Asset Managers Regulatory Updates

Key dates

2025-01-01

Beginning of the general period identified by the SEC during which the charged entities allegedly filed Forms ADV containing material misrepresentations; the publication does not specify an exact start date.

2026-08-27

The SEC announced the charges, disclosed the requested remedies, stated that the 38 ERA filings had been removed from its website, and referenced its related investor alert.

Suggested considerations

• Compliance teams may wish to perform a documented, line-by-line validation of Form ADV Part 1 and applicable Form ADV Part 2 disclosures, including business addresses, telephone numbers, websites, ownership, control persons, regulatory status, assets, private funds, clients, and service providers.
• Firms should consider retaining contemporaneous evidence supporting material Form ADV representations, such as lease or office records, corporate and ownership documents, fund records, audited financial statements, auditor engagement evidence, and records supporting reported assets and advisory activities.
• ERA and registered adviser compliance programs may wish to establish independent verification of counterparties' SEC registration or ERA status through the Investment Adviser Public Disclosure system and should avoid treating an SEC filing, certificate, or website badge as conclusive proof of legitimacy.
• Firms that market investment advice to individuals should consider reviewing whether their regulatory status, Form ADV disclosures, and marketing materials accurately describe whether they are registered, exempt reporting, or otherwise authorized to provide services to retail investors.
• Compliance teams may wish to investigate repeated or highly similar ownership structures, numerical disclosures, addresses, telephone numbers, websites, auditor names, or filing patterns across related advisers as potential indicators of coordinated fraudulent filings.
• Firms should consider escalating unanswered SEC requests for records and preserving relevant books, records, communications, websites, and filing-support materials, because the SEC expressly relied on alleged failures to substantiate Form ADV information.
• Private fund sponsors and allocators may wish to verify that purported fund audits were performed by identifiable independent public accounting firms with appropriate federal or state registration or licensing, rather than relying solely on statements in Form ADV.
• Financial-crime and onboarding teams may wish to incorporate the SEC's PAUSE list, investor alerts, foreign-jurisdiction indicators, website authentication checks, and independent corporate-registration checks into risk-based due diligence for purported U.S. advisers.

What changed

This publication announces enforcement complaints rather than a new rule or generally applicable filing requirement. The SEC alleges violations of Section 204(a) of the Investment Advisers Act of 1940, which governs adviser records and reports including Form ADV, and Section 207, which prohibits untrue statements or omissions in applications and reports filed under the Act. The SEC seeks permanent injunctions, conduct-based injunctions preventing the defendants from filing Forms ADV as exempt reporting advisers, and civil penalties.

Key dates

2026-04-30

APRA issued its letter to banks, insurers and superannuation trustees calling for a step-change in governance, risk management, assurance and operational resilience for AI-related risks.

2026-05-08

ASIC issued its open letter to all licensees and market participants urging urgent strengthening of cyber resilience as frontier AI intensifies the global cyber-risk environment.

2026-06-01

ASIC and APRA began the June–July 2026 series of nine industry roundtables on frontier-AI preparedness and resilience; the source identifies June as the starting month but does not provide an exact day.

2026-07-31

ASIC and APRA completed the June–July 2026 roundtable period; the source does not provide an exact closing day.

2026-08-27

ASIC published the joint warning and related information paper and preparedness checklist, urging entities to move from awareness to action.

Suggested considerations

• Firms should consider presenting the ASIC and APRA roundtable themes, together with the available board and executive preparedness checklist, to the board and relevant risk or technology committees.
• Compliance teams may wish to map frontier-AI cyber and operational risks to existing obligations and controls under APRA CPS 230 Operational Risk Management, APRA CPS 234 Information Security, APRA CPS 220 Risk Management where applicable, and the entity's ASIC licence, governance and cyber-resilience arrangements.
• Firms should consider identifying critical assets, systems, data flows and material third-party dependencies, including common providers and concentration points that could create sector-wide disruption.
• Technology and security teams may wish to test patching, identity and privileged-access controls, attack-surface reduction, backup integrity, recovery-time priorities and incident-response playbooks against AI-accelerated attack scenarios.
• Boards and executives should consider documenting risk appetite, incident escalation authority, recovery priorities, internal and external communication strategies and decision rights before a frontier-AI-related crisis occurs.
• Firms should consider testing response and recovery arrangements under compressed timeframes and retaining evidence of exercise results, lessons learned, remediation owners and completion status.
• Entities using or procuring AI should consider applying existing model, data, supplier, change-management and assurance controls to internally developed models, vendor tools and embedded AI functionality, including defensive-AI tools used for threat intelligence, vulnerability detection, code review or incident response.
• Procurement and outsourcing functions may wish to strengthen supplier assurance, obtain relevant information on providers' AI and cyber controls, map material dependencies and assess substitutability and exit arrangements.

What changed

The regulators have consolidated a cross-sector expectation that entities address frontier-AI risk through cyber fundamentals, critical-asset identification, timely patching, strong identity and access controls, attack-surface reduction, reliable backups, tested response and recovery arrangements, and third-party risk management.

Key dates

2026-08-27

JFSA published the revision and added Question 7 to the Q&A on Financial Instruments Business.

Suggested considerations

• Firms should identify all overseas-listed ETFs distributed or made available to Japanese customers and isolate products with a single Japanese-company equity exposure and leveraged or inverse performance objectives.
• Compliance teams may wish to suspend onboarding, marketing, solicitation, and new sales of affected products pending a documented legal and compliance assessment of the revised Question 7 and any follow-up JFSA communications.
• Firms should review whether existing distribution arrangements, product lists, customer disclosures, suitability controls, and overseas-product filing processes remain defensible in light of the JFSA’s public-interest position.
• Broker-dealers should assess whether affected products can remain accessible on an execution-only basis, including the risk that continued availability could be viewed as distribution or otherwise inconsistent with the JFSA’s stated view.
• Firms should obtain product-level information on the reference asset, leverage or inverse multiple, daily reset methodology, derivatives and rebalancing arrangements, listing venue, and Japanese investor access channels.
• Market surveillance and product-governance teams may wish to evaluate whether distribution of affected products could contribute to volatility, disorderly trading, or concerns about price formation in the Japanese underlying shares.
• Senior management should document escalation, inventory decisions, customer communications, and any decision to close or restrict positions, while monitoring for amendments to the Financial Instruments and Exchange Act framework, supervisory guidelines, or additional JFSA expectations.

What changed

The JFSA added Question 7 to its Q&A on Financial Instruments Business. The revised guidance expresses the JFSA’s view that distributing overseas single-stock leveraged ETFs whose underlying assets are shares of Japanese companies is not in the public interest because the products may amplify fluctuations in the prices of the underlying shares listed on Japanese exchanges and may significantly affect price formation in Japan’s financial markets.

Key dates

2026-07-24

The FCA conducted the Attest quantitative survey of 666 UK adults aged 18 to 40 who owned investments or were considering buying investments within 12 months.

2026-08-27

The FCA published the press release and research findings on young investors' trust in AI.

Suggested considerations

• Compliance teams may wish to map all AI use cases across investment research, recommendations, suitability, appropriateness assessments, client communications, and financial promotions, distinguishing general-purpose tools from systems specifically configured to provide financial advice.
• Firms should consider assessing whether any AI-generated output amounts to a personal recommendation, regulated advice, or a financial promotion under the Financial Services and Markets Act 2000 and the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001, rather than relying on the technology's general-purpose label.
• Firms using AI in regulated activities should consider applying the same suitability, appropriateness, customer understanding, disclosure, record-keeping, oversight, and accountability standards that apply to equivalent human-led processes.
• Customer-facing communications may warrant clear explanation that general-purpose chatbot outputs are not FCA-regulated advice and do not themselves create entitlement to FSCS compensation or access to the Financial Ombudsman Service.
• Compliance teams may wish to test AI outputs for hallucinations, stale or unsupported sources, misleading performance claims, inappropriate personalisation, bias, and inadequate risk warnings, with escalation and human-review controls for higher-risk outputs.
• Firms should consider reviewing whether AI-generated content used in promotions complies with the FCA financial promotion restriction in section 21 of the Financial Services and Markets Act 2000 and applicable FCA financial-promotion rules.
• Governance reviews may include vendor due diligence, approved-use restrictions, audit trails, model-change monitoring, incident reporting, staff training, and controls preventing customers or staff from treating AI output as a substitute for regulated advice.
• Firms may wish to monitor the FCA's expected late-2026 publication on good and poor AI practice and any subsequent FCA, HM Treasury, or industry measures addressing advice-like outputs from general-purpose AI.

What changed

No binding regulatory requirement, rule, prohibition, or implementation deadline was introduced. The FCA clarified its current supervisory position that general-purpose AI chatbots are not regulated by the FCA where they respond to varied prompts and are not specifically established to provide financial advice, research, or decision-making support. By contrast, an AI tool specifically deployed to provide financial advice would be likely to fall within the FCA's remit and could engage the existing UK regulatory framework for regulated advice and financial promotions.

Key dates

2025-01-17

DORA became applicable to in-scope financial entities, according to the CSSF implementation communication referenced by Circular CSSF 25/882.

2025-04-09

Circular CSSF 25/882 was published and applied with immediate effect.

2025-04-01 Deadline

The first exceptional CSSF register submission window opened for arrangements contracted up to 31 March 2025.

2025-04-15 Deadline

The first exceptional CSSF register submission window closed.

2026-08-27

Circular CSSF 26/915 was published and immediately amended Circular CSSF 25/882 to include qualifying third-country branches in Luxembourg.

2027-03-31 Deadline

Latest date for submission of the register covering arrangements contracted through the end of 2026, under the recurring annual window running from 28 February to 31 March of the following year.

Suggested considerations

• Firms should assess whether Luxembourg third-country branches now fall within the amended scope by comparing the branch’s undertaking and head-office activities with the DORA categories in Article 2(1)(a) to (t) and documenting the conclusion.
• Compliance teams may wish to inventory all ICT third-party arrangements, including digital, data, cloud, infrastructure and operational services that may not qualify as outsourcing under prior CSSF terminology.
• Firms should consider updating ICT third-party approval workflows so arrangements supporting critical or important functions are notified through the CSSF-prescribed form at least three months before commencement, or one month before commencement where the provider is an eligible Luxembourg support PFS.
• Firms should maintain an accurate register of information at individual, sub-consolidated and consolidated levels, with controls for prompt correction when requested by the CSSF and the ability to provide the register outside the annual submission window.
• Compliance and outsourcing teams may wish to reassess contractual access to professional-secrecy data against Article 41(2a) LFS or Article 30(2a) LPS and verify that Luxembourg ICT management or operations providers hold the required Article 29-3 LFS authorisation or qualify for an applicable exception.
• Firms using cloud services should confirm that the resource operator has designated a suitably qualified cloud officer and that internal cloud, information-security and third-party oversight responsibilities are clearly allocated.
• Third-country branches should consider implementing the requirements immediately because Circular CSSF 26/915 provides no transition period, while preserving evidence of governance, notification and register controls for supervisory review.

What changed

Circular CSSF 26/915 includes in Circular CSSF 25/882’s scope all Luxembourg third-country branches of undertakings covered by the specified DORA financial-entity categories where the head office would qualify as a DORA entity under Article 2(1)(a) to (t) in the relevant third country. The requirements apply to ICT services broadly, not only arrangements that meet a traditional outsourcing definition.

Key dates

2025-01-17

DORA began applying to financial entities within its scope, subject to the relevant provisions and transitional arrangements.

2025-04-09

Circular CSSF 25/883 was published and applied with immediate effect, amending Circular CSSF 22/806 and introducing the DORA-based division between ICT and business-process outsourcing.

2025-12-17

The European Commission confirmed through a DORA Q&A that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF-extended submission date for the 2026 DORA register of information for third-country branches of credit institutions headquartered in a third country; entities were invited to submit on a best-efforts basis.

2026-08-27

Circular CSSF 26/915 was published and applied with immediate effect, confirming the DORA treatment of qualifying Luxembourg third-country branches and updating Circular CSSF 22/806 accordingly.

2027-03-31 Deadline

Target CSSF submission deadline for the DORA register of information for affected third-country branches following the initial 2026 collection.

Suggested considerations

• Firms should classify each outsourcing arrangement as ICT or non-ICT and determine whether the entity and arrangement fall within DORA, Circular 22/806, or both regimes in their respective areas of application.
• DORA entities should consider moving ICT arrangements from their Circular 22/806 outsourcing inventory and controls into the DORA ICT third-party register, while retaining Circular 22/806 controls for business-process outsourcing.
• Non-DORA entities should consider continuing to apply the full Circular 22/806 framework to ICT and business-process outsourcing, including due diligence, governance, critical-or-important assessments, monitoring, sub-outsourcing and exit planning.
• Third-country branches should assess whether their head office would qualify under Article 2(1)(a) to (t) of DORA and, if so, align ICT governance, contractual arrangements, registers and reporting with DORA rather than relying solely on Circular 22/806.
• Compliance teams may wish to review cloud contracts and avoid carrying forward legacy EEA governing-law or hosting clauses where DORA now provides the applicable framework, while preserving enforceable audit, access, cooperation, security, business-continuity and exit rights.
• Firms should use the revised CSSF notification form for new critical or important ICT outsourcing arrangements and preserve evidence supporting the three-month notification period, or the one-month period for arrangements involving a support PSF.
• Firms should consider validating that existing ICT outsourcing notifications remain complete under the applicable DORA register-of-information requirements, even though Circular 25/883 does not require their re-submission.
• Affected third-country branches should consider submitting and maintaining the DORA register of information through the CSSF process, with the 2027 collection requiring data quality suitable for the 31 March 2027 submission deadline.

What changed

From 9 April 2025, DORA entities generally no longer apply the ICT-outsourcing provisions of Circular CSSF 22/806 to ICT arrangements; those arrangements are governed by DORA, including its ICT third-party risk-management, contractual, register-of-information and oversight requirements, together with Circular CSSF 25/882. Circular 22/806 continues to apply to business-process outsourcing by DORA entities, and continues to apply in full to non-DORA entities, including their ICT outsourcing. Chapter 16 management companies remain subject to Circular 22/806 for ICT outsourcing.

Key dates

2025-05-19

The Joint ESA Guidelines JC/GL/2024/34 apply at ESA level.

2025-05-31

Circular CSSF 25/892 applies to its original in-scope Luxembourg entities, excluding DORA microenterprises.

2026-08-27

Circular CSSF 26/915 is issued and applies with immediate effect, bringing qualifying Luxembourg third-country branches into the scope of Circular CSSF 25/892.

Suggested considerations

• Compliance teams may wish to determine whether each Luxembourg entity or third-country branch falls within the amended scope, including whether a third-country head-office undertaking would qualify under DORA Article 2(1)(a) to (t).
• Firms should consider documenting their microenterprise analysis against DORA Article 3(60), including the fewer-than-10-employees and EUR 2 million annual turnover and/or balance-sheet-total thresholds, while noting that the DORA definition excludes trading venues, central counterparties, trade repositories and central securities depositories from the microenterprise exemption.
• Firms should consider maintaining an incident-level ledger linking major ICT-related incidents, DORA final-report reference codes, gross costs, losses, provisions, recoveries and subsequent adjustments.
• Finance, operational-risk and ICT-incident teams may wish to agree whether the firm will use a completed calendar year or completed accounting year as its reference basis and establish controls to apply that basis consistently.
• Firms should consider reconciling estimates to financial-statement or supervisory-reporting data where available, while retaining documented estimation methodology and assumptions where accurate data is unavailable.
• Firms should consider tracking quantifiable financial impacts from prior-year major incidents because those impacts may need to be included in a later reference year without reopening the original final incident report.
• Third-country branches may wish to confirm reporting ownership and data availability with their head office, because the amended CSSF scope is at branch level but the required cost and loss information may arise across the undertaking.
• Compliance teams may wish to monitor CSSF communications for a specific request, reporting channel and submission deadline; the circular itself establishes an upon-request obligation rather than a fixed automatic annual filing deadline.

What changed

From 2025-05-31, in-scope Luxembourg financial entities other than DORA microenterprises must be able, upon CSSF request, to provide an entity-level estimate of aggregated annual costs and losses arising from major ICT-related incidents. The estimate must use the ESA common template and identify each relevant incident by the same reference code used in its DORA final incident report.

Key dates

2025-01-17

DORA provisions became applicable to financial entities in scope and supervised by the CSSF.

2025-05-28

Circular CSSF 25/893 was published and established the Luxembourg DORA incident and significant cyber-threat reporting modalities.

2025-11-28 Deadline

End of the six-month transition period granted to payment service providers outside DORA for implementation of the Circular 25/893 framework.

2026-08-27

Circular CSSF 26/915 was published and the 25/893 page was updated to clarify DORA applicability to qualifying third-country branches in Luxembourg; the amendment applies immediately.

Suggested considerations

• Compliance teams may wish to confirm the entity-by-entity scope analysis against DORA Article 2, including whether a Luxembourg third-country branch is covered following the 27 August 2026 clarification.
• Firms should consider documenting incident-classification criteria and decision records against Commission Delegated Regulation (EU) 2024/1772, including the quantitative thresholds for clients, transactions, duration, geographical spread, data loss, economic impact and reputational impact.
• Firms should consider testing an escalation timetable that supports classification, initial notification within four hours and no later than 24 hours after awareness, the 72-hour intermediate report and the one-month final report.
• PSPs outside DORA may wish to update policies so that all ICT-related incidents, rather than only payment-service incidents, are assessed under the DORA framework and to verify that the six-month transition requirements were completed by 28 November 2025.
• Firms should consider ensuring that eDesk access, authorised users, templates, internal approvals and S3 API connectivity are operational before an incident occurs.
• Incident-response procedures may wish to prohibit aggregation of separate major incidents where the CSSF reporting process requires event-specific submissions and should assign ownership even where reporting support is outsourced.
• Third-country branches may wish to align their Luxembourg reporting playbooks, head-office escalation arrangements and local CSSF contacts with the immediate-effect scope clarification.
• Firms should consider retaining evidence of classification, notification times, report versions, management approvals and communications with ICT third parties to demonstrate timely compliance.

What changed

DORA financial entities supervised by the CSSF must classify ICT-related incidents using the criteria and thresholds in Commission Delegated Regulation (EU) 2024/1772 and report each major ICT-related incident using the DORA reporting templates and procedures. Reporting is phased: an initial notification is generally due within four hours after classification as major and in any event no later than 24 hours after the entity becomes aware of the incident; an intermediate report is generally due within 72 hours after the initial notification; and a final report is generally due within one month...

Key dates

2022-04-22

Circular CSSF 22/806 was published and replaced or amended specified earlier CSSF and IML outsourcing, governance and control circulars.

2022-06-30

Circular CSSF 22/806 became applicable according to the CSSF implementation framework.

2025-01-17

DORA Regulation (EU) 2022/2554 became applicable to in-scope financial entities, creating the primary EU framework for ICT third-party risk management.

2025-04-09

Circular CSSF 25/883 was published; the amended Circular 22/806 applies to outsourcing arrangements entered into, reviewed or amended on or after this date.

2025-12-17

The European Commission confirmed that DORA also applies to qualifying third-country branches in an EU Member State where the third-country head-office entity would fall within DORA Article 2(1)(a) to (t).

2026-08-27

Circular CSSF 26/915 was published and the CSSF webpage consolidated the amended version of Circular 22/806, confirming the DORA treatment of qualifying Luxembourg third-country branches.

Suggested considerations

• Firms should map each outsourcing and third-party technology arrangement against the applicable regime: DORA, Circular 22/806 business-process outsourcing requirements, or the full Circular 22/806 framework for non-DORA entities.
• Compliance teams may wish to review whether Luxembourg third-country branches have a head-office activity that corresponds to a DORA Article 2(1)(a) to (t) financial entity and document the resulting DORA scope assessment.
• Firms should update outsourcing policies, risk assessments, governance approvals, materiality or criticality assessments, due-diligence files, monitoring controls and exit strategies to reflect the split between DORA ICT third-party risk management and Circular 22/806 business-process outsourcing.
• Firms should maintain or update the DORA register of information for ICT third-party arrangements where DORA applies, and reconcile it with the outsourcing inventory and CSSF notification processes.
• Firms should review legacy cloud contracts and remove reliance on the repealed Circular 22/806 EEA-law and EEA-resilience clauses where DORA is the applicable ICT third-party regime, while retaining contract terms needed to satisfy DORA and any applicable national requirements.
• Non-DORA entities should consider whether their existing contracts still address Circular 22/806 requirements for access and audit rights, sub-outsourcing, confidentiality, data location, business continuity, termination and exit.
• Management companies authorised solely under Article 125-1 should consider retaining the full Circular 22/806 control framework for ICT outsourcing rather than assuming that DORA displaces it.
• Firms should assess whether outsourcing arrangements entered into, reviewed or amended from 9 April 2025 require remediation or re-papering under the amended framework.

What changed

Circular 25/883 amended Circular 22/806 following DORA Regulation (EU) 2022/2554 becoming applicable on 17 January 2025. For entities subject to DORA, the ICT-outsourcing provisions of Circular 22/806 were largely repealed or displaced by DORA's ICT third-party risk-management requirements, while Circular 22/806 remains applicable to business-process outsourcing.

Key dates

2016-01-01

The period began during which the FCA found that the investor-visa scheme operated; the exact start date is not specified in the publication.

2019-01-01

The period ended during which the FCA found that the scheme operated; the exact end date is not specified in the publication.

2021-03-12

The FCA imposed restrictions preventing Dolfin from carrying on regulated activities, following concerns including its operation of the investor-visa funding scheme.

2021-06-01

Dolfin entered special administration; the exact date in June is not specified in the publication.

2022-02-17

The Home Office closed the Tier 1 investor visa route of entry to the UK.

2026-08-26

The FCA published the enforcement announcement concerning the bans, fines and Joukovski Decision Notice.

Suggested considerations

• Compliance teams may wish to review whether any product or client arrangement could create a misleading impression that a regulatory, immigration or other statutory investment threshold has been met when the client’s own qualifying capital is materially lower.
• Firms should consider testing the end-to-end governance of immigration-linked investment business, including approval of the business model, ownership and control disclosures, conflicts management, introducer due diligence, fee flows and oversight of connected or offshore entities.
• Firms may wish to reassess source-of-funds and source-of-wealth controls where client investments are supported by loans, circular funding, guarantees or funds provided by affiliated entities, and document why the resulting structure is consistent with the relevant immigration and financial-services requirements.
• Senior managers and boards should consider whether regulatory submissions, notifications and attestations fully disclose shadow directorships, controllers, beneficial ownership, related-party involvement and the true commercial purpose of client arrangements.
• Firms should consider conducting targeted reviews of historical investor-visa or residence-by-investment clients, including communications and files supplied to regulators or other public authorities, and escalating any potentially misleading statement or omission through the appropriate remediation and notification processes.
• Training and surveillance may be reviewed to ensure staff understand that conduct outside the core regulated service, including assistance with immigration-rule circumvention, can affect the firm’s and individuals’ integrity, fitness and propriety.
• Where third-party immigration agents or introducers are used, firms may wish to assess their incentives, remuneration, representations to clients, due-diligence records and ongoing monitoring, particularly where fees are unusually high or linked to visa approval.

What changed

This is a final enforcement outcome for Nagy and Maraj, not a new generally applicable rule or supervisory requirement. Both were prohibited from performing any function in relation to regulated activities; Nagy’s discounted penalty was £324,800, compared with an undiscounted £464,000, and Maraj’s discounted penalty was £122,000, compared with an undiscounted £174,300. Joukovski was issued a Decision Notice proposing a prohibition order, but the proposed action has no effect pending the Upper Tribunal’s determination.

Key dates

2026-08-25

EBA launched the consultation on three draft RTS.

2026-09-25 Deadline

Deadline at 16:00 CEST to register for the EBA virtual public hearing.

2026-09-30

EBA virtual public hearing scheduled from 10:00 CEST.

2026-11-25 Deadline

Deadline for submitting comments on the consultation.

Suggested considerations

• Firms should assess whether their solo and group-level asset populations capture all entities and activities covered by the CRD amendments, including the potential effect of EU branches and consolidated group assets.
• Compliance and finance teams may wish to reconcile the proposed threshold methodology against regulatory reporting, audited financial statements and internal management information, using a rolling 12-month monitoring process where relevant.
• Investment firms above EUR 5 billion should review the draft reporting templates and instructions and identify data, governance, validation and submission gaps before the RTS become applicable.
• Firms near the EUR 30 billion threshold should model the consequences of credit institution authorisation, including CRD and CRR application, supervisory engagement, capital and liquidity requirements, governance expectations and implementation timelines.
• Groups potentially affected by the group test should consider submitting comments on the geographic scope of assets, treatment of branches, consolidation methodology and any disproportionate effects on cross-border business models.
• Potentially eligible firms may wish to prepare evidence against the proposed waiver factors and engage early with their competent authority, while recognising that a waiver is discretionary and not guaranteed.
• Stakeholders wishing to participate in the EBA public hearing should register by the stated registration deadline and firms wishing to influence the final RTS should submit consultation responses by 25 November 2026.

What changed

The EBA is revising its draft RTS following the 2024 amendments to the Capital Requirements Directive, including clarifications on which entities and assets must be included in the threshold calculation at solo and group level. The package addresses the methodology for calculating total assets against the EUR 30 billion threshold, reporting requirements for investment firms whose total assets exceed EUR 5 billion under Article 55(5) of the Investment Firms Regulation, and the factors competent authorities must consider when deciding whether to grant a waiver under Article 8a(7) of the CRD.

Key dates

2016-06-01

Approximate start of the Relevant Period during which Keptain’s liquid capital was window dressed and deficiencies arose.

2018-03-31

Approximate end of the Relevant Period identified by the SFC.

2026-08-24

SFC revoked Chan’s licence and RO approval and began his 10-year prohibition on re-entering the industry.

2036-08-23

Chan’s 10-year industry ban ends.

Suggested considerations

• Firms should consider reconciling every FRR return to bank statements, cleared funds, and post-period dishonour or reversal information rather than relying solely on month-end account balances.
• Compliance teams may wish to test whether cheques, related-party funding, temporary transfers, overdrafts, unsettled receipts, and other non-cash or conditional items meet the applicable FRR eligibility and valuation requirements before inclusion in liquid capital.
• ROs and managers-in-charge should consider documenting their review and challenge of each FRR return, including explanations for material month-end movements and evidence that reported funds were genuinely available and not temporary window dressing.
• Firms should consider implementing daily or intraday escalation triggers that identify actual or foreseeable breaches of the minimum liquid-capital requirement and the 120% notification threshold.
• Where a deficiency occurs or is reasonably identified, firms should consider assessing and documenting whether notification is required under SFO section 146(1) and FRR Rule 55(1), including the one-business-day outer limit under Rule 55(1).
• Compliance teams may wish to review historical FRR returns and supporting bank evidence for similar patterns, particularly where funds were received from connected companies or were reversed shortly after reporting dates.
• Licensed corporations should consider reminding ROs that signing regulatory returns can create personal fitness-and-properness consequences, including licence revocation and a lengthy industry ban, and should ensure that responsibility cannot be reduced to a nominal or administrative role.

What changed

This is a final enforcement action rather than a change to the underlying rules. The SFC applied Rules 4 and 6 of the Securities and Futures (Financial Resources) Rules, under which Keptain was required to maintain at least HK$3 million in liquid capital at all times. The SFC found that cheques deposited at or around month-end but dishonoured before the returns were submitted should not have been included in the liquid-capital calculations; excluding them would have produced deficiencies ranging from HK$731,000 to HK$3,473,000 over 20 months.

Key dates

2021-09-01

ASIC's investigation into Edwards and associated entities commenced; the publication gives only September 2021 and does not specify a day.

2022-12-13

ASIC executed search warrants at Edwards's business premises and seized materials.

2025-01-22

The remaining court proceeding brought by Edwards that had delayed ASIC's review of seized materials was dismissed by consent.

2025-09-12

ASIC banned Edwards for 10 years under sections 920A and 920B of the Corporations Act 2001 from providing financial services, controlling an entity carrying on a financial services business, or performing functions involved in such a business.

2026-03-25

ASIC commenced NSW Supreme Court winding-up proceedings against the 12 companies and sought appointment of provisional liquidators.

2026-05-28

ASIC's disqualification of Edwards as a self-managed superannuation fund auditor took effect.

2026-08-19

ASIC's interlocutory application for appointment of provisional liquidators was heard before Justice Nixon.

2026-08-21

The NSW Supreme Court appointed Kathryn Evans and Vaughan Strawbridge of FTI Consulting as provisional liquidators of the 12 companies.

Suggested considerations

• Firms with exposure to the 12 companies should consider reviewing receivables, investments, security interests, guarantees, trust relationships and outstanding transactions, and preserving relevant records for engagement with the provisional liquidators.
• Investor-facing firms should consider identifying clients or funds exposed to the companies, suspending any further investor subscriptions or transfers involving the affected entities where legally and operationally appropriate, and assessing communications and complaint-handling requirements.
• Financial services licensees and professional firms that dealt with Edwards or the companies should consider checking the scope of their engagements, referral arrangements, client-money or custody controls, representations made to investors, and potential conflicts or undisclosed related-party transactions.
• Compliance teams may wish to verify that no person acting for the affected companies is relying on Edwards to provide financial services, control a financial services business or perform a function involved in carrying on such a business, given the 10-year prohibition under sections 920A and 920B of the Corporations Act 2001.
• Relevant firms should consider monitoring the NSW Supreme Court proceeding and the provisional liquidators' creditor and investor information portal ahead of the 2 November 2026 directions hearing.
• Persons holding potentially relevant information may wish to consider providing it to ASIC at [email protected] and preserving documents relevant to the ongoing investigation.

What changed

The directors of the 12 companies no longer control their affairs to the extent provided by the Court's orders; the provisional liquidators are responsible for investigating and reporting on the companies' assets, liabilities, asset recoverability, solvency, likely creditor returns, suspected contraventions of the Corporations Act 2001 or ASIC Act 2001, and transactions requiring further investigation.

Key dates

2025-07-01

During July 2025, Companisto offered the relevant profit participation certificate to retail investors for subscription without having first published the KID. The source identifies the month but not a specific day.

2026-07-30

BaFin imposed the €9,000 administrative fine on Companisto Trust Service XXXV UG for a supervisory-duty breach connected with the Article 5(1) PRIIPs violation.

2026-08-20

BaFin published the English enforcement notice concerning the fine.

2026-08-21

The BaFin publication was updated and displayed the publication date of 21 August 2026.

Suggested considerations

• Firms should inventory products offered to retail investors and identify instruments that may constitute PRIIPs, including profit participation certificates and other structured or investment-linked products.
• Compliance teams may wish to maintain a documented PRIIP classification assessment for each product, including the rationale where an equity-like asset investment is considered outside the PRIIPs scope.
• Manufacturers should ensure that a final, approved KID is published on the relevant website before the product is offered or made available for subscription, with evidence showing the exact publication timestamp and the start of marketing.
• Firms should implement a launch gate preventing website publication, advertising, subscription opening or other retail distribution activity until the required KID has been approved and published.
• Product governance procedures should allocate responsibility among the manufacturer, platform, distributor and website operator for preparing, approving, uploading, monitoring and updating the KID.
• Compliance teams may wish to test archived web pages, subscription journeys and marketing records to confirm that retail investors could not subscribe before the KID became available.
• Senior management should receive exception reporting for any product launch where the KID is incomplete, unavailable, published late or hosted at a location that is not readily accessible to the relevant retail audience.
• Firms should assess whether existing organisational controls are sufficient to prevent or materially impede Article 5(1) breaches, because BaFin’s action shows that inadequate supervisory arrangements may be sanctioned separately from the underlying disclosure failure.

What changed

This is an enforcement action rather than a new rule or amended requirement. BaFin applied Article 5(1) of Regulation (EU) No 1286/2014, which requires a PRIIP manufacturer to draw up and publish a compliant KID before a PRIIP is made available to retail investors. The sanctioned failure was not merely a defective document: the KID was not published on the website in good time before the subscription offer.

Key dates

2026-08-21

Proposal published in the Federal Register for public comment.

2026-10-05 Deadline

Written comments are due 45 days after Federal Register publication.

Suggested considerations

• Firms should assess each pool’s investor eligibility against the natural-person and non-natural-person requirements in proposed Regulation 4.13(a)(4), including the distinctions between qualified eligible persons and accredited investors.
• RIAs should review offering documents, subscription procedures, investor representations, and transfer controls to support the required reasonable belief at investment or conversion that all participants satisfy the applicable eligibility criteria.
• Compliance teams may wish to confirm that each relevant pool’s interests qualify for a Securities Act exemption and that U.S. marketing practices comply with the proposed restriction, including the Rule 506(c) exception.
• Eligible advisers should map Form PF obligations and determine whether existing SEC filings would satisfy the proposed condition that Form PF be filed where required.
• Firms should prepare to file or update electronic exemption notices with the NFA and maintain the proposed Regulation 4.13 annual affirmation, recordkeeping, disclosure, and statutory-disqualification representations.
• Managers operating both registered and exempt pools should assess the proposed Regulation 4.13(e)(2) communications and redemption-right requirements and identify whether any existing participants would require notice before a pool is operated as exempt.
• Small-pool operators should model eligibility using the proposed $800,000 aggregate threshold while continuing to monitor the 15-participant-per-pool limit and unchanged contribution exclusions.
• Managers relying on Staff Letter 25-50 should preserve evidence of current compliance and evaluate transition implications because the CFTC preliminarily proposes to supersede that relief if the rule is finalized.

What changed

Proposed Regulation 4.13(a)(4) would exempt an SEC-registered investment adviser from CPO registration for qualifying pools if the pool interests are exempt from Securities Act registration and are not publicly marketed in the United States, except that the marketing restriction would not apply to pools offered under SEC Rule 506(c) of Regulation D.

Key dates

2021-03-01

First Guardian Diversified Class and Growth Class became available to adviser-led members through Netwealth Super Accelerator Plus; the publication gives March 2021 rather than a specific day.

2022-12-01

First Guardian classes were closed to new investments; the publication gives December 2022 rather than a specific day.

2024-05-01

Falcon Capital froze redemptions, leaving approximately 1,080 NSMF members invested with holdings totalling about $100.7 million; the publication gives May 2024 rather than a specific day.

2025-12-17

APRA accepted a court-enforceable undertaking from Netwealth Superannuation Services addressing material weaknesses in its investment governance framework and practices.

2025-12-18

ASIC commenced Federal Court proceedings against Netwealth and accepted a court-enforceable undertaking requiring compensation of affected members.

2026-01-28

Netwealth credited compensation payments to affected members' superannuation accounts; ASIC reported that more than $100 million had been paid to over 1,000 investors in January 2026.

2026-08-20

The Federal Court made declarations that Netwealth contravened the Corporations Act in relation to First Guardian.

Suggested considerations

• Firms should consider mapping their investment-option onboarding and review processes against sections 912A(1)(a) and 912A(5A) of the Corporations Act 2001, including documenting how the trustee independently validates issuer-provided information.
• Compliance teams may wish to require documented evidence of independent enquiries into strategy, underlying assets, valuation methodology, leverage, related-party exposure, custody, redemption terms, liquidity and operational risks before an option is approved.
• Trustees should consider implementing risk-based ongoing monitoring, watch-list and escalation criteria for complex or high-risk options, with clear triggers for suspension, closure, member notification and review of future investment directions.
• Firms should consider testing whether product disclosure documents, investment menus, member communications and online materials accurately explain potential illiquidity and any limits or conditions affecting withdrawals or redemptions.
• Trustees may wish to review historical investment options that were onboarded between March 2021 and December 2022, or during comparable periods, to identify gaps in due diligence, monitoring, risk disclosure and remediation records.
• Compliance teams should consider preserving approval papers, committee minutes, independent research, issuer correspondence, risk assessments, liquidity analyses and member communications sufficient to demonstrate the basis for each onboarding and monitoring decision.
• Where material weaknesses are identified, firms should consider a documented remediation assessment covering member impact, compensation, disclosure correction, governance uplift and potential notification to ASIC, APRA or AFCA as appropriate.
• Trustees should consider whether their governance framework can evidence alignment with the best financial interests duty and applicable APRA prudential expectations, particularly when adding high-risk investments to a platform.

What changed

The publication records binding Federal Court declarations against Netwealth; it does not introduce a new statutory rule or generally applicable deadline. The relevant conduct was found to breach the Australian financial services licensee obligation in section 912A(1)(a) to do all things necessary to ensure licensed financial services are provided efficiently, honestly and fairly, together with section 912A(5A), in the context of Netwealth's operation of the Netwealth Superannuation Master Fund.

Key dates

2020-01-01

The FCA's temporary product intervention restricting mass-marketing of speculative illiquid securities to retail investors took effect.

2020-12-10

The FCA published PS20/15, confirming permanent rules for marketing speculative illiquid securities, including speculative mini-bonds, to retail investors.

2021-01-01

The permanent FCA restrictions on mass-marketing speculative illiquid securities to ordinary retail investors came into force.

2026-08-19

The FCA published the consumer warning following continuing losses and concerns about unregulated loan notes and mini-bonds, including the collapse of Woodville Consultants Limited.

2026-08-20

The FCA page was updated; the publication continues to operate as a warning and supervisory or enforcement signal rather than a new rule.

Suggested considerations

• Compliance teams may wish to inventory all loan notes, mini-bonds, debentures, preference shares, and comparable securities promoted, approved, advised on, arranged, or distributed by the firm.
• Firms should consider testing each product against the FCA definition of a speculative illiquid security, including the denomination threshold of less than £100,000, the use of proceeds, transferability, listing, and the applicable exemptions.
• Authorised firms should consider blocking mass-market communications, including websites, social-media advertising, broad email campaigns, affiliate content, and introducer activity, where the promotion is likely to reach ordinary retail clients.
• Where an exemption is relied on, firms should consider evidencing investor eligibility, the basis for any high-net-worth or sophisticated-investor status, the timing and validity of the investor declaration, and controls preventing onward dissemination to ineligible persons.
• Firms approving or communicating relevant promotions should consider verifying that required risk warnings, loss-of-capital disclosures, liquidity and default information, and third-party fee or commission disclosures are accurate, prominent, and consistent across all distribution channels.
• Due diligence should consider whether claims such as asset-backed, secured, FCA-authorised security trustee, listed, or fixed return accurately describe the legal and economic position of investors.
• Compliance teams may wish to review introducer agreements, commission arrangements, marketing costs, investor-money flows, and the proportion of subscriptions actually applied to the underlying investment.
• Firms should consider checking that communications do not use artificial deadlines, pressure tactics, unrealistic return comparisons, or performance claims unsupported by a credible explanation of repayment capacity.

What changed

No new binding requirement or prohibition was introduced by this publication. The FCA restated that its permanent rules prohibit authorised firms from approving or communicating financial promotions for speculative illiquid securities in a manner likely to be received by retail clients, subject to defined exemptions.

Key dates

2026-08-19

CFTC issued Release 9286-26 and announced the request for comment on listing compute derivatives contracts.

Suggested considerations

• Compliance teams may wish to identify whether the firm has direct or indirect exposure to compute cash markets, proposed compute futures, perpetual futures, benchmark administration, clearing, brokerage, or related trading activity.
• Firms considering submitting comments should assess the CFTC questions concerning cash-market size and liquidity, contract specifications, price formation, benchmark representativeness, settlement and rollover mechanics, manipulation scenarios, customer protection, and the risks of perpetual contracts.
• Potential contract venues and intermediaries should consider documenting how existing CFTC requirements under the Commodity Exchange Act and 17 CFR Parts 1 and 38 could apply to product submission, exchange oversight, market surveillance, position management, reporting, risk management, and customer funds.
• Trading and surveillance functions may wish to evaluate potential abusive strategies involving GPU capacity reservations, cloud allocation, data-centre outages, energy constraints, benchmark inputs, wash trading, spoofing, corners, squeezes, and manipulation of physical or reference markets.
• Firms should monitor the Federal Register and Regulations.gov for the publication date, final comment deadline, any technical corrections, and subsequent CFTC guidance or contract-approval filings.
• Market participants may wish to avoid treating the press release or request for comment as evidence that compute derivatives are already approved or that a reported exchange launch date is assured.
• Governance teams may wish to assign ownership across legal, commodities compliance, market surveillance, model risk, technology risk, procurement, and business teams because compute derivatives would connect financial-market controls with operational characteristics of cloud and data-centre markets.

What changed

The CFTC opened a public consultation under RIN 3038-AF77 concerning compute cash markets and potential compute derivatives contracts. The request seeks information on market size, liquidity, contract design, market oversight, manipulation risks, customer protection, and perpetual compute futures, and is associated with potential amendments or application of the CFTC framework in 17 CFR Parts 1 and 38. It does not itself approve a compute futures contract, authorize an exchange to list one, impose new compliance obligations, or establish a final regulatory position.

Key dates

2018-05-01

Demetrios Hadjigeorgiou became CEO of SVS Securities Plc.

2019-08-02

The FCA required SVS to cease regulated activities, safeguard assets and notify affected third parties.

2019-08-05

SVS Securities Plc entered special administration.

2023-08-10

SVS Securities Plc was dissolved.

2024-04-25

The FCA issued its initial Decision Notice proposing an £84,600 penalty and prohibition order against Mr Hadjigeorgiou.

2026-08-19

The FCA published the settled enforcement outcome: a £56,400 fine and prohibition from senior management positions in financial services.

Suggested considerations

• Compliance teams may wish to review whether senior managers have documented challenge and escalation responsibilities for investments involving issuer payments, commissions, related parties or other conflicts of interest.
• Firms should consider testing whether investment due diligence appropriately assesses product risk, liquidity, valuation methodology, concentration and suitability for pension and retail customers.
• Firms should consider reconciling all fees, commissions, retained spreads and exit-value adjustments against customer disclosures, ensuring that any reduction in redemption or sale value is prominent, timely and understandable.
• Boards and senior managers may wish to evidence periodic review of model portfolios against customers’ stated objectives, risk appetite, liquidity needs and pension-transfer circumstances.
• Compliance teams may wish to assess whether management information would have identified customer detriment, unusually high issuer-related income or investment decisions that prioritised firm revenue over customer interests.
• Firms should consider retaining clear records showing how conflicts were identified, mitigated, disclosed and challenged, including the rationale for approving high-risk or illiquid products for retail and pension-related portfolios.
• Authorised firms may wish to review the FCA’s SVS enforcement materials alongside their own senior-manager accountability maps and Statements of Responsibilities, while recognising that this case does not itself create a new universal obligation.

What changed

This is a concluded enforcement action against an individual, not a new general rule or threshold applicable to firms. The FCA imposed a financial penalty under section 66 of the Financial Services and Markets Act 2000 and a prohibition order under section 56 of that Act, following settlement and withdrawal of the Upper Tribunal referral. The FCA found a breach of Statement of Principle 6, requiring an approved person to exercise due skill, care and diligence in managing the business of the firm.

Key dates

2026-08-19

MAS published the announcement of the proposed tax exemption, Hedge Fund Investment Programme and Investment Management Track.

2027-01-01

The proposed tax exemption is expected to apply from Year of Assessment 2027; the precise income-period mechanics and legislative commencement remain to be confirmed.

Suggested considerations

• Firms should inventory existing carried-interest, performance-fee, incentive-allocation and other profit-participation arrangements and identify whether returns are received directly or indirectly for fund-management services.
• Tax and legal teams may wish to map each relevant fund against Sections 13D, 13O, 13OA, 13U and 13V of the Income Tax Act 1947 and retain evidence of Singapore-based management and applicable economic-substance conditions.
• Firms should avoid treating the announcement as an immediately available exemption and should monitor Budget 2027 and subsequent legislation or administrative guidance for the effective scope, rate, thresholds, attribution rules and documentation requirements.
• Compliance teams may wish to review fund, management-company, partnership and individual remuneration agreements so that the commercial basis for any profit-related return is clearly documented and distinguishable from ordinary salary or bonus remuneration.
• Asset managers considering Singapore expansion should assess whether participation in the Hedge Fund Investment Programme or the proposed Investment Management Track could support their business and talent strategy, while awaiting eligibility and application details.
• Immigration and HR teams may wish to identify senior investment professionals whose compensation is materially linked to investment performance and assess the potential implications once revised ONE Pass criteria are published.
• Firms should continue applying existing tax, licensing, employment, payroll, conduct, books-and-records and anti-avoidance requirements; this announcement does not displace those obligations.

What changed

MAS and the Ministry of Finance plan to introduce a tax exemption from Year of Assessment 2027 for qualifying profit-related returns arising from fund-management services. The exemption is intended to cover a contractual share of profits of funds qualifying under Sections 13D, 13O, 13OA, 13U or 13V of the Income Tax Act 1947, where the funds are managed by Singapore-based fund managers and the returns are received directly or indirectly by corporate entities, partnerships or individuals for providing fund-management services.

Key dates

2025-09-10

Tricolor and affiliates filed for Chapter 7 bankruptcy and moved toward liquidation.

2025-12-17

The U.S. Attorney’s Office for the Southern District of New York announced criminal charges against Tricolor executives in connection with the alleged fraud.

2026-08-18

The SEC announced the civil enforcement action against Daniel Chu, Jerome Kollar, and Ameryn Seibold in the U.S. District Court for the Southern District of New York.

Suggested considerations

• Firms should consider performing a targeted review of whether the same receivable, loan, vehicle, inventory item, or other asset can be pledged across multiple warehouse facilities, securitizations, lenders, or managed accounts, including through affiliates and special-purpose vehicles.
• Compliance teams may wish to test collateral eligibility and borrowing-base reporting back to source-level records, payment histories, lien and ownership data, servicing systems, and independent third-party evidence rather than relying solely on management certifications.
• Securitization sponsors, underwriters, and investors should consider reviewing controls for detecting loans that are delinquent, charged off, non-paying, fictitious, materially impaired, or otherwise ineligible but reported as current or eligible.
• Firms should consider reconciling loan-level collateral tapes across all funding channels and establishing exception escalation, independent sign-off, segregation of duties, and documented remediation for duplicate identifiers or inconsistent pledging data.
• Finance and compliance functions may wish to assess whether offering documents, investor presentations, lender certificates, and management meetings accurately describe liquidity constraints, funding needs, collateral encumbrances, and portfolio performance.
• Boards and senior-management committees should consider reviewing governance over collateral operations, securitization disclosures, liquidity reporting, related-party or affiliate financing, and controls over executive certifications.
• Investment managers and lenders may wish to incorporate independent collateral verification, borrowing-base audit rights, data-access rights, concentration and duplication analytics, and covenant triggers into new and renewed transactions.
• Firms with relevant exposure should consider preserving records, communications, collateral tapes, system audit trails, certifications, underwriting files, and exception reports in light of parallel SEC and criminal proceedings.

What changed

The publication does not introduce a new rule, threshold, filing requirement, or compliance deadline. It announces an enforcement complaint under the antifraud provisions of the Securities Act of 1933 and Securities Exchange Act of 1934, including alleged control-person liability against Chu and aiding-and-abetting liability against all three defendants. The SEC seeks injunctions, disgorgement with prejudgment interest, civil penalties, and officer-and-director bars against Chu and Kollar.

Key dates

2026-08-18

The SEC published the Chairman’s statement and proposed Regulation Crypto Assets, including the proposed startup exemption, fundraising exemption, and investment-contract safe harbor.

2026-03-17

The SEC issued its interpretation concerning the application of the federal securities laws to certain crypto assets and transactions, which the Chairman identifies as a basis for the proposed framework.

Suggested considerations

• Compliance teams may wish to treat the package as a proposal rather than a currently usable exemption and continue applying the existing Securities Act, Exchange Act, and applicable state-law analysis until final rules become effective.
• Potential issuers should consider mapping planned token offerings against the proposed $5 million/four-year and $75 million/12-month limits, including aggregation, timing, resale, and interaction with other registration exemptions once the proposing release is reviewed in full.
• Issuers considering the fundraising exemption should consider preparing systems for principles-based crypto disclosures, financial-condition information, audited financial statements at the applicable thresholds, and ongoing reporting.
• Legal and compliance functions may wish to assess whether existing investment-contract documentation contains essential managerial promises and whether operational evidence could support the proposed certification required for the safe harbor.
• Crypto trading venues and intermediaries should consider inventorying assets currently treated as securities or investment contracts and evaluating how a future safe-harbor determination could affect onboarding, trading permissions, disclosures, custody, surveillance, and state-law analysis.
• Firms may wish to monitor the Federal Register publication, the SEC comment period, any revisions to the proposal, and the status of the CLARITY Act, which the Chairman described as necessary for durable market-structure rules.
• Compliance teams may wish to review independent commentary emphasizing that the proposal is a major policy shift toward tailored token fundraising but that the practical scope remains uncertain until the detailed conditions, audit thresholds, eligibility criteria, and final text are settled.

What changed

The proposed rules would establish two exemptions from Securities Act of 1933 registration for qualifying crypto-asset investment contracts. The startup exemption would permit offerings of up to $5 million during a four-year period. The fundraising exemption would permit offerings of up to $75 million during each 12-month period, subject to principles-based crypto-asset disclosures, financial-condition disclosures, financial statements, ongoing reporting, and audited financial statements at specified capital-raising thresholds; the publication does not state those audit thresholds.

Key dates

2026-03-17

The SEC issued its earlier interpretation clarifying how federal securities laws apply to certain crypto assets and transactions involving crypto assets.

2026-08-18

The SEC announced the proposed Regulation Crypto Assets framework and opened the process for public comment, subject to publication of the proposing release in the Federal Register.

Suggested considerations

• Compliance teams may wish to map planned and existing token offerings against the proposed $5 million four-year and $75 million 12-month thresholds, including aggregation across related issuers, affiliates, projects and offering periods once the proposing release is reviewed.
• Issuers should consider documenting which exemption they would use, the relevant measurement period, investor eligibility and transfer restrictions, and controls intended to prevent exceeding the applicable offering cap.
• Firms should consider preparing draft principles-based narrative disclosures and, for the $75 million exemption, assessing financial-statement readiness and the systems needed for ongoing SEC reporting.
• Project sponsors may wish to inventory all essential managerial efforts represented or promised to investors and establish evidence, governance approvals and public communications supporting any future safe-harbor position based on completion or permanent cessation of those efforts.
• Exchanges, broker-dealers and trading platforms should consider assessing how the proposed safe harbor and state-law preemption could affect asset classification, listing reviews, customer disclosures, surveillance, custody and secondary-market controls.
• Industry participants may wish to review the full proposing release and consider submitting comments within 60 days after its publication in the Federal Register; the specific deadline should not be assumed until the Federal Register publication date is confirmed.
• Firms should continue treating the proposal as non-final and should not represent that an exemption, safe harbor or state-law preemption is currently available.

What changed

The proposed framework would add two exemptions from Securities Act of 1933 registration requirements for qualifying investment contracts involving crypto assets. The first would allow aggregate offerings of up to $5 million during a four-year period on a one-time basis; the second would allow offerings of up to $75 million during each 12-month period. Issuers relying on either exemption would need to make specified principles-based narrative disclosures available to investors.

Key dates

2026-08-18

ESMA launched the consultation on draft EMIR RTS and ITS for annual reporting of clearing activity at recognised third-country CCPs.

2026-10-12 Deadline

Deadline for stakeholders to provide feedback on the reporting framework, templates and format.

Suggested considerations

• Compliance teams may wish to submit comments on the proposed framework, templates and reporting format by 2026-10-12.
• Firms should consider identifying every recognised third-country CCP used by their EU entities and distinguishing direct clearing-member activity from client clearing activity.
• Reporting owners may wish to map the proposed Article 7d data points to existing EMIR Article 9 transaction reporting, margin, collateral, default-fund and treasury or payments data to determine what can be reused and what new data controls are needed.
• Groups should consider determining whether reporting will be performed by each EU entity or by the EU parent undertaking on a consolidated basis.
• Firms may wish to assess data availability by asset class and Union currency, calculation methodologies for annual average cleared values, and controls for margins, default-fund contributions and largest payment obligations.
• Technology and regulatory-reporting teams should consider designing provisional data lineage, reconciliation and governance processes, while treating implementation dates and final fields as subject to the final RTS and ITS.
• Firms should monitor ESMA’s Final Report and the subsequent adoption, endorsement and publication of the technical standards before treating the proposed reporting model as a final operative obligation.

What changed

This is a consultation rather than a final binding rule. ESMA proposes the reporting framework, templates and format required under EMIR 3 Article 7d for clearing members and clients that clear transactions through recognised third-country CCPs. Firms established in the EU and not part of an EU-consolidated-supervision group would report to their competent authority; where the firm belongs to such a group, the EU parent undertaking would report on a consolidated basis.