriptions, locations of data, security and incident support, audit access, sub-contracting conditions and exit assistance. Expect these requests and prepare a standard addendum rather than negotiating each one from scratch.

• SolutionsCommercial Contracts & Transactions →
• TechnologyContract Review →

The Cyber Resilience Act (Regulation (EU) 2024/2847) covers products with digital elements made available on the EU market: hardware and software that connect, directly or indirectly, to a device or a network. That includes apps, firmware and software sold separately, and the remote data processing a product needs to work. Pure SaaS falls outside it, and so do products with their own regime, such as medical devices and vehicles. It applies to manufacturers, importers and distributors, including those outside the EU.

• AcademyCan I Protect My Software? →
• SolutionsCommercial Contracts & Transactions →

The regulation entered into force on 10 December 2024 and applies in steps. From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents, also for products already on the market. Most other obligations, including the essential requirements and CE marking, apply from 11 December 2027. Products placed on the market before then are generally only caught after a substantial modification. Use the time to build the vulnerability handling process, because that takes longest.

Design and ship the product without known exploitable vulnerabilities, secure by default, and keep it secure with updates for a support period that reflects its expected use, as a rule at least five years. Run a vulnerability handling process with a software bill of materials and a coordinated disclosure policy. Before you sell, carry out the conformity assessment, draw up the technical documentation and the EU declaration of conformity, and affix the CE marking. Reports go through ENISA's single reporting platform: an early warning within 24 hours, a notification within 72 hours and a final report afterwards.

• SolutionsCommercial Contracts & Transactions →

For most products a self-assessment is enough. Important products, listed in Annex III, need more: for class I, such as password managers, VPNs and routers, you can self-assess only if you apply harmonised standards or a certification scheme; for class II, such as firewalls and hypervisors, a notified body must be involved. For critical products, such as smart cards and hardware security modules, the Commission can require a European cybersecurity certificate. Classify your product early, because it decides your timeline and budget.

The Cybersecurity Act (Regulation (EU) 2019/881) gave ENISA a permanent mandate and set up an EU framework for cybersecurity certification of ICT products, services and processes. The first scheme, EUCC, based on the Common Criteria, applies since 27 February 2025, and an amendment of 2025 extends the framework to managed security services. Certification is voluntary unless EU or national law requires it. Customers and public tenders increasingly ask for it, though, and under the Cyber Resilience Act it can be the way to show conformity.

As a manufacturer you are responsible for the whole product, including the open-source components you integrate, so check them with due diligence and track them in your software bill of materials. Free open-source software developed or supplied outside a commercial activity is outside the Cyber Resilience Act. Organisations that support open source for commercial use as open-source software stewards have lighter duties, such as a cybersecurity policy and cooperation with authorities. Your licence choice and your contracts should match your role.

• AcademyCan I Protect My Software? →
• SolutionsPatent and Technology Licensing →

Breaching the essential requirements can lead to fines of up to EUR 15 million or 2.5% of worldwide annual turnover, and market surveillance authorities can order a withdrawal or recall. Most of the work sits upstream, with chip, module and software suppliers. Agree on security requirements, vulnerability notification within your own reporting deadlines, update support for the full support period, documentation and cooperation in conformity assessments. Pitch drafts and reviews these clauses.

• SolutionsCommercial Contracts & Transactions →
• TechnologyContract Review →
• TechnologyDocument Studio →

The Digital Services Act (Regulation (EU) 2022/2065), fully applicable since 17 February 2024, covers intermediary services offered to users in the EU: mere conduit, caching and hosting. Anyone who stores content for users is a hosting service, so a SaaS tool with uploads or a site with comments can be caught. Online platforms, which also spread that content to the public, and marketplaces have more duties, and the very largest the most. A provider outside the EU must appoint a legal representative in the EU.

• SolutionsBrand Policy Compliance →

Not as long as you do not know about illegal content and act quickly once you do. That is the hosting exemption, and the DSA keeps it. There is no general duty to monitor, and your own voluntary checks do not cost you the exemption. Marketplaces are an exception: if an average consumer would think the product or service comes from you, consumer law can hold you liable as if you were the seller. Clear trader labels and a working notice-and-action process are your best protection.

• TechnologyTakedowns and Enforcement Notices →
• SolutionsBrand Monitoring & Online Enforcement →

Every intermediary service needs points of contact for authorities and users, and terms that explain how you moderate content. Hosting services add a notice-and-action mechanism and a statement of reasons for every restriction they impose. Online platforms add an internal complaint system, access to out-of-court dispute settlement, priority for trusted flaggers, measures against misuse, transparency on advertising and recommender systems, protection of minors and a ban on dark patterns. Micro and small enterprises are exempt from most platform-specific duties.

• SolutionsCommercial Contracts & Transactions →
• TechnologyDocument Studio →

You must know your traders before they can sell: collect their name, address, contact details, identification, payment account and registration number, and make reasonable efforts to check them. Design your interface so traders can give the pre-contractual, product safety and labelling information consumers need. If you learn that an illegal product was sold, inform the buyers you can reach. Your terms with traders and the onboarding flow are where this comes together.

• SolutionsBrand Policy Compliance →
• SolutionsCommercial Contracts & Transactions →

If businesses reach customers through your platform, app store or search engine, the Platform-to-Business Regulation (EU) 2019/1150 applies. Your terms must be clear and available, changes need at least 15 days' notice, and you must give reasons when you restrict or suspend a business user, with 30 days' notice before ending the relationship. Explain the main ranking parameters, offer an internal complaint system (small enterprises are exempt) and name mediators.

• SolutionsCommercial Contracts & Transactions →

Each Member State has a Digital Services Coordinator, and the one where you are established supervises you. The European Commission supervises very large online platforms and search engines, those with at least 45 million monthly active users in the EU. Fines can reach 6% of worldwide annual turnover, and 1% for incorrect or incomplete information. Users and their organisations can also complain and claim compensation.

Under the Consumer Rights Directive (2011/83/EU), before the order: who you are and how to reach you, the main characteristics, the total price including taxes and delivery, payment and delivery terms, the right of withdrawal, the legal guarantee and, for digital content, functionality and compatibility. The order button must make clear that ordering means paying, such as 'order with obligation to pay'. Confirm the contract afterwards on a durable medium, such as an email.

• SolutionsCommercial Contracts & Transactions →
• TechnologyDocument Studio →

Consumers can withdraw within 14 days without giving a reason, counted from delivery for goods and from the contract for services and digital content. There are exceptions, for instance for customised goods, perishables, and digital content the consumer asked to receive straight away while acknowledging the loss of the right. If you did not inform the consumer properly, the period extends by up to 12 months. From 19 June 2026, online traders must also offer an easy-to-find withdrawal function on their website or app.

For goods, the Sale of Goods Directive (EU) 2019/771 sets a legal guarantee of at least two years for defects present at delivery, with the burden of proof on the seller for at least the first year. For digital content and services, the Digital Content Directive (EU) 2019/770 adds conformity rules, including updates, also when the consumer 'pays' with personal data. A commercial guarantee comes on top of these and can never limit them.

A price reduction must refer to the lowest price you charged in the 30 days before it. If you show reviews, say whether and how you check that they come from real buyers; fake or bought reviews are banned. Tell consumers when a price is personalised by automated decisions. Misleading or aggressive practices, such as false scarcity or pressure timers, are unfair commercial practices. Coordinated cross-border actions can lead to fines of at least 4% of annual turnover.

• SolutionsBrand Policy Compliance →

Only with care. From 27 September 2026, Directive (EU) 2024/825 bans generic environmental claims such as 'eco-friendly' or 'green' unless you can show recognised excellent environmental performance, claims that a product is neutral or positive for the climate because of offsetting, and sustainability labels not based on a certification scheme or set by a public authority. Specific, verifiable claims remain possible. Review your packaging, website and advertising now, because packaging is printed months ahead.

• SolutionsBrand Policy Compliance →

Probably. Since 28 June 2025, the European Accessibility Act (Directive (EU) 2019/882) requires e-commerce services, and other services such as banking, e-books and ticketing, to be accessible to people with disabilities. Service providers with fewer than 10 employees and no more than EUR 2 million turnover or balance sheet are exempt. In practice you design to the harmonised standard EN 301 549, which follows WCAG, and explain in your terms how the service meets the requirements.

You can choose the law that governs your terms, but if you direct your activities to a consumer's country, that consumer keeps the protection of the mandatory rules of their own country. The Geo-blocking Regulation (EU) 2018/302 also bars you from treating customers differently by nationality or residence without a justified reason. One set of terms usually works across the EU if it meets the strictest mandatory rules in your markets. Pitch drafts terms that hold up in every market you sell to.

• SolutionsCommercial Contracts & Transactions →
• TechnologyDocument Studio →

EU sanctions bind every EU company, not only banks, and prohibit making funds or resources available to listed persons, directly or indirectly. No law prescribes one screening method for non-regulated businesses, but you need a documented process at the start of each relationship: check names and beneficial owners against the EU consolidated list and relevant UN, UK or US lists, and repeat when lists change. Breaches are penalised under national law, often as criminal offences (in Belgium, for example), and the EU is aligning these penalties across Member States.

• AcademySanctions Screening and AML →
• SolutionsM&A and Due Diligence →

Stop and escalate at once. Do not proceed with the deal, payment or delivery until it is clear whether the match is true or a false positive, checking identifiers such as date of birth, nationality and registration number. Document the investigation either way. A confirmed match normally means freezing assets and notifying the competent national authority (in Belgium, the FPS Finance Treasury). Take legal advice before acting or terminating contracts.

• AcademySanctions Screening and AML →
• TechnologyData Room and Due Diligence →

Only obliged entities are subject to the anti-money laundering rules, which implement the EU AML Directives and are therefore broadly similar across Member States (in Belgium, the Law of 18 September 2017): financial institutions, notaries, accountants, tax advisers, real estate agents, company service providers, certain dealers in high-value goods and lawyers for specified activities. They must identify customers and beneficial owners, assess risk, monitor and report suspicions to the national financial intelligence unit (in Belgium, the CTIF-CFI). Other companies must still keep their own UBO register entry accurate.

• AcademySanctions Screening and AML →

Companies must record the natural persons who ultimately own or control them, currently above 25% of shares or voting rights or through other control, and the senior managers if nobody meets the test, and keep the data current. For a counterparty, ask for a certified ownership chart and supporting documents, and screen every natural person and entity in it. Layered structures through trusts or third countries need extra care.

• AcademySanctions Screening and AML →
• SolutionsM&A and Due Diligence →
• TechnologyData Room and Due Diligence →

Add sanctions and compliance clauses: warranties that neither party nor its owners are listed, a duty to notify changes, a right to suspend or terminate without liability if performance would breach sanctions, and audit or information rights. In acquisitions, screen the seller, the target and its owners before signing and record the checks. Pitch builds this into due diligence and contract review.

• SolutionsM&A and Due Diligence →
• TechnologyContract Review →
• TechnologyData Room and Due Diligence →

The EU AML package of 2024 includes Regulation (EU) 2024/1624, which applies directly from July 2027 and sets harmonised customer due diligence rules, and creates the European AML Authority (AMLA). It also refers to a beneficial ownership threshold of 25% or more. National laws will be adjusted, so if you are an obliged entity, plan your procedures now and check the current text before relying on any detail.

• AcademySanctions Screening and AML →