Topics
Topics
The themes the firm covers continuously: MiCAR, DORA, DLT Pilot, AI Act, Listing Act, tokenisation, GDPR, M&A.
MiCA
EU Regulation 2023/1114 (MiCA) is the first comprehensive European framework for the issuance, public offering and provision of services on crypto-assets. In Italy implementation runs through Legislative Decree 129/2024, which designates CONSOB and Banca d'Italia as competent authorities and sets the sanctions regime. For CASPs (Crypto-Asset Service Providers) MiCA introduces a single licensing regime covering capital, governance, AML, conflict of interest, client-asset custody and disclosure. Issuers of asset-referenced tokens (ARTs) and e-money tokens (EMTs) face prudential, reserve and interoperability requirements. Other tokens require a notified white paper. LX20 supports Italian and cross-border CASPs in the migration from the previous regime (OAM register, MiFID) to the MiCA licence, in white paper drafting and notification, in supervisory dialogue and in internal governance (AML, segregation and business continuity policies).
DLT Pilot
EU Regulation 2022/858 (DLT Pilot Regime) allows the experimentation of DLT-based market infrastructures (DLT MTF, DLT SS, DLT TSS) with targeted exemptions from MiFID II, CSDR and Settlement Finality. In Italy Decree-Law 25/2023 (DL Fintech), converted by Law 52/2023, complements the EU regime by introducing the digital form of financial instruments and rules on issuance and circulation on DLT. The pilot regime lasts three years (extendable), with quantitative thresholds on capitalisation and volumes, and requires authorisation by CONSOB (with Banca d'Italia and ESMA) of concrete pilot projects. The first authorisations were granted in 2025–2026. LX20 advises banks, investment firms, market infrastructures and fintechs on feasibility assessment, choice of DLT perimeter (permissioned/permissionless), drafting of the authorisation application, supervisory dialogue with CONSOB and contractual and technical documentation.
AI Act
EU Regulation 2024/1689 (AI Act) is the first comprehensive AI law worldwide. It adopts a risk-based approach: prohibited practices (subliminal manipulation, social scoring, public-space biometric identification), high-risk systems (employment, credit, education, critical infrastructure, justice), GPAI models (general-purpose) with stricter rules for models with systemic risk, and limited/minimal-risk systems subject only to transparency. Timeline: February 2025 (prohibited practices), August 2025 (GPAI + governance), August 2026 (high-risk Annex III), August 2027 (Annex I). Sanctions reach up to EUR 35 million or 7% of global turnover. LX20 supports Italian businesses with AI portfolio mapping by risk level, compliance for high-risk systems (quality management, data governance, logs, conformity assessment, CE marking), contracting with GPAI vendors, DPIA and the interaction with GDPR and the Data Act.
Listing Act
The Listing Act package is one of the most relevant reforms of European capital markets. It comprises Regulation (EU) 2024/2809 (amending the Prospectus Regulation, MAR and MiFIR), Directive (EU) 2024/2810 (amending MiFID II) and Directive (EU) 2024/2811 on multiple-vote share structures. In force from 4 December 2024, with staggered application. As of May 2026, the bulk of Prospectus Regulation amendments enters application on 5 June 2026: simplified prospectus content, a new EU follow-on regime for subsequent issuances by already-listed issuers, reduced approval timelines, section standardisation. The mandatory prospectus exemption threshold rises to 12 million euros on a 12-month rolling basis, with Member States' option to derogate downwards to 5 million. The multiple-vote share structures directive harmonises the introduction of multiple-vote shares for SMEs at first listing on SME growth markets: transposition deadline 5 December 2026. Italy has already moved with the Italian Capital Markets Law (Law 21/2024), extending the maximum voting cap from 3 to 10 votes per share. The directive will impact actively upon transposition. On MAR amendments (delayed disclosure of inside information, insider lists, manager transactions), ESMA is still consulting: final guidelines expected in the second half of 2026. On manager transactions, the new EU baseline is €20,000 with national authorities' option to raise it to €50,000 or lower it to €10,000. LX20 advises pipeline IPO issuers, SMEs assessing Euronext Growth Milan or European equivalents, and listed issuers in managing the regulatory transition, with attention to interim period clauses governing the move from the old to the new regime.
M&A
M&A in Italy combines civil law (Italian Civil Code, in particular Title V of Book V), regulatory (TUF post Italian Capital Markets Law, CONSOB Issuers' Regulation, MAR), antitrust (Law 287/1990, Reg. (EU) 139/2004) and sectoral (Golden Power, FDI screening, banking, insurance, telecoms, critical infrastructure regulation). The framework was significantly renewed by the Italian Capital Markets Law (Law 21/2024): multiple voting cap extended from 3 to 10 votes per share, introduction of slate voting, review of internal committees, updated tender offer rules. Regulation (EU) 2022/2560 on Foreign Subsidies (FSR) added a third clearance track for transactions involving non-EU public funding, alongside antitrust merger control and FDI screening. LX20 advises private equity sponsors, Italian and international groups, funds and family offices on: - Private M&A (acquisitions, joint ventures, carve-outs, leveraged buyouts) with negotiation of SPAs, SHAs, escrow agreements, W&I insurance, indemnity packages - Public M&A (voluntary, mandatory and residual tender offers, exemptions, whitewash) on listed issuers - Corporate reorganisations (mergers, demergers, contributions, cross-border transactions under Legislative Decree 19/2023) - Shareholders' agreements with drag-along, tag-along, RoFR, exit strategies - Golden Power and Italian FDI screening, coordinated with foreign regimes (CFIUS, EU FDI Regulations, UK NSI Act) - Merger control AGCM and EU, post-2022 threshold review, gun jumping, remedies The practice integrates coordination with tax, labour, IP and sectoral regulatory teams throughout the transaction.
Tokenization
Tokenisation of financial instruments in Italy operates on three distinct legal layers that must be kept separate: the Italian Fintech Decree (DL 25/2023, Law 52/2023) for the digital form of Italian financial instruments on DLT; the EU DLT Pilot Regime (Reg. (EU) 2022/858) for European market infrastructures; MiCAR (Reg. (EU) 2023/1114) for crypto-assets not qualifying as financial instruments. The Italian Fintech Decree allows issuance, in digital form on DLT, of: shares, bonds, S.r.l. debt securities under Article 2483 of the Civil Code, further admitted debt securities, money market instruments, units or shares of Italian collective investment undertakings. The original list is typified in Article 2; CONSOB regulatory extensions (Article 28 of the post-conversion decree) may include additional instruments (e.g. S.r.l. PMI quotas). The register manager is a supervised entity listed in a CONSOB register. As of May 2026 the market has seen first registrations (2024), the registration of ClubDeal Digital (July 2025), first cancellations, and the issuance of the first Italian Fintech Decree-compliant digital bond by CDP (July 2025). On the boundary with MiCAR, the substance over form criterion applies (ESMA Guidelines December 2024): a token's qualification as a transferable security depends on the substantive analysis of embedded rights. LX20 advises issuers, investment funds, intermediaries and technology operators on: - Structuring of native DLT issuances (shares, bonds, participative financial instruments) - Register manager authorisation before CONSOB - Real-asset tokenisation (real estate, art, commodities) with structures compatible with Italian law - Corporate DAOs: integration of decentralized governance with company law - MEF regulatory sandbox DM 100/2021 for complex projects (indicative practice timeframes 4-9 months) The practice coordinates corporate, regulatory, tax and technology aspects.
DORA
Regulation (EU) 2022/2554 (DORA) has been applicable since 17 January 2025. It establishes a harmonised European framework for ICT risk management of financial entities and for EU-level oversight of ICT providers designated as critical. Five pillars: - ICT risk management: governance framework, policies, threat intelligence - Incident reporting on major ICT-related incidents (Delegated Reg. (EU) 2025/295) - Digital operational resilience testing (including selective TLPT, Delegated Reg. (EU) 2025/1190) - ICT third-party risk management (Register of Information under Implementing Reg. (EU) 2025/302, Article 30 DORA contracting) - Information sharing between entities As of May 2026 the most active supervisory areas are: - Register of Information: in Italy, the Bank of Italy has set the annual deadline at 15 March. Technical vademecum published April 2026. The 2025 horizontal analysis flagged vendor concentration, limited substitutability, supply chain complexity. - Major incident notification timeline (Delegated Reg. (EU) 2025/301 Article 5): as soon as possible, within 4 hours of classification as major, and in any event within 24 hours from when the entity became aware; intermediate report 72 hours; final report within one month. - Selective TLPT: the competent authority selects entities based on potential systemic impact, systemic character, ICT risk profile. LX20 advises banks, investment firms, asset managers, e-money and payment institutions, market infrastructures and ICT providers on gap analysis, IT third-party contracts, incident reporting management, dialogue with the Bank of Italy, Register of Information preparation.
GDPR
Regulation (EU) 2016/679 (GDPR) is the basis of European personal data protection law. In Italy it operates jointly with the Italian Privacy Code (Legislative Decree 196/2003) as amended by Legislative Decree 101/2018 adapting to GDPR. The most relevant areas are: - Legal bases and consent: consent, legal obligation, contract performance, legitimate interest (Article 6 GDPR) - DPIA for high-risk processing (Article 35 GDPR) - Roles: controller, joint controller, processor, sub-processor - Article 28 GDPR contracting (Data Processing Agreement) - Cross-border data transfers: Standard Contractual Clauses 2021 (Decision 2021/914), Transfer Impact Assessment post-Schrems II, EU-US Data Privacy Framework, Binding Corporate Rules, Article 49 derogations - Cybersecurity and data breach notification (Articles 33-34 GDPR, 72 hours) - Data subject rights: access, rectification, erasure, portability, objection, no automated decisions The Italian Data Protection Authority (Garante) exercises sanctioning and supervisory powers. For Italian law firms, the 2018 Garante guidance and subsequent guidelines specifically govern lawyers' professional secrecy (Article 28 Italian Lawyers' Code of Conduct) and its interaction with GDPR. LX20 advises Italian and international companies on GDPR mapping, DPIAs, DPA contracting, cross-border transfers, data breach management, dialogue with the Garante. The practice integrates with AI Act, DSA, DMA, Data Act, NIS2 for tech sector clients.