Crypto & Digital Assets Regulatory Updates

Key dates

2020-10-27

FinCEN and the Federal Reserve Board published the NPRM proposing a $250 threshold and CVC-related clarifications at 85 FR 68005.

2026-11-09

Withdrawal of the NPRM takes effect upon publication in the Federal Register; no final rule will be issued from the withdrawn proposal without a new opportunity for public comment.

Suggested considerations

• Compliance teams may wish to document that the $250 threshold was proposed but never finalized, and that the applicable threshold remains $3,000 under the existing Recordkeeping Rule and Travel Rule framework.
• Firms may wish to validate that transaction-monitoring, case-management, record-retention, and payment-message controls have not been configured on the assumption that the withdrawn $250 threshold became effective.
• Covered institutions may wish to continue collecting, retaining, and transmitting the information required by 31 CFR 1010.410(e), 31 CFR 1010.410(f), and, where applicable, 31 CFR 1020.410(a) for transactions within the existing rule scope.
• Crypto businesses and their banking or payment partners may wish to retain existing risk-based controls for CVC transactions rather than treating withdrawal of the clarification as a removal of applicable AML obligations.
• Firms may wish to monitor for a future NPRM addressing CVC, stablecoins, digital assets with legal tender status, or transaction thresholds, because the agencies expressly left open the possibility of future amendments after additional public feedback.
• Remittance and payment providers may wish to assess whether procedures, customer disclosures, vendor specifications, and interinstitutional messaging agreements were prepared for the proposed $250 threshold and should now be revised or archived.

What changed

The agencies withdrew the NPRM published at 85 FR 68005 on October 27, 2020, and stated that they will take no further action on that proposal. The proposed reduction of the Recordkeeping Rule threshold under 31 CFR 1010.410(e) and 31 CFR 1020.410(a) from $3,000 to $250 for funds transfers and transmittals of funds beginning or ending outside the United States will not take effect. The proposed reduction of FinCEN's Travel Rule threshold under 31 CFR 1010.410(f) from $3,000 to $250 for transmission of information to other financial institutions in the payment chain will also not take effect.

Key dates

2026-11-03

The EAER expanded and amended the Swiss sanctions lists relating to Russia and Belarus.

2026-11-04

The Federal Council decided to adopt the EU’s 21st Russia and Belarus sanctions package and related measures.

2026-11-04

The amended sanctions lists entered into force at 23:00 Swiss time.

2026-11-05

The sectoral measures, including the strengthened crypto-sector restrictions and transaction prohibitions, entered into force.

Suggested considerations

• Compliance teams may wish to refresh sanctions screening against the amended Swiss Russia and Belarus lists, including customer, beneficial-owner, authorised-signatory, counterparty and payment screening records.
• Swiss crypto-sector companies should consider reviewing ownership registers, pending acquisitions, shareholder changes, control arrangements and beneficial-ownership information for Russian nationals and persons resident in Russia, including indirect acquisition structures.
• Firms should consider mapping exposure to the newly prohibited banks, financial institutions, crypto-service providers and other entities, and placing appropriate holds on affected transactions and assets pending resolution.
• Financial intermediaries may wish to document asset-freeze decisions and report affected business relationships to SECO in accordance with the applicable Ukraine sanctions ordinance.
• Where sanctions-related facts create suspicion of money laundering or terrorist financing, firms should consider completing the additional clarifications required by Article 6 AMLA and filing an immediate report under Article 9 AMLA if the suspicion cannot be dispelled.
• Firms may wish to update sanctions procedures, transaction-monitoring scenarios, onboarding questionnaires and escalation controls to distinguish SECO sanctions reporting from separate AMLA reporting.
• Compliance teams may wish to review external exposure to EU sanctions controls as well as Swiss measures; independent Swiss sanctions commentary describes the regime as not being a general Russia or Belarus embargo, but highlights continuing expansion of financial, crypto, services and circumvention controls.

What changed

The EAER expanded and amended the Russia and Belarus sanctions lists, adding 254 individuals, companies and organisations to measures including asset freezes and restrictions on making funds or economic resources available. Switzerland also introduced transaction prohibitions covering, among others, 33 Russian banks, one bank in a third country, 17 financial institutions and crypto-service providers, five third-country companies, four Russian airports and two Russian ports.

Key dates

2024-06-30

MiCAR provisions concerning asset-referenced tokens and e-money tokens became applicable.

2024-12-30

Most remaining MiCAR provisions, including the principal Title II framework for offers and admissions to trading of other crypto-assets and Title V CASP requirements, became applicable.

2026-11-06

The AFM published its warning and reminder concerning public crypto-asset offerings, memecoins, white papers and marketing communications.

Suggested considerations

• Compliance teams may wish to identify every token launched, distributed or promoted to EU users and document whether the activity is an issuance, public offer, admission to trading or a crypto-asset service under MiCAR.
• Firms should consider confirming that the issuer is a legal person and recording the basis on which any MiCAR exemption is relied upon, including the relevant investor-count or EUR 1,000,000 12-month threshold where applicable.
• Before marketing or distribution, firms should consider preparing, notifying and publishing the required MiCAR white paper and ensuring that its content follows the applicable regulatory technical standards and AFM submission expectations.
• Marketing, influencer activity, website content and social-media posts should be reviewed for fair, clear and non-misleading presentation, clear advertising identification, balanced risk disclosure and consistency with the white paper.
• Firms should consider retaining approval records, versions of promotional content, influencer instructions, audience and jurisdiction controls, and evidence supporting any exemption or risk classification.
• Trading platforms and CASPs may wish to assess onboarding and listing controls for tokens whose issuer, white paper, promotional claims or market-abuse risk indicators are unclear.
• Compliance teams should consider escalation procedures for exaggerated profit claims, undisclosed paid promotion, misleading statements about token utility or supply, and conduct suggesting fraud or market manipulation.
• Firms should consider checking whether the token is instead a financial instrument or an asset-referenced token or e-money token, in which case MiFID II or MiCAR Titles III or IV and their associated authorisation requirements may apply rather than, or in addition to, the ordinary Title II analysis.

What changed

The publication does not introduce a new regulation or effective date; it restates and foregrounds existing obligations under Regulation (EU) 2023/1114 on markets in crypto-assets (MiCAR). Under MiCAR Title II, a person intending to make a public offer of a crypto-asset other than an asset-referenced token or e-money token, or seeking its admission to trading, generally must be a legal person, draw up a crypto-asset white paper, notify it to the competent authority and publish it.

Key dates

2025-06-12

The SFC launched the consultation on expanding section 34 of the SFO and introducing similar restrictions under the AMLO.

2025-08-11

The consultation period closed; the SFC reported receiving nine submissions from industry associations, professional bodies, a bank and other interested parties.

2026-11-06

The SFC published its consultation conclusions, updated the FAQs and announced its intention to introduce an amendment bill into LegCo.

Suggested considerations

• Compliance teams may wish to inventory legal-entity names, business names, brands, websites, domains, mobile applications, social-media handles, product names and marketing descriptions against the SFC's proposed Table A and Table B titles.
• Firms should consider mapping each relevant name to the activities actually performed, including trading, brokerage, matching, exchange, clearing, settlement, custody and virtual-asset services, and documenting whether SFO or AMLO licensing could be required.
• Unregulated entities may wish to assess whether current names imply SFC licensing, regulated status or an association with a well-known exchange, clearing house or VATP, including through abbreviations, translated names and closely resembling wording.
• Licensed VATPs and financial groups may wish to review whether group-company names, partnerships, white-label arrangements, sponsorships or marketing references could create an apparent association with an established operation that does not exist.
• Legal and compliance functions may wish to monitor the amendment bill, LegCo proceedings, commencement provisions, transitional arrangements, the final restricted-title list and any future mechanism for updating that list.
• Firms considering a new name or business launch may wish to obtain independent Hong Kong legal advice and, where appropriate, seek SFC authorisation before adopting a potentially restricted title; the SFC has not announced a final application deadline or commencement date.
• Marketing and financial-promotion controls may be updated to require enhanced review of terms such as "exchange", "trading platform", "clearing house", "virtual asset", "digital asset", "token" and "crypto" once the amendments are enacted.

What changed

The SFC will proceed with legislative amendments to expand the existing section 34 SFO restrictions beyond titles such as "stock exchange" and "commodity exchange". The expanded scope is intended to cover titles commonly used instead of "exchange", titles describing SFO-regulated products, titles referring specifically to clearing operations, and names or acronyms implying association with established or well-known exchanges, clearing houses, VATPs or similar operations, whether located in Hong Kong or elsewhere and whether regulated or unregulated.

Key dates

2026-09-30

The FCA’s application window for the new UK cryptoasset regime opened.

2026-10-01

The application window opened for the FCA Regulatory Sandbox themed cohort on climate scenario models.

2026-11-02

The FCA published Wholesale banks supervision - Insights 3 (Autumn 2026).

2026-11-30 Deadline

The application window closes for the FCA Regulatory Sandbox climate scenario models cohort.

2027-02-28 Deadline

FCA-encouraged deadline for wholesale banks to submit a variation-of-permission application for new regulated cryptoasset activities to obtain the stated pre-regime application treatment.

2027-10-25

The new UK cryptoasset regime comes into force.

Suggested considerations

• Firms should consider performing a control-by-control review of critical data ingestion, including completeness checks, reconciliation, coding-change testing, source-to-consumption lineage and evidence of design and operating effectiveness for financial-crime and surveillance controls.
• Compliance and technology teams may wish to test communications surveillance after system changes, including lexicon configuration, geographic and channel coverage, third-party-provider interfaces, ingestion completeness and retention or auditability of records for in-scope activities.
• Firms should consider reconciling the technology-asset inventory to procurement, disposal, redeployment, identity and endpoint-management records across all regions, assigning clear lifecycle accountability and confirming that assets cannot leave service without security and inventory updates, including encryption status.
• Algorithmic-trading firms should consider testing enhancements across the complete order lifecycle, including near-simultaneous and geographically distributed fills, order-management and fill-notification interactions, overfills, stop-loss scenarios, venue behaviour, pre-trade limits, kill or cancel mechanisms and post-implementation monitoring, with governance aligned to UK MiFID RTS 6.
• Firms should consider testing DLP controls against deliberate circumvention, including split messages, altered classifications, changed file formats, embedded images and misleading subjects, while reviewing staff training, monitoring, escalation and privacy safeguards.
• Operational-resilience owners may wish to refresh important-business-service impact tolerances using potential disruption to trading, settlement, clients, counterparties and time-critical market processes rather than relying solely on generic recovery-time or availability metrics.
• Firms should consider separating current resilience capability from planned remediation in self-assessments, linking incidents, near misses and test results to mapping and remediation decisions, and validating completed remediation through retesting.
• Settlement-related firms should consider the effect of T+1 on post-trade dependencies, reconciliation, funding, exception management, recovery capability, scenario testing and impact-tolerance calibration.

What changed

The FCA has not introduced new binding rules through this publication; it has consolidated supervisory findings and clarified areas against which wholesale banks may be assessed. Firms are expected to be able to evidence complete data lineage and ingestion controls, auditable recording and communications surveillance even where third parties are used, reliable asset inventories, end-to-end algorithmic-trading testing and controls consistent with UK MiFID RTS 6, and DLP controls capable of addressing adaptive evasion techniques.

Key dates

2026-10-29

The SEC announced charges against BG Wealth Sharing Ltd and DSJ Exchange Pty Ltd and filed the related enforcement complaint in the U.S. District Court for the Northern District of California.

Suggested considerations

• Compliance teams may wish to review third-party crypto platforms, advisers, issuers, introducers, and promoters for unsupported claims that an SEC filing represents licensing, approval, endorsement, or authorization.
• Firms should consider independently verifying Form ADV, Form D, and other regulatory filings through official regulator databases and documenting the precise legal effect of each filing before relying on it in due diligence or investor communications.
• Marketing and financial-promotion controls may wish to test for claims of risk-free or guaranteed returns, extraordinary monthly performance, government approval, SEC registration, fake certificates, and statements that a Rule 506(c) filing authorizes operation of a crypto exchange.
• Firms with exposure to BG Wealth Sharing, DSJ Exchange, or associated promoters should consider escalating the relationship for legal, fraud, sanctions, counterparty, and suspicious-activity review and preserving relevant communications, transaction records, and onboarding materials.
• Investment advisers and other regulated firms may wish to assess whether referral, custody, payment, or platform relationships involving similar schemes create customer-protection, books-and-records, disclosure, or reputational risks.
• Compliance teams may wish to incorporate the related state and foreign warnings into typology monitoring, particularly indicators such as recruitment-based compensation, blocked withdrawals, advance exit or compliance fees, fake account balances, and periodic payments used to sustain investor confidence.

What changed

This is an enforcement action, not a new rule or generally applicable compliance requirement. The SEC alleges violations of the antifraud provisions of the Securities Act of 1933 and Securities Exchange Act of 1934 by both entities, and violations of Sections 204(a) and 207 of the Investment Advisers Act of 1940 by BG Wealth. The SEC is seeking permanent injunctions, disgorgement with prejudgment interest, civil penalties against both entities, and conduct-based injunctions against BG Wealth.

Key dates

2025-10-21

The FCA commenced High Court proceedings in the Business and Property Division against Huobi Global S.A. and persons unknown concerning alleged breaches of section 21 FSMA.

2026-02-10

The FCA publicly announced its enforcement action against HTX for unlawful cryptoasset promotions to UK consumers.

2026-10-29

The FCA announced the High Court settlement and undertakings; HTX was no longer active in the UK, with no deposits or new UK registrations permitted.

2027-10-01

The FCA publication states that cryptoassets remain largely unregulated in the UK, apart from anti-money-laundering and financial-promotion requirements, until October 2027.

2031-10-21

The court order provides that Huobi Global's undertakings continue until this date.

Suggested considerations

• Compliance teams may wish to identify all UK-facing cryptoasset communications across websites, applications, email, affiliates, influencers and social-media platforms, including communications published by overseas group entities.
• Firms should consider documenting the legal basis for each UK financial promotion under section 21 FSMA, including the firm's authorisation status, any authorised-person approval and any applicable exemption under the Financial Services and Markets Act 2000 (Financial Promotion) Order 2005.
• Overseas firms should consider geo-blocking and other durable controls for UK users, while testing whether content, account access, app availability, search visibility or social-media activity remains capable of having an effect in the UK.
• Marketing and compliance teams may wish to implement pre-publication approval, withdrawal and monitoring controls for third-party affiliates, influencers and social-media operators, with records showing who approved each communication and where it was distributed.
• Firms with existing UK users should consider reviewing account-access, deposit, withdrawal and customer-communications arrangements so that any UK exit strategy does not leave consumers exposed to continuing unlawful promotions.
• Cryptoasset businesses may wish to monitor the FCA Warning List and Firm Checker and assess whether their UK activities could also trigger UK anti-money-laundering registration or other authorisation requirements.

What changed

This is a settlement and enforcement outcome rather than a new generally applicable rule. Huobi Global is bound by court undertakings not to knowingly, directly or indirectly, communicate or cause to be communicated financial promotions contravening section 21 FSMA, including promotions on HTX websites, software applications and social-media platforms. HTX will not target, solicit or actively seek to engage UK consumers; UK consumers can no longer deposit funds or open new accounts, and residual-asset withdrawals are addressed through HTX's published arrangements.

Key dates

2026-10-28

ADGM published the Guidance on Crypto Mining Activities in and from ADGM under section 23 of the Commercial Licensing Regulations 2025.

Suggested considerations

• Firms considering establishment or continued operation in ADGM should perform the RA pre-application self-assessment and document why their activities fall within commercial mining rather than an FSRA-regulated financial service.
• Operators should assess whether they require or should apply for the dedicated commercial licence associated with activity code 7230 and should avoid representing the licence as an authorisation to conduct regulated financial services.
• Compliance teams may wish to prepare an up-to-date corporate structure and ultimate-beneficial-owner information for RA review, together with governance documentation proportionate to the scale and risk of the operation.
• Operators should identify all blockchain addresses used to receive mining rewards and establish controlled procedures for making the required confidential on-chain address disclosures to the RA.
• ADGM-headquartered groups should map global mining activities, reporting lines, outsourced infrastructure, jurisdictional controls and board oversight so that the ADGM entity can demonstrate reasonable supervision of overseas operations.
• Firms should review whether staking, validator, custody, brokerage, token issuance, investment management or other associated activities separately require FSRA permission or create an additional regulatory perimeter.
• Operators may wish to monitor the RA’s forthcoming consultation on the second-phase regulatory framework and preserve records supporting their current perimeter analysis, licensing basis, governance and operational-risk controls.
• Firms should consider the practical implications identified in independent commentary, including operational resilience, cybersecurity, infrastructure security, energy management, transparent service terms and any applicable UAE federal tax, accounting and AML/CFT requirements, without treating those commentary points as additional requirements expressly created by this publication.

What changed

Commercial crypto mining conducted in or from ADGM is associated with dedicated RA commercial activity code 7230 and requires the applicable commercial licensing pathway. The Guidance is technology-neutral and covers Proof-of-Work, Proof-of-Stake and future consensus mechanisms. It establishes a pre-application self-assessment to help applicants distinguish mining from FSRA-regulated financial activities, and highlights expectations concerning corporate structure, ultimate beneficial ownership, and confidential disclosure of on-chain addresses used for reward flows.

Key dates

2026-10-23

FCA consultation CP26/38 opened and published.

2026-12-24 Deadline

Deadline for submitting responses to the FCA consultation.

2027-10-01

The FCA describes the new cryptoasset regime as applying from October 2027; the precise commencement date should be confirmed against the final legislation and FCA rules.

Suggested considerations

• Compliance teams may wish to review the proposed changes and submit consultation responses through the FCA online form by 24 December 2026, particularly where the proposals would create material implementation costs or operational challenges.
• Firms should consider mapping current fraud, AML/CTF, sanctions, proliferation-financing, data-security and financial-crime systems-and-controls frameworks against the consultation themes, while recognising that the proposals are not yet final guidance.
• Cryptoasset businesses and firms intending to provide regulated cryptoasset services may wish to assess readiness for the new regime expected in October 2027, including AML/KYC controls, blockchain analytics, Travel Rule processes, sanctions screening, transaction monitoring and governance.
• Firms using AI or external technology providers for transaction monitoring, customer screening or other financial-crime controls should consider documenting model governance, validation, parameter testing, explainability, human oversight, data security, third-party oversight and retention of decision records.
• Senior management and boards may wish to review whether financial-crime management information, risk assessments and escalation arrangements adequately cover proliferation financing, sanctions evasion, cryptoasset risks and reliance on outsourced or AI-enabled controls.
• Firms may wish to monitor the FCA's final Policy Statement and consolidated Financial Crime Guide, since the final text may differ from the consultation proposals and is likely to inform future supervisory assessments.

What changed

No new binding rules have been made by this consultation. The FCA proposes to revise non-Handbook guidance and practical examples in the Financial Crime Guide to reflect emerging risks and regulatory developments, including AI and third-party tools used in financial-crime controls, cryptoasset-specific risks, evolving financial and trade sanctions, proliferation financing, data security, fraud, and AML/CTF systems and controls.

Key dates

2020-11-01

Beginning of the period during which the Central Bank found Coinbase Ireland breached safeguarding and outsourcing obligations under the Electronic Money Regulations 2011.

2025-08-19

End of the enforcement period identified by the Central Bank.

2026-10-21

Central Bank of Ireland and Coinbase Ireland reached the settlement under the undisputed-facts settlement process.

2026-10-22

Central Bank published the enforcement outcome and announced the proposed reprimand and discounted monetary penalty.

Suggested considerations

• Firms should map all safeguarding responsibilities to the specific Irish or EU-authorised entity that holds the regulatory obligation and document how the entity retains effective control despite group or third-party outsourcing.
• Compliance teams may wish to assess whether the regulated entity has sufficient local expertise, decision-making authority and management information to oversee safeguarding and challenge outsourced providers on an ongoing basis.
• Firms should consider independently validating the design of safeguarding calculations, reconciliations, treasury-rebalancing processes and designated safeguarding-account funding, including testing for data, systems and mapping errors.
• Firms may wish to perform daily or otherwise risk-appropriate reconciliations between customer liabilities, safeguarding obligations and funds held in designated accounts, with documented investigation and remediation of exceptions.
• Boards and senior management should consider whether control testing covers the complete safeguarding process, including outsourced components, and whether testing is sufficiently independent and frequent to identify prolonged shortfalls.
• Firms should review escalation procedures for safeguarding incidents, control failures, underfunding and material changes to operating models, including criteria and ownership for notifying the Central Bank of Ireland.
• Authorised firms should compare their current operating model with representations, commitments and governance arrangements submitted during authorisation and assess whether any material changes were notified to the Central Bank.
• Outsourcing registers, contracts and service-level arrangements should be reviewed to confirm clear regulatory access, audit rights, information rights, incident reporting, business-continuity provisions and accountability for safeguarding outcomes.

What changed

The publication does not introduce a new statutory rule; it applies existing obligations under the Electronic Money Regulations 2011 and establishes a substantial enforcement precedent. Coinbase Ireland admitted that it lacked an adequate outsourcing-governance framework, relied excessively on a US Coinbase Group entity, lacked sufficient local skill and expertise to oversee safeguarding, used inadequately designed and tested systems that left its designated safeguarding account underfunded, and lacked adequate escalation and reporting arrangements for material safeguarding changes.

Key dates

2026-10-21

FCA published GC26/7 and opened the guidance consultation.

2026-11-18 Deadline

Deadline for consultation responses to GC26/7.

2027-01-01

FCA plans to publish final DeFi guidance during January 2027; no specific publication day has been stated.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are due to bring new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Compliance teams may wish to map each DeFi use case, protocol, smart-contract dependency, service provider and customer-facing activity against the firm's existing SYSC 15A, SYSC 6 and Money Laundering Regulations obligations.
• Firms should consider documenting governance and accountability for DeFi arrangements, including who controls or can materially influence protocol changes, access permissions, treasury assets, upgrades, emergency controls and customer outcomes.
• Operational resilience teams may wish to assess important business services, impact tolerances, vulnerabilities, third-party and smart-contract dependencies, oracle and bridge risks, key-management arrangements, cyberattack scenarios and credible disruption testing.
• Financial-crime teams should consider whether existing customer due diligence, transaction monitoring, sanctions screening, blockchain analytics, wallet-risk assessment, suspicious activity escalation and record-keeping controls remain effective for pseudonymous, automated or cross-chain activity.
• Firms may wish to review outsourcing and third-party risk assessments for protocol developers, validators, custodians, wallet providers, analytics providers, cloud infrastructure and other critical DeFi dependencies.
• Legal and regulatory teams should assess whether current and planned activities fall within the existing perimeter or the new cryptoasset activities introduced by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, including whether there is an identifiable controlling entity.
• Affected stakeholders may wish to submit responses to the FCA by 18 November 2026 and identify any areas where the illustrative guidance is unclear, disproportionate or difficult to apply to genuinely decentralised arrangements.
• Firms may wish to track the FCA's planned final guidance in January 2027 and update risk assessments, policies, control testing and implementation plans before the new cryptoasset regime commences.

What changed

The FCA is proposing guidance describing the operational resilience and financial crime risks associated with DeFi and providing illustrative measures firms may consider. The guidance is relevant to firms within SYSC 15A, SYSC 6 and the Money Laundering Regulations, including firms using distributed-ledger technology, automated protocols, open and interoperable systems or arrangements with limited traditional intermediation. It is intended to clarify application of existing requirements rather than establish a separate DeFi regime or new Handbook obligations.

Key dates

2026-09-30

The application period opened for existing UK cryptoasset businesses seeking to conduct new regulated cryptoasset activities and benefit from the savings provision.

2026-10-21

FCA consultation CP26/36 opened and was published.

2026-11-18 Deadline

Deadline for responses to FCA consultation CP26/36.

2027-01-01

FCA aims to publish final perimeter guidance after considering consultation responses.

2027-02-28 Deadline

Application period closes for firms seeking to rely on the savings provision for newly regulated cryptoasset activities.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are scheduled to bring the new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Firms should map each proposed and existing cryptoasset activity against the statutory regulated activities in the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 and the proposed PERG guidance, documenting the factual basis for any exclusion relied upon.
• Technical-service providers should assess whether they merely provide access to a third-party service or decentralised protocol, or whether they also arrange, execute, safeguard, operate, control or otherwise provide a service to users; the use of automation or decentralised technology should not be treated as determinative.
• Stablecoin and payment businesses should identify the precise duration, purpose, parties and asset flows associated with temporary holding and backing-asset arrangements and test whether the relevant statutory conditions are met.
• Trading firms and market makers should distinguish genuine proprietary trading from activity performed as a service for another person and retain evidence supporting any reliance on the proprietary-trading or qualifying-cryptoasset-trading-platform market-maker exclusion.
• Firms should review safeguarding and settlement structures, including structures involving central securities depositaries and third-country central securities depositaries, for possible inclusion within the proposed exclusions or within regulated custody-related activities.
• Businesses that may need authorisation should consider submitting responses to CP26/36 by 18 November 2026 and should not defer application planning while the guidance remains in consultation.
• Existing UK cryptoasset businesses seeking to conduct newly regulated activities should consider submitting an otherwise complete application between 30 September 2026 and 28 February 2027 to preserve access to the applicable savings provision.
• Firms materially affected by uncertainty about the technical-services-provider exclusion should consider engaging the FCA through its pre-application support service and retaining evidence of how that uncertainty affected application preparation.

What changed

The FCA proposes guidance on exclusions from regulated cryptoasset activities introduced by the draft Cryptoassets (Miscellaneous Amendments) Regulations 2026. The examples include temporary settlement arrangements; temporary arrangements for holding UK qualifying stablecoins in connection with payment transactions; arrangements involving backing assets held in relation to a UK qualifying stablecoin; proprietary trading where the person is not providing a service to another person; proprietary trading by a market maker on a qualifying cryptoasset trading platform; and technical services that...

Key dates

2026-10-21

The OCC issued Bulletin 2026-51 and stated that applications and waiver requests will be accepted only after OMB approves the related information collection.

2027-01-18 Deadline

The GENIUS Act and OCC final rule become effective; the Prior Approval Requirement generally applies, and unauthorized issuance of a payment stablecoin in the United States may carry criminal penalties.

2028-01-18 Deadline

The maximum statutory period for a waiver beginning on January 18, 2027 expires, subject to the terms and shorter duration of any individual waiver.

Suggested considerations

• Firms should determine whether they are currently issuing a payment stablecoin in the United States and whether they fall within the OCC application pathway or another primary federal payment stablecoin regulator's pathway.
• Existing issuers should consider preparing and submitting a substantially complete OCC application as soon as the agency announces that applications are accepted, rather than relying on the waiver as a substitute for authorization.
• Applicants should map their submission against every prescribed application question and documentation requirement, including the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML, OFAC, third-party risk, enterprise risk, compliance risk, and audit functions.
• Compliance teams may wish to prepare a separate written waiver request addressing the Prior Approval Requirement, identifying any additional GENIUS Act or final-rule requirements that cannot be met by January 18, 2027, and explaining the requested duration and operational rationale.
• Issuers should monitor the OCC's GENIUS Act landing page and press releases for OMB approval and the opening of the application and waiver process, because the bulletin does not provide a fixed application-opening date.
• Firms should maintain evidence supporting the completeness and accuracy of their applications and establish a process to respond promptly to OCC requests for missing information within the 30-day review cycles.
• Prospective issuers that are not already operating in the United States should consider planning for operations to begin only after OCC approval, consistent with the agency's stated position on waiver eligibility.
• Regulatory change teams should continue tracking separate FinCEN, OFAC, OCC, and other agency rulemakings concerning AML, CFT, sanctions, and customer-identification requirements rather than assuming that an OCC application or Prior Approval Requirement waiver resolves those obligations.

What changed

Beginning January 18, 2027, a person generally must be approved as a permitted payment stablecoin issuer before issuing a payment stablecoin in the United States; unauthorized issuance may carry criminal penalties. Under GENIUS Act section 5(f) and 12 CFR 15.30(g), an issuer with a substantially complete OCC application pending on January 18, 2027 may request a written waiver of the Prior Approval Requirement and other statutory or final-rule requirements that it cannot satisfy by the effective date.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule and related application, waiver and reporting materials.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment stablecoin issuance generally requires permitted payment stablecoin issuer status, and a substantially complete application must be pending by this date to support eligibility for an OCC waiver request.

2027-01-25

Proposed first weekly OCC reporting date, subject to OMB approval of the information collection.

2027-03-31

Proposed first quarterly OCC reporting date, subject to OMB approval of the information collection.

Suggested considerations

• Firms seeking permitted payment stablecoin status should consider mapping their licensing strategy, corporate structure and applicable OCC pathway under 12 CFR part 15 before 2027-01-18.
• Existing U.S. issuers that need transitional relief should consider submitting a substantially complete OCC application on or before 2027-01-18 and preparing a written waiver request promptly after the OCC begins accepting applications and waiver requests.
• Applicants should consider documenting business plans, management, reserve assets, issuance and redemption processes, capital and liquidity, risk management, third-party and shared-services arrangements, audit functions and compliance governance in the application package.
• Issuers should consider validating reserve composition, one-to-one backing, liquidity, concentration, counterparty exposure, stress-testing and redemption controls against the final rule rather than relying on the proposal's reserve assumptions.
• Issuers should consider testing operational capacity to process redemptions within two business days and to notify the OCC within 24 hours when the 10% redemption-demand trigger is reached.
• Issuers and distribution partners should consider reviewing stablecoin rewards, yield, rebate and promotional arrangements on a transaction-by-transaction basis because pre-existing programs are not automatically grandfathered and the final rule provides no general safe harbor.
• Covered firms should consider establishing governance for audits, reporting, examination responses, custody controls, foreign-issuer oversight and potential approval revocation or rescission.
• Compliance teams should track the separate Treasury-coordinated BSA, AML and OFAC rulemaking and avoid treating this final rule as the complete GENIUS Act compliance framework.

What changed

The final rule applies to national banks and their subsidiaries, federal savings associations and their subsidiaries, federal branches and their subsidiaries, federal qualified payment stablecoin issuers, foreign payment stablecoin issuers, and state qualified payment stablecoin issuers over which the OCC has regulatory or enforcement authority.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule, application and waiver guidance, and revised proposed reporting forms.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment-stablecoin issuance generally requires permitted payment stablecoin issuer approval, and existing issuers seeking a waiver generally must have a pending substantially complete OCC application by this date.

2027-01-25 Deadline

Proposed effective report date for the weekly reporting form, subject to Office of Management and Budget approval.

2027-03-31 Deadline

Proposed effective report date for the quarterly reporting form, subject to Office of Management and Budget approval.

Suggested considerations

• Firms considering U.S. payment-stablecoin issuance should assess whether they qualify as a permitted payment stablecoin issuer, a federal qualified issuer, a state-qualified issuer subject to OCC authority, or a foreign issuer within the rule's scope.
• Existing U.S. issuers should consider preparing a substantially complete OCC application and evaluating whether a waiver request is needed by January 18, 2027; the OCC may grant waivers for up to 12 months beginning on that date, generally where an eligible application is pending.
• Applicants should prepare documentation covering the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML/OFAC controls, third-party risk, enterprise risk, compliance risk, and audit functions.
• Issuers should map reserve assets to the final rule's 1:1 backing, daily-liquidity, diversification, and counterparty-concentration requirements and establish controls capable of supporting generally timely redemption within two business days.
• Compliance and product teams should inventory interest, yield, cashback, loyalty, referral, and exchange rewards arrangements involving payment stablecoins and document the business purpose and consideration supporting each payment, because the OCC has not provided a categorical safe harbor and will apply the statutory prohibition case by case.
• Issuers should design weekly reserve and payment-stablecoin activity reporting and quarterly reports of condition and income, subject to confirming the final OMB-approved forms and effective reporting dates.
• Banks and other OCC-supervised custodians should review custody arrangements, segregation and control frameworks, third-party dependencies, and contractual allocation of responsibility for stablecoin and reserve-asset custody.
• Firms should track the separate Treasury, FinCEN, OFAC, Federal Reserve, and FDIC implementation work because the OCC final rule does not complete BSA, AML, or sanctions requirements and is only one component of the GENIUS Act framework.

What changed

New 12 CFR part 15 establishes requirements for permitted payment stablecoin issuers, foreign payment stablecoin issuers subject to OCC authority, certain state-qualified issuers, and specified custody activities conducted by OCC-supervised entities. The framework covers issuer activities, reserve assets, redemption, risk management, audits, reports, examinations, supervision, custody, applications and registrations, state-to-federal transitions, foreign-issuer supervision, approval revocation or rescission, and capital and operational backstops.

Key dates

2026-10-21

The French Treasury, AMF, Banque de France and ACPR published their joint response to the European Commission consultation on the MiCA review.

2026-09-30 Deadline

The European Commission consultation deadline identified in independent legal commentary; this date had passed before publication of the French authorities' response.

Suggested considerations

• Compliance teams may wish to maintain the existing MiCA control framework because this publication does not create an immediate amendment, authorisation requirement or prohibition.
• Firms should consider mapping each token, service and distribution channel against the definitions and perimeter provisions of MiCA, MiFID II and payment-services legislation, with particular attention to products that could require more than one authorisation.
• EU-authorised crypto-asset service providers should consider reviewing onboarding, asset-admission, execution, custody, trading and distribution controls for exposure to asset-referenced tokens or e-money tokens that may not satisfy MiCA requirements.
• Stablecoin issuers and groups using the same fungible token across EU and third-country markets should consider documenting issuance structures, reserve segregation, redemption rights, equivalence assumptions and supervisory-cooperation dependencies in anticipation of possible multi-issuance rules.
• Significant crypto-asset service providers and crypto-conglomerates should consider assessing governance, prudential, group-risk and supervisory-reporting readiness for a possible future shift of direct or enhanced oversight toward ESMA.
• Banks, payment firms and investment firms should consider assessing strategic opportunities and regulatory dependencies arising from euro-denominated e-money tokens and tokenised bank deposits without treating the French position as approval of any specific product.
• DeFi, staking and crypto-lending businesses should consider identifying responsible intermediaries, documenting due-diligence controls and preserving evidence of protocol governance and risk assessments pending any future EU framework.
• Industry participants may wish to monitor the Commission's MiCA review, subsequent legislative proposals, ESMA and EBA opinions, and national implementation developments before changing operating models.

What changed

No legal requirements changed on 2026-10-21. The French authorities proposed streamlining MiCA and clarifying when an activity falls under MiCA, the legislation governing financial instruments, or payment-services legislation, including where one business model could require multiple authorisations. They stated that a financial instrument should remain fully subject to the financial-instruments regime irrespective of the technology used for issuance or trading, and that the same principle should apply to payment instruments.

Key dates

2022-05-12

The CFTC filed its complaint against Alexandre and EminiFX, alleging fraudulent solicitation, misappropriation, and operation of an unregistered commodity pool.

2026-07-01

As of July 2026, the court-appointed receiver had returned more than $98 million to over 28,000 investors.

2026-10-19

The CFTC announced that the Southern District of New York had entered orders granting summary judgment, injunctive relief, and a civil monetary penalty against Alexandre and EminiFX.

Suggested considerations

• Compliance teams may wish to inventory products, investment clubs, managed accounts, and digital-asset offerings that pool customer contributions and obtain exposure to forex, futures, options, or other commodity interests.
• Firms should consider assessing whether their activities constitute operating a commodity pool or acting as a commodity pool operator or associated person under the Commodity Exchange Act and CFTC regulations, including whether registration or an available exemption is required.
• Firms should consider validating marketing claims about returns, automated trading, proprietary technology, trading results, and risk, with particular scrutiny of unusually high or consistent returns such as weekly performance representations.
• Compliance teams may wish to test segregation, custody, reconciliation, withdrawal, and use-of-funds controls to detect commingling, personal use of customer assets, payments to earlier investors, and unexplained transfers.
• Firms should consider maintaining evidence supporting reported performance, trading activity, investor statements, and asset ownership so that customer communications can be reconciled to underlying records.
• Digital-asset businesses may wish to review whether crypto terminology or a technology-focused structure obscures activities that remain subject to commodities, anti-fraud, registration, or customer-protection requirements.
• Firms should consider escalating suspected misappropriation, fabricated performance, or unregistered commodity-pool activity through applicable internal investigation, suspicious-activity, and regulatory-reporting processes.

What changed

This is a final enforcement outcome rather than a new rule or generally applicable regulatory amendment. The Southern District of New York entered summary judgment and injunctive relief against Alexandre and EminiFX, finding that the defendants made fraudulent representations, misappropriated investor funds, and operated as an unregistered commodity pool operator, with Alexandre acting in an unregistered associated-person capacity. The judgment imposes $228,576,962 of restitution, $15,049,500 of disgorgement subject to offset by restitution payments, and a $45,148,500 civil monetary penalty.

Key dates

2026-10-16

ESMA published Q&As 2949, 2950, 2936, 2937 and 2938.

2025-06-25

The EMIR 3 active account regime began applying to counterparties already within scope after the six-month implementation period.

Suggested considerations

• CASPs should consider mapping each client-funds flow against MiCA Article 70(2) and (3), documenting the end-of-next-business-day transfer control and verifying that any intermediary-held credit-institution account is specifically held for the CASP and technically segregated.
• CASPs and their payment-service-provider partners may wish to review contractual terms, account mandates, insolvency protections, reconciliation processes and evidence demonstrating clients’ ownership rights and prohibition of proprietary use.
• Crowdfunding providers using registration, membership or access fees should consider documenting why their model does or does not constitute a crowdfunding service under Regulation (EU) 2020/1503 and reviewing website disclosures, fee descriptions, client communications and investor-protection controls.
• AAR counterparties should recalculate the 12-month aggregate month-end average gross notional position, including the applicable group perimeter and excluding client-clearing activity, against the EUR 6 billion and EUR 100 billion thresholds.
• AAR counterparties relying on the 85% exemption should consider testing the one-half rule across the relevant derivative classes, retaining the underlying EU-CCP clearing data and avoiding any assumption that the exemption removes the representativeness requirement.
• Affected counterparties should review trade-level residual-maturity data, bucket allocation, annual-average trade counts and reporting calendars so that representative clearing can be demonstrated at the applicable reporting date.
• Compliance teams may wish to update policies, procedures, management information and regulatory inventories to distinguish ESMA Q&A interpretive expectations from directly binding Level 1 and Level 2 requirements.

What changed

For CASPs, ESMA clarifies that client funds may be temporarily held in an account with a non-bank payment service provider, such as a payment institution or electronic money institution, provided the funds are transferred to an account with a credit institution or central bank no later than the end of the business day following receipt.

Key dates

2026-10-09

FSRA published Consultation Paper No. 6 of 2026 on proposed revisions to the FEES and GEN Rulebooks.

2026-11-06 Deadline

Consultation closes and written comments are due to the FSRA.

2027-01-01

Implementation is proposed by independent market commentary to begin, subject to consultation feedback and final FSRA rulemaking; this is not yet an adopted effective date.

Suggested considerations

• Compliance teams may wish to review the consultation paper, Appendix 1 amendments to FEES, Appendix 2 amendments to GEN and Attachment 1 amendments to the GPM, and submit written comments to [email protected] by 2026-11-06.
• Market-infrastructure operators may wish to model the proposed application, annual supervision, Official List and trading-related charges against current budgets and assess whether the proposals affect pending applications or planned launches.
• Virtual-asset MTF operators and applicants may wish to recalculate total regulatory costs using the proposed USD 100,000 base MTF application fee, USD 40,000 base annual supervision fee, USD 25,000 virtual-asset application fee and USD 20,000 virtual-asset annual fee.
• Authorised Persons may wish to inventory permissions covering Virtual Assets, Fiat-Referenced Tokens and Spot Commodities and determine whether a proposed permission addition would trigger a separate variation or activity fee.
• Regulatory reporting owners may wish to test filing calendars, escalation controls and management information against the proposed USD 1,000, USD 2,000 and USD 3,000 late-filing stages, while recognising that the proposed regime is not yet binding.
• Applicants and compliance officers may wish to review change-in-control and variation-of-permission procedures, including whether proposed applications require additional supporting information or revised fee calculations.
• Firms may wish to prepare implementation plans for a possible 2027-01-01 commencement while continuing to apply the existing FEES and GEN requirements until final amendments are published.

What changed

The consultation proposes completing the FSRA's review of market-infrastructure fees by revising charges payable by Recognised Bodies and by operators of Multilateral Trading Facilities and Organised Trading Facilities. For a virtual-asset MTF, independent analysis of the proposed FEES amendments identifies a proposed underlying MTF application fee of USD 100,000 and annual supervision fee of USD 40,000, plus proposed virtual-asset-specific fees of USD 25,000 on application and USD 20,000 annually, producing proposed totals of USD 125,000 and USD 60,000 before any applicable trading levy or...

Key dates

2026-09-30

The extended sector-wide no-action position associated with INFO 225 ended.

2026-11-27 Deadline

Deadline for submissions on ASIC Consultation Paper 392, at 5pm AEDT.

2027-04-08

The DAF Act and the new DAP and TCP framework are scheduled to commence.

2027-10-07 Deadline

The proposed transition deadline by which platforms already operating as DAPs or TCPs should apply for an AFS licence or variation.

Suggested considerations

• Firms should assess whether their products, custody arrangements and platform activities fall within the DAP or TCP definitions under the DAF Act and the proposed ASIC guidance.
• Affected operators should consider whether they need a new Australian financial services licence or a variation to an existing licence, including whether any streamlined process may apply.
• Compliance teams may wish to map current custody, segregation, asset-control, reconciliation, trading, settlement and incident-management processes against the proposed standards.
• Firms should assess the likely impact of the proposed net tangible asset and other financial requirements on capital planning, liquidity and licence documentation.
• Operators should review proposed customer disclosure documents and platform rules, including how digital-asset risks, custody arrangements, execution and settlement are explained to clients.
• Businesses affected by the framework should consider submitting comments to ASIC by 2026-11-27 and engaging with ASIC's consultation events or targeted roundtables.
• Firms should maintain evidence of their licensing analysis and transition planning, particularly because the sector-wide INFO 225 no-action position ended on 2026-09-30 and independent commentary indicates that existing licensing obligations apply outside the relief period.

What changed

CP 392 proposes implementation guidance for digital asset platforms (DAPs), which hold digital tokens for clients and provide associated platform services, and tokenised custody platforms (TCPs), which record underlying client assets as digital tokens. ASIC is proposing standards covering asset holding, trading and settlement activities, and financial requirements including net tangible asset requirements where relevant.

Key dates

2026-10-14

The EBA announced that USDC issued by Circle Internet Financial Europe SAS had been classified as a significant EMT under MiCA.

2026-11-12 Deadline

Dual supervision of USDC begins: the EBA assumes direct responsibility for own funds, reserve of assets, liquidity requirements, and recovery and redemption plans, while the ACPR retains specified governance and organisational responsibilities.

Suggested considerations

• Circle and its regulatory counsel should map existing own-funds, reserve-of-assets, liquidity, recovery, and redemption controls to the EBA’s supervisory expectations and establish clear evidence and reporting channels before 2026-11-12.
• Circle should confirm the allocation of responsibilities between the EBA and ACPR, including supervisory contacts, escalation procedures, information requests, and documentation ownership for prudential and organisational matters.
• Crypto-asset service providers should reassess their USDC due diligence, product governance, liquidity, redemption, custody, safeguarding, and operational-risk controls in light of the significant-EMT designation.
• Firms using USDC should identify exposures in client assets, settlement, treasury, collateral, and payment flows and assess whether updated counterparty, liquidity, concentration, and business-continuity assessments are appropriate.
• Compliance teams should monitor EBA and ACPR communications, supervisory-college activity, and any subsequent guidance or requests concerning significant EMT reporting and recovery or redemption planning.
• Firms operating across the EU and United States should review information-sharing, incident-notification, and cross-border supervisory arrangements, noting the EBA’s memorandum of understanding with the New York State Department of Financial Services.

What changed

USDC will be subject to the MiCA framework for significant EMTs from 2026-11-12. The EBA will assume direct supervisory responsibility for own-funds requirements, the reserve of assets, liquidity requirements, and recovery and redemption plans; the ACPR will continue supervising governance, qualifying holdings, fit and proper assessments, outsourcing, and conflicts of interest. Under MiCA Articles 56 and 43(1), an EMT is classified as significant where at least three significance criteria are met during the applicable reporting periods.

Key dates

2026-10-13

Federal Register publication date for the ANPRM, published as 91 FR 64811 and document number 2026-20888.

2026-12-14 Deadline

Deadline for submitting comments to the CFTC on Regulation CTX, Regulation CAM, and the interpretation and implementation of CEA section 2(c)(2)(D).

Suggested considerations

• Compliance teams may wish to determine whether current or planned retail crypto products could constitute transactions covered by CEA section 2(c)(2)(D), including products described as spot, margin, leveraged, financed, perpetual, or otherwise structured to defer delivery.
• Firms should consider mapping current customer agreements, funding arrangements, custody models, delivery controls, and liquidation processes against the CFTC's preliminary positions on offers and actual delivery.
• Prospective venues may wish to assess the potential CAM operating model, including registration perimeter, governance, listing standards, market surveillance, position controls, execution, recordkeeping, cyber and system safeguards, proof-of-reserves, and customer-asset arrangements.
• FCMs, IBs, DCOs, custodians, and leverage providers should consider identifying the registrations, permissions, capital, segregation, margin, clearing, insolvency, and operational dependencies that a CAM structure could create.
• Crypto businesses may wish to prepare comments addressing the scope of section 2(c)(2)(D), the definition and practical test for actual delivery, treatment of fully paid open transactions, permissible crypto assets, and the allocation of responsibilities among CAMs, FCMs, DCOs, and leverage providers.
• Firms should monitor whether the CFTC follows the ANPRM with a formal proposed rule and should not treat the ANPRM as creating immediate registration, margin, reporting, or conduct obligations.
• Affected firms may wish to preserve evidence of product design, delivery capability, customer disclosures, surveillance controls, and legal analysis in anticipation of supervisory or enforcement scrutiny under the CFTC's stated interpretation of section 2(c)(2)(D).

What changed

The CFTC has published ANPRM RIN 3038-AF80, 91 FR 64811, concerning proposed Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets. Regulation CTX would seek to clarify when section 2(c)(2)(D) applies to crypto asset transactions, including the meaning of covered offers, actual delivery, and actual delivery of fully paid open transactions. Regulation CAM would create a crypto asset market subcategory of designated contract market registration under 17 CFR part 38, supported by related amendments or requirements under 17 CFR parts 1, 38, and 39.

Key dates

2021-03-29

The current CFD product intervention order commenced, imposing leverage limits, standardised margin close-out arrangements, negative-balance protection and restrictions on specified inducements.

2022-04-06

ASIC extended the CFD PIO for five years to 23 May 2027.

2027-05-23

The current CFD PIO is due to expire unless it is remade, extended or revoked earlier.

2037-05-23

Indicative end of the proposed further 10-year extension, subject to Ministerial approval and the final instrument's commencement and expiry terms.

2026-11-09 Deadline

Deadline at 5pm AEDT for submissions on the proposed extension, amendments and separate question concerning CFDs over options with losses exceeding the premium.

Suggested considerations

• CFD issuers and distributors should consider mapping all products against the proposed expanded CFD definition, including products settled by cash, set-off or transfer of digital assets.
• Firms should consider testing initial-margin systems so that margin is calculated separately for each CFD and opposing long and short positions cannot reduce the required amount through netting.
• Firms offering CFDs over options should consider classifying contracts by whether retail-client losses are capped at the premium and assessing the effect of the proposed margin methodology on collateral, liquidation and client disclosures.
• Compliance teams may wish to review whether any option-linked CFD could expose a retail client to losses exceeding the premium and prepare evidence for the separate ASIC question on continued retail availability.
• Firms should consider reviewing discounts, rebates, bonuses and educational or research tools against the proposed conditions and assessing whether records can be retained for the proposed seven-year period.
• Product-governance teams may wish to refresh target-market determinations, onboarding controls, leverage settings, margin-close-out logic, negative-balance controls and inducement policies for the proposed extended period.
• Affected stakeholders should consider submitting comments to ASIC by 5pm AEDT on 9 November 2026, particularly on digital-asset settlement, option CFD availability, margin methodology and operational implementation costs.
• Firms should continue complying with the current PIO until any amended instrument takes effect and should plan on the basis that the existing order expires on 23 May 2027 unless remade or otherwise extended.

What changed

The proposed ASIC Corporations (Product Intervention Order Amendment—Contracts for Difference) Instrument 2026/XX would extend the existing CFD PIO until 2037 unless revoked earlier. It would modernise the definition of a CFD to capture products settled by transferring digital assets, replace the term cryptoasset with digital asset, clarify initial-margin rules for CFDs over options, and require initial margin to be calculated separately for each CFD rather than reduced by netting opposing positions.

Key dates

2026-10-08

ESMA published its opinion on the provision of crypto-asset services in relation to non-MiCA-compliant asset-referenced tokens and e-money tokens.

2027-01-08 Deadline

Latest date by which National Competent Authorities should require remediation of remaining pre-existing exposures, calculated as three months after publication; firms may be required to act earlier.

Suggested considerations

• Firms should inventory every ART and EMT made available to EU clients and classify whether each token satisfies the applicable MiCA requirements, including any relevant authorisation, notification, offer, and admission-to-trading conditions.
• Compliance teams may wish to map each affected token across trading, exchange, execution, placing, order-routing, advice, transfer, custody, and portfolio-management workflows, including bundled or indirect services.
• Firms should consider suspending onboarding, purchases, subscriptions, trading, swaps, staking-related access where relevant, and other activities that could allow EU clients to acquire or increase exposure to a non-MiCA-compliant token.
• Technology and operations teams should assess geolocation, account, wallet, order-management, token-listing, transfer, and API controls, with testing and monitoring designed to prevent EU-client access or increased exposure.
• Legal and product teams should review client terms, token-listing policies, disclosures, contractual restrictions, and arrangements with issuers, liquidity providers, exchanges, and other intermediaries.
• Firms should identify pre-existing client exposures and prepare a documented wind-down or remediation plan capable of completion by 2027-01-08, subject to any earlier NCA requirement.
• Firms may wish to define narrowly controlled exit-only services for liquidation, conversion, withdrawal, transfer, and safekeeping, with time limits, risk controls, client communications, records, and escalation to the relevant NCA.
• Governance functions should document the interpretation of the ESMA opinion, approvals for affected product changes, control ownership, exceptions, surveillance, management information, and evidence available for supervisory review.

What changed

The opinion covers the full range of MiCA crypto-asset services, including operating trading platforms, exchanging crypto-assets for funds or other crypto-assets, executing orders, placing crypto-assets, reception and transmission of orders, investment advice, transfers, custody and administration, and portfolio management. ESMA expects National Competent Authorities to supervise so that CASPs do not maintain, introduce, or facilitate EU-client access to non-MiCA-compliant ARTs or EMTs.

Key dates

2026-11-30 Deadline

Consultation period for ADGM FSRA Consultation Paper No. 5 of 2026 closes; comments may be submitted to [email protected].

Suggested considerations

• Compliance teams may wish to review the proposed Guidance and submit written comments to [email protected] by 2026-11-30, particularly on operational feasibility, proportionality and the treatment of permissionless protocols.
• Firms should consider inventorying current and planned DeFi activity, including protocol use, liquidity provision, staking, lending, borrowing, decentralised exchange activity, smart-contract interaction and client-facing exposure.
• Firms should consider mapping each DeFi activity to existing ADGM permissions and identifying activities that may require a variation of permission, additional controls or discontinuation.
• Risk and compliance functions may wish to assess whether existing governance arrangements clearly assign senior accountability for DeFi, approve protocols and counterparties, set exposure limits and address conflicts of interest.
• Firms should consider enhancing due diligence for protocol code, governance structures, upgrade and administrative privileges, oracle dependencies, bridge and composability risks, concentration, liquidity, sanctions exposure and the availability of legal recourse.
• AML and financial-crime teams may wish to assess transaction-monitoring, wallet-screening, sanctions-screening, blockchain analytics, travel-rule and suspicious-activity escalation controls for DeFi-related activity, taking account of limited visibility into beneficial ownership and counterparties.
• Operations and technology teams should consider whether incident-management procedures cover smart-contract exploits, oracle failures, governance attacks, de-pegging, bridge compromise, protocol insolvency, loss of access and material service disruption.
• Client-asset teams should review segregation, custody, ownership, valuation, reconciliation and disclosure arrangements where client assets interact with DeFi protocols or are exposed to protocol failure.

What changed

The proposed Guidance sets supervisory expectations for identifying, assessing, monitoring and managing risks arising from engagement with DeFi protocols and venues. It covers governance and accountability, risk assessments, due diligence, exposure and control measures, ongoing monitoring, financial-crime controls, incident escalation, recordkeeping, auditability, competence and client-asset safeguards. The proposal is guidance under consultation and does not itself introduce binding new rules at this stage.

Key dates

2020-12-23

FinCEN published the NPRM at 85 FR 83840 proposing additional reporting, recordkeeping, and identity-verification requirements for certain transactions involving unhosted or otherwise covered wallets.

2026-10-06

FinCEN withdrew the NPRM and stated that it would take no further action on that rulemaking.

Suggested considerations

• Compliance teams may wish to remove implementation workstreams, testing scenarios, and policy language that were created solely for the withdrawn NPRM's proposed $3,000 recordkeeping or $10,000 reporting thresholds.
• Firms should consider documenting that the NPRM was never effective and that its withdrawal does not eliminate existing obligations under the Bank Secrecy Act or applicable implementing regulations in 31 CFR parts 1010, 1020, and 1022.
• Banks and MSBs may wish to reassess whether current controls for transfers involving unhosted wallets remain risk-based and supported by documented AML risk assessments, rather than treating the withdrawn proposal's thresholds as mandatory rules.
• Crypto businesses should continue reviewing applicable customer-identification, customer-due-diligence, suspicious-activity-reporting, recordkeeping, transaction-monitoring, and OFAC sanctions requirements independently of this withdrawal.
• Regulatory-monitoring teams may wish to track whether FinCEN or Treasury develops a replacement digital-asset framework, particularly in light of the stated policy objective that digital-asset regulation be fit for purpose.

What changed

FinCEN withdrew the NPRM published at 85 FR 83840 and stated that it will take no further action on that rulemaking. The withdrawn proposal would have required banks and money services businesses to file reports when a transaction involving an unhosted or otherwise covered wallet exceeded $10,000, or multiple such transactions exceeded $10,000 in 24 hours. It also would have required records, counterparty information, and customer identity verification for covered transactions exceeding $3,000.

Key dates

2023-10-23

FinCEN published the proposed section 311 finding and special measure concerning international CVC mixing at 88 FR 72701.

2026-10-06

FinCEN's withdrawal of the finding and proposed rulemaking became effective upon Federal Register publication at 91 FR 63513.

Suggested considerations

• Compliance teams should discontinue implementation work that was undertaken solely for the withdrawn section 311 CVC-mixing proposal, including plans for the proposal-specific data fields, reporting workflows, and enhanced customer records.
• Firms should not interpret the withdrawal as authorization to process illicit mixer activity without controls; they should continue applying existing risk-based AML, sanctions, transaction-monitoring, escalation, and suspicious activity reporting procedures.
• Crypto exchanges and other covered institutions should review whether current transaction-monitoring scenarios appropriately identify mixer exposure and other indicators of money laundering or terrorist financing under existing requirements, without treating all privacy-preserving activity as inherently suspicious.
• Firms may wish to document the withdrawal in their regulatory inventory, rulemaking-impact assessments, and model or procedure change logs, while preserving controls that address independently applicable BSA or sanctions requirements.
• Compliance teams should monitor future FinCEN notices, section 311 actions, enforcement activity, and interpretive guidance because FinCEN expressly reserved the possibility of future measures concerning mixers.
• Legal and compliance functions should reassess any customer, product, or transaction restrictions adopted specifically in anticipation of the proposed rule and determine whether they remain justified by the firm's risk assessment, other legal requirements, or contractual obligations.

What changed

FinCEN withdrew the proposed rule published at 88 FR 72701 and the underlying section 311 finding concerning international CVC mixing. The proposed special measure one regime would have required covered financial institutions to report specified information for transactions they knew, suspected, or had reason to suspect involved international CVC mixing, including CVC type and amount, mixer and wallet information, transaction hashes, transaction dates, IP addresses, customer-identifying information, and a narrative description.

Key dates

2026-10-05

The CFTC Chairman announced the proposed Regulation CTX and Regulation CAM framework, and independent industry reporting identified the accompanying action as an advance notice of proposed rulemaking.

Suggested considerations

• Compliance teams may wish to monitor the Federal Register for publication of the CTX/CAM ANPRM and calculate the 60-day comment period from the actual publication date rather than from the Chairman’s October 5 statement.
• Affected exchanges should map each product and customer flow against margin, leverage, financing, custody, settlement, and internal-ledger features to determine whether the activity could fall within the proposed CTX concept.
• State-licensed platforms may wish to assess the strategic and operational consequences of pursuing a CFTC registration pathway instead of relying solely on state money-transmitter licenses.
• Firms may wish to review governance, conflicts-of-interest controls, market surveillance, anti-manipulation controls, customer-asset segregation, operational resilience, disclosure, and recordkeeping capabilities against existing CFTC designated contract market and customer-protection expectations.
• Exchanges and service providers may wish to prepare comments addressing the scope of Section 2(c)(2)(D), the treatment of fully paid transactions, the boundary between spot trading and financed transactions, and the interaction between CAM registration and state licensing.
• Legal and compliance functions may wish to inventory crypto assets and classify them consistently with the referenced joint CFTC-SEC interpretation, while preserving separate analysis for assets that may constitute securities or fall outside the proposed framework.
• U.S.-facing offshore platforms should reassess territorial exposure and customer-access controls because the proposal may create a clearer federal compliance pathway without eliminating potential CFTC jurisdiction over unregistered or fraudulent activity.

What changed

The CFTC is proposing to use its existing Commodity Exchange Act authority, including Section 2(c)(2)(D), to develop a purpose-built framework for crypto asset transactions and markets. Regulation CTX would address retail crypto transactions involving margin, leverage, or financing. Regulation CAM would establish a tailored category of CFTC-registered crypto asset market, apparently as a specialized form of designated contract market, for exchanges offering those transactions.

Key dates

2026-10-05

Chairman Michael S. Selig delivered the remarks at the Fordham Law Blockchain Regulatory Symposium and publicly described the CFTC-SEC crypto-asset classification framework and the shift toward formal crypto market regulation.

Suggested considerations

• Compliance teams may wish to inventory each supported token and document its likely classification under the five-category framework, including the facts supporting treatment as a digital commodity, digital collectible, digital tool, stablecoin, or digital security.
• Firms may wish to reassess whether their products involve retail commodity transactions under CEA section 2(c)(2)(D), including transactions involving margin, leverage, financing, or other arrangements that may require execution on or registration with a CFTC-registered venue.
• Crypto exchanges and trading platforms may wish to assess whether their activities could require DCM registration, a future crypto-asset-market registration, SEC registration, or multiple registrations depending on the asset and service provided.
• Issuers and platforms may wish to preserve evidence concerning network functionality, decentralization, token utility, marketing, purchaser expectations, transfer restrictions, and the separation of a crypto asset from any investment contract.
• Firms may wish to maintain controls addressing customer-asset segregation, custody, conflicts of interest, orderly trading, market surveillance, anti-manipulation, recordkeeping, and AML obligations, because the speech criticizes state money-transmission licensing as insufficient to provide federal market protections.
• Legal and regulatory teams may wish to monitor the CFTC and SEC rulemaking dockets and distinguish the Chairman's personal views, the joint interpretation, proposed rules, and any final rules or effective compliance dates.
• U.S. and offshore groups serving U.S. customers may wish to reassess their territorial and solicitation controls because the policy direction is intended to offer a federal pathway without eliminating the risk of CFTC or SEC jurisdiction over offshore conduct.

What changed

The Chairman described a joint CFTC-SEC interpretation that classifies crypto assets into five categories: digital commodities, digital collectibles, digital tools, stablecoins, and digital securities. The interpretation reportedly provides that digital commodities, digital collectibles, and digital tools are generally not securities; stablecoins may in some circumstances be securities; and digital securities remain subject to the federal securities laws.

Key dates

2026-10-05

CFTC published Release 9307-26 announcing the ANPRM and beginning consultation on a potential framework for crypto asset transactions and crypto asset markets.

Suggested considerations

• Compliance teams may wish to determine whether current or planned products involve retail commodity transactions under CEA Section 2(c)(2)(D), particularly where crypto assets are leveraged, margined, financed, or embedded in derivatives or perpetual-style products.
• Firms should consider mapping their customer-facing crypto activities, order execution arrangements, custody model, financing terms, liquidation processes, conflicts, market-abuse controls, and consumer disclosures against the issues identified in the ANPRM.
• Potential commenters may wish to prepare submissions addressing the scope of CTXs, the proposed treatment of spot versus financed transactions, appropriate registration and supervisory requirements, and the operational feasibility of a crypto asset market category.
• Designated contract markets and prospective applicants should consider assessing whether existing governance, surveillance, listing, liquidity, technology, and risk-management controls could support a future crypto asset market registration framework.
• Firms may wish to preserve evidence of existing controls and industry practices that they regard as effective, because the CFTC is specifically seeking information on crypto-specific contextual guidance and compliance practices.
• Compliance teams should monitor the Federal Register for the ANPRM publication and calculate the 60-day comment period from that publication date rather than from the October 5 press release.
• Firms should continue complying with currently applicable CEA, CFTC, securities, commodities, consumer-protection, AML, and state requirements because the ANPRM does not replace or suspend existing obligations.

What changed

The CFTC has opened a consultation process and is considering future rules referred to in market commentary as Regulation Crypto Asset Transactions (CTX) and Regulation Crypto Asset Markets (CAM). The ANPRM seeks views on preventing abusive practices in crypto asset markets and CTXs, providing crypto-specific context on compliance requirements and industry practices that the Commission considers best practices, and codifying a subcategory of designated contract market registration for crypto asset markets.

Key dates

2026-06-30

The FCA opened consultation on the proposed CRYPTOPRU 7 guidance.

2026-07-30

Consultation on the proposed guidance closed.

2026-09-30

The FCA finalised and published FG26/10.

2027-10-25 Deadline

FG26/10 comes into force alongside the FCA's new UK cryptoasset regime.

Suggested considerations

• Firms should map their current CRYPTOPRU 7 overall risk assessment against FG26/10, documenting any gaps in risk identification, stress testing, financial-resource calculations, recovery planning and wind-down analysis.
• Compliance and prudential teams may wish to confirm that the own-funds requirement is calculated as the highest of the permanent minimum requirement, fixed overheads requirement and K-factor requirement, and that the own-funds threshold requirement is not below that amount.
• Firms should consider developing severe-but-plausible scenarios that combine cryptoasset price declines, customer withdrawal surges, counterparty or exchange failure, cyber incidents, private-key compromise, reduced market liquidity, stablecoin de-pegging and infrastructure outages.
• Firms should assess whether collateral, committed facilities, group support, banking arrangements, custody structures and other mitigants are legally, operationally and practically available under stress, rather than relying solely on their accounting treatment.
• Firms should prepare or refresh a stressed 90-day cash-flow forecast covering peak and cumulative liquidity needs, including margin calls, settlement failures, client drawdowns, pre-funding requirements and delayed or unavailable funding.
• Firms should assess their funding profile over the following 12 months, including renewal and rollover risk, withdrawal of facilities, reduced group funding and increased funding costs.
• Firms should establish a contingency funding plan with quantitative internal triggers above regulatory thresholds, credible actions within management control, implementation timelines, impediments and communication arrangements.
• Firms should distinguish recovery actions that management can execute directly from actions dependent on shareholders, banks, counterparties, group entities or buyers, and should consider whether limited recovery capacity requires earlier wind-down triggers.

What changed

FG26/10 does not create a new standalone binding rule or prescribe a single methodology; it explains how firms should evidence compliance with the binding requirements in CRYPTOPRU 7 and should be applied proportionately to the firm's nature, scale and complexity. Firms should begin with their business model, strategy and risk appetite, identify market, leverage, credit, liquidity, operational and concentration risks, assess interactions between those risks, and evaluate whether mitigants remain effective under stress.

Key dates

2023-01-01

The Economic Crime and Corporate Transparency Act 2023 received Royal Assent during 2023; its voluntary information-sharing provisions are identified by the FCA as a potential mechanism for firms to share information concerning economic crime. The specific commencement date for any relevant provision should be verified against the applicable commencement instruments.

2025-01-01

Cifas introduced a dedicated funds received for money muling filing category and revised filing criteria and guidance, making 2025 filing data not directly comparable with 2023 and 2024. The date is stated as January 2025 rather than a specific day.

2026-09-23

The FCA published its multi-firm review on money-mule activity and cashing out findings.

Suggested considerations

• Firms should consider refreshing their business-wide and customer-risk assessments to reflect mule-chain activity, including the concentration of cashing out between the second and fifth accounts and the higher concentration at the second account.
• Compliance and fraud teams may wish to test whether transaction-monitoring scenarios identify linked accounts, repeated use of accounts across fraud types, rapid onward transfers, fragmented card spending, international destinations and higher-value crypto-related cash-outs.
• Firms should consider reviewing controls across the full payment chain rather than focusing only on the first account receiving suspected fraud proceeds, including internal account link analysis and escalation between fraud, AML and investigations teams.
• Banks, payment institutions and EMIs may wish to compare detection and response performance by account tenure, customer type and channel, noting that 74.1% of EMI closures and 56.9% of PI closures in the survey occurred within six months of account opening.
• Firms should consider assessing whether their use of the National Fraud Database is effective and whether suspected cases meet the applicable Cifas evidential and category criteria; the FCA data should not be interpreted as requiring Cifas filings to equal account closures.
• Firms should consider whether the Economic Crime and Corporate Transparency Act 2023 information-sharing provisions can lawfully support prevention, detection or investigation of linked mule activity, with appropriate governance, records and data-protection controls.
• MLROs and nominated officers may wish to prepare for the further FCA and National Economic Crime Centre alert and retain evidence showing how the review findings were considered and, where appropriate, incorporated into control enhancements.

What changed

The FCA has provided new supervisory findings on the scale, profile and mechanics of money-mule activity based on a survey of 35 firms and analysis by a 22-firm public-private cell covering 140 cases across seven fraud types. It expects firms to use the findings in their own money-mule risk assessments and to review and strengthen controls for detecting, preventing and disrupting mule activity.

Key dates

2026-09-16

The FCA published PS26/18 and its final cryptoasset perimeter guidance.

2026-09-30

The application window opened for firms seeking to use the transitional arrangements.

2027-02-28 Deadline

The application window closes for firms wishing to use the transitional arrangements.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 introduce the new regulated cryptoasset activities into the FCA perimeter.

Suggested considerations

• Firms should map each current and planned cryptoasset service against the PERG 18 regulated-activity analysis, including whether the activity is conducted in the UK and by way of business.
• Firms registered under the Money Laundering Regulations should assess separately whether FCA authorisation or a variation of permission is required, because existing registration does not convert automatically into authorisation.
• Existing FCA-authorised firms should review their permissions and consider whether a variation of permission will be needed for cryptoasset activities.
• Firms intending to rely on transitional or savings arrangements should assess eligibility and submit an application within the 30 September 2026 to 28 February 2027 application window.
• Compliance teams may wish to inventory custodial wallets, trading venues, brokerage and arranging models, staking services, stablecoin issuance, lending products, market-making and technology or infrastructure services.
• Firms should review UK territoriality, customer location, solicitation, marketing and operating-model assumptions, particularly for overseas businesses serving UK consumers.
• Firms should monitor the FCA's further consultation on amendments to the perimeter guidance and reassess their analysis when the underlying regulations and final amended guidance change.
• Applicants should prepare governance, business-model, financial, operational, safeguarding, systems and controls material expected for authorisation and may wish to obtain independent legal and compliance advice.

What changed

The FCA has finalised new PERG 18 guidance on determining whether a cryptoasset activity is regulated, whether it is carried on in the UK, whether it is carried on by way of business, and whether an exemption or transitional provision applies. The perimeter covers activities such as issuing qualifying stablecoins, operating cryptoasset trading platforms, dealing in or arranging deals in cryptoassets, safeguarding cryptoassets and arranging cryptoasset staking.

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying [email protected] by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.