What a Report About Children Reveals About the Supervisory Agenda for Financial Institutions

Someone sent me a European Parliament report about children on social media. I nearly did not open it.

It is not a financial services report. Its subject is the protection of minors in the online environment, and it imposes no obligations on financial institutions. The Committee on Culture and Education adopted it on 14 July 2026, by 17 votes to 3 with 4 abstentions, as an own-initiative report, which means it is non-binding.

Then I read what MEPs actually asked for.

1. What the report asks for

• A ban on the most harmful addictive practices.
• Risk-based safeguards for recommender systems.
• Algorithmic transparency, on the basis that opaque recommendation and moderation systems prevent users understanding why content is shown, suppressed or removed.
• A "youth mode" disabling targeted advertising.
• An EU code of conduct for influencers, and a harmonised definition of "influencer marketing".
• Mandatory ethical standards for AI companions.
• Classification of AI-generated content impersonating media professionals and brands, the so-called celebrity scams, as a systematic risk under the Digital Services Act.
• Possible personal liability in cases of serious and persistent non-compliance with the provisions concerning the protection of minors.

That last point is easy to over-read. The personal liability MEPs refer to is tied specifically to provisions protecting minors. It is not a general proposal for personal liability across regulated sectors and should not be described as one.

The report also asks the Commission to ensure consistency across the Audiovisual Media Services Directive, the GDPR, the Digital Services Act, the AI Act and the Digital Fairness Act.

The odd thing about this document: strip out the word "minors" and most of that list reads like the agenda ESMA has been working through since 2023. The report is addressed to a different audience entirely, and much of what it asks for is already being examined in our own sector.

2. The same subjects, already in financial services

In 2023, ESMA and the national competent authorities ran a common supervisory action on the application of MiFID II disclosure rules to marketing communications. It expressly covered apps, websites, social media and collaborations with affiliates such as influencers. ESMA observed that younger, less experienced investors are particularly vulnerable when they operate online.

That was supervisory work under existing MiFID II rules, not new legislation. The distinction matters, because what follows sits at very different points on the same scale.

In December 2023, ESMA published a discussion paper on MiFID II investor protection topics linked to digitalisation. It covered gamification, dark patterns, nudging, information layering, social features and digital marketing practices. A discussion paper binds nobody, but it is a reasonable guide to what a supervisor has begun thinking about.

Neither document is about children. Both are about the same practices.

3. The Digital Services Act: in force, and addressed elsewhere

The Digital Services Act became fully applicable on 17 February 2024. Article 25(1) provides that providers of online platforms shall not design, organise or operate their online interfaces in a way that deceives or manipulates the recipients of their service, or otherwise materially distorts or impairs their ability to make free and informed decisions.

Read that provision without its heading and it could pass for a conduct rule. It is binding law, it is about interface design, and it has been in force since early 2024.

It does not bind financial institutions. It binds providers of online platforms, and a firm's own app or client portal is not an online platform within the meaning of the Regulation. The same is true of Article 28, which requires providers of online platforms accessible to minors to put appropriate and proportionate protective measures in place, and which prohibits presenting advertisements based on profiling where the provider is aware with reasonable certainty that the recipient is a minor.

Worth being precise about: Articles 25 and 28 bind platform providers, not advertisers. They shape where a firm's advertising can reach and what a platform may do with it. They are not duties on the firm. But they are the clearest example of the pattern in this article: the prohibition on manipulative interface design already exists in EU law, fully applicable, aimed at someone else.

4. The AI Act: applicable, and conditional

The AI Act has a different legal status again. Its Article 5 prohibitions have applied since 2 February 2025, and they reach certain harmful uses of AI involving manipulation or deception, as well as the exploitation of vulnerabilities linked to age, disability or a person's social or economic situation.

The statutory conditions do a great deal of work here, and they are not identical across the prohibitions. Depending on which is in issue, they include material distortion of behaviour, appreciable impairment of the ability to make an informed decision such that the person takes a decision they would not otherwise have taken, and significant harm or a reasonable likelihood of significant harm. What follows is a summary rather than the operative text, and anyone assessing a specific system should work from the Regulation itself.

Even at that summary level the shape is clear enough. Article 5 is not a prohibition on persuasive design, and it does not convert every interface choice into an AI Act question. Applicability turns on the Act's scope, the firm's role in relation to an AI system, and the particular use made of it.

5. The Retail Investment Strategy: agreed, not adopted

On 18 December 2025 the Council and the European Parliament reached political agreement on the Retail Investment Strategy, which includes requirements on marketing communications and practices, provisions addressing finfluencers, and a best-interest test.

Formal adoption is not complete. The provisional agreement requires formal approval by both Parliament and Council before the rules can enter into force, and Official Journal publication follows adoption. The Parliament's Legislative Observatory lists procedure 2023/0167(COD) as awaiting Parliament's position in first reading, with an indicative plenary sitting date of 11 November 2026. Indicative dates move.

The agreed transposition and application periods run from Official Journal publication. The relative periods are known. The calendar dates are not, because publication has not happened, so any specific application date circulating at this stage should be treated with caution.

6. The Digital Fairness Act: planned, unpublished

The Commission plans to propose a Digital Fairness Act in the fourth quarter of 2026. It has said it intends to address dark patterns, addictive design, problematic or misleading influencer marketing, and personalised practices that exploit vulnerabilities. A public consultation closed on 24 October 2025.

Those are stated policy aims, not enacted requirements. The proposal remains under preparation and unpublished, and whether it ends up reaching regulated financial institutions is an open question rather than a settled one.

7. Seven instruments, and what each one actually is

These sit at very different points on the scale, from a supervisory exercise to two sets of prohibitions already in force to an initiative still under preparation. It would be wrong to read them as a single trend line with legal force behind it, and anyone presenting them that way is overselling.

What they have in common is subject matter. The design of digital journeys, and the way products are marketed through them, keep appearing in European regulatory and supervisory work, whoever the stated audience happens to be.

8. So who signs off the design?

None of that makes the minors report a preview because anyone intends it as one. It reads as one because the same practices keep being described in the same words, across instruments that carry very different legal weight and address very different audiences.

Which makes interface design more than a product or marketing question. It can also be a compliance question, when the client journey itself starts creating regulatory risk.

So, a fairly basic question. In your firm, who signs off the design of the client-facing app or platform? Product? Marketing? Compliance? Some combination of the three?

I am curious how firms are handling that division of responsibility in practice, because the instruments above do not care which department drew the screen.

Sources

European Parliament press release, "Better enforcement of rules needed for a safer social media and online environment", 14 July 2026 (ref 20260709IPR46415)
ESMA, common supervisory action on marketing communications
ESMA Discussion Paper on MiFID II investor protection topics linked to digitalisation (ESMA35-43-3682)
Digital Services Act, Article 25
AI Act, Article 5
European Parliament Legislative Observatory, procedure 2023/0167(COD)
Council of the EU, Retail Investment Strategy political agreement, 18 December 2025
European Parliament Legislative Train, Digital Fairness Act

Know what is coming before it arrives. Most of the subjects in this article are covered in our MiFID II course Marketing Communications, Gamification & Digital Engagement: the Article 44 marketing communication rules, gamification and digital engagement practices, and finfluencers, worked through with real enforcement cases. 5 CPD units, €119.

Marketing Communications, Gamification & Digital Engagement

This article is general information about regulatory developments and is not legal advice. Legislative timetables and indicative dates change. Verify the current position before relying on any date given here.