Europe's fintech rulebook moves on many fronts, but the payment rules themselves stay drafts

Europe's digital policy news on Tuesday was dominated by things that are not, strictly, payments. France's Bull and Schwarz Digits, the IT arm of the Lidl and Kaufland owner Schwarz Group, said on Tuesday they had agreed a memorandum of understanding. The aim is a European AI and cloud infrastructure stack running from servers to software. The deal was announced at the German government's 2026 Digital Summit in Berlin, according to The Next Web.

The two firms put sovereignty at the centre of the pitch. Schwarz Digits will contribute its STACKIT cloud. Bull will bring AI and high-performance computing work. Servers would be built at Bull's factory in Angers, France, using direct liquid cooling.

None of that is a payment rule. But it is the same political current that has shaped European fintech policy for two years. Build the infrastructure at home, then write the rules around it.

What is actually moving, and what is still a draft

For payments specifically, the freshest document in circulation is not a law. FinTech Futures reported on Monday that cloned websites have turned up in the EU's draft payment rules. Hardly anyone has noticed. That is a draft, not a settled text. The practical effect on firms depends on what survives the negotiations.

The same caution applies to the digital euro. FinTech Futures reported on Monday that the European Central Bank had revealed the network service providers for the proposed digital euro. That is a procurement step, not a launch. At Sibos 2026, FF News carried a session with the ECB's Mayte Arráez González on the digital euro. It is still a project with a timetable, not a product with users.

The gap between the two kinds of story matters. Announcements about AI clouds and central bank plumbing get the headlines. The rules that decide whether a payment firm can operate across borders move through consultation and trilogue. They move slowly, and mostly out of sight.

The security story that did land

The most concrete European tech incident of the week was not a policy paper. On Monday, supermarkets in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems with refrigeration systems, some rising to as high as 50C, according to The Guardian. Several companies confirmed they had been hacked.

CNBC reported that Ahold Delhaize had dozens of Delhaize stores affected in Belgium and Luxembourg, with food discarded. Colruyt Group said five Spar stores were targeted. Carrefour told the BBC that 15 of its Belgian stores were attacked. Intermarché said 15 of its 153 Belgian stores were hit. IKEA said an incident affected fridges and freezers at its Mons store in Belgium between Sunday and Monday.

The European Commission is in direct contact with national authorities. It convened a meeting on Tuesday morning of the EU interinstitutional Task Force with ENISA, Europol and relevant Commission services, a spokesperson told CNBC.

In the UK, the National Cyber Security Centre said it was working with affected companies. Paul Chichester, the centre's director of operations, spoke at the launch of the NCSC annual review on Tuesday. "We're aware of those incidents in the UK, and obviously we're working with the affected organisations. We'll keep monitoring that." The British Association of Independent Meat Suppliers told the BBC some of its more than 300 members had been affected.

"There are so many vulnerabilities out there that … you could say are waiting to be exploited," said NCSC chief executive Richard Horne, describing the fridge attacks as the "foothills" of a larger threat.

The Hacker News also covered the second wave of refrigeration attacks on Tuesday. Researchers at Lupovis told The Guardian they had recorded 256 attempted attacks from 91 different sources between 20 October and 30 October. The attacks hit honeypot traps mimicking Danfoss fridge controllers, mostly using factory-default credentials.

Where the money is going

Capital, at least, is still moving. Tech.eu's weekly recap, published on Monday, counted more than 60 European tech funding deals worth over €1.3 billion in the previous week. AI took €815.6 million, healthtech €121.1 million and fintech €104.1 million. The UK led on €1 billion, followed by Switzerland on €74.4 million and Spain on €59.5 million.

On the fund side, TechCrunch reported on Tuesday that Yvonne Bajela had closed an oversubscribed $17 million Fund I for her firm Evertrue. She was formerly of LocalGlobe and Impact X Capital Partners. The fund focuses on early-stage investing across the UK and Europe, with an average cheque of around £350,000. It plans to back at least 20 companies over three years. She said the fund had five institutional backers, including the British Business Bank. She said PitchBook data through the end of September showed emerging UK fund managers had raised $7.4 billion, already above the $6.2 billion raised in all of 2025.

Smaller cheques are still being written too. Tech.eu reported on Tuesday that Portuguese startup Granter had raised €1.6 million. 3XP Global led the round through its Impact Innovation Fund under Portugal's state development bank Banco Português de Fomento. Celtis Venture Partners, Gateway Ventures and Deel participated, bringing total funding to €2 million. Granter's product is AI software for finding and applying for public funding. That tells you something about how much of European tech now runs on subsidy navigation.

The sovereignty argument, in its own words

The political frame around all of this was set out plainly in Berlin. Mistral CEO Arthur Mensch told POLITICO in an interview published on Monday that Europe risks a "complete trap". That trap comes if Europe focuses on industrial AI while leaving frontier models to the US and China.

"The idea that we can build anything meaningful without owning the foundation of it, which are the reasoning models, the brains that can operate the factories, that can help design better systems … is, I think, a complete trap," Mensch said.

His comments came as the German government unveiled plans on Monday to make Germany a "sovereign AI nation" by 2030, including at least three European frontier AI labs. Mensch welcomed the ambition but said: "There is no such thing as a national strategy on AI. It needs to be a European strategy on AI." He also faces a commercial counterargument. POLITICO reported that German search engine Ecosia stopped using Mistral's models after concluding they did not meet its needs. Its CEO said switching to Chinese models cut costs by half while improving performance.

POLITICO also reported on Saturday that Brussels has a plan to win the next tech revolution through a quantum act. It is a reminder that the EU's answer to losing one technology race has been to legislate for the next one.

Rules that arrive with a date

Some European tech rules do have firm deadlines, and firms would do well to read them. Electrek reported on Monday that from 18 February 2027, new e-bike batteries sold in the EU will need a digital battery passport accessible by QR code, under the EU's 2023 Batteries Regulation. The passport can carry manufacturer, chemistry, capacity, cycle count, carbon footprint and materials data. What an ordinary buyer sees depends on authorisation level.

CleanTechnica, citing Transport & Environment, reported on Monday on the EU Emissions Trading System review proposal published in July 2026. It said the proposal is not fit for purpose for supporting clean fuel investment in aviation and shipping. It argued for earmarking 50% of national ETS revenues for decarbonisation support.

Payment firms have their own deadline pressure. FinTech Weekly noted on 28 October that Verification of Payee is one year old and that instant payments are still testing Europe. That is a blunter summary of the state of play than any consultation paper.

The read across

Put together, the week's news describes a European tech policy that is loud about infrastructure and quiet about the operational rules firms need. The Bull and Schwarz Digits MoU, the German sovereignty strategy and Mensch's warnings are all arguments about who owns the stack. The cloned-website clause, the digital euro procurement and the Verification of Payee experience are about whether the plumbing works.

For fintechs, the second category decides the business. A draft rule on cloned websites can change onboarding and liability. A digital euro provider list can change the rails. A Verification of Payee regime that is still bedding in after a year can change fraud costs and conversion rates.

And the fridge attacks are a reminder that the security layer underneath all of it is not theoretical. Legacy technology connected to the internet with default passwords, as The Guardian reported of the French incidents last month, is the same class of problem. Payment systems spend millions trying to avoid it.

The next real signal will come from Brussels, not Berlin. Until the payment rules text is settled and published, the fintech sector is reading drafts and watching procurement notices. That is a poor substitute for a rulebook, but for now it is what exists.