October 2026

North America

1. OCC finalises GENIUS Act rules for payment stablecoin issuers

   OCC · 21 Oct

   The OCC's new framework sets licensing, one-for-one reserve, two-day redemption, custody and reporting standards for the stablecoin issuers it supervises. It takes effect on 18 January 2027, so existing issuers should prepare applications now; anti-money laundering rules will follow in a separate rulemaking.

2. OCC fines Bank of America a record $750m over AML failings

   OCC · 13 Oct

   The penalty, the largest the OCC has imposed, follows monitoring, escalation and suspicious activity reporting failures that persisted after a 2024 cease-and-desist order. It is credited against a $1.2bn FinCEN assessment, a clear signal that slow remediation under an existing order will be punished heavily.

3. Amex faces Fed order and $350m OCC penalty over card AML gaps

   Federal Reserve · 8 Oct

   Regulators found about $13bn of suspected trade-based money laundering went unreported for over a decade because Amex scoped its AML risk assessment around deposits rather than its card business. The bank has 90 days to submit a remediation plan; card issuers should check their risk assessments match their real product mix.

4. SEC sets 2027 exam focus on private credit, AI and Treasury clearing

   SEC · 23 Oct

   Examiners will prioritise adviser conflicts and fiduciary duty, complex and illiquid retail products, private funds and private credit, broker-dealer AML, and cyber resilience. Emerging technology, Treasury clearing and tokenisation also make the list, so firms should test their compliance plans against these themes.

5. SEC proposes crypto custody rules for advisers and funds

   SEC · 6 Oct

   The proposal would permit limited self-custody by advisers and funds, let qualifying state trust companies act as crypto custodians, and add safeguarding, cyber, audit and reporting duties. Comments close on 7 December; advisers that hold, or plan to hold, crypto for clients should assess the impact.

UK & Europe

1. EU T+1 rulebook is complete, with the first deadline on 7 December

   ESMA · 16 Oct

   ESMA's final guidelines complete the legal groundwork for EU securities to settle a day after trading, starting 11 October 2027. From 7 December, investment firms and their professional clients must exchange allocations and confirmations electronically in standard, machine-readable formats, so manual workflows need replacing now.

2. UK regulators propose scrapping the SM&CR Certification Regime

   BoE · 22 Oct

   Parallel PRA and FCA consultations would remove certification for about 139,000 staff and move several senior roles from pre-approval to notification, while chief executives, finance directors and chairs stay pre-approved. The regulators estimate savings of around £2bn over ten years; some changes need legislation.

3. PRA and FCA lift the firm-level cap on high loan-to-income mortgages

   PRA · 14 Oct

   Since 28 October, individual lenders may write more than 15% of new mortgages at 4.5 times income or above where their risk appetite and governance support it. The 15% limit still applies across the market, so lenders may be asked to scale back if aggregate lending overshoots.

4. AMLA sends its first technical standards for the EU AML rulebook

   CSSF · 7 Oct

   Draft standards on customer due diligence, business relationships and group-wide controls have gone to the European Commission, adding operational detail to the AML Regulation that applies from July 2027. Firms should begin gap analysis now, as AMLA proposes only six months' transition once the standards are final.

5. Central Bank of Ireland fines Coinbase €3.3m over safeguarding failures

   CBI · 22 Oct

   Coinbase Ireland leaned too heavily on its US group for outsourced safeguarding, lacked local expertise, and at times left its customer funds account short between 2020 and 2025. E-money and crypto firms relying on group outsourcing should be able to evidence local oversight; the fine awaits High Court confirmation.

Asia-Pacific, Middle East & Africa

1. Hong Kong's revised retail fund code takes effect

   SFC · 28 Oct

   From 1 November, SFC-authorised funds may measure derivative exposure using value-at-risk, and face stronger liquidity tools, anti-dilution expectations and money market fund safeguards. New funds must comply immediately, while most existing funds have until 31 October 2027 to transition.

2. SFC suspends Baicha shares and freezes assets over suspected IPO rigging

   SFC · 13 Oct

   The SFC suspects syndicates manufactured demand in several Hong Kong listings and has served restriction notices on brokers covering up to HK$4.7bn of assets. Brokers and sponsors should review placee networks, connected-party funding and how IPO proceeds are used after listing.

3. Hollard pays A$2m in the first utmost good faith penalty against an insurer

   ASIC · 9 Oct

   The Federal Court penalised Hollard after a 15-month claim delay left a storm-damaged family home uninhabitable and ultimately a total loss. It is the first civil penalty against an insurer for breaching this duty, so claims teams should review open property claims for long periods of inaction.

4. MAS issues AI risk management guidelines for all financial institutions

   MAS · 7 Oct

   The guidelines cover every type of AI, including generative and agentic systems, and expect board accountability, AI inventories, materiality assessments, lifecycle controls and assurance over third-party models. Most expectations apply from 7 October 2027, with the remainder by October 2028.

5. DFSA fines Moody's Middle East unit $586k over confidential data leaks

   DFSA · 28 Oct

   Seven inadvertent disclosures between December 2023 and May 2026, four of them to outside recipients, followed the withdrawal of a data-security tool with no replacement in place. Rating agencies and other firms holding confidential client data should keep controls running through any change of tooling.

Global standard-setters

1. Basel Committee curbs G-SIB window dressing with year-average reporting

   BIS · 16 Oct

   Banks in the G-SIB assessment must report and disclose indicators as averages across the year, rather than year-end snapshots, by 2030, and the reporting threshold rises to EUR 350bn from 2027. A consultation on EU banking union cross-border exposures runs until 14 January 2027.

2. FSB finalises 12 sound practices for responsible AI adoption

   FSB · 15 Oct

   The non-binding practices cover board oversight, materiality, data, explainability, human oversight, cyber and third-party AI risk, with tougher expectations for autonomous agentic systems. Supervisors are likely to treat them as a benchmark, so firms should map their AI governance against them.

Deadlines in the next 60 days

All upcoming deadlines →