Crypto & Digital Assets Regulatory Updates

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying [email protected] by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.

Key dates

2025-01-17

DORA became applicable to in-scope financial entities, according to the CSSF implementation communication referenced by Circular CSSF 25/882.

2025-04-09

Circular CSSF 25/882 was published and applied with immediate effect.

2025-04-01 Deadline

The first exceptional CSSF register submission window opened for arrangements contracted up to 31 March 2025.

2025-04-15 Deadline

The first exceptional CSSF register submission window closed.

2026-08-27

Circular CSSF 26/915 was published and immediately amended Circular CSSF 25/882 to include qualifying third-country branches in Luxembourg.

2027-03-31 Deadline

Latest date for submission of the register covering arrangements contracted through the end of 2026, under the recurring annual window running from 28 February to 31 March of the following year.

Suggested considerations

• Firms should assess whether Luxembourg third-country branches now fall within the amended scope by comparing the branch’s undertaking and head-office activities with the DORA categories in Article 2(1)(a) to (t) and documenting the conclusion.
• Compliance teams may wish to inventory all ICT third-party arrangements, including digital, data, cloud, infrastructure and operational services that may not qualify as outsourcing under prior CSSF terminology.
• Firms should consider updating ICT third-party approval workflows so arrangements supporting critical or important functions are notified through the CSSF-prescribed form at least three months before commencement, or one month before commencement where the provider is an eligible Luxembourg support PFS.
• Firms should maintain an accurate register of information at individual, sub-consolidated and consolidated levels, with controls for prompt correction when requested by the CSSF and the ability to provide the register outside the annual submission window.
• Compliance and outsourcing teams may wish to reassess contractual access to professional-secrecy data against Article 41(2a) LFS or Article 30(2a) LPS and verify that Luxembourg ICT management or operations providers hold the required Article 29-3 LFS authorisation or qualify for an applicable exception.
• Firms using cloud services should confirm that the resource operator has designated a suitably qualified cloud officer and that internal cloud, information-security and third-party oversight responsibilities are clearly allocated.
• Third-country branches should consider implementing the requirements immediately because Circular CSSF 26/915 provides no transition period, while preserving evidence of governance, notification and register controls for supervisory review.

What changed

Circular CSSF 26/915 includes in Circular CSSF 25/882’s scope all Luxembourg third-country branches of undertakings covered by the specified DORA financial-entity categories where the head office would qualify as a DORA entity under Article 2(1)(a) to (t) in the relevant third country. The requirements apply to ICT services broadly, not only arrangements that meet a traditional outsourcing definition.

Key dates

2026-08-20

Chairman Michael S. Selig delivered the Innovation Advisory Committee speech and announced the prospective roadmap for crypto assets, compute markets, and prediction markets.

Suggested considerations

• Firms should treat the speech as a forward-looking supervisory and rulemaking signal, not as an effective legal change, and continue applying currently effective CEA, CFTC regulations, registration, listing, reporting, customer-protection, and market-surveillance requirements.
• Crypto platforms should assess whether their products could constitute futures, swaps, or retail commodity transactions offered on a margined, leveraged, or financed basis, and should document the current jurisdictional and registration analysis for each product and customer segment.
• Crypto exchanges and protocol developers may wish to monitor CFTC releases, Federal Register notices, and any proposed rules concerning crypto asset markets, onchain finance protocols, and possible DCM designation; they should be prepared to submit comments within the applicable future comment periods rather than relying on the speech as a safe harbor.
• Designated contract markets and prediction-market operators should review event-contract listing governance, product surveillance, manipulation controls, customer disclosures, incentive programs, and state-law litigation exposure in light of the CFTC's stated intention to defend exclusive federal jurisdiction.
• Prediction-market firms should monitor developments concerning prohibited gaming-related contracts, public-interest standards, fully collateralized event-contract reporting, and enhanced consumer-protection requirements identified in independent industry coverage of the committee meeting.
• Firms developing compute-related contracts or financing products should map the underlying compute service, delivery and settlement terms, participants, and potential commodity or derivatives characterization so that they can respond meaningfully to the CFTC and Department of Commerce request for comment.
• Compliance teams may wish to update regulatory-change inventories and senior-management briefings to distinguish the Chairman's policy direction from binding Commission action, particularly because any future rules would require formal rulemaking, publication, and applicable transition periods.

What changed

The Chairman directed CFTC staff to explore rules establishing a CFTC framework for crypto asset markets using existing authorities. The proposed approach could allow current registrants and non-registrant crypto exchanges to be designated as a type of designated contract market called a crypto asset market, with authority to offer crypto asset trading on a leveraged or margined basis under purpose-specific rules; no rule text, eligibility criteria, effective date, or compliance threshold was issued in the speech.

Key dates

2026-05-22

Switzerland added 115 natural persons and organisations to its Russia-related sanctions list; approximately 2,790 persons, companies, and organisations are now subject to asset freezes in connection with Russia’s war against Ukraine.

2026-08-19

The Federal Council decided to adopt the further measures of the EU’s 20th Russia sanctions package according to Switzerland’s established practice.

2026-08-20 Deadline

The new measures entered into force, including the prohibition on using Russian platforms for crypto-asset transfers and exchanges and the prohibition on supporting development of specified Russian crypto-assets such as the digital rouble.

Suggested considerations

• Firms should consider updating sanctions screening rules, prohibited-platform lists, wallet and counterparty controls, and transaction-monitoring scenarios to identify Russian crypto-asset platforms and indirect use of those platforms.
• Crypto-asset firms should consider mapping all transfer, exchange, custody, brokerage, technical-support, wallet-access, and infrastructure services against the applicable provisions of the Ordinance on Measures connected with the Situation in Ukraine, including the newly prohibited Russian platforms and specified Russian crypto-assets.
• Compliance teams may wish to review exposure to the digital rouble and other Russian or rouble-linked crypto-assets, including holdings, listings, liquidity provision, development support, transfers, and third-party integrations, and document any required exit or blocking decisions.
• Firms should consider validating that assets of sanctioned natural persons, companies, and organisations are blocked and that affected business relationships are reported to SECO in accordance with the sanctions ordinance.
• Firms should consider establishing or refreshing procedures for prompt escalation of sanctions-related suspicions, including additional clarifications under Article 6 GwG and an immediate Article 9 GwG report to the Money Laundering Reporting Office where suspicions cannot be dispelled.
• Senior compliance and operations owners may wish to evidence implementation from 2026-08-20 through control attestations, blocked-transaction testing, vendor and platform due diligence, and documented review of open Russian-related relationships.

What changed

The Switzerland-Russia sanctions regime now prohibits the use of Russian platforms for crypto-asset transfers and exchanges, targeting alternative payment channels that could facilitate sanctions circumvention. It also prohibits support for the development of specified Russian crypto-assets, including the digital rouble; independent market commentary places this measure alongside restrictions concerning Russian crypto-asset service providers, sanctioned trading venues, wallet or account access, technical assistance, and certain rouble-backed assets such as RUBx and A7A5, although the FINMA...

Key dates

2026-08-18

The competent UN Sanctions Committee amended the ISIL (Da’esh) and Al-Qaida sanctions list; the amendment became directly applicable in Switzerland.

2026-08-19

SECO updated the SESAM database and published the Swiss sanctions-list adjustment.

2026-08-20

FINMA published the updated sanctions notice describing the amendment and related financial-intermediary obligations.

Suggested considerations

• Compliance teams may wish to obtain the 2026-08-19 SESAM update and identify precisely which persons, companies or organisations were added, amended or removed.
• Firms should consider refreshing sanctions-screening data and screening customers, beneficial owners, counterparties, payment parties, securities positions and existing business relationships against the amended entries without delay.
• Where a potential match is identified, firms should consider applying the relevant prohibitions, preventing disposal or transfer of assets, documenting the match analysis and escalating the case under their sanctions procedures.
• Firms should consider reporting affected business relationships and frozen assets to SECO in accordance with SR 946.231.08 and retaining evidence of the report and asset-freeze decision.
• A SECO sanctions report should not be treated as a substitute for AML controls; where indicators give rise to suspicion, compliance teams may wish to conduct the additional clarifications required by Article 6 GwG and file an immediate MROS report under Article 9 GwG if the suspicion cannot be dispelled.
• Firms with delegated or outsourced screening may wish to verify that vendors refreshed their Swiss sanctions data after 2026-08-19 and that payment and transaction-monitoring controls cover the amended list.

What changed

The sanctions list under the Swiss Ordinance of 2025-03-21 on measures against persons and organisations associated with ISIL (Da’esh) and Al-Qaida (SR 946.231.08) was amended following the UN committee decision of 2026-08-18. The publication does not identify the amended entries or specify whether they are new designations, amendments or delistings; firms should therefore reconcile the current SESAM data against their prior screening population. The amendment applies in Switzerland directly and without a separate Swiss legislative adoption step.

Key dates

2022-12-23

The SDNY entered the initial consent orders finding Ellison liable on two CFTC fraud counts and Wang liable on one fraud count; the trading and registration bans run from this date.

2026-08-19

The CFTC announced entry of the supplemental consent orders, continued cooperation requirements, and final sanctions resolving its enforcement actions against Ellison and Wang.

Suggested considerations

• Compliance teams may wish to update individual sanctions, registration-eligibility, and trading-eligibility records for Ellison and Wang, using December 23, 2022 as the start date for the applicable bans.
• CFTC registrants should consider screening applicants, employees, directors, officers, consultants, and controlled-account traders against the specific five-year trading prohibitions and registration prohibitions before permitting covered activity.
• Firms should consider obtaining and reviewing the operative supplemental and initial consent orders to determine the precise scope of prohibited trading, registration, and cooperation-related provisions rather than relying only on the press release.
• Digital asset and derivatives firms may wish to retain evidence of due diligence and escalation decisions concerning former FTX or Alameda personnel, counterparties, and beneficial owners.
• Compliance teams may wish to assess whether the resolution's treatment of substantial cooperation and the absence of additional monetary relief creates a relevant precedent for internal investigations, voluntary cooperation, document preservation, and regulator-engagement protocols.
• Firms should continue treating the permanent antifraud injunctions under Commodity Exchange Act Section 6(c)(1) and CFTC Regulation 180.1 as conduct restrictions applicable to Ellison and Wang; the resolution does not create a general exemption from those provisions for other market participants.
• Affected firms may wish to coordinate CFTC, SEC, bankruptcy, and criminal-case screening because the CFTC sanctions are distinct from the SEC officer-and-director restrictions and the criminal forfeiture order.

What changed

The supplemental consent orders finalize the CFTC's actions against Ellison and Wang in conjunction with their initial December 23, 2022 consent orders. Ellison is subject to a five-year trading ban and a 10-year registration ban; Wang is subject to a five-year trading ban and an eight-year registration ban. Both must continue cooperating with the Commission and remain permanently enjoined from violating the antifraud provisions charged under the Commodity Exchange Act and CFTC regulations. The bans run from the date of the initial consent orders rather than from August 19, 2026.

Key dates

2026-08-14

The competent UN sanctions committee amended the ISIL (Da’esh) and Al-Qaida sanctions list; the amendment became directly applicable in Switzerland under the applicable automatic-implementation framework.

2026-08-17

SECO updated the Swiss-authoritative SESAM sanctions database and published the corresponding list adjustment.

2026-08-19

FINMA published its notice reporting the SECO sanctions-list update.

Suggested considerations

• Compliance teams may wish to retrieve the 17 August 2026 SESAM update and reconcile it against the prior list, recording all additions, removals and amendments and preserving the source version used.
• Firms should consider rerunning customer, beneficial-owner, counterparty, payment, trade and custody screening against the amended list, including historical transactions and open orders where their risk-based controls require retrospective review.
• Firms should consider reviewing transliterations, aliases, dates of birth, nationality, incorporation data and other identifiers for any newly listed individual or entity to reduce false negatives and false positives.
• Where a potential match is identified, firms should consider applying the prohibitions and asset-freeze requirements under SR 946.231.08, escalating the case under their sanctions procedures and assessing whether notification to SECO is required.
• Compliance teams may wish to verify that vendor feeds, transaction-screening systems, watchlists, case-management workflows and manual escalation procedures reflect the direct-applicability model and the 17 August SESAM update date.
• Firms should consider documenting the timing of list ingestion, screening completion, disposition of alerts, any blocked or frozen assets, and any reports or licence requests submitted to SECO for audit and supervisory purposes.

What changed

The UN sanctions committee changed the list of sanctioned individuals, companies and organisations covered by SR 946.231.08. Switzerland applies the change directly, without a separate Swiss legislative or regulatory adoption step. SECO updated SESAM, the SECO Sanctions Management database described as authoritative for Switzerland, on 17 August 2026 and published the amendment on its website.

Key dates

2026-08-18

The SEC published the Chairman’s statement and proposed Regulation Crypto Assets, including the proposed startup exemption, fundraising exemption, and investment-contract safe harbor.

2026-03-17

The SEC issued its interpretation concerning the application of the federal securities laws to certain crypto assets and transactions, which the Chairman identifies as a basis for the proposed framework.

Suggested considerations

• Compliance teams may wish to treat the package as a proposal rather than a currently usable exemption and continue applying the existing Securities Act, Exchange Act, and applicable state-law analysis until final rules become effective.
• Potential issuers should consider mapping planned token offerings against the proposed $5 million/four-year and $75 million/12-month limits, including aggregation, timing, resale, and interaction with other registration exemptions once the proposing release is reviewed in full.
• Issuers considering the fundraising exemption should consider preparing systems for principles-based crypto disclosures, financial-condition information, audited financial statements at the applicable thresholds, and ongoing reporting.
• Legal and compliance functions may wish to assess whether existing investment-contract documentation contains essential managerial promises and whether operational evidence could support the proposed certification required for the safe harbor.
• Crypto trading venues and intermediaries should consider inventorying assets currently treated as securities or investment contracts and evaluating how a future safe-harbor determination could affect onboarding, trading permissions, disclosures, custody, surveillance, and state-law analysis.
• Firms may wish to monitor the Federal Register publication, the SEC comment period, any revisions to the proposal, and the status of the CLARITY Act, which the Chairman described as necessary for durable market-structure rules.
• Compliance teams may wish to review independent commentary emphasizing that the proposal is a major policy shift toward tailored token fundraising but that the practical scope remains uncertain until the detailed conditions, audit thresholds, eligibility criteria, and final text are settled.

What changed

The proposed rules would establish two exemptions from Securities Act of 1933 registration for qualifying crypto-asset investment contracts. The startup exemption would permit offerings of up to $5 million during a four-year period. The fundraising exemption would permit offerings of up to $75 million during each 12-month period, subject to principles-based crypto-asset disclosures, financial-condition disclosures, financial statements, ongoing reporting, and audited financial statements at specified capital-raising thresholds; the publication does not state those audit thresholds.

Key dates

2026-03-17

The SEC issued its earlier interpretation clarifying how federal securities laws apply to certain crypto assets and transactions involving crypto assets.

2026-08-18

The SEC announced the proposed Regulation Crypto Assets framework and opened the process for public comment, subject to publication of the proposing release in the Federal Register.

Suggested considerations

• Compliance teams may wish to map planned and existing token offerings against the proposed $5 million four-year and $75 million 12-month thresholds, including aggregation across related issuers, affiliates, projects and offering periods once the proposing release is reviewed.
• Issuers should consider documenting which exemption they would use, the relevant measurement period, investor eligibility and transfer restrictions, and controls intended to prevent exceeding the applicable offering cap.
• Firms should consider preparing draft principles-based narrative disclosures and, for the $75 million exemption, assessing financial-statement readiness and the systems needed for ongoing SEC reporting.
• Project sponsors may wish to inventory all essential managerial efforts represented or promised to investors and establish evidence, governance approvals and public communications supporting any future safe-harbor position based on completion or permanent cessation of those efforts.
• Exchanges, broker-dealers and trading platforms should consider assessing how the proposed safe harbor and state-law preemption could affect asset classification, listing reviews, customer disclosures, surveillance, custody and secondary-market controls.
• Industry participants may wish to review the full proposing release and consider submitting comments within 60 days after its publication in the Federal Register; the specific deadline should not be assumed until the Federal Register publication date is confirmed.
• Firms should continue treating the proposal as non-final and should not represent that an exemption, safe harbor or state-law preemption is currently available.

What changed

The proposed framework would add two exemptions from Securities Act of 1933 registration requirements for qualifying investment contracts involving crypto assets. The first would allow aggregate offerings of up to $5 million during a four-year period on a one-time basis; the second would allow offerings of up to $75 million during each 12-month period. Issuers relying on either exemption would need to make specified principles-based narrative disclosures available to investors.

Key dates

2026-08-13

The competent UN Sanctions Committee amended the ISIL (Da’esh) and Al-Qaida list; independent notices describe amendments to four entries.

2026-08-14

SECO updated the Swiss SESAM database and published the corresponding Swiss sanctions-list update.

2026-08-17

FINMA published its updated sanctions notice drawing attention to the directly applicable Swiss list change.

Suggested considerations

• Compliance teams may wish to obtain the amended UN list and the updated SESAM data, identify the three amended individuals and one amended entity, and map all aliases, dates of birth, nationalities, addresses, registration details and other identifiers into screening systems.
• Firms should consider immediate rescreening of customers, beneficial owners, authorised signatories, counterparties, vendors, payment beneficiaries and relevant historical transactions against the amended data.
• Where a potential match is identified, firms should consider suspending the relevant transaction or relationship pending a documented false-positive assessment and escalating a confirmed or unresolved match to sanctions, legal and MLRO governance channels.
• For a confirmed match, firms should consider applying the asset-freeze restrictions under SR 946.231.08, preventing funds or economic resources from being made available directly or indirectly to or for the benefit of the designated person or entity, and assessing applicable Swiss notification and reporting requirements.
• Firms should retain evidence of the SESAM and screening-data update, screening timestamps, alert dispositions, approvals, transaction holds and any regulatory or law-enforcement communications.
• Control owners may wish to test whether outsourced screening providers, payment filters, correspondent-bank interfaces and crypto blockchain analytics received the update without delay.
• Compliance teams may wish to note the market reading reflected in parallel official-industry notices: the practical expectation is operational list maintenance and prompt rescreening, not merely awareness of the FINMA publication.

What changed

The list entries covered by the Ordinance of 2025-03-21 on Measures Against Persons and Organisations Connected with ISIL (Da’esh) and Al-Qaida (SR 946.231.08) were amended; the available public notices indicate amendments to three individuals and one entity, rather than a new standalone FINMA rule. The amendments became directly applicable in Switzerland through the UN sanctions-list mechanism, and SECO incorporated them into SESAM on 2026-08-14.

Suggested considerations

• Firms should consider reviewing digital advertising, affiliate, referral and social-media monitoring for deepfake endorsements, unauthorised use of executive or brand identities, fake licence claims and links to cloned investment platforms.
• Compliance teams may wish to test whether the firm’s website address, legal entity name, AFSL number and contact details are consistently displayed and match ASIC’s Professional Registers Search, including any authorised representative relationships.
• Firms should consider implementing or refreshing rapid escalation and takedown processes for impersonation, cloned websites, fraudulent advertisements and misleading investment promotions, with documented evidence of referrals to platforms, banks, ASIC, cyber.gov.au and Scamwatch where appropriate.
• Marketing and distribution controls may wish to require provenance and approval checks for celebrity, influencer, public-figure and AI-generated content, together with surveillance for fabricated reviews, news articles and testimonials.
• Risk and governance functions should consider assessing AI-enabled scam and impersonation scenarios within financial-crime, cyber-risk, operational-resilience and consumer-harm frameworks, including scripted follow-up calls, fake trading dashboards and small initial profit payments used to build trust.
• Firms should consider reviewing customer and counterparty onboarding controls for entities claiming to hold an AFSL, and escalation procedures where an opportunity encourages consumers to bypass licensed professionals or cannot be independently verified.
• Boards or risk committees may wish to receive trend reporting on impersonation incidents, customer complaints, fraudulent domains, takedown requests, losses and control remediation, notwithstanding that this media release itself imposes no new reporting requirement.

What changed

No new rule, mandatory control, reporting obligation or compliance deadline was introduced. ASIC has reinforced its expectation that consumers independently verify Australian Financial Services Licence details against the professional registers, including matching the licence holder’s name and number to the business or opportunity being promoted. The warning also indicates that reliance on search-engine results, polished websites, branding, testimonials, celebrity endorsements or claims of ASIC licensing is insufficient where firms or consumers assess legitimacy.

Key dates

2026-06-25

FinCEN published the underlying NPRM to amend the Huione Group definition

2026-06-25

Electronic comment filing became unavailable due to a portal issue

2026-06-30

Portal issue period ended after six days of blocked electronic filing

2026-07-22

FinCEN dated the comment-period extension notice

2026-07-24

Federal Register publication of the extension notice at 91 FR 46761

2026-08-02 Deadline

Extended deadline for written comments on the NPRM

Suggested considerations

• Consider whether to submit comments on the NPRM by the extended deadline of 2026-08-02.
• Review customer, correspondent, and payment relationships for any exposure to Huione Group, H-Pay Service PLC, or entities that may be treated as successor entities if the proposal is finalized.
• Assess whether internal screening, escalation, and due diligence procedures would need updates if FinCEN finalizes the expanded definition.
• Monitor FinCEN’s final action on the NPRM and any resulting special-measures scope changes under 31 CFR 1010.

What changed

This publication does not impose a new final obligation; it extends the public comment deadline for an existing NPRM. The underlying proposal would amend FinCEN’s definition of Huione Group, a financial institution operating outside the United States of primary money laundering concern, to include H-Pay Service PLC and to add a defined term for “successor entity.” The extension was granted because a technological issue with the comment portal prevented electronic filing from June 25 through June 30, 2026.

Key dates

22 June 2026

- CFTC issues the targeted request for comment on extending standard energy futures to 24/7 trading and on the listing of perpetual contracts referencing physically delivered or storable energy commodities

26 July 2026 Deadline

- Original 30‑day comment deadline for the RFC on 24/7 trading and energy perpetual contracts (now superseded by the extension)

26 August 2026 Deadline

- Extended deadline for submission of public comments on the RFC regarding 24/7 trading of standard energy futures and perpetual contracts referencing physically delivered or storable energy commodities

Suggested considerations

• Identify and convene an internal cross‑functional working group (trading, risk, operations, compliance, legal, and IT) to assess potential impacts of 24/7 trading and energy perpetual contracts on your firm’s business model and control environment.
• Perform a gap analysis of current trading, clearing, surveillance, margin, and risk management frameworks against the operational and risk expectations articulated in recent CFTC staff advisories and policy statements on 24/7 markets and perpetual contracts.
• Draft and submit a data‑driven comment to the CFTC by 26 August 2026 addressing the RFC questions most relevant to your activities, including empirical analysis of liquidity, price formation, manipulation risk, funding rate behavior, and customer protection in energy derivatives.
• Review and update internal policies and procedures for trade surveillance, market abuse monitoring, and manipulation detection to address continuous 24/7 trading windows and any contemplated use of energy perpetual contracts.
• Assess whether current staffing models, systems support, and incident‑response processes can support 24/7 trading or clearing operations, and document enhancements or mitigations that would be needed to maintain operational resilience.

What changed

• - The CFTC has extended the comment deadline on the RFC regarding 24/7 trading of standard futures contracts and perpetual contracts in energy markets by 30 days, moving the due date to 26 August...
• The RFC focuses on the extension of standard futures contracts, including energy futures, to a 24/7 trading schedule while keeping fixed expirations but allowing potentially material economic changes...
• The RFC separately focuses on the listing and regulation of perpetual contracts that reference physically delivered or storable energy commodities, such as crude oil, and that have no fixed...
• The Commission has added additional questions to the original RFC to probe market integrity, price formation, operational resilience, customer protections, and risk management implications of 24/7...
• The RFC builds on and is informed by the CFTC’s May 29, 2026 coordinated actions on perpetual contracts and 24/7 trading in digital commodities, including the Policy Statement on perpetual contracts,...

Key dates

22 July 2026

– AFM/AMF joint press release and position paper “From design to delivery – five enablers for effective European supervision” published, formally articulating the five enablers for centralised EU‑level supervision under the MISP

TBD (MISP legislative timeline)

– Specific dates for adoption and phased implementation of the Market Integration and Supervision Package will follow the EU legislative process; firms should anticipate a multi‑year transition with key milestones likely aligned to ESMA governance and funding reforms and initial scopes of direct supervision

Suggested considerations

• Review and update the firm’s supervisory engagement strategy to include structured, proactive engagement with ESMA (not just NCAs), anticipating more direct interactions, thematic reviews, and data requests at EU level.
• Assess current risk‑assessment and risk‑reporting frameworks to ensure they are compatible with a risk‑based and adaptive supervisory approach, including the ability to demonstrate how your firm identifies, measures, and mitigates emerging risks and new business models.
• Conduct a gap analysis of data architecture and regulatory reporting, focusing on data quality, standardisation, and ability to feed into centralised EU data hubs; plan upgrades to systems, controls, and data governance to support ESMA‑level data centralisation.
• Prepare for potential changes in supervisory levies and funding, by modelling the impact of EU‑level ESMA fees in addition to national contributions and incorporating them into medium‑term budgeting and pricing strategies.
• Review governance arrangements, including board oversight, senior management responsibilities, and internal escalation processes, to ensure they can meet higher expectations of independent, transparent, and accountable governance under an ESMA‑centric model.

What changed

• - ESMA is explicitly positioned as the central supervisory authority for selected capital‑markets activities, with national competent authorities (NCAs) expected to operate within a more formalised...
• Supervisory objectives are reframed towards risk‑based and adaptive supervision, meaning firms should expect more differentiated supervisory intensity based on risk profile, business model, and...
• The paper supports proportionate and transparent funding for ESMA, indicating a future where firms may be subject to EU‑level supervisory levies or fee structures in addition to national regimes,...
• AFM and AMF call for independent, transparent, and accountable EU‑level supervisory governance, foreshadowing changes to ESMA’s decision‑making bodies, oversight processes, and accountability...
• Data centralisation is identified as a core enabler, implying a stronger move towards EU‑wide data hubs, harmonised reporting formats, and central access for ESMA to transaction, position, and...

Key dates

10 July 2026

- ESMA publishes the new Q&As on ESGRR, MiCA, and MiFIR secondary market topics

Suggested considerations

• Review ESG ratings policies to ensure consulting, notification, issuer feedback, and factual error review procedures align with ESMA’s latest ESGRR Q&As.
• Update internal case-handling workflows so notifications are screened for the designated contact issue and the two-working-day notification period is calculated consistently.
• Document how your firm distinguishes internal-use ESG ratings or in-house financial services from externally provided ESG ratings activity.
• Reassess whether any second-party opinion business can rely on the ESGRR exemption and record the legal basis for that conclusion.
• Re-map MiCA permissions for custody, administration, transfer, and lending services to confirm the firm is not performing activities outside its authorisation scope.

What changed

• - ESMA added a Q&A clarifying consulting activities to investors or undertakings under the EU ESG Ratings Regulation (ESGRR), which is relevant where a ratings provider’s advisory services may...
• ESMA added Q&As on the application and scope of the two working day notification period under ESGRR, indicating that firms must apply the notification clock consistently and in line with ESMA’s...
• ESMA clarified access to the dataset for factual error review under ESGRR, which affects how rated entities or issuers can review underlying data used in ESG ratings processes.
• ESMA added a Q&A on notifications without a designated contact under ESGRR, which is relevant for governance and outreach workflows when a notification lacks an identified recipient.
• ESMA clarified the obligation to consider issuer feedback under ESGRR, reinforcing that issuer comments cannot be ignored and must be handled through a documented review process.

Key dates

Early 2Q 2024

- JFSA previously indicated additional jurisdictions would be added to the travel rule scope, signaling the ongoing evolution of the jurisdiction list and the need for firms to monitor regulatory updates

July 2026

- JFSA publishes the finalized partial amendment to the designation of countries/regions under Articles 17-2 and 17-3 of the Order for Enforcement of the APTCP following public consultation, confirming five additional jurisdictions

03 August 2026

- The finalized amendment to the designation of countries and regions under Articles 17-2 and 17-3 of the Order for Enforcement of the APTCP takes effect; travel rule obligations for transfers to VASPs in the newly added jurisdictions become legally binding from this date

Suggested considerations

• Review and obtain the official Attachment to identify the five newly added jurisdictions and verify their exact legal names and any specific conditions attached to their designation.
• Update internal jurisdiction lists and travel rule mapping to reflect all currently designated countries and regions under Articles 17-2 and 17-3, including the newly added five jurisdictions, ensuring that this mapping is embedded in transaction routing and screening engines.
• Revise travel rule implementation procedures so that originator and beneficiary information is consistently transmitted for all transfers of cryptoassets and electronic payment instruments from Japanese VASPs to foreign VASPs located in designated jurisdictions, including the new additions.
• Confirm that no de minimis threshold is applied in practice to covered transactions and that systems are configured to send travel rule data regardless of transaction size when the counterparty is in a designated jurisdiction.
• Update customer and counterparty onboarding documentation and contractual terms for foreign VASPs in newly designated jurisdictions to reflect their status as travel rule counterparties and any data-sharing, security, and retention requirements.

What changed

• - Japan has finalized a partial amendment to the list of designated countries/regions under Articles 17-2 and 17-3 of the Order for Enforcement of the Act on Prevention of Transfer of Criminal...
• The amendment expands the set of foreign jurisdictions for which Japanese firms must apply travel rule obligations when transferring cryptoassets and electronic payment instruments to foreign VASPs,...
• For transfers of cryptoassets and electronic payment instruments from Japanese VASPs to foreign VASPs, travel rule obligations apply only when the counterparty VASP is located in a jurisdiction...
• Transfers to foreign VASPs in non-designated jurisdictions remain outside the Japanese travel rule transmission obligation, reflecting JFSA’s concern about regulatory ineffectiveness where equivalent...
• The amendment confirms that the travel rule applies to both cryptoassets (virtual assets, VAs) and electronic payment instruments, including stablecoins (SCs) handled by Cryptoasset Exchange Service...

Key dates

10 November 2025

- Bank of England consultation paper issued on the proposed regulatory framework for sterling‑denominated systemic stablecoins and systemic payment system operators

Late 2026

- Bank of England intends to finalise the Code of Practice and supporting materials by the end of 2026, confirming the prudential and structural regime for systemic stablecoins

From 2026

- UK introduces new regulatory authorisation requirements for stablecoin issuers, including FCA authorisation for qualifying issuance and custody activities

10 February 2026

- Consultation period closes for the Bank of England’s systemic stablecoin regime proposals

June 2026

- Bank of England publishes its policy statement and draft Code of Practice for systemic stablecoin issuers, setting out detailed prudential and backing‑asset rules and confirming joint work with the FCA on an end‑to‑end regime

Suggested considerations

• Map all existing and planned sterling‑denominated stablecoin products against the UK’s systemic and non‑systemic regimes and assess whether their intended use in UK payments could trigger HM Treasury systemic recognition.
• Initiate or update FCA authorisation applications for stablecoin issuance and cryptoasset custody activities, ensuring business models, governance and safeguarding arrangements align with CP25/14 and the forthcoming stablecoin regime.
• Design and implement reserve‑management frameworks capable of maintaining backing assets equal to outstanding coins, in the proposed 70/30 mix between short‑term UK government debt and Bank of England deposits, with appropriate stress testing and liquidity risk oversight.
• Establish statutory trust and segregation structures for backing assets and liquid‑asset reserves, including appointing UK‑authorised third‑party custodians and aligning documentation with FCA client‑asset‑style protections and coinholder proprietary claims.
• Develop capital planning processes and ICAAP‑style assessments to meet the Bank of England’s requirements for capital against general business risk and dedicated reserves for financial risk and wind‑down costs.

What changed

• - UK stablecoin issuance will be subject to a dual regulatory regime: non‑systemic stablecoins will be supervised solely by the FCA, while systemic stablecoins used for payments will be jointly...
• Issuing a qualifying sterling‑denominated stablecoin in the UK will become a regulated activity, requiring FCA authorisation for non‑bank issuers and bringing them within the FCA’s prudential,...
• HM Treasury will apply statutory systemic tests under the Banking Act (e.g. scale, interconnectedness, substitutability, impact on confidence in sterling) to decide whether a stablecoin payment...
• Once recognised as systemic, stablecoin issuers and systemic payment system providers will fall under the Bank of England’s remit under the Banking Act 2009, including powers to obtain information,...
• Systemic sterling‑denominated stablecoin issuers will be required to maintain backing reserves equal to all outstanding coins, with backing assets held on statutory trust in the UK and ring‑fenced...

Key dates

18 June 2025

- FATF adopts modifications to Recommendation 16 to enhance payment transparency, including strengthened travel‑rule standards

24 June 2026

- FATF launches public consultation on guidance for the implementation of the updated Recommendation 16

21 August 2026 Deadline

- FATF public consultation period closes; this is the deadline for private‑sector contributions highlighted by the CSSF

End 2030

- FATF’s revised Recommendation 16 framework is expected to be fully effective, with jurisdictions having implemented the standard into national law or regulation by this date

Suggested considerations

• Map and document all existing and planned cross‑border payment and value‑transfer flows (including virtual asset transfers) to identify where FATF Recommendation 16 and travel‑rule obligations currently apply or will apply by 2030.
• Review the June 2025 FATF modifications to Recommendation 16 and the current consultation materials, and perform a gap analysis against your existing AML/CTF, KYC and payments data standards, including thresholds, data fields, and monitoring use‑cases.
• Establish an internal project for travel‑rule implementation and enhancement that spans AML, operations, technology, legal and data‑protection teams, with explicit ownership and governance.
• Strengthen beneficiary‑side transaction‑monitoring rules to use incoming travel‑rule data for sanctions, fraud and AML detection, including controls to identify misdirected or unusual payments based on name, location, and other attributes.
• Review and, where necessary, update customer due diligence and KYC procedures to ensure the availability and verification of data fields that will be required to travel with transactions (for example, address, town and country, identification numbers, date of birth).

What changed

• *(Based on the CSSF notice plus the 2025 FATF revisions to Recommendation 16 and existing travel‑rule standards; details may be further refined by the new guidance now under consultation.)*
• FATF is issuing implementation guidance for the updated Recommendation 16, which already increased obligations regarding payment transparency, including more granular beneficiary data and expanded...
• Cross‑border payments and value transfers above 1,000 USD/EUR are expected to include additional mandatory beneficiary information, such as beneficiary name, account or unique reference, and at least...
• Beneficiary institutions are given enhanced responsibilities to use travel‑rule information (not just receive it) for transaction monitoring, including detecting misdirected payments and indicators...
• The revised travel rule continues to apply to both traditional wire transfers and value transfers involving virtual assets, reinforcing that Virtual Asset Service Providers (VASPs) must collect,...

Key dates

TBD (from AMLA operational go‑live date in 2025–2026)

- AMLA formally designates its first batch of directly supervised obliged entities at EU level, potentially including entities identified under this circular

25 June 2026

- CSSF publishes Circular 26/914 identifying obliged entities eligible for direct supervision by AMLA and setting the framework for Luxembourg’s contribution to AMLA’s selection and supervisory process

TBD (periodic, post‑AMLA go‑live)

- Periodic reviews by AMLA and the CSSF of eligible entities’ status and updates to the list of entities subject to, or proposed for, direct AMLA supervision

Suggested considerations

• Determine whether your firm is likely to fall within the “eligible for AMLA direct supervision” perimeter by assessing your cross‑border footprint, ML/TF risk profile, group structure, and relative size against AMLA’s high‑risk and cross‑border criteria.
• Review and update the firm‑wide AML/CFT risk assessment to ensure it is robust, data‑driven, and aligned with an EU‑level supervisory perspective, including explicit consideration of cross‑border risks, complex group structures, and high‑risk products.
• Strengthen AML/CFT governance and oversight, including Board and senior management reporting, to demonstrate clear ownership of ML/TF risk, documented risk appetite, and effective challenge consistent with what AMLA expects from directly supervised entities.
• Review and, where necessary, enhance customer due diligence, transaction monitoring, screening and suspicious activity reporting frameworks to withstand more intrusive and harmonised EU‑level scrutiny.
• Map and document cross‑border business lines and passporting activities (branches, agents, tied intermediaries, distributors) to ensure you can provide complete and up‑to‑date information to the CSSF and AMLA on request.

What changed

• - The CSSF formally identifies Luxembourg “obliged entities” under AML/CFT law that are potentially eligible for direct AMLA supervision, clarifying which categories of firms fall into the EU‑level...
• The circular operationalises, at CSSF level, the EU allocation mechanism for direct supervision, building on Regulation (EU) 2024/… establishing AMLA and the forthcoming directly applicable AML...
• The CSSF establishes a process for providing information to AMLA on Luxembourg obliged entities (e.g. size, cross‑border activities, risk profile) to support AMLA’s periodic selection and review of...
• The circular clarifies that CSSF‑supervised entities identified as “eligible” remain under CSSF supervision unless and until AMLA formally designates them for direct supervision, at which point AMLA...
• The circular anticipates enhanced data and reporting requirements for entities assessed as eligible for AMLA direct supervision, including more granular information on cross‑border business,...

Key dates

23 June 2026

- CFTC files its lawsuit against Kentucky to block enforcement actions and special transaction fees against CFTC‑registered DCMs

TBD (2026–2027)

- Key procedural milestones in *CFTC v. Kentucky* (motion practice, preliminary injunction hearings, and potential appellate review), which will shape how quickly and broadly federal preemption over prediction markets is clarified

TBD (aligned with ongoing cases in Minnesota, Illinois, Rhode Island)

- Progression of related CFTC suits and amicus‑briefed appeals in the Sixth Circuit, Ninth Circuit, and Massachusetts Supreme Judicial Court, which will collectively define the jurisdictional perimeter for event contracts

Suggested considerations

• Review and update state‑law risk assessments for all CFTC‑regulated DCM activities, with a specific focus on gambling, consumer‑protection, tax, and licensing regimes in Kentucky and other active states.
• Conduct a targeted legal analysis of whether existing or planned event‑based or prediction‑market contracts might be recharacterised as gambling under relevant state laws, and document the basis for treating them as CFTC‑regulated derivatives.
• Map all customer‑facing operations, servers, marketing, and on‑the‑ground presence in Kentucky and other contentious states, and evaluate whether operational changes (e.g. geofencing, revised onboarding flows) are warranted pending judicial outcomes.
• Engage external counsel to monitor *CFTC v. Kentucky* and related state and federal cases, and establish an internal escalation protocol so that material developments (e.g. injunctions, adverse rulings) trigger prompt compliance and product‑governance review.
• Update board and senior management reporting to include a standing item on state–federal jurisdictional conflicts affecting prediction markets, highlighting litigation exposure, revenue at risk, and contingency plans.

What changed

• - The CFTC has initiated federal litigation against Kentucky seeking declaratory and injunctive relief to prevent the state from enforcing civil actions and special transaction fees against...
• Kentucky has filed civil enforcement actions in state court against CFTC‑regulated DCMs, characterising their event contracts as illegal gambling and seeking substantial monetary penalties.
• Kentucky has adopted a new “special transaction fee” (functionally an excise or levy) specifically targeting transactions on CFTC‑regulated DCMs, intended to incentivise these platforms to cease...
• The CFTC is explicitly framing Kentucky’s actions as an impermissible interference with Congress’s federal preemption framework and the CFTC’s exclusive jurisdiction over futures, options, and swaps,...
• The Commission is building a broader litigation strategy, noting parallel proceedings against Minnesota, Illinois, and Rhode Island and amicus participation before the Sixth and Ninth Circuits and...

Key dates

2026-06-23

BIS published the press release and pre-released the relevant Annual Economic Report 2026 chapter

2026-06-28

BIS plans to publish the full Annual Economic Report 2026 and the BIS Annual Report 2025/26

Suggested considerations

• Compliance teams may wish to assess whether any stablecoin-related business line depends on assumptions about parity redeemability, interoperability, or reserve quality that BIS identifies as weak points.
• Firms involved in tokenisation initiatives may wish to map their proposed operating model against the two-tier framework BIS endorses, especially where central bank money, commercial bank money, and tokenised assets would interact on programmable platforms.
• Banks and payment providers may wish to review funding, liquidity, and settlement assumptions for any products that could materially increase stablecoin usage or tokenised-money circulation.
• Crypto-facing firms may wish to examine whether current controls for financial crime, ledger interoperability, and customer redemption rights would satisfy a more stringent supervisory approach if stablecoins are used at scale.
• Market infrastructure and capital markets firms may wish to consider whether a unified-ledger or tokenised-deposit architecture could reduce reconciliation and settlement frictions in cross-border or wholesale workflows.
• Risk and policy teams may wish to monitor BIS follow-on publications, including the full Annual Economic Report 2026, for more detailed supervisory or implementation signals when it is published on 2026-06-28.

What changed

The publication is a policy signal, not a binding rule. BIS argues that tokenisation—digital representation of assets on programmable platforms—can be embedded in the current monetary architecture, where central banks provide the monetary anchor and commercial banks provide services to the public, to enable programmable payments and other efficiencies. BIS also states that current stablecoin designs fall short of the key properties of money, particularly singleness, meaning the ability to redeem different forms of money exactly at par for central bank money.

Key dates

2026-06-22

OCC bulletin announcing the notice of proposed rulemaking was issued

2026-07-22 Deadline

Planned deadline for comments, if the Federal Register publication date aligns with the bulletin date and the OCC’s 30-day comment period is measured from publication

Suggested considerations

• Compliance teams may wish to assess whether the entity falls within the OCC-supervised PPSI category or within the state-qualified issuer population covered by OCC authority under the GENIUS Act.
• Firms may wish to review existing AML/CFT and sanctions controls against the BSA, FinCEN, and OFAC requirements referenced in the proposal, including reporting, monitoring, and risk assessment procedures.
• Compliance teams may wish to map governance, escalation, and record-sharing workflows to the proposed OCC-FinCEN consultation framework, particularly for potential significant supervisory or enforcement matters.
• Firms may wish to consider whether their current policies, procedures, and internal controls are sufficiently tailored to stablecoin-specific risks and whether additional board or senior management oversight would be needed.
• Compliance teams may wish to evaluate whether they should submit comments during the 30-day Federal Register comment period if aspects of the proposed framework could affect operating models or compliance design.

What changed

The proposed rule would require OCC-supervised PPSIs to comply with the BSA, sections 4(a)(5) and 4(a)(6)(B) of the GENIUS Act, and applicable FinCEN and OFAC regulations, including AML/CFT program, sanctions program, and reporting requirements. It would also create a supervision and enforcement framework for PPSI AML/CFT programs, so the OCC can take AML/CFT supervisory and enforcement action against covered issuers. The rule would establish a formal consultation process between the OCC and FinCEN when the OCC intends to initiate an AML/CFT enforcement action or a significant AML/CFT...

Key dates

2024

- UK Government publishes its National Payments Vision, which provides the policy backdrop for a UK regime on digital money, including stablecoins

10 November 2025

- BoE consultation paper “Proposed regulatory regime for sterling‑denominated systemic stablecoins” is published, setting out the initial framework, including 60% cap on gilts and per‑holder limits

10 November 2025

- BoE Financial Stability Paper on “The role of holding limits for sterling‑denominated systemic stablecoins and a potential digital pound” is published, exploring the macro‑prudential rationale for quantitative limits

End of 2026

- BoE intends to finalise the Code of Practice and supporting rules for systemic sterling‑denominated stablecoins, following the consultation feedback

02 February 2026

- Sarah Breeden speech “Talking ’bout next generation” elaborates on digital money and the proposed stablecoin regime

Suggested considerations

• Conduct a regulatory perimeter and recognition analysis to determine whether any issued or planned sterling‑denominated stablecoin could meet the Banking Act 2009 systemic tests and therefore fall under the BoE systemic stablecoin regime.
• Review and update treasury and investment policies for stablecoin backing assets to ensure the portfolio structure can comply with the revised requirement of up to 70% short‑term UK government debt and the remainder in BoE deposits.
• Perform detailed liquidity and redemption stress‑testing to evidence that central bank deposits and gilt portfolios can support prompt redemption under extreme but plausible scenarios while remaining within the £40 billion issuance guardrail.
• Re‑calibrate business plans and revenue models for systemic stablecoin issuance to reflect the increased allowable share of interest‑bearing gilts, the absence of per‑holder limits, and continued constraints on paying interest to coinholders.
• Design and implement governance and risk‑management frameworks that meet BoE expectations for systemic payment systems, including Board‑level oversight, risk appetite for digital money, and clear accountability for prudential and operational risks.

What changed

• - The Bank of England has published a policy statement “Sterling‑denominated systemic stablecoins” (22 June 2026) and a draft Code of Practice that will constitute the primary rulebook for systemic...
• The regime applies only to systemic sterling‑denominated stablecoins used for UK payments, i.e. stablecoins recognised as systemic under Banking Act 2009 tests where disruption could threaten UK...
• The previous proposal that at least 40% of backing assets be unremunerated central bank deposits and up to 60% in short‑term UK government debt has been revised so that up to 70% of backing assets...
• Backing assets must remain highly liquid and low‑risk, with central bank deposits used explicitly to support prompt redemption in stress, while the expanded gilt component is intended to improve the...
• The BoE has dropped the earlier concept of temporary per‑holder limits (for example, £20,000 per individual and £10 million per business that were consulted on in 2025) and replaced them with a...

Key dates

17 June 2026

- CBI issues and publishes the warning notice that Lambestone Holding Limited (CLONE) is an unauthorised investment / investment business firm / crypto‑asset service provider and that its name is listed under section 53 of the Central Bank (Supervision and Enforcement) Act 2013

Suggested considerations

• Update internal sanctions, fraud, and high‑risk entity screening lists immediately to include Lambestone Holding Limited (CLONE), its known websites, email addresses and telephone numbers, and ensure these are used in client onboarding, periodic KYC reviews and transaction monitoring.
• Instruct client‑facing and dealing staff not to refer clients to, or accept instructions from, Lambestone Holding Limited (CLONE) or any individual using the listed domains, emails or phone numbers, and document this in internal guidance.
• Review and enhance client‑due‑diligence procedures to include explicit checks for clone‑firm indicators, including mismatches between a firm’s claimed regulatory status and the CBI online registers, as well as verification against CRO records.
• Implement a formal process to monitor and log Central Bank of Ireland warning notices (and similar notices from ESMA, other EU national competent authorities, FCA, etc.) and to propagate relevant alerts across first‑ and second‑line control functions.
• Conduct targeted staff awareness and training sessions for front‑office, call‑centre, and complaints‑handling teams on clone‑firm typologies, with Lambestone Holding Limited (CLONE) used as a current example of CRO‑identity cloning.

What changed

• - The CBI has formally designated Lambestone Holding Limited (CLONE) as an unauthorised investment firm, investment business firm and crypto‑asset service provider for Ireland, and has published its...
• The warning confirms that Lambestone Holding Limited (CLONE) is not authorised to operate as an investment firm or to provide crypto‑asset services in Ireland, and therefore may not lawfully provide...
• The CBI explicitly identifies Lambestone Holding Limited (CLONE) as a “clone firm” that has copied the name, address and CRO number of a legitimate company in the Companies Registration Office (CRO)...
• The CBI clarifies that there is no connection whatsoever between the legitimate CRO‑registered company and the scam entity, thereby protecting the reputation of the genuine firm and reducing...
• The warning includes a non‑exhaustive list of websites, email domains and telephone numbers used by the clone (multiple .com domains, support and individual email accounts, and international phone...

Key dates

10 June 2024

– Earlier CFTC NPRM on event contracts was published in the Federal Register as “Event Contracts; Proposed Rule, 89 FR 48968,” later withdrawn on 06 February 2026; the new NPRM effectively replaces that initiative with a more targeted framework

06 February 2026

– CFTC formally withdrew the 2024 Event Contracts proposed regulatory action (91 FR 5386), clearing the path for the current, more targeted NPRM on enumerated activities

12 March 2026

– CFTC issued an Advance Notice of Proposed Rulemaking (ANPRM) on prediction markets and a staff advisory to DCMs, launching a broader process to develop a tailored regulatory framework for prediction markets

30 April 2026 Deadline

– Comment deadline for the March 2026 prediction‑markets ANPRM, which this NPRM is described as addressing in part and which may lead to additional rulemaking

10 June 2026

– CFTC announces the new NPRM on amendments to Regulation 40.11 and addition of Appendix F to Part 40 regarding event contracts involving enumerated activities

Suggested considerations

• Map and inventory all existing and planned event contracts listed or cleared through CFTC‑registered entities to identify those that may “involve” terrorism, assassination, war, gaming, or conduct unlawful under federal or state law.
• Conduct a legal analysis of how the proposed definitions of “involve” and “gaming” would apply to your current product set, particularly sports, political, entertainment, and other contest‑based contracts, and document the rationale.
• Review and update internal product‑approval and new‑contract listing procedures to incorporate the proposed 90‑day CFTC review process, including timelines, documentation standards, and decision gates tied to Section 5c(c)(5)(C).
• Develop or update written policies and controls to ensure that contracts potentially involving enumerated activities are escalated for legal, compliance, and regulatory‑affairs review before submission to the CFTC.
• For DCMs and SEFs, enhance product‑submission templates to clearly address the proposed Appendix F public‑interest factors, including description of the underlying event, potential for unlawful activity, market integrity risks, and consumer‑protection considerations.

What changed

• - The NPRM would amend CFTC Regulation 40.11 to embed a formal analytical framework for assessing whether an event contract involves an activity enumerated in CEA Section 5c(c)(5)(C) and, if so,...
• The NPRM would add Appendix F to Part 40 to set out the factors, tests, and procedural steps the Commission will apply when reviewing specific event contracts referencing enumerated activities.
• The proposal would define key statutory terms, including at minimum “involve” and “gaming,” to clarify when an event contract is considered to touch an enumerated activity under CEA Section...
• The NPRM would establish a 90‑day review process for the Commission to evaluate event contracts that may implicate enumerated activities, including procedural protections such as notice, opportunity...
• The proposed framework would codify public‑interest factors the Commission will apply when deciding whether a particular contract involving an enumerated activity is contrary to the public interest...