Breaking news

Apple Challenges UK Demand For Access To Encrypted User Data

Apple has launched a new legal challenge against the UK government’s attempt to gain access to encrypted customer data, reigniting debate over the balance between privacy, encryption and national security.

At the centre of the case are requests made under the UK’s Investigatory Powers Act, which allows authorities to require technology companies to assist law enforcement under specific legal conditions. Apple confirmed it had filed the challenge but declined to comment further.

A Renewed Privacy Dispute

This latest legal action follows a long-running disagreement between Apple and the UK government over access to encrypted cloud data. Earlier requests reportedly extended beyond British users, prompting concerns in the United States about privacy and the potential reach of foreign government orders.

More recent reports suggest UK authorities are now seeking access specifically to the encrypted data of British users.

Apple’s Position

Apple has consistently argued that weakening encryption would compromise the security of all users. Company executives have repeatedly said Apple will never build a backdoor or universal access mechanism into its products, maintaining that strong encryption remains one of the most effective safeguards against cyberattacks and data breaches.

Earlier this year, Advanced Data Protection (ADP) was withdrawn for new users in the UK following regulatory pressure, while existing users are also expected to lose access to the feature over time.

The UK’s Position

Officials at the Home Office maintain that strong encryption can coexist with lawful access for investigators. According to the department, requests made under the Investigatory Powers Act are intended to support investigations into terrorism, serious crime and child exploitation, while remaining subject to judicial oversight.

A Global Debate Over Encryption

Beyond the UK, the case reflects a broader debate over encrypted communications and digital privacy. Governments continue to argue that access to encrypted data is essential for law enforcement, while technology companies warn that introducing exceptional access mechanisms would weaken security for every user, regardless of where they live.

ECB Moves to Ease Rules for Smaller Banks Without Weakening Supervision

The European Central Bank is preparing a significant broadening of proportionality in banking supervision, a move that could bring roughly 150 additional smaller institutions into a lighter regulatory framework, according to ECB Executive Board member Frank Elderson.

In a post on the ECB’s supervision blog, Elderson, who also serves as vice-chair of the Supervisory Board, said the goal is to reduce the regulatory burden on small and non-complex institutions while preserving the safeguards that support financial stability.

A More Flexible Approach To Supervision

Rather than creating a separate rulebook for smaller lenders, the ECB’s proposals would expand the existing framework for small and non-complex institutions, or SNCIs, by broadening eligibility and easing the frequency and intensity of certain supervisory tasks.

Elderson argued that Europe’s varied banking sector is a strategic strength. Smaller, locally focused banks, he said, play a critical role in financing households and small and medium-sized enterprises, which in turn supports innovation, employment and investment across the region.

“These institutions play an important role in financing households and small and medium-sized enterprises, helping innovative ideas become successful products and supporting jobs and investment across the region,” Elderson wrote.

He added that a banking system combining different business models, sizes and areas of expertise is better positioned to meet the financing needs of the European economy and, by extension, support competitiveness.

Why Proportionality Matters

The ECB’s approach rests on a simple principle: regulatory requirements should be calibrated to a bank’s size, complexity and risk profile.

At the same time, Elderson cautioned that smaller banks are not insulated from the pressures facing the wider financial system. He pointed to geopolitical risk, cyber resilience in the era of advanced artificial intelligence, digitalisation and climate- and nature-related risks.

“Depositors in smaller banks should be just as confident that their savings are safe and their bank is well managed, resilient and subject to robust risk management standards as those in larger institutions,” he wrote.

The central bank believes a more targeted framework would allow smaller lenders to devote more resources to the risks that matter most, while trimming compliance work that adds cost without materially improving resilience.

A Wider Definition Of Small Banks

The most consequential proposal would broaden the definition of what qualifies as a small bank.

Today, the SNCI framework covers 75% of all less significant institutions under European banking supervision, representing more than 1,400 entities as of December 2025.

Under the ECB’s proposal, national authorities would be able to lift the current €5 billion total-assets threshold for SNCI status to as much as €10 billion, depending on the size and structure of domestic banking sectors.

The ECB also wants the definition of “non-complex” to better reflect how banks operate in practice. Elderson noted that some institutions, especially in smaller member states, fail to qualify as SNCIs because of technical features in their recovery and resolution arrangements, even when they are not complex from a resolution standpoint.

Taken together, the changes could result in as many as 85% of less significant institutions being classified as SNCIs, bringing about 150 additional banks into the lighter framework.

The ECB also wants the SNCI label to be used more consistently in future European banking legislation, with new and amended rules spelling out more clearly how they apply to smaller and non-complex institutions.

Less Frequent Supervisory Reviews

The changes would not stop at classification. The ECB is also proposing a more selective approach to supervision itself.

The Supervisory Review and Evaluation Process, or SREP, could be carried out less frequently for some institutions. Elderson said certain banks might go two to three years without a full SREP if their risk profile justifies that approach.

That flexibility would remain subject to supervisory judgment, meaning banks could still face more frequent scrutiny if their risk warrants it.

“Where risks are low, some supervisory assessments will in practice be carried out even less frequently, reducing the burden on banks without undermining supervisory effectiveness,” Elderson wrote.

The ECB is also seeking to reduce the burden of stress testing. Bottom-up stress tests, in which banks run their own projections and submit them to supervisors, would be used only selectively for SNCIs. Supervisors would rely more heavily on top-down exercises, with projections carried out centrally.

That shift could meaningfully reduce the workload for nearly 1,000 SNCIs that are still subject to bottom-up stress tests.

Reporting Could Be Cut Dramatically

Reporting is another area targeted for simplification.

The ECB said its systems have already been adapted to support a materiality threshold for reporting resubmissions once the relevant legislative changes are in place.

A new SNCI category is also set to be introduced into the ECB’s FINREP regulation from 2027, beginning with a public consultation.

Under the proposed revisions, the volume of financial reporting required from SNCIs could fall from around 13,500 data points to roughly 700.

Updates to the European Banking Authority’s technical standards on supervisory reporting are also expected to remove redundant templates, eliminate overlaps and exempt SNCIs from certain reporting requirements.

More Flexibility On Governance

The ECB is also pushing for a more proportionate approach to governance requirements.

Supervisors would make greater use of existing flexibility to reflect a bank’s risk profile and operational complexity.

That could allow certain committees to be merged, including nomination and remuneration committees, while functions such as risk management and compliance could also be combined where appropriate.

The proposals would also create more room for flexibility around pay rules, including possible exemptions from requirements to defer variable remuneration or pay it in financial instruments.

Periodic independent reviews of remuneration policies could also be outsourced and applied in line with the sophistication of a bank’s internal stress-testing framework.

Why Smaller Markets Stand To Benefit

The proposals may be especially relevant to smaller European banking markets, even though the ECB has not identified which national authorities would choose to raise the €5 billion threshold.

Cyprus, for example, has a relatively small banking market and its domestic institutions fall under the European banking supervision framework. Any decision to apply the higher SNCI threshold would therefore depend on the applicable rules and supervisory assessment.

Elderson was explicit that the changes should not be read as a weakening of core safeguards.

“Proportionality should not be mistaken for reducing prudential standards for smaller banks,” he wrote. “The aim is not to lower standards, but to achieve them in a more efficient and proportionate manner.”

The ECB also said any simpler regime for smaller banks must be matched by a credible, flexible and efficient crisis management framework.

In Elderson’s view, trimming administrative overhead would free up scarce resources for risk management, customer service, investment in competitiveness and operational efficiency.

“By reducing undue complexity and the administrative burden for small and non-complex banks, these measures can support the competitiveness of Europe’s diverse banking sector, without compromising resilience,” he wrote.

What Comes Next

The ECB is preparing to implement the simplification measures within its authority. It will also work with European institutions on changes that require action beyond the central bank, including initiatives under development through the European Banking Authority.

For Elderson, the proposals are part of a broader push to streamline European banking supervision, not just for smaller institutions but across the system as a whole.

“Our goal is clear: to make our supervision more efficient, more effective and more risk-based, while continuing to preserve banks’ resilience,” he wrote.

Aretilaw firm
eCredo
Uol
The Future Forbes Realty Global Properties

Become a Speaker

Become a Speaker

Become a Partner

Subscribe for our weekly newsletter