August 2026 Regulatory Updates

Key dates

2025-01-01

Beginning of the general period identified by the SEC during which the charged entities allegedly filed Forms ADV containing material misrepresentations; the publication does not specify an exact start date.

2026-08-27

The SEC announced the charges, disclosed the requested remedies, stated that the 38 ERA filings had been removed from its website, and referenced its related investor alert.

Suggested considerations

• Compliance teams may wish to perform a documented, line-by-line validation of Form ADV Part 1 and applicable Form ADV Part 2 disclosures, including business addresses, telephone numbers, websites, ownership, control persons, regulatory status, assets, private funds, clients, and service providers.
• Firms should consider retaining contemporaneous evidence supporting material Form ADV representations, such as lease or office records, corporate and ownership documents, fund records, audited financial statements, auditor engagement evidence, and records supporting reported assets and advisory activities.
• ERA and registered adviser compliance programs may wish to establish independent verification of counterparties' SEC registration or ERA status through the Investment Adviser Public Disclosure system and should avoid treating an SEC filing, certificate, or website badge as conclusive proof of legitimacy.
• Firms that market investment advice to individuals should consider reviewing whether their regulatory status, Form ADV disclosures, and marketing materials accurately describe whether they are registered, exempt reporting, or otherwise authorized to provide services to retail investors.
• Compliance teams may wish to investigate repeated or highly similar ownership structures, numerical disclosures, addresses, telephone numbers, websites, auditor names, or filing patterns across related advisers as potential indicators of coordinated fraudulent filings.
• Firms should consider escalating unanswered SEC requests for records and preserving relevant books, records, communications, websites, and filing-support materials, because the SEC expressly relied on alleged failures to substantiate Form ADV information.
• Private fund sponsors and allocators may wish to verify that purported fund audits were performed by identifiable independent public accounting firms with appropriate federal or state registration or licensing, rather than relying solely on statements in Form ADV.
• Financial-crime and onboarding teams may wish to incorporate the SEC's PAUSE list, investor alerts, foreign-jurisdiction indicators, website authentication checks, and independent corporate-registration checks into risk-based due diligence for purported U.S. advisers.

What changed

This publication announces enforcement complaints rather than a new rule or generally applicable filing requirement. The SEC alleges violations of Section 204(a) of the Investment Advisers Act of 1940, which governs adviser records and reports including Form ADV, and Section 207, which prohibits untrue statements or omissions in applications and reports filed under the Act. The SEC seeks permanent injunctions, conduct-based injunctions preventing the defendants from filing Forms ADV as exempt reporting advisers, and civil penalties.

Key dates

2026-08-27

The FDIC Board unanimously approved the final rule on unsafe or unsound practices and MRAs and the interim final rule on Road to Housing Act reciprocal deposits by notational vote.

Suggested considerations

• Compliance teams may wish to inventory open MRAs, supervisory recommendations, and section 8 enforcement matters and assess whether each matter satisfies the new material-harm, Deposit Insurance Fund risk, prudent-operation, or legal-violation criteria.
• Banks should consider mapping existing policies, procedures, reporting controls, documentation findings, and governance issues to the new distinction between MRAs, supervisory observations, and other violations, while retaining controls for matters that could affect capital, asset quality, earnings, liquidity, market-risk sensitivity, consumer outcomes, or receivership risk.
• Management and board committees may wish to prepare for examiner requests for the objective facts, risk analysis, and reasoning supporting any MRA or unsafe-or-unsound-practice conclusion, including evidence of how the bank assessed reasonably foreseeable conditions.
• Banks using reciprocal deposits should consider recalculating their permissible nonbrokered reciprocal-deposit capacity under the tiered liability formula and updating brokered-deposit classification, liquidity, deposit reporting, internal limits, and regulatory reporting controls.
• Potential agent institutions should verify their eligibility under the revised definition, including the applicable capital and examination-rating requirements and the broadened CAMELS-based criteria.
• Treasury, balance-sheet management, and deposit operations teams may wish to model the effect of the expanded reciprocal-deposit exclusion on funding concentration, liquidity stress assumptions, deposit pricing, and brokered-deposit monitoring.
• Legal and regulatory-affairs teams should monitor the Federal Register publication of both rules, confirm the effective dates, review any interim-final-rule comment opportunity, and determine whether implementation or comments are appropriate.
• Banks should consider reviewing examiner lookback requests and suspicious-activity review scopes against the related OCC examination guidance, which generally limits lookbacks involving failures to detect or report suspicious activity to one year or less unless heightened approval is obtained.

What changed

The final supervisory rule defines an unsafe or unsound practice as a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and that, if continued, is likely to materially harm the bank's financial condition or present a material risk of loss to the Deposit Insurance Fund, or that has materially harmed the bank's financial condition.

Key dates

2026-08-27

The OCC issued Bulletin 2026-42 announcing the notice of proposed rulemaking.

Suggested considerations

• Compliance teams may wish to inventory open and recently closed MRAs arising from alleged legal or regulatory violations and assess whether each matter would satisfy one or more of the proposed substantive-violation criteria.
• Firms should consider strengthening documentation linking examination findings to duration, frequency, systemic characteristics, financial-condition effects, books-and-records impacts, customer harm, restitution, or insider misconduct.
• Banks may wish to separate remediation plans for legal or regulatory violations from broader supervisory enhancements, because the proposal would limit examiner authority over technical violations to directing correction of the violation itself.
• Compliance and examination-management teams should consider preparing comments or internal positions on the undefined terms more than minimal, systemic, pattern, and meaningfully impact, including how those terms should be applied to isolated but high-severity events.
• Management may wish to review escalation thresholds so that technical-violation treatment does not result in under-escalation of recurring findings that could become systemic or satisfy the proposed substantive criteria.
• Banks should monitor the Federal Register publication of the notice of proposed rulemaking and calculate the 30-day comment period from that publication date rather than from the OCC bulletin date.
• Legal and regulatory-change teams may wish to assess this proposal alongside the OCC-FDIC final rule and related supervisory reforms concerning unsafe or unsound practices, MRAs, and material financial risk, while treating the proposal as nonfinal until adopted.

What changed

The proposed rule would provide that the OCC may issue an MRA for a violation of a banking or banking-related law or regulation only when the violation is substantive. A violation would be substantive when its nature, duration, frequency, or severity could meaningfully impact the bank or its customers, and at least one of five criteria would need to be met: the violation is systemic or constitutes a pattern; it has had or could reasonably be expected to have a direct, clear, predictable, and more than minimal impact on the bank's financial condition; it has had or could reasonably be expected...

Key dates

2026-08-27

OCC issued revised PPM 5310-3 and PPM 5400-11; PPM 5310-3 replaces the May 25, 2023 manual, PPM 5400-11 replaces the February 27, 2026 version, and OCC Bulletin 2023-16 is rescinded.

Suggested considerations

• Compliance teams may wish to map open MRAs, enforcement orders, capital directives, and supervisory findings against the new material-harm, Deposit Insurance Fund risk, and substantive-violation thresholds.
• Banks should consider reviewing issue-management taxonomies and governance procedures so that MRAs, other violations, and supervisory observations are recorded and escalated according to their distinct consequences.
• Board and committee reporting processes may warrant review because supervisory observations do not automatically require board presentation or a corrective-action plan, whereas MRAs and enforcement actions remain subject to formal remediation and validation expectations.
• Large and complex banks should consider reassessing whether deficiencies that might previously have produced a community-bank-level supervisory response could receive faster escalation under the revised tailoring framework.
• Banks with existing enforcement actions may wish to assess whether their remediation evidence demonstrates substantial compliance with the essential requirements of each order and whether remaining issues are minor and isolated.
• Capital management teams may wish to review procedures for the institution of and termination of individual minimum capital ratios under the revised enforcement manual.
• Legal and regulatory change teams should monitor Federal Register publication of the joint OCC-FDIC final rule and calculate the actual effective date rather than relying on the bulletin date.
• Internal audit and compliance functions may wish to preserve objective factual support for responses to MRAs and other supervisory communications, particularly where the bank believes an issue does not meet the new risk-based threshold.

What changed

Revised PPM 5310-3 replaces the May 25, 2023 version and structures the OCC enforcement framework around escalation, tailoring, and focus. The OCC generally intends to provide banks an opportunity to remediate deficiencies through supervision before initiating a Section 8 enforcement action, although it retains authority to act at any time when legally supportable and warranted.

Key dates

2026-08-27

OCC revised PPM 5310-3 and PPM 5400-11, issued Bulletin 2026-41, and published the proposed rulemaking notice concerning substantive and technical violations. The proposed rule's 30-day comment period begins only upon Federal Register publication.

Suggested considerations

• Compliance teams may wish to map open and recently closed MRAs and enforcement actions against the revised material-financial-risk threshold and the stated tailoring factors of capital structure, complexity, activities, and asset size.
• Banks should consider documenting objective facts, legal violations, financial-risk consequences, customer impact, duration, frequency, severity, and remediation status supporting the classification and closure of examination findings.
• Large and complex banks may wish to reassess escalation risk because the OCC expressly permits enforcement action for practices that might not produce the same response at a community bank.
• Banks should consider reviewing corrective-action plans to confirm that each action is directly tied to a specific deficiency and is proportionate to the risk, while preserving evidence of substantial compliance with existing orders.
• Compliance teams may wish to distinguish substantive violations from potential technical violations in issue-management inventories, including systemic or repeated conduct, customer restitution, books-and-records impacts, financial-condition effects, and insider misconduct.
• Banks should consider monitoring the Federal Register for publication of the proposed rule and calculating the 30-day comment period from that publication date; affected institutions may wish to submit comments on the proposed substantive-versus-technical framework.
• Examiners may identify lower-level weaknesses as supervisory observations rather than MRAs; banks should consider maintaining internal governance and risk records for such observations without assuming that the OCC may require a board action plan or track remediation in the same manner as an MRA.

What changed

Revised PPM 5310-3, Bank Enforcement Action and Related Matters, replaces the May 25, 2023 version and emphasizes escalation, tailoring, and focused corrective action. The OCC generally expects to provide a bank an opportunity to remediate deficiencies through supervision before taking an enforcement action under section 8 of the Federal Deposit Insurance Act, although it retains authority to act at any time when legally supportable.

Key dates

2026-08-27

OCC and FDIC issued the joint final rule through OCC Bulletin 2026-40. The bulletin applies to all OCC-supervised banks; it does not state the Federal Register publication date, effective date, or a firm compliance deadline.

Suggested considerations

• Firms should identify the final rule’s Federal Register publication and effective date, because the OCC bulletin itself does not state either date or a compliance deadline, and should monitor OCC and FDIC implementation guidance before relying on any transition treatment.
• Compliance teams may wish to inventory open MRAs, supervisory recommendations, enforcement matters, and examination findings and map each item to the final rule’s material-financial-risk, DIF-risk, actual-violation, or already-caused-harm criteria.
• Firms should consider separating board-level MRA remediation obligations from discretionary management responses to supervisory observations and documenting why a weakness is treated under one category rather than another.
• Risk and compliance functions may wish to enhance evidence files supporting assessments of likelihood, materiality, current and reasonably foreseeable conditions, and impacts on capital, asset quality, earnings, liquidity, and market-risk sensitivity.
• Banks should consider documenting how supervisory requirements and remediation plans are tailored to asset size, complexity, activities, capital structure, and other financial-risk factors, particularly where the institution has heightened systemic, concentration, liquidity, or operational complexity.
• Legal and compliance teams may wish to distinguish actual violations of banking or banking-related laws and regulations from prudential weaknesses, because an actual violation can support an MRA without separately satisfying the prudent-operation and material-risk test.
• Boards and senior management should consider reviewing governance procedures so that MRAs receive required escalation and tracking while supervisory observations are clearly identified as non-binding potential enhancements.
• Firms should consider preparing a process for requesting and retaining the objective facts and reasoning underlying an MRA or unsafe-and-unsound-practice determination, as the rule requires examiners to share that basis.

What changed

An unsafe or unsound practice is now defined as a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and either is likely, if continued, to materially harm the bank’s financial condition or present a material risk of loss to the Deposit Insurance Fund, or has already materially harmed the bank’s financial condition. “Likely” requires more than a merely possible risk; relevant financial-condition effects include impacts on capital, asset quality, earnings, liquidity, and sensitivity to market risk.

Key dates

2026-08-27

OCC and FDIC issued the final rule and OCC published Bulletin 2026-40 describing its application to OCC-supervised banks.

Suggested considerations

• Compliance teams may wish to map existing and anticipated MRAs, enforcement commitments, supervisory recommendations, and examination findings against the new material-financial-risk and actual-violation criteria.
• Firms should consider separating board-level corrective-action items from nonbinding supervisory observations and documenting why each issue does or does not meet the MRA threshold.
• Risk and compliance functions may wish to update issue-taxonomy and escalation procedures to assess impacts on capital, asset quality, earnings, liquidity, sensitivity to market risk, and the Deposit Insurance Fund.
• Banks should consider retaining objective evidence and documented reasoning supporting materiality assessments, including institution-specific factors such as asset size, complexity, activities, and capital structure.
• Management and boards may wish to review outstanding policies, process, and documentation findings to determine whether they remain mandatory remediation matters, are better treated as supervisory observations, or independently constitute violations of banking or banking-related law.
• OCC-supervised banks should monitor the related examination guidance and assess whether planned lookbacks, independent-consultant requirements, or suspicious-activity review scopes are affected by the revised supervisory approach described in industry reporting.
• Firms should track Federal Register publication and calculate the 60-day effective date once publication occurs; the August 27, 2026 announcement date is not itself the effective date.

What changed

An unsafe or unsound practice is now defined as a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and either, if continued, is likely to materially harm the bank’s financial condition or present a material risk of loss to the Deposit Insurance Fund, or has already materially harmed the bank’s financial condition. Relevant financial-condition impacts include capital, asset quality, earnings, liquidity, and sensitivity to market risk; reputation concerns unrelated to financial condition are excluded.

Key dates

2026-04-30

APRA issued its letter to banks, insurers and superannuation trustees calling for a step-change in governance, risk management, assurance and operational resilience for AI-related risks.

2026-05-08

ASIC issued its open letter to all licensees and market participants urging urgent strengthening of cyber resilience as frontier AI intensifies the global cyber-risk environment.

2026-06-01

ASIC and APRA began the June–July 2026 series of nine industry roundtables on frontier-AI preparedness and resilience; the source identifies June as the starting month but does not provide an exact day.

2026-07-31

ASIC and APRA completed the June–July 2026 roundtable period; the source does not provide an exact closing day.

2026-08-27

ASIC published the joint warning and related information paper and preparedness checklist, urging entities to move from awareness to action.

Suggested considerations

• Firms should consider presenting the ASIC and APRA roundtable themes, together with the available board and executive preparedness checklist, to the board and relevant risk or technology committees.
• Compliance teams may wish to map frontier-AI cyber and operational risks to existing obligations and controls under APRA CPS 230 Operational Risk Management, APRA CPS 234 Information Security, APRA CPS 220 Risk Management where applicable, and the entity's ASIC licence, governance and cyber-resilience arrangements.
• Firms should consider identifying critical assets, systems, data flows and material third-party dependencies, including common providers and concentration points that could create sector-wide disruption.
• Technology and security teams may wish to test patching, identity and privileged-access controls, attack-surface reduction, backup integrity, recovery-time priorities and incident-response playbooks against AI-accelerated attack scenarios.
• Boards and executives should consider documenting risk appetite, incident escalation authority, recovery priorities, internal and external communication strategies and decision rights before a frontier-AI-related crisis occurs.
• Firms should consider testing response and recovery arrangements under compressed timeframes and retaining evidence of exercise results, lessons learned, remediation owners and completion status.
• Entities using or procuring AI should consider applying existing model, data, supplier, change-management and assurance controls to internally developed models, vendor tools and embedded AI functionality, including defensive-AI tools used for threat intelligence, vulnerability detection, code review or incident response.
• Procurement and outsourcing functions may wish to strengthen supplier assurance, obtain relevant information on providers' AI and cyber controls, map material dependencies and assess substitutability and exit arrangements.

What changed

The regulators have consolidated a cross-sector expectation that entities address frontier-AI risk through cyber fundamentals, critical-asset identification, timely patching, strong identity and access controls, attack-surface reduction, reliable backups, tested response and recovery arrangements, and third-party risk management.

Key dates

2026-08-27

JFSA published the revision and added Question 7 to the Q&A on Financial Instruments Business.

Suggested considerations

• Firms should identify all overseas-listed ETFs distributed or made available to Japanese customers and isolate products with a single Japanese-company equity exposure and leveraged or inverse performance objectives.
• Compliance teams may wish to suspend onboarding, marketing, solicitation, and new sales of affected products pending a documented legal and compliance assessment of the revised Question 7 and any follow-up JFSA communications.
• Firms should review whether existing distribution arrangements, product lists, customer disclosures, suitability controls, and overseas-product filing processes remain defensible in light of the JFSA’s public-interest position.
• Broker-dealers should assess whether affected products can remain accessible on an execution-only basis, including the risk that continued availability could be viewed as distribution or otherwise inconsistent with the JFSA’s stated view.
• Firms should obtain product-level information on the reference asset, leverage or inverse multiple, daily reset methodology, derivatives and rebalancing arrangements, listing venue, and Japanese investor access channels.
• Market surveillance and product-governance teams may wish to evaluate whether distribution of affected products could contribute to volatility, disorderly trading, or concerns about price formation in the Japanese underlying shares.
• Senior management should document escalation, inventory decisions, customer communications, and any decision to close or restrict positions, while monitoring for amendments to the Financial Instruments and Exchange Act framework, supervisory guidelines, or additional JFSA expectations.

What changed

The JFSA added Question 7 to its Q&A on Financial Instruments Business. The revised guidance expresses the JFSA’s view that distributing overseas single-stock leveraged ETFs whose underlying assets are shares of Japanese companies is not in the public interest because the products may amplify fluctuations in the prices of the underlying shares listed on Japanese exchanges and may significantly affect price formation in Japan’s financial markets.

Key dates

2026-08-27

The Bank of England announced deferral of the entire November 2026 RTGS standards release, including CHAPS messaging standards; Swift announced the corresponding Standards Release delay on the same date.

2026-12-31

Swift has indicated that it will provide an update on the optimal timing and approach for the structured-address change by December 2026 at the latest; this is an expected communications milestone, not a confirmed implementation deadline.

Suggested considerations

• Firms should update regulatory-change inventories and project plans to record that the November 2026 RTGS and CHAPS standards release has been deferred, without assuming that the change has been cancelled.
• CHAPS and RTGS participants should obtain the BoE’s revised implementation timetable and monitor the BoE ISO 20022 implementation page, participant communications and Swift governance updates, including the expected update by December 2026 at the latest.
• Compliance and payments teams may wish to preserve completed analysis and technical preparations for structured or hybrid postal addresses, while reassessing sequencing, testing windows, release dependencies and vendor delivery dates against the revised timetable.
• Firms should distinguish the deferred BoE/CHAPS release from any other payment-system or bilateral requirements that may continue on their original schedules, and should confirm the treatment of address validation, message rejection, exception handling and operational support with relevant counterparties and vendors.
• Technology and operations teams should maintain regression-test environments and data-quality remediation plans so that implementation can resume without restarting discovery or delaying future mandatory testing.
• Firms using both CHAPS/RTGS and Swift CBPR+ should assess whether the coordinated deferral changes their customer communications, correspondent-bank testing, operational-resilience scenarios, payment-routing controls and incident-management assumptions.
• Governance committees may wish to record the deferral as a schedule and dependency change rather than as a reduction in scope, because the BoE states that the November release is deferred in its entirety and provides no indication that the underlying standards work is withdrawn.

What changed

The November 2026 RTGS standards release will not proceed as originally planned and has been deferred in its entirety rather than being split into separate changes. This includes the RTGS messaging standards applicable to CHAPS payments. The decision maintains alignment with Swift’s deferred CBPR+ release and means that the previously expected 2026-11-14 removal of fully unstructured postal addresses should not be treated as the operative BoE/Swift implementation date; Swift has indicated that it will consult market participants and provide an update by December 2026 at the latest.

Key dates

2026-07-24

The FCA conducted the Attest quantitative survey of 666 UK adults aged 18 to 40 who owned investments or were considering buying investments within 12 months.

2026-08-27

The FCA published the press release and research findings on young investors' trust in AI.

Suggested considerations

• Compliance teams may wish to map all AI use cases across investment research, recommendations, suitability, appropriateness assessments, client communications, and financial promotions, distinguishing general-purpose tools from systems specifically configured to provide financial advice.
• Firms should consider assessing whether any AI-generated output amounts to a personal recommendation, regulated advice, or a financial promotion under the Financial Services and Markets Act 2000 and the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001, rather than relying on the technology's general-purpose label.
• Firms using AI in regulated activities should consider applying the same suitability, appropriateness, customer understanding, disclosure, record-keeping, oversight, and accountability standards that apply to equivalent human-led processes.
• Customer-facing communications may warrant clear explanation that general-purpose chatbot outputs are not FCA-regulated advice and do not themselves create entitlement to FSCS compensation or access to the Financial Ombudsman Service.
• Compliance teams may wish to test AI outputs for hallucinations, stale or unsupported sources, misleading performance claims, inappropriate personalisation, bias, and inadequate risk warnings, with escalation and human-review controls for higher-risk outputs.
• Firms should consider reviewing whether AI-generated content used in promotions complies with the FCA financial promotion restriction in section 21 of the Financial Services and Markets Act 2000 and applicable FCA financial-promotion rules.
• Governance reviews may include vendor due diligence, approved-use restrictions, audit trails, model-change monitoring, incident reporting, staff training, and controls preventing customers or staff from treating AI output as a substitute for regulated advice.
• Firms may wish to monitor the FCA's expected late-2026 publication on good and poor AI practice and any subsequent FCA, HM Treasury, or industry measures addressing advice-like outputs from general-purpose AI.

What changed

No binding regulatory requirement, rule, prohibition, or implementation deadline was introduced. The FCA clarified its current supervisory position that general-purpose AI chatbots are not regulated by the FCA where they respond to varied prompts and are not specifically established to provide financial advice, research, or decision-making support. By contrast, an AI tool specifically deployed to provide financial advice would be likely to fall within the FCA's remit and could engage the existing UK regulatory framework for regulated advice and financial promotions.

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying [email protected] by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.

Key dates

2025-01-17

DORA began applying to in-scope financial entities supervised by the CSSF.

2025-12-17

The European Commission confirmed through DORA Q&A 102 that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF’s extended best-efforts deadline for the first register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2026-08-27

Circular CSSF 26/915 was published and took effect immediately; the listed CSSF circulars were amended to include or remove qualifying third-country branches as applicable.

2027-03-31 Deadline

Target date identified by CSSF for the required-quality register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2027-01-11

Relevant CRD VI third-country-branch provisions are scheduled to take effect, subject to national transposition and applicable transitional rules.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the counterfactual test in Circular 26/915: whether the head-office undertaking would qualify under Article 2(1)(a) to (t) of DORA if established in the relevant third country.
• Affected branches should update their regulatory-perimeter inventories, governance documents, ICT-risk policies, outsourcing inventories, incident-classification procedures and DORA control testing to reflect immediate inclusion in the DORA-specific CSSF circulars.
• Compliance teams may wish to separate non-ICT outsourcing, which remains subject to Part I of Circular CSSF 22/806, from ICT outsourcing, which is governed by DORA and Circular CSSF 25/882 rather than the legacy Part II framework.
• Affected entities should validate their register-of-information process under DORA and Circular CSSF 25/882, including branch-level data, ICT third-party contracts, intra-group arrangements and submission ownership. The 30 June 2026 best-efforts deadline for third-country branches of credit institutions has passed, and firms should prepare for the 31 March 2027 collection and any CSSF remediation requests.
• Incident-response teams should test access to the CSSF eDesk procedure and S3 API and document an escalation process for emailing [email protected] when technical impossibility prevents electronic submission.
• Firms should assess whether they qualify for the microenterprise exclusion in Circular CSSF 25/892; the exclusion applies to entities employing fewer than 10 persons with annual turnover and/or annual balance-sheet total not exceeding EUR 2 million, subject to the DORA definition and exclusions for specified market infrastructures.
• Third-country banking groups should coordinate DORA implementation with the CRD VI third-country-branch analysis, including the 11 January 2027 effective date for relevant CRD VI provisions, rather than assuming that the two regimes have identical scope or timing.

What changed

Qualifying third-country branches are added to the scope of Circulars CSSF 25/882, 25/892 and 25/893, covering DORA ICT third-party-service information and reporting, estimation of aggregated annual costs and losses from major ICT-related incidents under Article 11(11) of DORA and the Joint ESA Guidelines JC/GL/2024/34, and reporting of major ICT-related incidents and significant cyber threats.

Key dates

2025-01-17

DORA became applicable to financial entities within its scope, subject to the specific DORA provisions and technical standards applicable to each entity.

2025-04-09

Circular CSSF 25/881 was published and took effect, removing DORA financial entities from Circular 20/750 and retaining 20/750 for entities outside DORA; PSP-specific provisions were reorganised under Circular 25/880.

2026-06-30 Deadline

CSSF extended the first Register of Information submission for Luxembourg branches of third-country credit institutions to this date on a best-efforts basis; the CSSF indicated that the required level of quality should be achieved for the 2027 submission.

2026-08-27

Circular CSSF 26/915 was published, confirming the DORA treatment of qualifying third-country branches and removing them from the full scope of Circular 20/750 and related overlapping circular provisions.

2027-03-31 Deadline

Target date identified by the CSSF for the required-quality Register of Information submission by Luxembourg branches of third-country credit institutions.

Suggested considerations

• Firms should classify each Luxembourg entity and branch against DORA Article 2 and the amended scope of Circular 20/750, including an assessment of whether a third-country head office would qualify under DORA Article 2(1)(a) to (t).
• Compliance teams may wish to determine whether the entity should operate under DORA rather than 20/750, and document the rationale, legal-entity perimeter and treatment of any Luxembourg branch.
• Firms remaining within Circular 20/750 should consider reviewing their ICT and security-risk-management framework, governance approvals, risk assessments, incident processes, business-continuity arrangements and control testing against the continuing requirements.
• Payment service providers should consider replacing references to the PSP provisions formerly contained in Circular 20/750 with the applicable requirements in Circular CSSF 25/880 and EBA/GL/2025/02.
• Third-country branches treated as DORA entities should consider validating their DORA governance, ICT-risk framework, incident-reporting arrangements, ICT contractual inventory and Register of Information processes, taking account of CSSF reporting communications.
• Firms should update policies, regulatory inventories, outsourcing and ICT-third-party registers, training materials and regulatory mapping to distinguish DORA obligations from the residual Circular 20/750 obligations.
• Compliance teams may wish to retain evidence of the scope assessment and implementation date, because the 2025 amendment was effective immediately and the 2026 amendment changes the treatment of a previously identified 20/750 population.

What changed

Circular 25/881 provides that DORA financial entities supervised by the CSSF no longer fall within Circular 20/750; for entities covered by 20/750 but outside DORA, the circular continues to apply in full. Payment-service-provider-specific ICT and security-risk provisions were removed from 20/750 and regrouped in Circular CSSF 25/880, reflecting the revised EBA Guidelines on ICT and security risk management for payment service providers, including EBA/GL/2025/02.

Key dates

2025-01-17

DORA became applicable to in-scope financial entities, according to the CSSF implementation communication referenced by Circular CSSF 25/882.

2025-04-09

Circular CSSF 25/882 was published and applied with immediate effect.

2025-04-01 Deadline

The first exceptional CSSF register submission window opened for arrangements contracted up to 31 March 2025.

2025-04-15 Deadline

The first exceptional CSSF register submission window closed.

2026-08-27

Circular CSSF 26/915 was published and immediately amended Circular CSSF 25/882 to include qualifying third-country branches in Luxembourg.

2027-03-31 Deadline

Latest date for submission of the register covering arrangements contracted through the end of 2026, under the recurring annual window running from 28 February to 31 March of the following year.

Suggested considerations

• Firms should assess whether Luxembourg third-country branches now fall within the amended scope by comparing the branch’s undertaking and head-office activities with the DORA categories in Article 2(1)(a) to (t) and documenting the conclusion.
• Compliance teams may wish to inventory all ICT third-party arrangements, including digital, data, cloud, infrastructure and operational services that may not qualify as outsourcing under prior CSSF terminology.
• Firms should consider updating ICT third-party approval workflows so arrangements supporting critical or important functions are notified through the CSSF-prescribed form at least three months before commencement, or one month before commencement where the provider is an eligible Luxembourg support PFS.
• Firms should maintain an accurate register of information at individual, sub-consolidated and consolidated levels, with controls for prompt correction when requested by the CSSF and the ability to provide the register outside the annual submission window.
• Compliance and outsourcing teams may wish to reassess contractual access to professional-secrecy data against Article 41(2a) LFS or Article 30(2a) LPS and verify that Luxembourg ICT management or operations providers hold the required Article 29-3 LFS authorisation or qualify for an applicable exception.
• Firms using cloud services should confirm that the resource operator has designated a suitably qualified cloud officer and that internal cloud, information-security and third-party oversight responsibilities are clearly allocated.
• Third-country branches should consider implementing the requirements immediately because Circular CSSF 26/915 provides no transition period, while preserving evidence of governance, notification and register controls for supervisory review.

What changed

Circular CSSF 26/915 includes in Circular CSSF 25/882’s scope all Luxembourg third-country branches of undertakings covered by the specified DORA financial-entity categories where the head office would qualify as a DORA entity under Article 2(1)(a) to (t) in the relevant third country. The requirements apply to ICT services broadly, not only arrangements that meet a traditional outsourcing definition.

Key dates

2025-01-17

DORA began applying to financial entities within its scope, subject to the relevant provisions and transitional arrangements.

2025-04-09

Circular CSSF 25/883 was published and applied with immediate effect, amending Circular CSSF 22/806 and introducing the DORA-based division between ICT and business-process outsourcing.

2025-12-17

The European Commission confirmed through a DORA Q&A that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF-extended submission date for the 2026 DORA register of information for third-country branches of credit institutions headquartered in a third country; entities were invited to submit on a best-efforts basis.

2026-08-27

Circular CSSF 26/915 was published and applied with immediate effect, confirming the DORA treatment of qualifying Luxembourg third-country branches and updating Circular CSSF 22/806 accordingly.

2027-03-31 Deadline

Target CSSF submission deadline for the DORA register of information for affected third-country branches following the initial 2026 collection.

Suggested considerations

• Firms should classify each outsourcing arrangement as ICT or non-ICT and determine whether the entity and arrangement fall within DORA, Circular 22/806, or both regimes in their respective areas of application.
• DORA entities should consider moving ICT arrangements from their Circular 22/806 outsourcing inventory and controls into the DORA ICT third-party register, while retaining Circular 22/806 controls for business-process outsourcing.
• Non-DORA entities should consider continuing to apply the full Circular 22/806 framework to ICT and business-process outsourcing, including due diligence, governance, critical-or-important assessments, monitoring, sub-outsourcing and exit planning.
• Third-country branches should assess whether their head office would qualify under Article 2(1)(a) to (t) of DORA and, if so, align ICT governance, contractual arrangements, registers and reporting with DORA rather than relying solely on Circular 22/806.
• Compliance teams may wish to review cloud contracts and avoid carrying forward legacy EEA governing-law or hosting clauses where DORA now provides the applicable framework, while preserving enforceable audit, access, cooperation, security, business-continuity and exit rights.
• Firms should use the revised CSSF notification form for new critical or important ICT outsourcing arrangements and preserve evidence supporting the three-month notification period, or the one-month period for arrangements involving a support PSF.
• Firms should consider validating that existing ICT outsourcing notifications remain complete under the applicable DORA register-of-information requirements, even though Circular 25/883 does not require their re-submission.
• Affected third-country branches should consider submitting and maintaining the DORA register of information through the CSSF process, with the 2027 collection requiring data quality suitable for the 31 March 2027 submission deadline.

What changed

From 9 April 2025, DORA entities generally no longer apply the ICT-outsourcing provisions of Circular CSSF 22/806 to ICT arrangements; those arrangements are governed by DORA, including its ICT third-party risk-management, contractual, register-of-information and oversight requirements, together with Circular CSSF 25/882. Circular 22/806 continues to apply to business-process outsourcing by DORA entities, and continues to apply in full to non-DORA entities, including their ICT outsourcing. Chapter 16 management companies remain subject to Circular 22/806 for ICT outsourcing.

Key dates

2025-05-19

The Joint ESA Guidelines JC/GL/2024/34 apply at ESA level.

2025-05-31

Circular CSSF 25/892 applies to its original in-scope Luxembourg entities, excluding DORA microenterprises.

2026-08-27

Circular CSSF 26/915 is issued and applies with immediate effect, bringing qualifying Luxembourg third-country branches into the scope of Circular CSSF 25/892.

Suggested considerations

• Compliance teams may wish to determine whether each Luxembourg entity or third-country branch falls within the amended scope, including whether a third-country head-office undertaking would qualify under DORA Article 2(1)(a) to (t).
• Firms should consider documenting their microenterprise analysis against DORA Article 3(60), including the fewer-than-10-employees and EUR 2 million annual turnover and/or balance-sheet-total thresholds, while noting that the DORA definition excludes trading venues, central counterparties, trade repositories and central securities depositories from the microenterprise exemption.
• Firms should consider maintaining an incident-level ledger linking major ICT-related incidents, DORA final-report reference codes, gross costs, losses, provisions, recoveries and subsequent adjustments.
• Finance, operational-risk and ICT-incident teams may wish to agree whether the firm will use a completed calendar year or completed accounting year as its reference basis and establish controls to apply that basis consistently.
• Firms should consider reconciling estimates to financial-statement or supervisory-reporting data where available, while retaining documented estimation methodology and assumptions where accurate data is unavailable.
• Firms should consider tracking quantifiable financial impacts from prior-year major incidents because those impacts may need to be included in a later reference year without reopening the original final incident report.
• Third-country branches may wish to confirm reporting ownership and data availability with their head office, because the amended CSSF scope is at branch level but the required cost and loss information may arise across the undertaking.
• Compliance teams may wish to monitor CSSF communications for a specific request, reporting channel and submission deadline; the circular itself establishes an upon-request obligation rather than a fixed automatic annual filing deadline.

What changed

From 2025-05-31, in-scope Luxembourg financial entities other than DORA microenterprises must be able, upon CSSF request, to provide an entity-level estimate of aggregated annual costs and losses arising from major ICT-related incidents. The estimate must use the ESA common template and identify each relevant incident by the same reference code used in its DORA final incident report.

Key dates

2025-01-17

DORA provisions became applicable to financial entities in scope and supervised by the CSSF.

2025-05-28

Circular CSSF 25/893 was published and established the Luxembourg DORA incident and significant cyber-threat reporting modalities.

2025-11-28 Deadline

End of the six-month transition period granted to payment service providers outside DORA for implementation of the Circular 25/893 framework.

2026-08-27

Circular CSSF 26/915 was published and the 25/893 page was updated to clarify DORA applicability to qualifying third-country branches in Luxembourg; the amendment applies immediately.

Suggested considerations

• Compliance teams may wish to confirm the entity-by-entity scope analysis against DORA Article 2, including whether a Luxembourg third-country branch is covered following the 27 August 2026 clarification.
• Firms should consider documenting incident-classification criteria and decision records against Commission Delegated Regulation (EU) 2024/1772, including the quantitative thresholds for clients, transactions, duration, geographical spread, data loss, economic impact and reputational impact.
• Firms should consider testing an escalation timetable that supports classification, initial notification within four hours and no later than 24 hours after awareness, the 72-hour intermediate report and the one-month final report.
• PSPs outside DORA may wish to update policies so that all ICT-related incidents, rather than only payment-service incidents, are assessed under the DORA framework and to verify that the six-month transition requirements were completed by 28 November 2025.
• Firms should consider ensuring that eDesk access, authorised users, templates, internal approvals and S3 API connectivity are operational before an incident occurs.
• Incident-response procedures may wish to prohibit aggregation of separate major incidents where the CSSF reporting process requires event-specific submissions and should assign ownership even where reporting support is outsourced.
• Third-country branches may wish to align their Luxembourg reporting playbooks, head-office escalation arrangements and local CSSF contacts with the immediate-effect scope clarification.
• Firms should consider retaining evidence of classification, notification times, report versions, management approvals and communications with ICT third parties to demonstrate timely compliance.

What changed

DORA financial entities supervised by the CSSF must classify ICT-related incidents using the criteria and thresholds in Commission Delegated Regulation (EU) 2024/1772 and report each major ICT-related incident using the DORA reporting templates and procedures. Reporting is phased: an initial notification is generally due within four hours after classification as major and in any event no later than 24 hours after the entity becomes aware of the incident; an intermediate report is generally due within 72 hours after the initial notification; and a final report is generally due within one month...

Key dates

2022-04-22

Circular CSSF 22/806 was published and replaced or amended specified earlier CSSF and IML outsourcing, governance and control circulars.

2022-06-30

Circular CSSF 22/806 became applicable according to the CSSF implementation framework.

2025-01-17

DORA Regulation (EU) 2022/2554 became applicable to in-scope financial entities, creating the primary EU framework for ICT third-party risk management.

2025-04-09

Circular CSSF 25/883 was published; the amended Circular 22/806 applies to outsourcing arrangements entered into, reviewed or amended on or after this date.

2025-12-17

The European Commission confirmed that DORA also applies to qualifying third-country branches in an EU Member State where the third-country head-office entity would fall within DORA Article 2(1)(a) to (t).

2026-08-27

Circular CSSF 26/915 was published and the CSSF webpage consolidated the amended version of Circular 22/806, confirming the DORA treatment of qualifying Luxembourg third-country branches.

Suggested considerations

• Firms should map each outsourcing and third-party technology arrangement against the applicable regime: DORA, Circular 22/806 business-process outsourcing requirements, or the full Circular 22/806 framework for non-DORA entities.
• Compliance teams may wish to review whether Luxembourg third-country branches have a head-office activity that corresponds to a DORA Article 2(1)(a) to (t) financial entity and document the resulting DORA scope assessment.
• Firms should update outsourcing policies, risk assessments, governance approvals, materiality or criticality assessments, due-diligence files, monitoring controls and exit strategies to reflect the split between DORA ICT third-party risk management and Circular 22/806 business-process outsourcing.
• Firms should maintain or update the DORA register of information for ICT third-party arrangements where DORA applies, and reconcile it with the outsourcing inventory and CSSF notification processes.
• Firms should review legacy cloud contracts and remove reliance on the repealed Circular 22/806 EEA-law and EEA-resilience clauses where DORA is the applicable ICT third-party regime, while retaining contract terms needed to satisfy DORA and any applicable national requirements.
• Non-DORA entities should consider whether their existing contracts still address Circular 22/806 requirements for access and audit rights, sub-outsourcing, confidentiality, data location, business continuity, termination and exit.
• Management companies authorised solely under Article 125-1 should consider retaining the full Circular 22/806 control framework for ICT outsourcing rather than assuming that DORA displaces it.
• Firms should assess whether outsourcing arrangements entered into, reviewed or amended from 9 April 2025 require remediation or re-papering under the amended framework.

What changed

Circular 25/883 amended Circular 22/806 following DORA Regulation (EU) 2022/2554 becoming applicable on 17 January 2025. For entities subject to DORA, the ICT-outsourcing provisions of Circular 22/806 were largely repealed or displaced by DORA's ICT third-party risk-management requirements, while Circular 22/806 remains applicable to business-process outsourcing.

Key dates

2020-08-25

Circular CSSF 20/750 was originally published, establishing CSSF expectations for ICT and security risk management.

2025-01-17

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector became applicable to DORA-defined financial entities supervised by the CSSF.

2025-04-09

Circular CSSF 25/881 amended Circular 20/750, narrowing it primarily to non-DORA entities and moving PSP-specific requirements to Circular CSSF 25/880.

2026-08-27

Circular CSSF 26/915 was published and applies with immediate effect; DORA-equivalent third-country branches are removed from Circular 20/750 and addressed through the DORA-related CSSF framework.

Suggested considerations

• Firms with Luxembourg third-country branches should document an entity-by-entity DORA scoping analysis, including the classification of the non-EU head-office undertaking under Article 2(1)(a) to (t) of Regulation (EU) 2022/2554 and the relevance of Article 2(2).
• Affected branches should consider retiring Circular 20/750 as their primary ICT framework and mapping controls instead to DORA and the applicable CSSF circulars, including Circular CSSF 25/882 on ICT third-party services and Circular CSSF 25/893 on major ICT-related incidents and significant cyber threats.
• Firms should review ICT third-party inventories, contracts, due diligence files, exit strategies and, where relevant, the DORA Register of Information so that all ICT services are captured regardless of whether the arrangement is formally classified as outsourcing.
• Entities remaining within Circular 20/750 should consider confirming that the management body has approved the ICT and security risk-management framework and that it is reviewed at least annually.
• Remaining in-scope entities should consider refreshing their annual ICT and security risk assessment, critical-function and information-asset mapping, threat and vulnerability monitoring, access controls, patching, backup, recovery, incident-response and business-continuity documentation.
• Compliance teams may wish to verify that critical ICT systems undergo security testing at least annually, non-critical systems are tested regularly and at least every three years, and critical business continuity arrangements are tested at least annually.
• Branches and PSP-related entities should consider validating incident-reporting channels and escalation procedures, including the CSSF alternative email channel for exceptional technical failures where the prescribed DORA reporting channel cannot be used.
• Firms should consider preserving evidence of proportionality assessments, control testing, audit findings, remediation, management-body reporting and staff security training for CSSF supervisory review.

What changed

Circular 26/915 applies with immediate effect and removes DORA-equivalent third-country branches from the scope of Circular 20/750. A third-country branch is treated as DORA-relevant where, in the jurisdiction of its head office, the undertaking would qualify as an entity listed in Article 2(1)(a) to (t) of Regulation (EU) 2022/2554, subject to the applicable exclusions and Article 2(2) conditions.

Key dates

2016-01-01

The period began during which the FCA found that the investor-visa scheme operated; the exact start date is not specified in the publication.

2019-01-01

The period ended during which the FCA found that the scheme operated; the exact end date is not specified in the publication.

2021-03-12

The FCA imposed restrictions preventing Dolfin from carrying on regulated activities, following concerns including its operation of the investor-visa funding scheme.

2021-06-01

Dolfin entered special administration; the exact date in June is not specified in the publication.

2022-02-17

The Home Office closed the Tier 1 investor visa route of entry to the UK.

2026-08-26

The FCA published the enforcement announcement concerning the bans, fines and Joukovski Decision Notice.

Suggested considerations

• Compliance teams may wish to review whether any product or client arrangement could create a misleading impression that a regulatory, immigration or other statutory investment threshold has been met when the client’s own qualifying capital is materially lower.
• Firms should consider testing the end-to-end governance of immigration-linked investment business, including approval of the business model, ownership and control disclosures, conflicts management, introducer due diligence, fee flows and oversight of connected or offshore entities.
• Firms may wish to reassess source-of-funds and source-of-wealth controls where client investments are supported by loans, circular funding, guarantees or funds provided by affiliated entities, and document why the resulting structure is consistent with the relevant immigration and financial-services requirements.
• Senior managers and boards should consider whether regulatory submissions, notifications and attestations fully disclose shadow directorships, controllers, beneficial ownership, related-party involvement and the true commercial purpose of client arrangements.
• Firms should consider conducting targeted reviews of historical investor-visa or residence-by-investment clients, including communications and files supplied to regulators or other public authorities, and escalating any potentially misleading statement or omission through the appropriate remediation and notification processes.
• Training and surveillance may be reviewed to ensure staff understand that conduct outside the core regulated service, including assistance with immigration-rule circumvention, can affect the firm’s and individuals’ integrity, fitness and propriety.
• Where third-party immigration agents or introducers are used, firms may wish to assess their incentives, remuneration, representations to clients, due-diligence records and ongoing monitoring, particularly where fees are unusually high or linked to visa approval.

What changed

This is a final enforcement outcome for Nagy and Maraj, not a new generally applicable rule or supervisory requirement. Both were prohibited from performing any function in relation to regulated activities; Nagy’s discounted penalty was £324,800, compared with an undiscounted £464,000, and Maraj’s discounted penalty was £122,000, compared with an undiscounted £174,300. Joukovski was issued a Decision Notice proposing a prohibition order, but the proposed action has no effect pending the Upper Tribunal’s determination.

Key dates

2026-08-26

EBA consultation launched and consultation period opened.

2026-09-25 Deadline

Deadline to register for the EBA virtual public hearing, at 16:00 CEST.

2026-09-29

EBA virtual public hearing from 10:00 to 12:00 CEST (Paris time).

2026-12-31 Deadline

Deadline for submitting consultation responses to the EBA, at 23:59 CEST.

Suggested considerations

• Compliance and operational-risk teams should obtain and map the consultation draft against Article 323(1), points (a) to (h), of the CRR and identify requirements that would require changes to policies, committee mandates, controls or management information.
• Institutions should determine their business indicator and assess whether it is below the proposed EUR 750 million proportionality threshold, while treating that threshold as proposed rather than final.
• Firms should inventory operational-risk data sources, loss-event thresholds, taxonomies, reporting processes, validation controls and audit coverage, and assess whether data granularity is sufficient for the proposed framework.
• Management-body and senior-management responsibilities should be compared with existing governance arrangements, including the independence, authority and resourcing of the operational risk management function.
• Firms should assess alignment between the proposed RTS, CRR3 operational-risk capital and reporting implementation, the EBA Guidelines on internal governance and DORA, avoiding duplication or gaps for ICT-related risk.
• Affected stakeholders should consider submitting comments to the EBA by 31 December 2026; compliance teams may wish to coordinate responses with risk, finance, internal audit and industry associations.
• Stakeholders wishing to participate in the EBA public hearing should register by 25 September 2026 at 16:00 CEST and prepare questions on proportionality, data granularity, thresholds, reporting frequency and implementation timing.
• Institutions should monitor the EBA’s final draft, the European Commission’s endorsement process and the eventual application date before treating the consultation text as a binding requirement.

What changed

The proposed RTS would give detailed effect to Article 323(1), points (a) to (h), of the CRR by requiring three framework components: governance arrangements, an operational risk management process and an operational risk assessment system. They clarify responsibilities of the management body, senior management and the independent operational risk management function, and address operational risk data and taxonomy, the business indicator component, reporting, validation and audit. ICT risk requirements are intended to remain governed primarily by Regulation (EU) 2022/2554 (DORA).

Key dates

2026-08-26

The CFTC proposed the amendment in 91 FR 55030, RIN 3038-AF79, and opened the public-comment period.

2026-09-25 Deadline

Public comments on the proposed rule must be received by the CFTC.

Suggested considerations

• SEF compliance teams should distinguish Required Transactions from Permitted Transactions under 17 CFR 37.9 and confirm that any planned platform changes preserve Order Book and RFQ functionality for Required Transactions.
• SEFs may wish to inventory Permitted Transaction products, execution protocols, customer usage, liquidity, pre-trade transparency, surveillance dependencies, and annual Order Book operating costs before deciding whether to retain, modify, or discontinue optional Order Book functionality.
• SEFs relying on CFTC No-Action Letter No. 25-24 should assess whether their current implementation remains consistent with the proposal and should monitor the eventual final rule rather than treating the NPRM as binding law.
• SEF applicants may wish to reassess platform design and launch costs because the proposal could remove the need to build an Order Book solely for Permitted Transactions.
• Swap dealers, major swap participants, and other active SEF users should assess whether removal of an optional Order Book could affect execution practices, liquidity access, pre-trade transparency, best-execution analysis, or internal trading procedures for Permitted Transactions.
• Interested firms should consider submitting comments to CFTC docket CFTC-2026-1882, including quantified technology, staffing, infrastructure, surveillance-integration, and market-impact data, by September 25, 2026.
• Compliance teams should continue applying CEA section 2(h)(8), 17 CFR 37.9, and applicable Part 43 reporting obligations unless and until a final rule changes them.

What changed

The proposed amendment would revise 17 CFR 37.3(a)(2) so that a SEF must, at a minimum, offer an Order Book as defined in 17 CFR 37.3(a)(3) for Required Transactions as defined in 17 CFR 37.9(a)(1). It would remove the obligation to offer an Order Book for Permitted Transactions, defined in 17 CFR 37.9(c)(1) as transactions that do not involve a swap subject to the CEA section 2(h)(8) trade-execution requirement. SEFs could continue offering Order Books for Permitted Transactions voluntarily and could use any execution method permitted under 17 CFR 37.9(c)(2).

Key dates

2026-04-22

The CFPB published a final rule amending Regulation B provisions concerning special purpose credit programs, including new restrictions applicable to programs offered or participated in by for-profit organizations.

2026-07-21

The CFPB's Regulation B amendments became effective. For-profit special purpose credit programs offered or participated in on or after this date must comply with the amended requirements, including the prohibition on using race, color, national origin, or sex as a common eligibility criterion.

2026-08-25

The seven agencies rescinded the 2022 interagency statement and OCC Bulletin 2022-3, effective immediately. Creditors should no longer rely on those issuances or related guidance.

Suggested considerations

• Compliance teams may wish to inventory special purpose credit programs, marketing, eligibility criteria, underwriting policies, written plans, and monitoring practices that were developed or supported by the 2022 interagency statement, OCC Bulletin 2022-3, or related guidance.
• Firms should consider reassessing any program that uses race, color, national origin, or sex as a common eligibility criterion, particularly for credit extended on or after July 21, 2026, against 12 CFR 1002.8 as amended.
• For-profit creditors may wish to confirm that each written special purpose credit program plan contains evidence of need, explains why the relevant class would not receive credit under the organization's ordinary creditworthiness standards, and supports any eligibility characteristic used by the program.
• Compliance teams may wish to remove rescinded guidance from policies, procedures, training materials, legal inventories, product governance documents, and examiner-facing materials, while retaining records needed to explain prior program design and implementation.
• Firms should consider reviewing program communications and applicant data practices for potential discrimination or misleading reliance on the rescinded statement, including communications suggesting that protected-class distinctions are broadly authorized.
• Banks and credit unions may wish to brief fair-lending, legal, product, underwriting, marketing, and model-risk stakeholders and document the governance decision regarding whether each program should be amended, suspended, or continued under current law.

What changed

The 2022 interagency statement and OCC Bulletin 2022-3 are rescinded, effective immediately, and creditors are instructed not to rely on those issuances or related guidance. The rescission does not eliminate the statutory or regulatory framework for special purpose credit programs under ECOA and Regulation B, including 12 CFR 1002.8; rather, it clarifies that those programs remain subject to applicable fair-lending prohibitions. The agencies specifically identify the prior version of Regulation B referenced by the 2022 statement as having been amended.

Key dates

2026-08-25

EBA launched the consultation on three draft RTS.

2026-09-25 Deadline

Deadline at 16:00 CEST to register for the EBA virtual public hearing.

2026-09-30

EBA virtual public hearing scheduled from 10:00 CEST.

2026-11-25 Deadline

Deadline for submitting comments on the consultation.

Suggested considerations

• Firms should assess whether their solo and group-level asset populations capture all entities and activities covered by the CRD amendments, including the potential effect of EU branches and consolidated group assets.
• Compliance and finance teams may wish to reconcile the proposed threshold methodology against regulatory reporting, audited financial statements and internal management information, using a rolling 12-month monitoring process where relevant.
• Investment firms above EUR 5 billion should review the draft reporting templates and instructions and identify data, governance, validation and submission gaps before the RTS become applicable.
• Firms near the EUR 30 billion threshold should model the consequences of credit institution authorisation, including CRD and CRR application, supervisory engagement, capital and liquidity requirements, governance expectations and implementation timelines.
• Groups potentially affected by the group test should consider submitting comments on the geographic scope of assets, treatment of branches, consolidation methodology and any disproportionate effects on cross-border business models.
• Potentially eligible firms may wish to prepare evidence against the proposed waiver factors and engage early with their competent authority, while recognising that a waiver is discretionary and not guaranteed.
• Stakeholders wishing to participate in the EBA public hearing should register by the stated registration deadline and firms wishing to influence the final RTS should submit consultation responses by 25 November 2026.

What changed

The EBA is revising its draft RTS following the 2024 amendments to the Capital Requirements Directive, including clarifications on which entities and assets must be included in the threshold calculation at solo and group level. The package addresses the methodology for calculating total assets against the EUR 30 billion threshold, reporting requirements for investment firms whose total assets exceed EUR 5 billion under Article 55(5) of the Investment Firms Regulation, and the factors competent authorities must consider when deciding whether to grant a waiver under Article 8a(7) of the CRD.

Key dates

2016-06-01

Approximate start of the Relevant Period during which Keptain’s liquid capital was window dressed and deficiencies arose.

2018-03-31

Approximate end of the Relevant Period identified by the SFC.

2026-08-24

SFC revoked Chan’s licence and RO approval and began his 10-year prohibition on re-entering the industry.

2036-08-23

Chan’s 10-year industry ban ends.

Suggested considerations

• Firms should consider reconciling every FRR return to bank statements, cleared funds, and post-period dishonour or reversal information rather than relying solely on month-end account balances.
• Compliance teams may wish to test whether cheques, related-party funding, temporary transfers, overdrafts, unsettled receipts, and other non-cash or conditional items meet the applicable FRR eligibility and valuation requirements before inclusion in liquid capital.
• ROs and managers-in-charge should consider documenting their review and challenge of each FRR return, including explanations for material month-end movements and evidence that reported funds were genuinely available and not temporary window dressing.
• Firms should consider implementing daily or intraday escalation triggers that identify actual or foreseeable breaches of the minimum liquid-capital requirement and the 120% notification threshold.
• Where a deficiency occurs or is reasonably identified, firms should consider assessing and documenting whether notification is required under SFO section 146(1) and FRR Rule 55(1), including the one-business-day outer limit under Rule 55(1).
• Compliance teams may wish to review historical FRR returns and supporting bank evidence for similar patterns, particularly where funds were received from connected companies or were reversed shortly after reporting dates.
• Licensed corporations should consider reminding ROs that signing regulatory returns can create personal fitness-and-properness consequences, including licence revocation and a lengthy industry ban, and should ensure that responsibility cannot be reduced to a nominal or administrative role.

What changed

This is a final enforcement action rather than a change to the underlying rules. The SFC applied Rules 4 and 6 of the Securities and Futures (Financial Resources) Rules, under which Keptain was required to maintain at least HK$3 million in liquid capital at all times. The SFC found that cheques deposited at or around month-end but dishonoured before the returns were submitted should not have been included in the liquid-capital calculations; excluding them would have produced deficiencies ranging from HK$731,000 to HK$3,473,000 over 20 months.