{"id":13170,"date":"2026-09-13T11:50:23","date_gmt":"2026-09-13T11:50:23","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13170"},"modified":"2026-09-13T11:50:23","modified_gmt":"2026-09-13T11:50:23","slug":"eu-crypto-wallet-reporting-deadlines","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13170","title":{"rendered":"EU crypto wallet reporting deadlines"},"content":{"rendered":"

<\/p>\n

\n

Commercial manufacturers whose connected hardware wallets or wallet software meet the European Union’s product test must now warn cyber authorities within 24 hours of discovering an actively exploited vulnerability or severe security incident.<\/p>\n

The requirement took effect Sept. 11, 2026, under the EU’s Cyber Resilience Act, or CRA. The European Commission’s reporting guidance says the clock applies to manufacturers of products with digital elements.<\/p>\n

The CRA is a horizontal product law. The Commission’s implementation FAQ says it applies to hardware and software made available on the EU market. The legal test also requires the product’s intended or reasonably foreseeable use to include a direct or indirect data connection to a device or network.<\/p>\n

A commercially supplied connected hardware wallet or downloadable wallet app can meet that test. However, EU guidance does not name wallet brands or declare every wallet service or project covered. Coverage depends on the specific product, how it is supplied and any applicable exclusion.<\/p>\n

\n

Related Reading<\/span><\/p>\n

SafePal breach exposes 40,000 customers as hardware wallet attacks escalate from data leaks to $100 million theft<\/h3>\n<\/p>\n

<\/span> <\/div>\n

What manufacturers must report<\/h2>\n

The first filing is an early warning due without undue delay and no later than 24 hours after a manufacturer becomes aware of the vulnerability or incident. It must indicate, where applicable, the member states where the product is known to have been made available. For a severe incident, the warning must also say whether unlawful or malicious acts are suspected.<\/p>\n

A fuller notification is due within 72 hours unless the relevant information was already provided. For an actively exploited vulnerability, that filing adds general information about the product, exploit and vulnerability, plus corrective or mitigating measures. For a severe incident, it adds the nature of the incident, an initial assessment and available mitigation information.<\/p>\n