Broker Dealers Regulatory Updates

Key dates

2026-08-27

JFSA published the revision and added Question 7 to the Q&A on Financial Instruments Business.

Suggested considerations

• Firms should identify all overseas-listed ETFs distributed or made available to Japanese customers and isolate products with a single Japanese-company equity exposure and leveraged or inverse performance objectives.
• Compliance teams may wish to suspend onboarding, marketing, solicitation, and new sales of affected products pending a documented legal and compliance assessment of the revised Question 7 and any follow-up JFSA communications.
• Firms should review whether existing distribution arrangements, product lists, customer disclosures, suitability controls, and overseas-product filing processes remain defensible in light of the JFSA’s public-interest position.
• Broker-dealers should assess whether affected products can remain accessible on an execution-only basis, including the risk that continued availability could be viewed as distribution or otherwise inconsistent with the JFSA’s stated view.
• Firms should obtain product-level information on the reference asset, leverage or inverse multiple, daily reset methodology, derivatives and rebalancing arrangements, listing venue, and Japanese investor access channels.
• Market surveillance and product-governance teams may wish to evaluate whether distribution of affected products could contribute to volatility, disorderly trading, or concerns about price formation in the Japanese underlying shares.
• Senior management should document escalation, inventory decisions, customer communications, and any decision to close or restrict positions, while monitoring for amendments to the Financial Instruments and Exchange Act framework, supervisory guidelines, or additional JFSA expectations.

What changed

The JFSA added Question 7 to its Q&A on Financial Instruments Business. The revised guidance expresses the JFSA’s view that distributing overseas single-stock leveraged ETFs whose underlying assets are shares of Japanese companies is not in the public interest because the products may amplify fluctuations in the prices of the underlying shares listed on Japanese exchanges and may significantly affect price formation in Japan’s financial markets.

Key dates

2026-08-27

The Bank of England announced deferral of the entire November 2026 RTGS standards release, including CHAPS messaging standards; Swift announced the corresponding Standards Release delay on the same date.

2026-12-31

Swift has indicated that it will provide an update on the optimal timing and approach for the structured-address change by December 2026 at the latest; this is an expected communications milestone, not a confirmed implementation deadline.

Suggested considerations

• Firms should update regulatory-change inventories and project plans to record that the November 2026 RTGS and CHAPS standards release has been deferred, without assuming that the change has been cancelled.
• CHAPS and RTGS participants should obtain the BoE’s revised implementation timetable and monitor the BoE ISO 20022 implementation page, participant communications and Swift governance updates, including the expected update by December 2026 at the latest.
• Compliance and payments teams may wish to preserve completed analysis and technical preparations for structured or hybrid postal addresses, while reassessing sequencing, testing windows, release dependencies and vendor delivery dates against the revised timetable.
• Firms should distinguish the deferred BoE/CHAPS release from any other payment-system or bilateral requirements that may continue on their original schedules, and should confirm the treatment of address validation, message rejection, exception handling and operational support with relevant counterparties and vendors.
• Technology and operations teams should maintain regression-test environments and data-quality remediation plans so that implementation can resume without restarting discovery or delaying future mandatory testing.
• Firms using both CHAPS/RTGS and Swift CBPR+ should assess whether the coordinated deferral changes their customer communications, correspondent-bank testing, operational-resilience scenarios, payment-routing controls and incident-management assumptions.
• Governance committees may wish to record the deferral as a schedule and dependency change rather than as a reduction in scope, because the BoE states that the November release is deferred in its entirety and provides no indication that the underlying standards work is withdrawn.

What changed

The November 2026 RTGS standards release will not proceed as originally planned and has been deferred in its entirety rather than being split into separate changes. This includes the RTGS messaging standards applicable to CHAPS payments. The decision maintains alignment with Swift’s deferred CBPR+ release and means that the previously expected 2026-11-14 removal of fully unstructured postal addresses should not be treated as the operative BoE/Swift implementation date; Swift has indicated that it will consult market participants and provide an update by December 2026 at the latest.

Key dates

2026-07-24

The FCA conducted the Attest quantitative survey of 666 UK adults aged 18 to 40 who owned investments or were considering buying investments within 12 months.

2026-08-27

The FCA published the press release and research findings on young investors' trust in AI.

Suggested considerations

• Compliance teams may wish to map all AI use cases across investment research, recommendations, suitability, appropriateness assessments, client communications, and financial promotions, distinguishing general-purpose tools from systems specifically configured to provide financial advice.
• Firms should consider assessing whether any AI-generated output amounts to a personal recommendation, regulated advice, or a financial promotion under the Financial Services and Markets Act 2000 and the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001, rather than relying on the technology's general-purpose label.
• Firms using AI in regulated activities should consider applying the same suitability, appropriateness, customer understanding, disclosure, record-keeping, oversight, and accountability standards that apply to equivalent human-led processes.
• Customer-facing communications may warrant clear explanation that general-purpose chatbot outputs are not FCA-regulated advice and do not themselves create entitlement to FSCS compensation or access to the Financial Ombudsman Service.
• Compliance teams may wish to test AI outputs for hallucinations, stale or unsupported sources, misleading performance claims, inappropriate personalisation, bias, and inadequate risk warnings, with escalation and human-review controls for higher-risk outputs.
• Firms should consider reviewing whether AI-generated content used in promotions complies with the FCA financial promotion restriction in section 21 of the Financial Services and Markets Act 2000 and applicable FCA financial-promotion rules.
• Governance reviews may include vendor due diligence, approved-use restrictions, audit trails, model-change monitoring, incident reporting, staff training, and controls preventing customers or staff from treating AI output as a substitute for regulated advice.
• Firms may wish to monitor the FCA's expected late-2026 publication on good and poor AI practice and any subsequent FCA, HM Treasury, or industry measures addressing advice-like outputs from general-purpose AI.

What changed

No binding regulatory requirement, rule, prohibition, or implementation deadline was introduced. The FCA clarified its current supervisory position that general-purpose AI chatbots are not regulated by the FCA where they respond to varied prompts and are not specifically established to provide financial advice, research, or decision-making support. By contrast, an AI tool specifically deployed to provide financial advice would be likely to fall within the FCA's remit and could engage the existing UK regulatory framework for regulated advice and financial promotions.

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying [email protected] by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.

Key dates

2025-01-17

DORA became applicable to financial entities within its scope, subject to the specific DORA provisions and technical standards applicable to each entity.

2025-04-09

Circular CSSF 25/881 was published and took effect, removing DORA financial entities from Circular 20/750 and retaining 20/750 for entities outside DORA; PSP-specific provisions were reorganised under Circular 25/880.

2026-06-30 Deadline

CSSF extended the first Register of Information submission for Luxembourg branches of third-country credit institutions to this date on a best-efforts basis; the CSSF indicated that the required level of quality should be achieved for the 2027 submission.

2026-08-27

Circular CSSF 26/915 was published, confirming the DORA treatment of qualifying third-country branches and removing them from the full scope of Circular 20/750 and related overlapping circular provisions.

2027-03-31 Deadline

Target date identified by the CSSF for the required-quality Register of Information submission by Luxembourg branches of third-country credit institutions.

Suggested considerations

• Firms should classify each Luxembourg entity and branch against DORA Article 2 and the amended scope of Circular 20/750, including an assessment of whether a third-country head office would qualify under DORA Article 2(1)(a) to (t).
• Compliance teams may wish to determine whether the entity should operate under DORA rather than 20/750, and document the rationale, legal-entity perimeter and treatment of any Luxembourg branch.
• Firms remaining within Circular 20/750 should consider reviewing their ICT and security-risk-management framework, governance approvals, risk assessments, incident processes, business-continuity arrangements and control testing against the continuing requirements.
• Payment service providers should consider replacing references to the PSP provisions formerly contained in Circular 20/750 with the applicable requirements in Circular CSSF 25/880 and EBA/GL/2025/02.
• Third-country branches treated as DORA entities should consider validating their DORA governance, ICT-risk framework, incident-reporting arrangements, ICT contractual inventory and Register of Information processes, taking account of CSSF reporting communications.
• Firms should update policies, regulatory inventories, outsourcing and ICT-third-party registers, training materials and regulatory mapping to distinguish DORA obligations from the residual Circular 20/750 obligations.
• Compliance teams may wish to retain evidence of the scope assessment and implementation date, because the 2025 amendment was effective immediately and the 2026 amendment changes the treatment of a previously identified 20/750 population.

What changed

Circular 25/881 provides that DORA financial entities supervised by the CSSF no longer fall within Circular 20/750; for entities covered by 20/750 but outside DORA, the circular continues to apply in full. Payment-service-provider-specific ICT and security-risk provisions were removed from 20/750 and regrouped in Circular CSSF 25/880, reflecting the revised EBA Guidelines on ICT and security risk management for payment service providers, including EBA/GL/2025/02.

Key dates

2025-01-17

DORA began applying to financial entities within its scope, subject to the relevant provisions and transitional arrangements.

2025-04-09

Circular CSSF 25/883 was published and applied with immediate effect, amending Circular CSSF 22/806 and introducing the DORA-based division between ICT and business-process outsourcing.

2025-12-17

The European Commission confirmed through a DORA Q&A that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF-extended submission date for the 2026 DORA register of information for third-country branches of credit institutions headquartered in a third country; entities were invited to submit on a best-efforts basis.

2026-08-27

Circular CSSF 26/915 was published and applied with immediate effect, confirming the DORA treatment of qualifying Luxembourg third-country branches and updating Circular CSSF 22/806 accordingly.

2027-03-31 Deadline

Target CSSF submission deadline for the DORA register of information for affected third-country branches following the initial 2026 collection.

Suggested considerations

• Firms should classify each outsourcing arrangement as ICT or non-ICT and determine whether the entity and arrangement fall within DORA, Circular 22/806, or both regimes in their respective areas of application.
• DORA entities should consider moving ICT arrangements from their Circular 22/806 outsourcing inventory and controls into the DORA ICT third-party register, while retaining Circular 22/806 controls for business-process outsourcing.
• Non-DORA entities should consider continuing to apply the full Circular 22/806 framework to ICT and business-process outsourcing, including due diligence, governance, critical-or-important assessments, monitoring, sub-outsourcing and exit planning.
• Third-country branches should assess whether their head office would qualify under Article 2(1)(a) to (t) of DORA and, if so, align ICT governance, contractual arrangements, registers and reporting with DORA rather than relying solely on Circular 22/806.
• Compliance teams may wish to review cloud contracts and avoid carrying forward legacy EEA governing-law or hosting clauses where DORA now provides the applicable framework, while preserving enforceable audit, access, cooperation, security, business-continuity and exit rights.
• Firms should use the revised CSSF notification form for new critical or important ICT outsourcing arrangements and preserve evidence supporting the three-month notification period, or the one-month period for arrangements involving a support PSF.
• Firms should consider validating that existing ICT outsourcing notifications remain complete under the applicable DORA register-of-information requirements, even though Circular 25/883 does not require their re-submission.
• Affected third-country branches should consider submitting and maintaining the DORA register of information through the CSSF process, with the 2027 collection requiring data quality suitable for the 31 March 2027 submission deadline.

What changed

From 9 April 2025, DORA entities generally no longer apply the ICT-outsourcing provisions of Circular CSSF 22/806 to ICT arrangements; those arrangements are governed by DORA, including its ICT third-party risk-management, contractual, register-of-information and oversight requirements, together with Circular CSSF 25/882. Circular 22/806 continues to apply to business-process outsourcing by DORA entities, and continues to apply in full to non-DORA entities, including their ICT outsourcing. Chapter 16 management companies remain subject to Circular 22/806 for ICT outsourcing.

Key dates

2020-08-25

Circular CSSF 20/750 was originally published, establishing CSSF expectations for ICT and security risk management.

2025-01-17

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector became applicable to DORA-defined financial entities supervised by the CSSF.

2025-04-09

Circular CSSF 25/881 amended Circular 20/750, narrowing it primarily to non-DORA entities and moving PSP-specific requirements to Circular CSSF 25/880.

2026-08-27

Circular CSSF 26/915 was published and applies with immediate effect; DORA-equivalent third-country branches are removed from Circular 20/750 and addressed through the DORA-related CSSF framework.

Suggested considerations

• Firms with Luxembourg third-country branches should document an entity-by-entity DORA scoping analysis, including the classification of the non-EU head-office undertaking under Article 2(1)(a) to (t) of Regulation (EU) 2022/2554 and the relevance of Article 2(2).
• Affected branches should consider retiring Circular 20/750 as their primary ICT framework and mapping controls instead to DORA and the applicable CSSF circulars, including Circular CSSF 25/882 on ICT third-party services and Circular CSSF 25/893 on major ICT-related incidents and significant cyber threats.
• Firms should review ICT third-party inventories, contracts, due diligence files, exit strategies and, where relevant, the DORA Register of Information so that all ICT services are captured regardless of whether the arrangement is formally classified as outsourcing.
• Entities remaining within Circular 20/750 should consider confirming that the management body has approved the ICT and security risk-management framework and that it is reviewed at least annually.
• Remaining in-scope entities should consider refreshing their annual ICT and security risk assessment, critical-function and information-asset mapping, threat and vulnerability monitoring, access controls, patching, backup, recovery, incident-response and business-continuity documentation.
• Compliance teams may wish to verify that critical ICT systems undergo security testing at least annually, non-critical systems are tested regularly and at least every three years, and critical business continuity arrangements are tested at least annually.
• Branches and PSP-related entities should consider validating incident-reporting channels and escalation procedures, including the CSSF alternative email channel for exceptional technical failures where the prescribed DORA reporting channel cannot be used.
• Firms should consider preserving evidence of proportionality assessments, control testing, audit findings, remediation, management-body reporting and staff security training for CSSF supervisory review.

What changed

Circular 26/915 applies with immediate effect and removes DORA-equivalent third-country branches from the scope of Circular 20/750. A third-country branch is treated as DORA-relevant where, in the jurisdiction of its head office, the undertaking would qualify as an entity listed in Article 2(1)(a) to (t) of Regulation (EU) 2022/2554, subject to the applicable exclusions and Article 2(2) conditions.

Key dates

2026-08-26

EBA consultation launched and consultation period opened.

2026-09-25 Deadline

Deadline to register for the EBA virtual public hearing, at 16:00 CEST.

2026-09-29

EBA virtual public hearing from 10:00 to 12:00 CEST (Paris time).

2026-12-31 Deadline

Deadline for submitting consultation responses to the EBA, at 23:59 CEST.

Suggested considerations

• Compliance and operational-risk teams should obtain and map the consultation draft against Article 323(1), points (a) to (h), of the CRR and identify requirements that would require changes to policies, committee mandates, controls or management information.
• Institutions should determine their business indicator and assess whether it is below the proposed EUR 750 million proportionality threshold, while treating that threshold as proposed rather than final.
• Firms should inventory operational-risk data sources, loss-event thresholds, taxonomies, reporting processes, validation controls and audit coverage, and assess whether data granularity is sufficient for the proposed framework.
• Management-body and senior-management responsibilities should be compared with existing governance arrangements, including the independence, authority and resourcing of the operational risk management function.
• Firms should assess alignment between the proposed RTS, CRR3 operational-risk capital and reporting implementation, the EBA Guidelines on internal governance and DORA, avoiding duplication or gaps for ICT-related risk.
• Affected stakeholders should consider submitting comments to the EBA by 31 December 2026; compliance teams may wish to coordinate responses with risk, finance, internal audit and industry associations.
• Stakeholders wishing to participate in the EBA public hearing should register by 25 September 2026 at 16:00 CEST and prepare questions on proportionality, data granularity, thresholds, reporting frequency and implementation timing.
• Institutions should monitor the EBA’s final draft, the European Commission’s endorsement process and the eventual application date before treating the consultation text as a binding requirement.

What changed

The proposed RTS would give detailed effect to Article 323(1), points (a) to (h), of the CRR by requiring three framework components: governance arrangements, an operational risk management process and an operational risk assessment system. They clarify responsibilities of the management body, senior management and the independent operational risk management function, and address operational risk data and taxonomy, the business indicator component, reporting, validation and audit. ICT risk requirements are intended to remain governed primarily by Regulation (EU) 2022/2554 (DORA).

Key dates

2026-08-26

The CFTC proposed the amendment in 91 FR 55030, RIN 3038-AF79, and opened the public-comment period.

2026-09-25 Deadline

Public comments on the proposed rule must be received by the CFTC.

Suggested considerations

• SEF compliance teams should distinguish Required Transactions from Permitted Transactions under 17 CFR 37.9 and confirm that any planned platform changes preserve Order Book and RFQ functionality for Required Transactions.
• SEFs may wish to inventory Permitted Transaction products, execution protocols, customer usage, liquidity, pre-trade transparency, surveillance dependencies, and annual Order Book operating costs before deciding whether to retain, modify, or discontinue optional Order Book functionality.
• SEFs relying on CFTC No-Action Letter No. 25-24 should assess whether their current implementation remains consistent with the proposal and should monitor the eventual final rule rather than treating the NPRM as binding law.
• SEF applicants may wish to reassess platform design and launch costs because the proposal could remove the need to build an Order Book solely for Permitted Transactions.
• Swap dealers, major swap participants, and other active SEF users should assess whether removal of an optional Order Book could affect execution practices, liquidity access, pre-trade transparency, best-execution analysis, or internal trading procedures for Permitted Transactions.
• Interested firms should consider submitting comments to CFTC docket CFTC-2026-1882, including quantified technology, staffing, infrastructure, surveillance-integration, and market-impact data, by September 25, 2026.
• Compliance teams should continue applying CEA section 2(h)(8), 17 CFR 37.9, and applicable Part 43 reporting obligations unless and until a final rule changes them.

What changed

The proposed amendment would revise 17 CFR 37.3(a)(2) so that a SEF must, at a minimum, offer an Order Book as defined in 17 CFR 37.3(a)(3) for Required Transactions as defined in 17 CFR 37.9(a)(1). It would remove the obligation to offer an Order Book for Permitted Transactions, defined in 17 CFR 37.9(c)(1) as transactions that do not involve a swap subject to the CEA section 2(h)(8) trade-execution requirement. SEFs could continue offering Order Books for Permitted Transactions voluntarily and could use any execution method permitted under 17 CFR 37.9(c)(2).

Key dates

2026-08-25

EBA launched the consultation on three draft RTS.

2026-09-25 Deadline

Deadline at 16:00 CEST to register for the EBA virtual public hearing.

2026-09-30

EBA virtual public hearing scheduled from 10:00 CEST.

2026-11-25 Deadline

Deadline for submitting comments on the consultation.

Suggested considerations

• Firms should assess whether their solo and group-level asset populations capture all entities and activities covered by the CRD amendments, including the potential effect of EU branches and consolidated group assets.
• Compliance and finance teams may wish to reconcile the proposed threshold methodology against regulatory reporting, audited financial statements and internal management information, using a rolling 12-month monitoring process where relevant.
• Investment firms above EUR 5 billion should review the draft reporting templates and instructions and identify data, governance, validation and submission gaps before the RTS become applicable.
• Firms near the EUR 30 billion threshold should model the consequences of credit institution authorisation, including CRD and CRR application, supervisory engagement, capital and liquidity requirements, governance expectations and implementation timelines.
• Groups potentially affected by the group test should consider submitting comments on the geographic scope of assets, treatment of branches, consolidation methodology and any disproportionate effects on cross-border business models.
• Potentially eligible firms may wish to prepare evidence against the proposed waiver factors and engage early with their competent authority, while recognising that a waiver is discretionary and not guaranteed.
• Stakeholders wishing to participate in the EBA public hearing should register by the stated registration deadline and firms wishing to influence the final RTS should submit consultation responses by 25 November 2026.

What changed

The EBA is revising its draft RTS following the 2024 amendments to the Capital Requirements Directive, including clarifications on which entities and assets must be included in the threshold calculation at solo and group level. The package addresses the methodology for calculating total assets against the EUR 30 billion threshold, reporting requirements for investment firms whose total assets exceed EUR 5 billion under Article 55(5) of the Investment Firms Regulation, and the factors competent authorities must consider when deciding whether to grant a waiver under Article 8a(7) of the CRD.

Key dates

2016-06-01

Approximate start of the Relevant Period during which Keptain’s liquid capital was window dressed and deficiencies arose.

2018-03-31

Approximate end of the Relevant Period identified by the SFC.

2026-08-24

SFC revoked Chan’s licence and RO approval and began his 10-year prohibition on re-entering the industry.

2036-08-23

Chan’s 10-year industry ban ends.

Suggested considerations

• Firms should consider reconciling every FRR return to bank statements, cleared funds, and post-period dishonour or reversal information rather than relying solely on month-end account balances.
• Compliance teams may wish to test whether cheques, related-party funding, temporary transfers, overdrafts, unsettled receipts, and other non-cash or conditional items meet the applicable FRR eligibility and valuation requirements before inclusion in liquid capital.
• ROs and managers-in-charge should consider documenting their review and challenge of each FRR return, including explanations for material month-end movements and evidence that reported funds were genuinely available and not temporary window dressing.
• Firms should consider implementing daily or intraday escalation triggers that identify actual or foreseeable breaches of the minimum liquid-capital requirement and the 120% notification threshold.
• Where a deficiency occurs or is reasonably identified, firms should consider assessing and documenting whether notification is required under SFO section 146(1) and FRR Rule 55(1), including the one-business-day outer limit under Rule 55(1).
• Compliance teams may wish to review historical FRR returns and supporting bank evidence for similar patterns, particularly where funds were received from connected companies or were reversed shortly after reporting dates.
• Licensed corporations should consider reminding ROs that signing regulatory returns can create personal fitness-and-properness consequences, including licence revocation and a lengthy industry ban, and should ensure that responsibility cannot be reduced to a nominal or administrative role.

What changed

This is a final enforcement action rather than a change to the underlying rules. The SFC applied Rules 4 and 6 of the Securities and Futures (Financial Resources) Rules, under which Keptain was required to maintain at least HK$3 million in liquid capital at all times. The SFC found that cheques deposited at or around month-end but dishonoured before the returns were submitted should not have been included in the liquid-capital calculations; excluding them would have produced deficiencies ranging from HK$731,000 to HK$3,473,000 over 20 months.

Key dates

2025-12-30

MAS issued the revised Notices FAA-N27, 508 and SFA 04-N24 and published its response to feedback.

2026-08-24

MAS published the circular and FAQs explaining the revised misconduct-reporting requirements and the discontinuation of the existing system.

2027-01-01 Deadline

The revised Notices FAA-N27, 508 and SFA 04-N24 take effect; the existing Notices FAA-N14, 504 and SFA 04-N11 are cancelled; and the existing misconduct reporting system is discontinued.

2027-01-22 Deadline

Default deadline for reporting qualifying pre-2027 misconduct matters that were not reported under the cancelled Notice, calculated as 21 calendar days after 1 January 2027, unless MAS permits a longer period in writing.

Suggested considerations

• Compliance teams may wish to map existing misconduct, incident, whistleblowing, investigation, HR and police-referral processes to the revised definition and categories of reportable misconduct.
• Firms should consider establishing a documented escalation test for when reasonable grounds to believe misconduct occurred arise, rather than waiting for a final investigation finding, and configuring workflow controls around the 21-calendar-day initial-reporting deadline.
• Firms may wish to obtain and operationalise the prescribed misconduct-report, investigation-report and update-report formats before the existing system is discontinued.
• Internal investigation procedures should be reviewed to ensure that the prescribed investigation information, supporting evidence, investigator assessment, corrective action and appeal information can be produced concurrently with the initial MAS report where an investigation has commenced.
• Police-report handling should be updated so that available police reports and required accompanying details are captured and submitted with the misconduct report, with subsequent police or criminal-proceeding developments tracked for update reporting.
• Firms should consider controls for providing representatives with copies of initial misconduct reports and subsequent updates within the prescribed timelines, including appropriate treatment of former representatives and confidentiality or privilege issues.
• A transitional review of open matters may be appropriate to identify cases where reasonable grounds arose before 1 January 2027 but no report was filed under the cancelled Notice; those matters may need to be reported by 22 January 2027, subject to any written extension from MAS.
• Record-retention policies, case-management systems and management information should be tested against the minimum five-year retention requirement and the requirement that electronic records remain accessible, retrievable and readable.

What changed

From 1 January 2027, Notices FAA-N27, 508 and SFA 04-N24 replace and cancel the existing Notices FAA-N14, 504 and SFA 04-N11. The initial misconduct report must generally be submitted within 21 calendar days after the firm has reasonable grounds to believe that reportable misconduct was committed or is likely to have been committed; a conclusive investigation finding is not required before reporting.

Key dates

2025-07-01

During July 2025, Effecta offered the relevant profit participation certificate to retail investors through a website without first publishing the KID. The source does not specify the exact day.

2026-07-30

BaFin imposed the €15,000 administrative fine on Effecta GmbH.

2026-08-21

BaFin’s English publication was current or updated on this date.

Suggested considerations

• Compliance teams may wish to inventory all products offered to retail investors and document the PRIIP classification decision for each product, including profit participation certificates and other structured or securities-like investments.
• Firms should consider implementing a hard pre-launch control that blocks retail subscriptions until the current KID is available on the relevant distribution website and the link, version and publication time have been recorded.
• Intermediaries may wish to allocate contractual responsibility between manufacturer, platform operator and distributor for preparing, approving, publishing, updating and removing KIDs, with evidence of completion retained for each offering.
• Online distributors should consider testing whether the KID is clearly accessible before the investor reaches the binding offer or subscription stage, is free of charge, can be downloaded and stored, and remains available on the required durable medium.
• Firms should consider maintaining audit trails showing the KID version displayed, publication timestamp, website location, investor notification and any periods during which an offering was paused because the KID was unavailable.
• Governance functions may wish to review supervisory oversight of product launches and assess whether escalation, sampling and post-launch monitoring would have prevented or detected a missing KID.
• Compliance teams may wish to review comparable offerings launched since July 2025 and remediate any period in which a PRIIP was presented to retail investors without a compliant KID, taking account of potential disclosure, distribution and customer-redress consequences.

What changed

This is an enforcement action rather than a new rule. BaFin applied Article 13(1) in conjunction with Article 14 of Regulation (EU) No 1286/2014, requiring persons advising on or selling a PRIIP to make the KID available to retail investors free of charge, in good time before they are bound by a contract or offer. The document may be supplied on paper, on another durable medium, or through a website meeting the Regulation’s conditions, including notifying the investor of the website address and location and keeping the KID accessible, downloadable and storable for as long as needed.

Key dates

2026-08-21

Request for Comment published in the Federal Register.

2026-10-20 Deadline

Comments are due, calculated as 60 days after Federal Register publication.

2026-10-05

Reported target date for CME Group and Silicon Data to list two compute or GPU-rental futures contracts, subject to regulatory review; this date is not established by the CFTC Request for Comment.

Suggested considerations

• Compliance teams may wish to determine whether the firm has relevant empirical data on compute prices, volumes, counterparties, supplier concentration, utilization, capacity commitments, or bilateral contract terms that could support a CFTC submission.
• Potential DCM and SEF applicants should consider mapping proposed contract specifications and settlement methodologies against CEA section 5(d), Core Principles 2, 3, 4, 5, 9, and 11, 17 CFR 38.150-38.160, 38.200-38.201, 38.250-38.258, 38.500, and 38.603, and the guidance in 17 CFR part 38 appendices B and C.
• Firms developing or contributing data to a compute index should consider documenting data provenance, publication practices, governance, auditability, contributor concentration, observation-window controls, fallback mechanisms, and safeguards against manipulation by capacity providers.
• FCMs, introducing brokers, and other intermediaries may wish to assess whether existing BSA/AML, KYC, onboarding, suitability, disclosure, and market-conduct controls address the risks identified for compute derivatives, including opaque bilateral markets and geopolitically sensitive supply.
• Market participants may wish to submit comments by the applicable deadline, clearly referencing RIN 3038-AF77 and the Request for Comment on the Listing of Compute Derivatives Contracts, while avoiding unnecessary personal or confidential business information because submissions will be publicly posted.
• Firms tracking product development should consider monitoring any subsequent DCM self-certification or Commission-approval filing, as the consultation itself does not authorize trading or postpone a proposed listing.

What changed

No final rule, approval, prohibition, or new compliance obligation was introduced. The CFTC is requesting comment on compute cash-market size, liquidity, transparency, supplier concentration, fungibility, benchmark methodology, deliverable supply, manipulation risks, surveillance feasibility, customer protection, heightened BSA/AML and KYC issues, retail protections, and the design and risks of perpetual compute futures.

Key dates

2026-08-20

CFTC announced and published the Notice of Proposed Rulemaking seeking amendments to Regulation 37.3(a)(2).

Suggested considerations

• SEFs should assess which listed products and transaction categories are permitted transactions under Regulation 37.9(c)(1), distinguishing them from swaps subject to the CEA section 2(h)(8) trade-execution requirement.
• SEFs should consider whether to submit comments within 30 days after the Notice of Proposed Rulemaking is published in the Federal Register, including evidence on order-book usage, execution quality, liquidity, market transparency, and operational costs.
• SEFs should review their rulebooks, execution protocols, product listings, disclosures, surveillance coverage, and client documentation to determine what changes would be needed if the proposal is finalized.
• SEFs relying on the CFTC’s existing no-action relief should confirm the relief’s scope and conditions and maintain controls ensuring that required transactions continue to satisfy applicable execution requirements.
• Swap dealers, major swap participants, and other market participants should identify whether counterparties or venues may discontinue order-book functionality for permitted transactions and evaluate impacts on liquidity access, best execution or execution-quality processes, recordkeeping, and internal trading procedures.
• Compliance teams should monitor the Federal Register for the actual publication date, comment deadline, final-rule date, and any changes to the proposed effective date; the August 20, 2026 press release does not itself establish the comment deadline.

What changed

The proposed rule would remove the Regulation 37.3(a)(2) requirement for an SEF to offer an order book for permitted transactions. A permitted transaction is defined in Regulation 37.9(c)(1) as a transaction that does not involve a swap subject to the CEA section 2(h)(8) trade-execution requirement; such transactions are not required to be executed on an SEF or designated contract market and may use any execution method offered by the SEF.

Key dates

2026-08-20

Chairman Michael S. Selig delivered the Innovation Advisory Committee speech and announced the prospective roadmap for crypto assets, compute markets, and prediction markets.

Suggested considerations

• Firms should treat the speech as a forward-looking supervisory and rulemaking signal, not as an effective legal change, and continue applying currently effective CEA, CFTC regulations, registration, listing, reporting, customer-protection, and market-surveillance requirements.
• Crypto platforms should assess whether their products could constitute futures, swaps, or retail commodity transactions offered on a margined, leveraged, or financed basis, and should document the current jurisdictional and registration analysis for each product and customer segment.
• Crypto exchanges and protocol developers may wish to monitor CFTC releases, Federal Register notices, and any proposed rules concerning crypto asset markets, onchain finance protocols, and possible DCM designation; they should be prepared to submit comments within the applicable future comment periods rather than relying on the speech as a safe harbor.
• Designated contract markets and prediction-market operators should review event-contract listing governance, product surveillance, manipulation controls, customer disclosures, incentive programs, and state-law litigation exposure in light of the CFTC's stated intention to defend exclusive federal jurisdiction.
• Prediction-market firms should monitor developments concerning prohibited gaming-related contracts, public-interest standards, fully collateralized event-contract reporting, and enhanced consumer-protection requirements identified in independent industry coverage of the committee meeting.
• Firms developing compute-related contracts or financing products should map the underlying compute service, delivery and settlement terms, participants, and potential commodity or derivatives characterization so that they can respond meaningfully to the CFTC and Department of Commerce request for comment.
• Compliance teams may wish to update regulatory-change inventories and senior-management briefings to distinguish the Chairman's policy direction from binding Commission action, particularly because any future rules would require formal rulemaking, publication, and applicable transition periods.

What changed

The Chairman directed CFTC staff to explore rules establishing a CFTC framework for crypto asset markets using existing authorities. The proposed approach could allow current registrants and non-registrant crypto exchanges to be designated as a type of designated contract market called a crypto asset market, with authority to offer crypto asset trading on a leveraged or margined basis under purpose-specific rules; no rule text, eligibility criteria, effective date, or compliance threshold was issued in the speech.

Key dates

2021-01-01

The FCA’s permanent restriction on marketing speculative illiquid securities, including relevant mini-bonds and loan notes, to retail investors took effect under COBS 4.14.

2026-01-01

The UK regime regulating offers of securities to the public came into force under the Public Offers and Admissions to Trading Regulations 2024.

2026-07-16

Robert Goodhew and Andrew Stoneman of Kroll Advisory were appointed joint administrators of Woodville Consultants Ltd.

2026-08-20

The FCA publication was updated and warned consumers and market participants about risky mini-bonds, loan notes and related financial promotions.

Suggested considerations

• Compliance teams should inventory current and proposed promotions, introducer arrangements and distribution channels involving loan notes, mini-bonds, litigation funding, private credit or other potentially speculative illiquid securities.
• Firms should document the classification analysis under FCA COBS 4.14, including whether the security is speculative and illiquid, whether it is excluded from the restriction, and the precise exemption relied upon for any retail communication.
• Authorised firms should verify that every financial promotion is made or approved within the firm’s permission and competence, is fair, clear and not misleading under FCA Principle 7 and COBS 4, and contains sufficiently prominent explanations of capital-loss, liquidity, issuer-default and compensation-scheme risks.
• Firms should not rely solely on an investor’s self-certification as a high-net-worth or sophisticated investor; compliance teams may wish to test the basis, timing, wording and evidence for each investor-status declaration against the applicable Financial Promotion Order exemptions.
• Banks, payment firms and professional intermediaries should consider enhanced onboarding and transaction-monitoring controls for unusual high-yield investment flows, unexplained introducer commissions, overseas exchange references, trust structures and claims of FCA-regulated involvement that may create a misleading halo effect.
• Distribution agreements should clearly identify fees, commissions, conflicts and the party responsible for the promotion, with controls to prevent unauthorised introducers from soliciting UK retail investors or passing them to unauthorised issuers.
• Firms should assess whether a proposed public offer engages the Public Offers and Admissions to Trading Regulations 2024 and related FCA requirements, while treating that assessment as separate from financial-promotion, authorisation, conduct and investor-protection analysis.
• Relevant firms and professional intermediaries should retain evidence of due diligence, approvals, investor categorisation, risk disclosures, payment flows and complaints handling, and consider reporting suspicious activity or unlawful promotions to the FCA.

What changed

The FCA has reiterated that speculative illiquid securities, including most mini-bonds and loan notes, have been subject to a permanent restriction on their marketing to retail investors since 1 January 2021 under FCA COBS 4.14. The restriction does not make every loan note unlawful or bring every issuer within FCA authorisation; firms must separately assess whether the instrument falls within the restricted category, whether an exemption applies, and whether the promotion is made or approved by an authorised person in accordance with the Financial Services and Markets Act 2000 and the...

Key dates

2020-01-01

The FCA's temporary product intervention restricting mass-marketing of speculative illiquid securities to retail investors took effect.

2020-12-10

The FCA published PS20/15, confirming permanent rules for marketing speculative illiquid securities, including speculative mini-bonds, to retail investors.

2021-01-01

The permanent FCA restrictions on mass-marketing speculative illiquid securities to ordinary retail investors came into force.

2026-08-19

The FCA published the consumer warning following continuing losses and concerns about unregulated loan notes and mini-bonds, including the collapse of Woodville Consultants Limited.

2026-08-20

The FCA page was updated; the publication continues to operate as a warning and supervisory or enforcement signal rather than a new rule.

Suggested considerations

• Compliance teams may wish to inventory all loan notes, mini-bonds, debentures, preference shares, and comparable securities promoted, approved, advised on, arranged, or distributed by the firm.
• Firms should consider testing each product against the FCA definition of a speculative illiquid security, including the denomination threshold of less than £100,000, the use of proceeds, transferability, listing, and the applicable exemptions.
• Authorised firms should consider blocking mass-market communications, including websites, social-media advertising, broad email campaigns, affiliate content, and introducer activity, where the promotion is likely to reach ordinary retail clients.
• Where an exemption is relied on, firms should consider evidencing investor eligibility, the basis for any high-net-worth or sophisticated-investor status, the timing and validity of the investor declaration, and controls preventing onward dissemination to ineligible persons.
• Firms approving or communicating relevant promotions should consider verifying that required risk warnings, loss-of-capital disclosures, liquidity and default information, and third-party fee or commission disclosures are accurate, prominent, and consistent across all distribution channels.
• Due diligence should consider whether claims such as asset-backed, secured, FCA-authorised security trustee, listed, or fixed return accurately describe the legal and economic position of investors.
• Compliance teams may wish to review introducer agreements, commission arrangements, marketing costs, investor-money flows, and the proportion of subscriptions actually applied to the underlying investment.
• Firms should consider checking that communications do not use artificial deadlines, pressure tactics, unrealistic return comparisons, or performance claims unsupported by a credible explanation of repayment capacity.

What changed

No new binding requirement or prohibition was introduced by this publication. The FCA restated that its permanent rules prohibit authorised firms from approving or communicating financial promotions for speculative illiquid securities in a manner likely to be received by retail clients, subject to defined exemptions.

Key dates

2026-08-19

CFTC issued Release 9286-26 and announced the request for comment on listing compute derivatives contracts.

Suggested considerations

• Compliance teams may wish to identify whether the firm has direct or indirect exposure to compute cash markets, proposed compute futures, perpetual futures, benchmark administration, clearing, brokerage, or related trading activity.
• Firms considering submitting comments should assess the CFTC questions concerning cash-market size and liquidity, contract specifications, price formation, benchmark representativeness, settlement and rollover mechanics, manipulation scenarios, customer protection, and the risks of perpetual contracts.
• Potential contract venues and intermediaries should consider documenting how existing CFTC requirements under the Commodity Exchange Act and 17 CFR Parts 1 and 38 could apply to product submission, exchange oversight, market surveillance, position management, reporting, risk management, and customer funds.
• Trading and surveillance functions may wish to evaluate potential abusive strategies involving GPU capacity reservations, cloud allocation, data-centre outages, energy constraints, benchmark inputs, wash trading, spoofing, corners, squeezes, and manipulation of physical or reference markets.
• Firms should monitor the Federal Register and Regulations.gov for the publication date, final comment deadline, any technical corrections, and subsequent CFTC guidance or contract-approval filings.
• Market participants may wish to avoid treating the press release or request for comment as evidence that compute derivatives are already approved or that a reported exchange launch date is assured.
• Governance teams may wish to assign ownership across legal, commodities compliance, market surveillance, model risk, technology risk, procurement, and business teams because compute derivatives would connect financial-market controls with operational characteristics of cloud and data-centre markets.

What changed

The CFTC opened a public consultation under RIN 3038-AF77 concerning compute cash markets and potential compute derivatives contracts. The request seeks information on market size, liquidity, contract design, market oversight, manipulation risks, customer protection, and perpetual compute futures, and is associated with potential amendments or application of the CFTC framework in 17 CFR Parts 1 and 38. It does not itself approve a compute futures contract, authorize an exchange to list one, impose new compliance obligations, or establish a final regulatory position.

Key dates

2018-05-01

Demetrios Hadjigeorgiou became CEO of SVS Securities Plc.

2019-08-02

The FCA required SVS to cease regulated activities, safeguard assets and notify affected third parties.

2019-08-05

SVS Securities Plc entered special administration.

2023-08-10

SVS Securities Plc was dissolved.

2024-04-25

The FCA issued its initial Decision Notice proposing an £84,600 penalty and prohibition order against Mr Hadjigeorgiou.

2026-08-19

The FCA published the settled enforcement outcome: a £56,400 fine and prohibition from senior management positions in financial services.

Suggested considerations

• Compliance teams may wish to review whether senior managers have documented challenge and escalation responsibilities for investments involving issuer payments, commissions, related parties or other conflicts of interest.
• Firms should consider testing whether investment due diligence appropriately assesses product risk, liquidity, valuation methodology, concentration and suitability for pension and retail customers.
• Firms should consider reconciling all fees, commissions, retained spreads and exit-value adjustments against customer disclosures, ensuring that any reduction in redemption or sale value is prominent, timely and understandable.
• Boards and senior managers may wish to evidence periodic review of model portfolios against customers’ stated objectives, risk appetite, liquidity needs and pension-transfer circumstances.
• Compliance teams may wish to assess whether management information would have identified customer detriment, unusually high issuer-related income or investment decisions that prioritised firm revenue over customer interests.
• Firms should consider retaining clear records showing how conflicts were identified, mitigated, disclosed and challenged, including the rationale for approving high-risk or illiquid products for retail and pension-related portfolios.
• Authorised firms may wish to review the FCA’s SVS enforcement materials alongside their own senior-manager accountability maps and Statements of Responsibilities, while recognising that this case does not itself create a new universal obligation.

What changed

This is a concluded enforcement action against an individual, not a new general rule or threshold applicable to firms. The FCA imposed a financial penalty under section 66 of the Financial Services and Markets Act 2000 and a prohibition order under section 56 of that Act, following settlement and withdrawal of the Upper Tribunal referral. The FCA found a breach of Statement of Principle 6, requiring an approved person to exercise due skill, care and diligence in managing the business of the firm.

Key dates

2022-12-23

The SDNY entered the initial consent orders finding Ellison liable on two CFTC fraud counts and Wang liable on one fraud count; the trading and registration bans run from this date.

2026-08-19

The CFTC announced entry of the supplemental consent orders, continued cooperation requirements, and final sanctions resolving its enforcement actions against Ellison and Wang.

Suggested considerations

• Compliance teams may wish to update individual sanctions, registration-eligibility, and trading-eligibility records for Ellison and Wang, using December 23, 2022 as the start date for the applicable bans.
• CFTC registrants should consider screening applicants, employees, directors, officers, consultants, and controlled-account traders against the specific five-year trading prohibitions and registration prohibitions before permitting covered activity.
• Firms should consider obtaining and reviewing the operative supplemental and initial consent orders to determine the precise scope of prohibited trading, registration, and cooperation-related provisions rather than relying only on the press release.
• Digital asset and derivatives firms may wish to retain evidence of due diligence and escalation decisions concerning former FTX or Alameda personnel, counterparties, and beneficial owners.
• Compliance teams may wish to assess whether the resolution's treatment of substantial cooperation and the absence of additional monetary relief creates a relevant precedent for internal investigations, voluntary cooperation, document preservation, and regulator-engagement protocols.
• Firms should continue treating the permanent antifraud injunctions under Commodity Exchange Act Section 6(c)(1) and CFTC Regulation 180.1 as conduct restrictions applicable to Ellison and Wang; the resolution does not create a general exemption from those provisions for other market participants.
• Affected firms may wish to coordinate CFTC, SEC, bankruptcy, and criminal-case screening because the CFTC sanctions are distinct from the SEC officer-and-director restrictions and the criminal forfeiture order.

What changed

The supplemental consent orders finalize the CFTC's actions against Ellison and Wang in conjunction with their initial December 23, 2022 consent orders. Ellison is subject to a five-year trading ban and a 10-year registration ban; Wang is subject to a five-year trading ban and an eight-year registration ban. Both must continue cooperating with the Commission and remain permanently enjoined from violating the antifraud provisions charged under the Commodity Exchange Act and CFTC regulations. The bans run from the date of the initial consent orders rather than from August 19, 2026.

Key dates

2026-08-18

The SEC published the Chairman’s statement and proposed Regulation Crypto Assets, including the proposed startup exemption, fundraising exemption, and investment-contract safe harbor.

2026-03-17

The SEC issued its interpretation concerning the application of the federal securities laws to certain crypto assets and transactions, which the Chairman identifies as a basis for the proposed framework.

Suggested considerations

• Compliance teams may wish to treat the package as a proposal rather than a currently usable exemption and continue applying the existing Securities Act, Exchange Act, and applicable state-law analysis until final rules become effective.
• Potential issuers should consider mapping planned token offerings against the proposed $5 million/four-year and $75 million/12-month limits, including aggregation, timing, resale, and interaction with other registration exemptions once the proposing release is reviewed in full.
• Issuers considering the fundraising exemption should consider preparing systems for principles-based crypto disclosures, financial-condition information, audited financial statements at the applicable thresholds, and ongoing reporting.
• Legal and compliance functions may wish to assess whether existing investment-contract documentation contains essential managerial promises and whether operational evidence could support the proposed certification required for the safe harbor.
• Crypto trading venues and intermediaries should consider inventorying assets currently treated as securities or investment contracts and evaluating how a future safe-harbor determination could affect onboarding, trading permissions, disclosures, custody, surveillance, and state-law analysis.
• Firms may wish to monitor the Federal Register publication, the SEC comment period, any revisions to the proposal, and the status of the CLARITY Act, which the Chairman described as necessary for durable market-structure rules.
• Compliance teams may wish to review independent commentary emphasizing that the proposal is a major policy shift toward tailored token fundraising but that the practical scope remains uncertain until the detailed conditions, audit thresholds, eligibility criteria, and final text are settled.

What changed

The proposed rules would establish two exemptions from Securities Act of 1933 registration for qualifying crypto-asset investment contracts. The startup exemption would permit offerings of up to $5 million during a four-year period. The fundraising exemption would permit offerings of up to $75 million during each 12-month period, subject to principles-based crypto-asset disclosures, financial-condition disclosures, financial statements, ongoing reporting, and audited financial statements at specified capital-raising thresholds; the publication does not state those audit thresholds.

Key dates

2026-03-17

The SEC issued its earlier interpretation clarifying how federal securities laws apply to certain crypto assets and transactions involving crypto assets.

2026-08-18

The SEC announced the proposed Regulation Crypto Assets framework and opened the process for public comment, subject to publication of the proposing release in the Federal Register.

Suggested considerations

• Compliance teams may wish to map planned and existing token offerings against the proposed $5 million four-year and $75 million 12-month thresholds, including aggregation across related issuers, affiliates, projects and offering periods once the proposing release is reviewed.
• Issuers should consider documenting which exemption they would use, the relevant measurement period, investor eligibility and transfer restrictions, and controls intended to prevent exceeding the applicable offering cap.
• Firms should consider preparing draft principles-based narrative disclosures and, for the $75 million exemption, assessing financial-statement readiness and the systems needed for ongoing SEC reporting.
• Project sponsors may wish to inventory all essential managerial efforts represented or promised to investors and establish evidence, governance approvals and public communications supporting any future safe-harbor position based on completion or permanent cessation of those efforts.
• Exchanges, broker-dealers and trading platforms should consider assessing how the proposed safe harbor and state-law preemption could affect asset classification, listing reviews, customer disclosures, surveillance, custody and secondary-market controls.
• Industry participants may wish to review the full proposing release and consider submitting comments within 60 days after its publication in the Federal Register; the specific deadline should not be assumed until the Federal Register publication date is confirmed.
• Firms should continue treating the proposal as non-final and should not represent that an exemption, safe harbor or state-law preemption is currently available.

What changed

The proposed framework would add two exemptions from Securities Act of 1933 registration requirements for qualifying investment contracts involving crypto assets. The first would allow aggregate offerings of up to $5 million during a four-year period on a one-time basis; the second would allow offerings of up to $75 million during each 12-month period. Issuers relying on either exemption would need to make specified principles-based narrative disclosures available to investors.

Key dates

2026-08-18

ESMA launched the consultation on draft EMIR RTS and ITS for annual reporting of clearing activity at recognised third-country CCPs.

2026-10-12 Deadline

Deadline for stakeholders to provide feedback on the reporting framework, templates and format.

Suggested considerations

• Compliance teams may wish to submit comments on the proposed framework, templates and reporting format by 2026-10-12.
• Firms should consider identifying every recognised third-country CCP used by their EU entities and distinguishing direct clearing-member activity from client clearing activity.
• Reporting owners may wish to map the proposed Article 7d data points to existing EMIR Article 9 transaction reporting, margin, collateral, default-fund and treasury or payments data to determine what can be reused and what new data controls are needed.
• Groups should consider determining whether reporting will be performed by each EU entity or by the EU parent undertaking on a consolidated basis.
• Firms may wish to assess data availability by asset class and Union currency, calculation methodologies for annual average cleared values, and controls for margins, default-fund contributions and largest payment obligations.
• Technology and regulatory-reporting teams should consider designing provisional data lineage, reconciliation and governance processes, while treating implementation dates and final fields as subject to the final RTS and ITS.
• Firms should monitor ESMA’s Final Report and the subsequent adoption, endorsement and publication of the technical standards before treating the proposed reporting model as a final operative obligation.

What changed

This is a consultation rather than a final binding rule. ESMA proposes the reporting framework, templates and format required under EMIR 3 Article 7d for clearing members and clients that clear transactions through recognised third-country CCPs. Firms established in the EU and not part of an EU-consolidated-supervision group would report to their competent authority; where the firm belongs to such a group, the EU parent undertaking would report on a consolidated basis.

Key dates

2026-08-18

CFTC announced publication of a Notice of Proposed Rulemaking concerning amendments to Part 4 CPO and CTA registration requirements.

Suggested considerations

• Compliance teams may wish to obtain and review the full Federal Register proposal, including the precise sophisticated-investor criteria, pool-level conditions, adviser eligibility requirements, proposed small-pool capital threshold, effective date, and transition provisions.
• Firms should consider mapping each existing and prospective pool against the proposed CPO exemption conditions and each advisory mandate against the proposed CTA exemption conditions, without treating the proposal as currently available relief.
• SEC-registered advisers may wish to compare the proposed exemption with their current CFTC registration status, CFTC Regulation 4.13 or 4.14 filings, Rule 4.7 reliance, and any applicable CFTC staff no-action relief.
• Small-pool operators should consider recalculating eligibility using the proposed inflation-adjusted capital-contribution threshold once the precise amount is published and assessing whether existing offering, subscription, and compliance controls would continue to demonstrate compliance.
• Affected firms may wish to assess whether to submit comments within 45 days after Federal Register publication, particularly on investor definitions, treatment of derivatives and swaps, aggregation rules, recordkeeping, reporting, and coordination with SEC adviser requirements.
• Firms relying on existing exemptions or no-action letters should continue meeting their current conditions and filing obligations unless and until a final rule or separate relief changes them.
• Legal and regulatory inventories may be updated to cross-reference CFTC Regulations 4.5, 4.7, 4.13, and 4.14, the Commodity Exchange Act, and the Investment Advisers Act of 1940.

What changed

The CFTC issued a Notice of Proposed Rulemaking proposing amendments to Part 4. The proposal would add a CPO registration exemption for certain investment advisers registered with the SEC in connection with commodity pools whose participants are limited to specified sophisticated investors and that satisfy additional conditions set out in the proposal. It would add a related CTA registration exemption. It would also increase the capital-contribution threshold applicable to the existing small commodity pool exemption under CFTC Regulation 4.13 to account for inflation.

Key dates

2026-08-14

EAER amended Annexes 2 and 14a of the Ukraine Ordinance; one entity was removed from Annex 14a and 610 Annex 2 individual and entity entries were amended.

2026-08-17 Deadline

The amendments and resulting prohibitions, asset-freezing requirements and reporting implications take effect at 23:00 Swiss time; firms should have implemented screening and control changes by this time.

Suggested considerations

• Compliance teams should load the amended Annex 2 and Annex 14a data into sanctions-screening systems and complete identifier, alias, ownership and account-linkage checks before the 17 August 2026 23:00 effective time.
• Firms should compare the pre-amendment and post-amendment lists to distinguish the Annex 14a deletion from the 610 amended Annex 2 entries and should avoid treating an amended record as cleared without validating the current consolidated list.
• Firms should review customers, beneficial owners, counterparties, payment instructions, securities positions, custody assets and correspondent relationships against the amended records, including possible indirect ownership or control links.
• Where a match is confirmed, firms should consider stopping prohibited activity, freezing relevant funds and economic resources, restricting access in accordance with the Ordinance, and reporting the affected business relationship to SECO using the applicable reporting channel and form.
• For suspected sanctions evasion, inconsistent customer information or other money-laundering indicators, compliance teams may wish to document the Article 6 AMLA enhanced clarification and assess whether an immediate Article 9 AMLA report to the Money Laundering Reporting Office is required.
• Firms should document screening-rule changes, alert disposition, freeze decisions, SECO notifications, AMLA escalation decisions and any controlled release following the Annex 14a removal. Any unblocking should be preceded by checks for separate Annex 2 designation, ownership or other sanctions grounds.

What changed

The EAER amended Annex 2 and Annex 14a of SR 946.231.176.72. The official government notice indicates that one entity was removed from Annex 14a and the entries concerning 610 individuals and entities were amended in Annex 2; the publication does not state that all 610 entries are new designations, so firms should obtain and compare the underlying consolidated and delta lists before determining the precise status of each relationship. Financial intermediaries must implement the applicable prohibitions, freeze assets of sanctioned persons, and report affected business relationships to SECO.

Suggested considerations

• Firms should consider reviewing digital advertising, affiliate, referral and social-media monitoring for deepfake endorsements, unauthorised use of executive or brand identities, fake licence claims and links to cloned investment platforms.
• Compliance teams may wish to test whether the firm’s website address, legal entity name, AFSL number and contact details are consistently displayed and match ASIC’s Professional Registers Search, including any authorised representative relationships.
• Firms should consider implementing or refreshing rapid escalation and takedown processes for impersonation, cloned websites, fraudulent advertisements and misleading investment promotions, with documented evidence of referrals to platforms, banks, ASIC, cyber.gov.au and Scamwatch where appropriate.
• Marketing and distribution controls may wish to require provenance and approval checks for celebrity, influencer, public-figure and AI-generated content, together with surveillance for fabricated reviews, news articles and testimonials.
• Risk and governance functions should consider assessing AI-enabled scam and impersonation scenarios within financial-crime, cyber-risk, operational-resilience and consumer-harm frameworks, including scripted follow-up calls, fake trading dashboards and small initial profit payments used to build trust.
• Firms should consider reviewing customer and counterparty onboarding controls for entities claiming to hold an AFSL, and escalation procedures where an opportunity encourages consumers to bypass licensed professionals or cannot be independently verified.
• Boards or risk committees may wish to receive trend reporting on impersonation incidents, customer complaints, fraudulent domains, takedown requests, losses and control remediation, notwithstanding that this media release itself imposes no new reporting requirement.

What changed

No new rule, mandatory control, reporting obligation or compliance deadline was introduced. ASIC has reinforced its expectation that consumers independently verify Australian Financial Services Licence details against the professional registers, including matching the licence holder’s name and number to the business or opportunity being promoted. The warning also indicates that reliance on search-engine results, polished websites, branding, testimonials, celebrity endorsements or claims of ASIC licensing is insufficient where firms or consumers assess legitimacy.

Key dates

2026-08-14

The SEC announced the enforcement action and filed the complaint in the U.S. District Court for the Southern District of New York.

2020-12-01

Approximate beginning of the conduct period alleged by the SEC.

2025-06-30

Approximate end of the conduct period alleged by the SEC.

Suggested considerations

• Firms should consider reconciling every investor-facing statement about upfront fees, markups, commissions, carried interest, advisory fees, transaction spreads, and total acquisition cost against actual fund and affiliate-level economics.
• Compliance teams may wish to map all principal transactions and related-party transfers between advisers, sponsors, general partners, feeder funds, and portfolio-acquisition vehicles, with documented conflict reviews and valuation support.
• Firms should consider testing whether each person soliciting private-fund interests is properly registered or otherwise operating within an applicable broker-dealer exemption, and whether compensation arrangements create broker-dealer registration or supervision concerns.
• Compliance teams may wish to review cold-calling scripts, call recordings, lead-generation practices, sales-agent training, and escalation controls for high-pressure claims, guaranteed or implied returns, scarcity statements, and misleading descriptions of pre-IPO access.
• Firms should consider verifying offering exemptions, investor eligibility, registration status, subscription documentation, and disclosure delivery for each private fund and distribution channel.
• Compliance teams may wish to perform targeted surveillance of retail and retiree sales, including cancellation or cooling-off requests, unusual concentration, complaints about undisclosed fees, and differences between quoted and realized investor charges.
• Firms should consider preserving communications, transaction records, fee calculations, investor files, sales-agent compensation data, and valuation materials in anticipation of regulatory inquiries or investor claims.

What changed

This is a civil enforcement action, not a new rule or generally applicable safe harbor. The SEC alleges violations of the antifraud, securities-registration, and broker-dealer-registration provisions of the Securities Act of 1933, the Securities Exchange Act of 1934, and the Investment Advisers Act of 1940, together with control-person liability and aiding-and-abetting violations by Spaventa.

Key dates

2026-09-03 Deadline

Weekly commodity derivatives position reporting framework goes live; updated weekly reporting requirements apply from this date

2026-08-14

ESMA published the confirmation of the go-live date and availability of updated technical documentation

Suggested considerations

• Compliance teams may wish to confirm whether their commodity derivatives reporting population is in scope for the weekly position reporting regime.
• Firms may wish to validate that their internal reporting logic aligns with XML schema version v2.0 and the updated validation rules.
• Operations and controls teams may wish to complete end-to-end testing against the updated reporting instructions before 2026-09-03.
• Firms may wish to reconcile source data, cut-off processes, and approval workflows to ensure weekly submission can be produced on time.
• Compliance teams may wish to monitor for any national competent authority implementation guidance or venue-specific instructions affecting submission mechanics.

What changed

The publication confirms the go-live date for the weekly commodity derivatives position reporting framework after ESMA’s earlier postponement. The reporting process will move to the updated technical framework, including new reporting instructions, XML schema version v2.0, and associated validation rules. The key change is not a policy redesign but a mandatory implementation milestone: firms in scope will need to file weekly reports in the new format from 2026-09-03.