Insurance Regulatory Updates

Key dates

2026-04-30

APRA issued its letter to banks, insurers and superannuation trustees calling for a step-change in governance, risk management, assurance and operational resilience for AI-related risks.

2026-05-08

ASIC issued its open letter to all licensees and market participants urging urgent strengthening of cyber resilience as frontier AI intensifies the global cyber-risk environment.

2026-06-01

ASIC and APRA began the June–July 2026 series of nine industry roundtables on frontier-AI preparedness and resilience; the source identifies June as the starting month but does not provide an exact day.

2026-07-31

ASIC and APRA completed the June–July 2026 roundtable period; the source does not provide an exact closing day.

2026-08-27

ASIC published the joint warning and related information paper and preparedness checklist, urging entities to move from awareness to action.

Suggested considerations

• Firms should consider presenting the ASIC and APRA roundtable themes, together with the available board and executive preparedness checklist, to the board and relevant risk or technology committees.
• Compliance teams may wish to map frontier-AI cyber and operational risks to existing obligations and controls under APRA CPS 230 Operational Risk Management, APRA CPS 234 Information Security, APRA CPS 220 Risk Management where applicable, and the entity's ASIC licence, governance and cyber-resilience arrangements.
• Firms should consider identifying critical assets, systems, data flows and material third-party dependencies, including common providers and concentration points that could create sector-wide disruption.
• Technology and security teams may wish to test patching, identity and privileged-access controls, attack-surface reduction, backup integrity, recovery-time priorities and incident-response playbooks against AI-accelerated attack scenarios.
• Boards and executives should consider documenting risk appetite, incident escalation authority, recovery priorities, internal and external communication strategies and decision rights before a frontier-AI-related crisis occurs.
• Firms should consider testing response and recovery arrangements under compressed timeframes and retaining evidence of exercise results, lessons learned, remediation owners and completion status.
• Entities using or procuring AI should consider applying existing model, data, supplier, change-management and assurance controls to internally developed models, vendor tools and embedded AI functionality, including defensive-AI tools used for threat intelligence, vulnerability detection, code review or incident response.
• Procurement and outsourcing functions may wish to strengthen supplier assurance, obtain relevant information on providers' AI and cyber controls, map material dependencies and assess substitutability and exit arrangements.

What changed

The regulators have consolidated a cross-sector expectation that entities address frontier-AI risk through cyber fundamentals, critical-asset identification, timely patching, strong identity and access controls, attack-surface reduction, reliable backups, tested response and recovery arrangements, and third-party risk management.

Key dates

2025-01-17

DORA began applying to in-scope financial entities supervised by the CSSF.

2025-12-17

The European Commission confirmed through DORA Q&A 102 that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF’s extended best-efforts deadline for the first register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2026-08-27

Circular CSSF 26/915 was published and took effect immediately; the listed CSSF circulars were amended to include or remove qualifying third-country branches as applicable.

2027-03-31 Deadline

Target date identified by CSSF for the required-quality register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2027-01-11

Relevant CRD VI third-country-branch provisions are scheduled to take effect, subject to national transposition and applicable transitional rules.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the counterfactual test in Circular 26/915: whether the head-office undertaking would qualify under Article 2(1)(a) to (t) of DORA if established in the relevant third country.
• Affected branches should update their regulatory-perimeter inventories, governance documents, ICT-risk policies, outsourcing inventories, incident-classification procedures and DORA control testing to reflect immediate inclusion in the DORA-specific CSSF circulars.
• Compliance teams may wish to separate non-ICT outsourcing, which remains subject to Part I of Circular CSSF 22/806, from ICT outsourcing, which is governed by DORA and Circular CSSF 25/882 rather than the legacy Part II framework.
• Affected entities should validate their register-of-information process under DORA and Circular CSSF 25/882, including branch-level data, ICT third-party contracts, intra-group arrangements and submission ownership. The 30 June 2026 best-efforts deadline for third-country branches of credit institutions has passed, and firms should prepare for the 31 March 2027 collection and any CSSF remediation requests.
• Incident-response teams should test access to the CSSF eDesk procedure and S3 API and document an escalation process for emailing [email protected] when technical impossibility prevents electronic submission.
• Firms should assess whether they qualify for the microenterprise exclusion in Circular CSSF 25/892; the exclusion applies to entities employing fewer than 10 persons with annual turnover and/or annual balance-sheet total not exceeding EUR 2 million, subject to the DORA definition and exclusions for specified market infrastructures.
• Third-country banking groups should coordinate DORA implementation with the CRD VI third-country-branch analysis, including the 11 January 2027 effective date for relevant CRD VI provisions, rather than assuming that the two regimes have identical scope or timing.

What changed

Qualifying third-country branches are added to the scope of Circulars CSSF 25/882, 25/892 and 25/893, covering DORA ICT third-party-service information and reporting, estimation of aggregated annual costs and losses from major ICT-related incidents under Article 11(11) of DORA and the Joint ESA Guidelines JC/GL/2024/34, and reporting of major ICT-related incidents and significant cyber threats.

Key dates

2025-12-30

MAS issued the revised Notices FAA-N27, 508 and SFA 04-N24 and published its response to feedback.

2026-08-24

MAS published the circular and FAQs explaining the revised misconduct-reporting requirements and the discontinuation of the existing system.

2027-01-01 Deadline

The revised Notices FAA-N27, 508 and SFA 04-N24 take effect; the existing Notices FAA-N14, 504 and SFA 04-N11 are cancelled; and the existing misconduct reporting system is discontinued.

2027-01-22 Deadline

Default deadline for reporting qualifying pre-2027 misconduct matters that were not reported under the cancelled Notice, calculated as 21 calendar days after 1 January 2027, unless MAS permits a longer period in writing.

Suggested considerations

• Compliance teams may wish to map existing misconduct, incident, whistleblowing, investigation, HR and police-referral processes to the revised definition and categories of reportable misconduct.
• Firms should consider establishing a documented escalation test for when reasonable grounds to believe misconduct occurred arise, rather than waiting for a final investigation finding, and configuring workflow controls around the 21-calendar-day initial-reporting deadline.
• Firms may wish to obtain and operationalise the prescribed misconduct-report, investigation-report and update-report formats before the existing system is discontinued.
• Internal investigation procedures should be reviewed to ensure that the prescribed investigation information, supporting evidence, investigator assessment, corrective action and appeal information can be produced concurrently with the initial MAS report where an investigation has commenced.
• Police-report handling should be updated so that available police reports and required accompanying details are captured and submitted with the misconduct report, with subsequent police or criminal-proceeding developments tracked for update reporting.
• Firms should consider controls for providing representatives with copies of initial misconduct reports and subsequent updates within the prescribed timelines, including appropriate treatment of former representatives and confidentiality or privilege issues.
• A transitional review of open matters may be appropriate to identify cases where reasonable grounds arose before 1 January 2027 but no report was filed under the cancelled Notice; those matters may need to be reported by 22 January 2027, subject to any written extension from MAS.
• Record-retention policies, case-management systems and management information should be tested against the minimum five-year retention requirement and the requirement that electronic records remain accessible, retrievable and readable.

What changed

From 1 January 2027, Notices FAA-N27, 508 and SFA 04-N24 replace and cancel the existing Notices FAA-N14, 504 and SFA 04-N11. The initial misconduct report must generally be submitted within 21 calendar days after the firm has reasonable grounds to believe that reportable misconduct was committed or is likely to have been committed; a conclusive investigation finding is not required before reporting.

Suggested considerations

• Compliance teams may wish to check whether any bundled, embedded, or referral-based cover could be characterised as insurance business requiring authorisation.
• Firms may wish to compare current products and distribution models against the licensing perimeter under the Short-term Insurance Act and Insurance Act.
• Compliance functions may wish to review complaint-handling controls to ensure perimeter issues are escalated promptly when customer complaints arise.
• Firms may wish to assess whether document-production and response procedures are adequate for FSCA investigations under the FSR Act.
• Senior management may wish to review governance over third-party arrangements and product approval processes where non-insurance businesses market insurance-like protection.

What changed

This is an enforcement outcome, not a new rule or consultation. The FSCA’s action confirms that operating an insurance-like business without the required short-term insurance authorisation can result in both a substantial monetary penalty and an individual debarment. The publication also indicates that obstruction or non-cooperation during an FSCA investigation can aggravate the matter and is treated as a breach of the Financial Sector Regulation Act framework.

Key dates

2026-03-03

FSCA confirmed it had completed its investigation into the South African Army Foundation and two senior officials and said enforcement action would follow.

2016-02-01

Start of the conduct period cited in reporting for the unlawful practices identified by the FSCA.

2022-03-31

End of the conduct period cited in reporting for the unlawful practices identified by the FSCA.

Suggested considerations

• Compliance teams may wish to review whether client-money segregation controls are strong enough to prevent commingling of funds where administration fees and member contributions pass through shared accounts.
• Firms may wish to test whether regulatory reporting processes include sufficient validation, approval, and escalation controls to reduce the risk of misleading submissions.
• Boards and senior management may wish to assess whether payment-authorization controls over senior personnel, related-party payments, and expense cards are independently reviewed and well documented.
• Risk and internal-audit teams may wish to examine whether bank-reconciliation and anomaly-detection procedures would identify unusual outflows to personal accounts or related entities quickly enough.
• Firms handling member deductions or insurance premiums may wish to confirm that end-to-end flow tracing exists for funds paid to insurers and third parties, with evidence that money is applied only for its intended purpose.
• Governance teams may wish to test whether fit-and-proper, debarment, and accountability frameworks are capable of detecting senior misconduct early and limiting harm.
• Businesses relying on legacy or outsourced administration structures may wish to confirm that interim management and contingency arrangements exist for rapid stabilisation if misconduct or licence risk emerges.

What changed

The FSCA confirmed that its investigation was complete and that enforcement action would follow, which is reflected in the later licence withdrawal, penalties, and debarment orders. The reported findings indicate unlawful practices between February 2016 and March 2022, including commingling client funds, submitting misleading regulatory reports, failing to exercise proper care over funds, and making unauthorised payments from the SANDF Group Life Insurance Scheme account.

Suggested considerations

• Compliance teams may wish to review whether client-money segregation and reconciliation controls are robust enough to prevent commingling or unauthorized use of funds.
• Firms may wish to reassess governance over senior executives, key individuals, related-party payments, and delegated authority limits.
• Institutions handling payroll deductions or benefit contributions may wish to test whether payment flows, beneficiary remittances, and audit trails are transparent and independently traceable.
• Compliance functions may wish to review statutory reporting sign-off, escalation, and challenge procedures for anomalies or inaccuracies.
• Boards and risk committees may wish to consider whether ongoing fit-and-proper monitoring of key individuals is sufficiently documented and frequent.
• Firms relying on affiliated or outsourced intermediaries may wish to confirm counterparties’ licence status and the scope of their authorisation before continuing service arrangements.

What changed

The Foundation’s authorisation to act as a financial services provider was withdrawn under the FAIS regulatory framework, ending its licence-based ability to render regulated financial services. Two senior individuals were also debarred from rendering financial services for 30 years, and the FSCA imposed administrative penalties of R24 million and R20.7 million, respectively, based on reported misconduct including commingling client funds, misleading regulatory reports, failure to exercise proper care over funds, and unauthorised payments to themselves.

Key dates

07 August 2023

- Law of 7 August 2023 introducing the new accounting regime for associations and foundations enters into force and defines classification as “small associations”, “medium‑sized associations” and “large associations” with corresponding accounting obligations

Autumn 2026

- CNC plans to publish an accounting guide dedicated to the new accounting regime for ASBLs classified as small, medium‑sized and large associations, and associations recognised as being of public utility

04 August 2026

- CSSF press release is published, formally drawing supervisory attention to CNC Q&A 26/038 and the related upcoming CNC accounting guide

Suggested considerations

• Identify all Luxembourg associations, public‑utility associations and foundations within or related to the group that are impacted by the Law of 7 August 2023 and confirm their size classification (small, medium‑sized, large) and whether they fall under the “medium‑sized undertakings” regime.
• Review existing accounting policies, charts of accounts and annual accounts formats for affected entities to ensure alignment with LRCS statutory layouts, including non‑abridged balance sheet, appropriate profit and loss format, and required notes disclosures.
• Decide at governing‑body level whether each affected entity will voluntarily adopt the PCN or maintain an internal chart of accounts, documenting the rationale, governance approvals and compliance impacts of the chosen option.
• Where PCN is not adopted, design, implement and document a robust mapping from the internal chart of accounts to the statutory LRCS balance sheet and profit and loss layouts, ensuring audit‑ready documentation and traceability.
• Update accounting systems and reporting tools for affected entities to support LRCS statutory layouts, consistent layout adaptations, and classic‑format filing with the RCS, including necessary changes to interfaces and data capture.

What changed

• - Large associations, associations recognised as being of public utility and foundations are now subject to the accounting regime applicable to “medium‑sized undertakings” under the amended...
• Annual accounts for affected entities must include a non‑abridged balance sheet, a profit and loss account (at least in abridged format), and notes to the accounts containing disclosures required by...
• Affected entities must use statutory LRCS layouts for the balance sheet and profit and loss account and file their annual accounts in classic format with the Luxembourg Trade and Companies Register...
• Large associations, public‑utility associations and foundations remain exempt from the mandatory use of the Standard Chart of Accounts (Plan Comptable Normalisé – PCN) and from eCDF standard data...
• Affected entities may voluntarily adopt the PCN; if they do not adopt PCN, they must maintain an internal chart of accounts and ensure robust, documented mapping between internal accounts and...

Key dates

03 August 2026

- ESAs publish the Final Report and draft RTS proposing amendments to Delegated Regulation (EU) 2016/2251 to simplify bilateral margin requirements for counterparties below the EUR 8 billion initial margin threshold

TBD (European Commission adoption)

- The European Commission reviews and, if satisfied, endorses the draft RTS amending the EMIR bilateral margin Delegated Regulation; exact date to be set by the Commission’s internal process

TBD (European Parliament and Council scrutiny)

- Following Commission endorsement, the RTS are subject to scrutiny by the European Parliament and the Council under the standard RTS procedure before publication in the Official Journal

TBD (Entry into force – OJ publication + 20 days)

- The amended RTS enter into force on the date specified in the Official Journal (typically 20 days after publication), from which firms can legally apply the new exemption regime

TBD (Three years after entry into force) Deadline

- By the date three years after entry into force, the ESAs must complete a review of the application and impact of the exemption from initial margin requirements in Article 28(1), potentially informing further changes

Suggested considerations

• Map all EMIR in-scope entities within the group and identify those whose AANA of non-centrally cleared OTC derivatives is close to or below the EUR 8 billion threshold, to assess which relationships may benefit from the expanded exemption.
• Review current collateral and margin frameworks to identify legacy contracts where initial margin is still being exchanged solely because the regime requires continuation despite the counterparty having fallen below the EUR 8 billion threshold.
• Prepare an internal policy update so that, once the RTS enter into force, initial margin requirements are switched off for counterparties below the EUR 8 billion threshold on both new and existing uncleared OTC derivatives, subject to group risk appetite.
• Update EMIR margin procedures and AANA calculation processes to ensure accurate annual determination of whether each counterparty is above or below the EUR 8 billion threshold, including documentation of the March–May calculation methodology.
• Review and amend collateral agreements, credit support annexes (CSAs) and associated legal documentation to incorporate the revised treatment for below-threshold counterparties, including terms for stopping margin exchange and potentially releasing segregated collateral.

What changed

• - Counterparties whose average aggregate notional amount (AANA) of non-centrally cleared OTC derivatives falls below the EUR 8 billion threshold will no longer be required to exchange initial margin...
• The current framework, under which below-threshold counterparties are exempt from initial margin for new trades but must continue to exchange initial margin for pre-existing “legacy” contracts, will...
• Article 28(1) of Delegated Regulation (EU) 2016/2251 will be amended to explicitly extend the exemption from initial margin requirements to outstanding contracts where one of the two counterparties...
• The RTS introduce a clearer operational framework for entry into and exit from the initial margin regime based on the annual AANA calculation for March–May, including scenarios where one or both...
• Once a counterparty falls below the EUR 8 billion threshold under the revised rules, firms will be permitted to terminate related initial margin processes, including ceasing ongoing calculation,...

Key dates

2026-08-03

ESAs publish final report and draft RTS proposing amendments to Delegated Regulation (EU) 2016/2251 bilateral margin requirements

Suggested considerations

• Compliance teams may wish to review current EMIR margin frameworks and inventories of uncleared OTC derivatives to identify portfolios and counterparties that are below the €8 billion initial margin threshold and could be affected by the proposed phase-out of initial margin exchange.
• Risk and collateral management functions should consider assessing the operational processes, documentation and systems currently used to calculate, call and exchange initial margin on legacy uncleared OTC derivative contracts, to understand the potential impact of a removal of these obligations on collateral flows and counterparty risk management.
• Legal and documentation teams may wish to map existing credit support annexes (CSAs) and collateral agreements to EMIR margin requirements, evaluating whether standard terms referencing Delegated Regulation (EU) 2016/2251 would need amendment if the RTS are endorsed and the obligation to exchange initial margin for below-threshold portfolios is removed.
• Regulatory affairs and policy teams should consider monitoring the European Commission’s endorsement process and subsequent scrutiny by the European Parliament and Council, tracking any changes to the draft RTS text that could affect scope, thresholds or transitional arrangements.
• Firms subject to EMIR in multiple jurisdictions may wish to compare the proposed EU treatment of below-threshold initial margin portfolios with requirements in other key jurisdictions (e.g. US, UK) to ensure consistent cross-border collateral and margin policies and avoid regulatory arbitrage or misalignment.
• Compliance teams may wish to prepare briefing materials for senior management and boards outlining the anticipated simplification and burden reduction, alongside any residual risks or supervisory expectations that could accompany the phase-out of initial margin for below-threshold counterparties.

What changed

Under the current EU bilateral margin framework in Delegated Regulation (EU) 2016/2251, counterparties with an aggregate average notional amount of non-centrally cleared derivatives below the €8 billion initial margin threshold specified in Regulation (EU) No 648/2012 (EMIR) are exempt from exchanging initial margin on new uncleared OTC derivative contracts, but must continue to exchange initial margin on existing contracts.

Key dates

2026-07-31

Joint ESA statement on ICT risks from frontier AI models in the EU financial sector published

Suggested considerations

• Compliance teams may wish to map existing and planned uses of frontier AI models (including large language models and other advanced generative or predictive systems) to current ICT risk and cyber resilience frameworks under Regulation (EU) 2022/2554 (DORA) to demonstrate that these models are covered by documented risk assessments, controls and monitoring.
• Firms should consider reviewing governance arrangements for frontier AI, including board and senior management oversight, clear accountability, and integration of AI-related ICT risks into the firm’s risk appetite, risk taxonomy and operational risk frameworks, with specific escalation and reporting lines.
• Risk and technology functions may wish to update ICT and cyber risk management policies to explicitly address frontier AI threats (e.g. prompt injection, model poisoning, data leakage, adversarial attacks) and to align detection, logging and incident response capabilities with the ESAs’ emphasis on prevention, detection and management of AI-related cyber risks.
• Operational resilience teams should consider conducting scenario analysis and testing around frontier AI incidents (such as compromised AI-enabled customer interaction tools or automated decision engines) to evidence the ability to maintain critical services in line with DORA requirements on ICT-related incident management and business continuity.
• Compliance and procurement teams may wish to review contracts and due diligence for critical ICT third‑party providers that supply or host frontier AI models, assessing how provider controls, service levels and incident processes meet DORA expectations and the ESAs’ focus on frontier AI risks.
• Supervisory engagement teams should consider preparing to discuss the firm’s frontier AI strategy, risk management and governance with competent authorities, using the ESA statement as a reference point for how existing supervisory expectations on ICT risk and cyber resilience are applied to AI use cases.
• Internal audit and second‑line control functions may wish to plan thematic reviews of frontier AI deployments to assess coverage of AI-specific ICT risks within existing control frameworks, including documentation quality, model oversight, and alignment with DORA and sectoral guidance.
• Firms should consider monitoring forthcoming ESA and national competent authority publications on frontier AI and DORA oversight activities, as the statement signals that supervisory practices and expectations in this area are evolving and may be further operationalised.

What changed

The publication introduces a consolidated supervisory expectation that frontier AI models be treated explicitly as a source of ICT and cyber risk within existing EU operational resilience and ICT risk management frameworks, rather than as a separate technology domain. It emphasises the need for robust governance, risk management, and controls around the prevention, detection and management of cyber risks stemming from frontier AI, including model governance, validation, monitoring and incident handling.

Key dates

2026-07-31

Launch of the public consultation on DPM 2.1 and publication of naming conventions for metadata used in reporting

2026-09-30 Deadline

Deadline for submitting comments to the DPM 2.1 public consultation

2023-06-01

Publication month of DPM Standard 2.0 by EBA and EIOPA, establishing the current baseline data dictionary standard

2024-03-01

Establishment of the DPM Alliance joint governance framework by EBA, EIOPA and ECB to extend DPM to ECB statistical reporting

Suggested considerations

• Compliance teams may wish to review the DPM 2.1 factsheet and the published naming conventions to understand proposed changes in metadata versioning, logical data model support and naming structures, and how these could impact existing COREP, FINREP, resolution and insurance reporting implementations.
• Regulatory reporting and technology teams should consider mapping current data dictionaries and reporting taxonomies (including those used for CRR/CRD prudential reports, BRRD/SRB resolution reports and EIOPA insurance and pensions reports) against the DPM 2.1 metamodel to assess the scale of future migration effort and potential system changes.
• Firms should consider engaging in the consultation process, either directly or via industry bodies, to provide feedback on the practicality of the proposed metamodel and naming conventions, particularly where they affect multi-framework reporting or large-scale data integration projects.
• Compliance and regulatory change functions may wish to flag DPM 2.1 internally as a strategic development in EU reporting architecture and ensure it is reflected in medium-term reporting transformation programmes, including planning for alignment with the ESCB Integrated Reporting Framework (IReF).
• Reporting vendors and in-house IT teams should consider evaluating whether their current regulatory reporting tools and data models can support DPM 2.1’s enhanced versioning and logical data model capabilities, and identify potential design changes needed to remain aligned with future EBA, EIOPA and ECB requirements.
• Supervisory liaison and public policy teams may wish to monitor subsequent EBA, EIOPA, ECB and SRB communications following the close of the consultation for indications of timelines when DPM 2.1 and the naming conventions will become expected or mandatory for specific reporting frameworks.

What changed

The DPM Alliance is consulting on DPM 2.1, an updated version of the DPM metadata model that introduces enhanced metadata versioning and extends the metamodel to host logical data models, with the explicit objective of supporting integrated European reporting across all regulatory frameworks in the financial sphere. The consultation also covers newly published naming conventions that set out a common approach for naming metadata used in reporting, designed to ensure consistent use of the common data dictionary across regulatory reporting frameworks.

Key dates

TBD (est. late 2026–2027)

- CBI will integrate the Supplemental Guidance with the Main Guidance on Fitness and Probity Investigations, Suspensions and Prohibitions as part of its wider implementation of a recent High Court judgment relating to F&P enforcement procedures

28 January 2026

- CBI launches Consultation Paper 166 on Supplemental Guidance relating to Prohibition Notices under the Fitness and Probity regime

11 March 2026

- CBI hosts an industry webinar on the Supplemental Guidance on Prohibition Notices under the Fitness and Probity regime

25 March 2026

- CP166 consultation period closes; CBI receives eight submissions from representative bodies and individuals

30 July 2026

- CBI publishes the final Supplemental Guidance on Prohibition Notices under the Fitness and Probity Regime and the Feedback Statement on CP166

Suggested considerations

• Update Fitness and Probity policies, procedures, and governance frameworks to explicitly address the possibility of Prohibition Notices, including criteria for escalation, internal investigation standards, record‑keeping, and engagement protocols with the CBI during prohibition-related processes.
• Ensure Board and senior management, including PCF role holders and HR/legal/compliance leads, are briefed on the new prohibition guidance, the publication policy, and the enhanced transparency of outcomes so that they understand the personal and organisational consequences of F&P failings.
• Strengthen documentation and retention of supervisory, disciplinary, compliance and performance records for CF and PCF holders to ensure that, if a prohibition is contemplated, the firm can provide a coherent, contemporaneous factual record to the CBI and the individual.
• Review and, where necessary, amend individual accountability frameworks (including Statements of Responsibilities and role profiles) to clearly delineate responsibilities, seniority and CF scope, given that these factors now explicitly influence the nature, scope and duration of any prohibition.
• Embed procedures to manage individuals who become subject to proposed or actual Prohibition Notices, including immediate role restrictions, notification workflows, communication protocols to boards and key stakeholders, and contingency planning for business continuity.

What changed

• - The Supplemental Guidance formally sets out the circumstances and general principles the CBI’s Prohibition Decision Maker will consider when deciding whether to impose a Prohibition Notice,...
• The guidance clarifies the decision-making framework for the nature, scope and duration of a prohibition, including whether it applies to specific controlled functions (CFs), parts of CFs, or any...
• The guidance codifies how a Prohibition Notice becomes effective, establishing that effectiveness arises either through a written agreement between the CBI and the individual concerned (prohibition...
• The guidance explains the three mechanisms by which a Prohibition Notice may be terminated or cease to have effect: (1) termination of a prohibition agreement by the CBI, (2) revocation of a...
• The Supplemental Guidance sets out CBI’s approach to requests by prohibited persons to terminate a prohibition agreement, including the factors CBI will assess when considering whether to lift or...

Key dates

31 December 2024

– Solvency UK reporting and disclosure reforms (phase 2) come into effect for reporting and disclosure reference dates on or after 31 December 2024, including the new Bank of England insurance XBRL taxonomy and removal of the Regular Supervisory Report requirement

Year‑end 2026 reporting (reference date 31 December 2026)

– Implementation of PS18/26 reporting and disclosure changes and Own Funds consequential reporting via a **single updated insurance taxonomy**, covering all amended templates, instructions, MALIR XBRL submissions and new FSCS projected liabilities data for third‑country branches

30 September 2026

– Liquidity reporting requirements for UK Solvency UK insurers with large derivatives and securities financing transaction exposures come into force, requiring firms above specified thresholds to commence new liquidity reporting

31 December 2026 Deadline

– Revocation of certain Solvency UK Modifications by Consent (including the Reporting MbC) becomes effective; affected third‑country branches meeting premium or provisions thresholds must submit the full branch reporting suite

Suggested considerations

• Review and map existing Solvency UK reporting processes, systems and controls against the amended Reporting Part of the PRA Rulebook and updated templates and instructions to identify required changes for year‑end 2026.
• Engage with finance, risk and actuarial functions to implement the new XBRL‑based MALIR submission process, including testing data extraction, validation and filing workflows aligned to the updated insurance taxonomy.
• Update internal Own Funds policies, classification procedures and governance documentation to reflect removal of specified permission requirements and the amended Own Funds Part and Group Supervision Part of the PRA Rulebook.
• Reconfigure regulatory reporting infrastructure and vendor solutions to adopt the single updated PRA insurance XBRL taxonomy, ensuring all Solvency UK quantitative reporting templates and narrative disclosures are correctly mapped and validated.
• For third‑country branch undertakings, design and implement processes to calculate and report projected FSCS liabilities data in line with PRA expectations, including data sourcing, modelling assumptions and internal review controls.

What changed

• - The PRA finalises amendments to the Reporting Part of the PRA Rulebook to implement post‑implementation clarifications, consistency improvements and data quality enhancements to Solvency UK...
• Reporting and disclosure templates and instructions are amended (including XBRL taxonomy changes) to reflect the refined Solvency UK reporting framework and consequential changes from the Own Funds...
• The PRA confirms transfer of the Matching Adjustment Asset and Liability Information Return (MALIR) templates from Excel to XBRL submission format, to be incorporated into the single insurance...
• The PRA updates Supervisory Statement 7/18 – Solvency II: Matching adjustment, including changes to the Matching Adjustment supplementary information form under Insurance rule permissions and...
• The PRA introduces a new collection of projected Financial Services Compensation Scheme (FSCS) liabilities data from third‑country branch undertakings to support enhanced branch supervision.

Key dates

11 September 2026

- Consultation end date for proposals to amend SS25/15, SS26/15, IM.03 instructions, and the PRA liquidity rules (Liquidity (CRR) Part and LCR (CRR) Part)

31 December 2026 Deadline

- Proposed implementation date for the SS25/15 and SS26/15 changes and removal of Lloyd’s syndicates from IMO reporting, so syndicates are not required to report IMOs as part of their 2026 year‑end results

01 January 2027

- Proposed implementation date for amendments to the Liquidity (CRR) Part and Liquidity Coverage Ratio (CRR) Part, aligned with Basel 3.1 implementation, CRR restatement in the PRA Rulebook, and the expected entry into force of the Overseas Prudential Requirements Regime (Credit Institutions and Investment Firms) Regulations 2026

Suggested considerations

• Review existing IMO reporting processes and systems for Lloyd’s syndicates and prepare to decommission IMO submissions to the PRA for 2026 year‑end, ensuring all dependent internal reports and controls are updated.
• Map all uses of IMOs in ORSA processes and supervisory reporting for non‑life firms, and update ORSA documentation and methodologies to reflect that the IMO‑based option applies only to firms that remain in scope of IMO reporting.
• Update internal reporting manuals and instructions for IM.03 and related Solvency UK templates to reflect the revised PRA wording, removal of outdated EU references, and alignment with the PRA’s Solvency UK framework.
• For Lloyd’s managing agents and syndicates, confirm alternative data channels and reporting obligations to the PRA (via Lloyd’s or Solvency UK templates) that will replace the supervisory reliance previously placed on IMO reporting.
• Conduct an inventory of non‑UK covered bonds currently recognised as Level 2A HQLA in LCR calculations and assess how the proposed amendments to Article 11(1)(d)(ii) would change eligibility, haircuts, or caps from 1 January 2027.

What changed

• - Lloyd’s syndicates would be removed from the scope of Internal Model Output (IMO) reporting to the PRA via amendments to SS25/15 (Solvency II: Regulatory reporting, internal model outputs),...
• SS26/15 (Solvency II: ORSA and the ultimate time horizon – non‑life firms) would be amended to clarify that the option to use IMO outputs in ORSA reporting applies only to firms still required to...
• The IM.03 reporting instructions (section “General Comment”) would be amended to align the reporting template guidance with the removal of Lloyd’s syndicates from IMO reporting, avoiding inconsistent...
• SS25/15 and SS26/15 would receive non‑substantive drafting updates to improve clarity and consistency, remove outdated EU references, and align terminology and framing with the PRA’s current Solvency...
• For 2026 year‑end, Lloyd’s syndicates would no longer be required to submit IMOs to the PRA, with supervisory reliance instead on other Solvency UK reporting streams and data provided through the...

Key dates

31 July 2023

- Consumer Duty came into force for open products and services and firms were expected to have outcomes monitoring capability in place from day one

31 July 2024 Deadline

- The final Consumer Duty implementation deadline applied to all in-scope financial services firms

2025

- The FCA reviewed firms’ approaches to outcomes monitoring over the past year and published its findings in this blog and related review material

TBD (ongoing)

- Firms are expected to continue regular monitoring, testing, and evidence-gathering on an ongoing basis under PRIN 2A.9

Suggested considerations

• Firms must establish and maintain a documented outcomes monitoring framework that defines good and poor customer outcomes for each relevant product or service.
• Firms must map metrics to the full customer journey, including product design, communications, customer support, and distribution arrangements.
• Firms must collect MI that can identify poor or potentially poor outcomes, root causes, and emerging risks before harm crystallises.
• Firms must document the rationale for each metric, threshold, and tolerance, including why those measures are appropriate for the customer population and product.
• Firms must maintain a clear audit trail linking MI, governance review, decisions, remediation, and outcome improvement testing.

What changed

• - The FCA expects firms to regularly assess, test, understand, and evidence the outcomes retail customers are receiving under the Consumer Duty.
• Firms should use monitoring to identify whether any group of retail customers is experiencing different outcomes from another group for the same product and understand why those differences exist.
• Monitoring frameworks should define what good outcomes look like in practice and translate those outcomes into measurable indicators tied to the customer journey.
• Firms should not rely on broad or high-level MI alone; they must use information to challenge performance, identify risks, and drive improvements.
• Firms should be able to explain why metrics and tolerances were chosen and whether any actions taken have been tested and shown to reduce harm or friction.

Key dates

27 April 2012

- CISIAM became licensed under the Securities and Futures Ordinance to carry on Type 4 (advising on securities) and Type 9 (asset management) regulated activities

03 June 2013

- CISIAM obtained a licence to carry on Type 5 (advising on futures contracts) regulated activity

August 2019

- Start of the period during which CISIAM’s failures as fund manager occurred in relation to the Tahoe Life‑related private fund

September 2020

- End of the period during which CISIAM’s failures in managing the private fund took place

Suggested considerations

• Review and update private fund governance frameworks to ensure investment approvals require independent investment discretion, documented due diligence, and explicit challenge of investor‑driven proposals, particularly those originating from client senior management.
• Implement or enhance written procedures to identify “dubious arrangements”, including criteria such as unnecessary structural complexity, unclear commercial rationale, additional costs or risks, related‑party exposure, and potential concealment of asset movements or connected transactions.
• Establish a mandatory escalation and approval process for complex or investor‑driven transactions, requiring risk, compliance, and senior management sign‑off before execution and documented reasoning for proceeding.
• Conduct a gap analysis of all existing private funds to confirm that current and past investments comply with the funds’ investment restrictions and stated objectives, and remediate any breaches including client notification and corrective actions where appropriate.
• Strengthen risk management frameworks for private funds by defining key risk types, setting monitoring thresholds, and implementing periodic risk reporting to senior management and the board.

What changed

• - Asset managers must maintain and apply documented procedures and controls to identify whether proposed private fund arrangements or transactions are dubious, including where structures are...
• Where a proposed arrangement or transaction is assessed as dubious, asset managers may only proceed once they are satisfied that concerns and red flags have been sufficiently addressed and evidenced.
• Fund managers are expected to exercise independent investment discretion and cannot rely solely on investor‑driven proposals, especially from influential client personnel such as chief investment...
• Asset managers must ensure that all fund investments comply with the fund’s stated investment restrictions and align with its stated investment objectives, with documented controls to verify...
• Firms must implement effective measures to identify, manage, and continuously monitor the risks to which private funds are exposed, including counterparty, concentration, structural, and...

Suggested considerations

• Conduct a board-level review of the firm’s business model, focusing on vertical integration, ownership and financing relationships to identify where commercial incentives may misalign with customer interests and create conflicts of interest.
• Map the full insurance value chain (underwriting, distribution, premium finance, ancillary services) within the group or related parties, and document actual and potential conflicts of interest at each link and interaction point.
• Review and, where necessary, update the firm’s conflicts-of-interest policy and SYSC 10 framework to explicitly cover vertically integrated structures, premium finance arrangements, delegated authorities and any intra-group referrals.
• Establish or strengthen governance arrangements to ensure clear senior management accountability for conflicts-of-interest management, including allocation of responsibilities in Statements of Responsibilities and the Management Responsibilities Map.
• Assess product design, panel construction and distribution strategies to ensure they are not unduly influenced by internal group relationships or remuneration structures that could lead to poor customer outcomes or unfair value.

What changed

• - The FCA explicitly highlights vertically integrated insurance business models (combining underwriting, distribution, premium finance and related services within one group) as a source of heightened...
• Ownership and financing relationships, including private and non-transparent arrangements within groups or between firms, are now clearly framed as potential conflicts drivers that must be assessed...
• The FCA reiterates that having conflicts of interest is not inherently unacceptable, but firms must actively identify, manage and evidence those conflicts through effective governance, senior...
• The FCA states that disclosure on its own is not sufficient; firms remain obligated to properly manage conflicts, and cannot rely solely on informing customers to discharge their duties.
• Firms are expected to review how they design products and panels, structure remuneration, and communicate with customers to ensure that commercial relationships and incentives do not distort customer...

Key dates

22 July 2026 Deadline

– CBI announces the appointment of Josephine Feehily and the commissioning of an independent review of enforcement activities, with a commitment that a report including recommendations will be provided to the Governor and published in due course

TBD (post‑review publication date)

– CBI publication of the external reviewer’s report and recommendations, which will likely act as the starting point for any formal changes to the enforcement framework, processes or guidance

TBD (following CBI response to the report)

– Expected phased implementation of any accepted recommendations through updated policies, procedures, public statements, or, where necessary, legislative or regulatory amendments

Suggested considerations

• Review and document your enforcement‑facing governance, including Board and senior management oversight of investigations, decision‑making on settlement, and escalation paths, to ensure these are robust and can withstand a more structured or time‑bound enforcement approach.
• Assess whether your record‑keeping, data, and management information relating to regulatory breaches, incidents, and CBI interactions are sufficiently complete and organised to support faster and more transparent enforcement processes.
• Conduct a gap analysis of investigation procedures and response playbooks (e.g. dawn raid readiness, information requests, interviews, internal investigations) to ensure they can meet potentially tighter CBI timeliness and information‑quality expectations.
• Update Board and senior management on the launch of the enforcement review and agree a watching brief, including designation of a responsible function (e.g. Compliance or Legal) to monitor the review, its terms of reference, stakeholder engagements and eventual recommendations.
• Engage external counsel or industry associations, as appropriate, to prepare for possible consultation or stakeholder engagement opportunities during the review, including developing key messages on proportionality, timeliness, transparency and coordination with supervision.

What changed

• - The CBI has formally commissioned an independent review of its enforcement activities, covering both how enforcement is structured and how it operates in practice, rather than a narrow thematic or...
• The review mandate expressly covers the performance of enforcement activities and the role of enforcement within the wider supervisory framework, indicating that enforcement may be repositioned...
• The review will examine enforcement structures and processes, including decision‑making governance, which may result in new approval routes, escalation paths, or committee structures for opening,...
• The review will look at case‑selection criteria and processes, suggesting potential future changes to how and why firms or individuals are selected for enforcement action, and possibly the...
• Timeliness of enforcement actions is in scope, which may lead to explicit timelines or service standards for case progression, investigation milestones, and resolution, with potential knock‑on...

Key dates

TBD (following consultation responses, expected late 2026 or later)

- The final Policy Statement would be published, and the proposals would take effect on publication

22 October 2026

- The consultation closes

Suggested considerations

• Firms planning a Part VIII transfer should map their transaction timetable against the PRA’s proposed step-by-step process and identify where the revised guidance may affect sequencing.
• Firms should assess whether their proposed transaction could qualify for a waiver of the transferee member vote and prepare supporting rationale and evidence accordingly.
• Firms should determine early whether the PRA is likely to expect an independent actuary’s report and build that workstream into the transaction plan.
• Firms should confirm whether the proposal applies to their structure, including whether they are a friendly society or another type of firm within scope.
• Firms and advisers should review current transaction playbooks and board papers to align them with the PRA’s stated approach before the consultation closes.

What changed

• - The PRA proposes to set out a typical sequence of steps firms would follow when undertaking a Part VIII transfer.
• The PRA proposes to provide greater transparency on its decision-making considerations for Part VIII transactions.
• The PRA proposes to explain when it may waive the requirement for a member vote by the transferee.
• The PRA proposes to explain when it may require an independent actuary’s report.
• The PRA proposes to clarify the scope of applicability of the process for both friendly societies and non-friendly-society firms.

Key dates

TBD (est. late 2026 / early 2027)

– Expected PRA policy statement and finalised amendments to the Statement of Policy on insurance business transfers, following consultation feedback (exact date not specified in the CP)

Early July 2026

– PRA publishes CP12/26 “Insurance friendly societies, amalgamations and transfers”, launching the consultation on proposed codified guidance and Statement of Policy amendments

Suggested considerations

• Map all current and planned amalgamations or transfers involving friendly societies against the proposed five‑part process (planning, analysis, member engagement and votes, application/notifications/representations, confirmation meetings) and identify procedural and evidential gaps.
• Review internal policies, governance frameworks, and transaction playbooks for friendly society restructurings to ensure they reflect the PRA’s codified expectations under Part VIII of the Friendly Societies Act 1992, including early regulatory engagement and documentation standards.
• Develop or enhance internal guidance for actuaries and finance teams on the required actuarial analysis for Part VIII transfers, ensuring the ability to evidence that preclusion grounds are not met and that the transaction is in the interests of members and policyholders.
• Implement procedures to identify all classes of members and policyholders affected by proposed amalgamations or transfers, assess whether their existing terms and conditions are preserved or materially changed, and document the implications for benefit levels and distribution.
• For partial transfers, establish a formal framework to assess and document how the interests of members remaining with the transferor society are considered, including any continuing obligations, capital support, and benefit expectations.

What changed

• - The PRA proposes a more detailed, codified description of the end‑to‑end Part VIII process for friendly society amalgamations and transfers, organised into stages such as planning and preparation,...
• The PRA intends to update and integrate its Statement of Policy on insurance business transfers to explicitly cover friendly society amalgamations and transfers under the Friendly Societies Act 1992,...
• For transfers, the PRA sets out circumstances in which it may exercise its statutory discretion to dispense with the requirement for the transferee friendly society to hold a member vote, subject to...
• The PRA proposes to clarify when it may direct the transferor and/or transferee to appoint an independent actuary to report on the proposed transfer’s effects on members and policyholders, including...
• Firms undertaking a Part VIII transfer will be expected to provide robust actuarial analysis and supporting evidence demonstrating that statutory preclusion grounds are not met and that the transfer...

Key dates

August 2021

- Start of the relevant period during which HDI Global SE submitted incorrect FSCS Liabilities and FSCS Fee Tariff data to the PRA

Summer 2023

- By this point, HDI Global SE had still not checked the PRA Rulebook or guidance on FSCS coverage and fee tariff methodology, illustrating the duration of governance and diligence failures

January 2024

- The Early Account Scheme (EAS) becomes part of the Bank of England’s enforcement policy for PRA firms and FMIs

August 2024

- End of the relevant period of misreporting, including errors in data submitted as purported remediation of earlier incorrect returns

November 2024

- The Bank of England updates its statutory statements of policy and procedure on enforcement, setting out the PRA’s approach to exercising enforcement powers under FSMA 2000

Suggested considerations

• Review and map all FSCS Liabilities and FSCS Fee Tariff reporting obligations under the PRA Rulebook and applicable guidance, ensuring the firm’s methodology aligns with regulatory definitions of FSCS-covered liabilities.
• Conduct a detailed end-to-end review of regulatory reporting processes for FSCS data, including data sourcing, calculations, validations, and submission workflows, to identify and remediate control weaknesses.
• Develop and document formal, robust written procedures that govern the calculation and validation of FSCS Liabilities and FSCS Fee Tariff data, including change-control processes for methodologies.
• Assign clear ownership and accountability for FSCS-related reporting within the firm’s governance framework, ensuring named individuals or functions are responsible for accuracy, completeness, and timely submission.
• Strengthen internal oversight, challenge and review mechanisms over prudential and FSCS-related reporting, including regular independent checks by risk, compliance or internal audit.

What changed

• - The PRA has explicitly reinforced that FSCS Liabilities and FSCS Fee Tariff data are core prudential reporting metrics, and misreporting them may both impede risk assessment and cause underpayment...
• The enforcement action clarifies that failures to consult the PRA Rulebook and applicable guidance on FSCS coverage and fee tariff methodologies constitute a breach of Fundamental Rule 2 (due skill,...
• The PRA has signalled that the absence of effective written processes for calculating regulatory data, and lack of clear accountability, internal oversight, and challenge over those calculations,...
• The case demonstrates that remediation submissions are subject to the same accuracy and governance expectations as original returns, and that errors in purported remediation will be treated as...
• The PRA’s Early Account Scheme (EAS), formally incorporated into its enforcement policy in January 2024, is now clearly positioned as a mechanism that can materially reduce penalties where firms...

Key dates

17 July 2026

- CBI issues the public warning notice listing Codeve Insurance Co DAC (CLONE) as an unauthorised firm under section 53 of the Central Bank (Supervision and Enforcement) Act 2013

Suggested considerations

• Update internal unauthorised/blacklist tables and watchlists to include “Codeve Insurance Co DAC (CLONE)”, the website `https://www.codeveinsurance.com`, and the email addresses `[email protected]`, `[email protected]`, and `[email protected]`.
• Configure onboarding, third‑party due diligence and supplier management systems so that any counterparty or proposal referencing these identifiers or closely similar names triggers escalation and enhanced verification.
• Conduct an immediate screening of existing distribution, outsourcing, binder, reinsurance and fronting arrangements to confirm that no current relationships involve the clone entity or its contact details.
• Implement or reinforce a formal “clone‑firm check” in client and counterparty KYC/KYB procedures, requiring staff to verify authorisation status directly against the CBI’s registers and unauthorised firm list before entering into insurance or reinsurance arrangements linked to Ireland.
• Issue an internal compliance and financial‑crime alert to underwriting, sales, distribution, treasury and investment teams highlighting the Codeve clone, the specific identifiers, and the need to report any contact or proposals linked to this entity.

What changed

• - The CBI has formally listed “Codeve Insurance Co DAC (CLONE)” as an unauthorised insurance/reinsurance firm and insurance intermediary/distributor for Ireland.
• The CBI confirms that this entity is not authorised in Ireland to provide insurance, reinsurance or insurance distribution/intermediary services.
• The warning identifies specific contact points used by the clone: website `https://www.codeveinsurance.com` and email addresses `[email protected]`, `[email protected]` and...
• The CBI confirms that the unauthorised firm has cloned the name and details of the authorised firm CODEVE Insurance Company dac to pass itself off as that legitimate entity and deceive consumers.
• The CBI explicitly states there is no connection between the authorised CODEVE Insurance Company dac and the unauthorised clone, clarifying that the authorised firm is a victim of impersonation.

Key dates

Summer 2026

– PRA and FCA consultations expected to be issued on detailed rules for the new UK captive insurance regime

16 June 2026

– PRA speech by Shoib Khan outlining policy approach, boundaries of captive activity, and expectation of a consultation in summer 2026

14 October 2026

– Consultation closing date for responses to the PRA/FCA captive regime proposals

Summer 2027

– Target **launch of the new captive insurance regime**, following consideration of consultation feedback and finalisation of PRA/FCA rules and guidance

Mid‑2027

– Consistent target implementation window indicated in government and regulator communications for the new captive framework to become operational

Suggested considerations

• Assess whether existing or planned group risk‑financing strategies would benefit from establishing a UK single‑parent captive under the proposed regime and document the strategic rationale.
• Map current and planned intra‑group insurance and reinsurance arrangements, including any employee benefits‑related policies, to confirm which risks can be written directly and which must only be written on a reinsurance basis.
• Engage early with internal stakeholders (risk, treasury, legal, tax, and senior management) to determine preferred captive structures (standalone vs future PCC) and governance arrangements aligned with PRA expectations.
• Prepare to participate in the PRA and FCA consultations by drafting detailed, technical responses on authorisation processes, capital methodologies, reporting templates, and conduct requirements for captives.
• Review existing Solvency UK and Consumer Duty compliance frameworks and identify which elements would no longer apply to captives under the proposed regime, while ensuring that any remaining protections and safeguards are maintained where appropriate.

What changed

• - Introduction of a tailored regulatory framework for single‑parent captive insurers in the UK, distinct from the regimes applicable to traditional insurers and reinsurers.
• Creation of a streamlined dual PRA/FCA authorisation process for captives, with an explicit target decision timeline of 4–6 weeks from application.
• Exclusion of captives from Solvency UK requirements, with a move to a separate, flexible capital resources framework rather than Solvency II‑style minimum capital requirements.
• Exclusion of captives from the FCA Consumer Duty, recognising that captives primarily insure intra‑group risks and have limited direct retail customer exposure.
• Introduction of proportionately lower capital requirements for captives, reflecting their lower risk profile and group‑risk‑financing purpose.

Key dates

Summer 2026

– PRA (and FCA) indicated they would consult on a new UK captive insurance regime as part of their 2026 supervisory priorities and joint statements

14 October 2026 Deadline

– Deadline for responses to CP11/26 “A tailored regime for captive insurance”

Mid 2027

– Target implementation date for the new UK captive insurance regime, as indicated in prior PRA policy communications and government consultation responses

Suggested considerations

• Review CP11/26 in detail and perform an internal impact assessment on how the proposed captive regime would affect your group’s current or planned captive insurance structures, including domicile and regulatory capital profile.
• Identify whether any existing insurance entities within the group may fall within the PRA’s proposed definition of a captive and assess whether reclassification would be beneficial or would trigger additional compliance work.
• Prepare and submit a coordinated consultation response by 14 October 2026, addressing eligibility criteria, proportionality of capital and reporting requirements, and any operational or tax implications for your captive strategy.
• Map existing governance, risk management, and internal control frameworks for captives against PRA’s proposed expectations and identify gaps that would need remediation ahead of the regime’s expected go‑live in mid‑2027.
• Engage with group legal, tax, and treasury teams to evaluate whether onshoring an offshore captive to the UK, or establishing a new UK captive, becomes strategically attractive under the tailored regime, and model scenarios accordingly.

What changed

• - The PRA proposes to establish a dedicated UK regulatory regime for captive insurers, separate from the standard Solvency UK treatment for commercial (non‑captive) insurers.
• Captive insurers would benefit from proportionate prudential requirements (for example simplified capital, reporting, and risk management expectations) reflecting their limited and group-focused risk...
• The consultation seeks views on eligibility criteria for captives, likely including ownership (group‑owned), purpose (insuring or reinsuring parent/group risks), and restrictions on third‑party...
• PRA proposes a UK authorisation and licensing pathway specifically tailored to captives, with adjusted expectations for business plans, risk appetites, and use of reinsurance and fronting structures.
• The regime is intended to sit within Solvency UK rather than as a completely separate legislative framework, implying changes to the PRA Rulebook and supervisory statements rather than primary...

Key dates

10 July 2026

- CBI issues and publishes the Warning Notice identifying Inloovi Ireland Ltd. (Clone) as an unauthorised insurance intermediary and clone of A.R.B. Underwriting Limited t/a Buddy Travel Insurance, and lists the associated website and email addresses

Suggested considerations

• Review and update internal sanctions/blacklist and fraud‑risk lists to include “Inloovi Ireland Ltd. (Clone)”, the domain inloovi.com, and the listed email addresses, ensuring screening across onboarding, claims, complaints, and payment processing.
• Conduct an immediate counterparty and referral review to confirm that no current or proposed distribution, outsourcing, or referral arrangements involve Inloovi Ireland Ltd. (Clone) or entities using the inloovi.com domain.
• Enhance KYC and intermediary due‑diligence procedures to include explicit checks against the CBI’s unauthorised firms list and Section 53 Warning Notices before entering into any new intermediary, coverholder, or introducer arrangement.
• Update staff training (particularly for sales, claims, complaints, and contact‑centre teams) on recognising clone‑firm indicators (e.g., similar names, use of look‑alike domains, unofficial email addresses) and on escalation pathways to compliance and fraud teams.
• Review and, where necessary, enhance website monitoring and brand‑abuse detection (including domain monitoring, phishing detection, and use of take‑down services) to identify and address fraudulent websites or email domains purporting to represent the firm.

What changed

• - The CBI has formally identified “Inloovi Ireland Ltd. (Clone)” as an unauthorised insurance intermediary that is not authorised to provide insurance intermediary or insurance distribution services...
• The CBI has publicly associated specific digital identifiers with this fraudulent entity, including the website inloovi.com and email addresses [email protected], [email protected],...
• The CBI confirms that Inloovi Ireland Ltd. (Clone) has cloned details of a legitimate CBI‑authorised firm, A.R.B.
• The CBI clarifies that there is no connection whatsoever between the legitimate authorised entity and the clone firm, and the warning is intended to protect both consumers and the legitimate firm’s...
• The CBI reiterates that the name of the unauthorised firm is published under Section 53 of the Central Bank (Supervision and Enforcement) Act 2013, reinforcing its supervisory and enforcement stance...

Key dates

31 July 2023

– Consumer Duty (Principle 12 and PRIN 2A) applies to all new and existing in‑scope products and services open to new business for retail customers

31 July 2024

– Consumer Duty applies to closed products and services (legacy books), extending the expectations on product design, monitoring and fair value to those products

Suggested considerations

• Review and update product governance frameworks to ensure they explicitly incorporate Consumer Duty outcomes, including structured consideration of customer needs, characteristics and objectives at every stage of product design and lifecycle.
• Define and document granular target markets for each retail product and service, clearly articulating which customer segments the product is designed for, and excluding groups for whom the product could cause foreseeable harm.
• Map products and services against vulnerable‑customer characteristics and update design, features, pricing and servicing models to mitigate risks and support good outcomes for vulnerable groups.
• Implement or enhance processes to collect comprehensive management information on consumer outcomes (complaints, customer feedback, usage patterns, lapse and cancellation data, arrears and forbearance metrics) for each product.
• Establish governance mechanisms to ensure that insights from monitoring and MI lead to timely, documented actions to improve products, pricing, communications or customer journeys where emerging risks or poor outcomes are identified.

What changed

• - FCA reinforces that product design must be explicitly based on evidenced consumer needs, characteristics and behaviours, rather than generic assumptions or internal commercial priorities.
• Firms are expected to define target markets at a granular level, avoiding broad or generic categories that mask differing needs or risks (especially for vulnerable customers).
• Product governance must be embedded into business‑as‑usual decision‑making with clear ownership, challenge and accountability, not treated as a one‑off Consumer Duty implementation project.
• Manufacturers and distributors must maintain robust, ongoing monitoring of consumer outcomes using a wide range of management information, including complaints, usage patterns, early cancellations...
• There must be a clear, demonstrable link between monitoring and remedial action; collecting data without acting on emerging risks is characterised as weak practice.

Key dates

March 2024

– Legacy Cash Ratio Deposit (CRD) non‑interest‑bearing balances are converted into remunerated central bank reserves and the corresponding gilts portfolio is transferred to the Bank’s Banking Department, triggering the start of the Cost of Transition mechanism

17 April 2026

– PRA publishes CP7/26 “Regulated fees and levies: Rates proposals 2026/27”, consulting on draft fee rates, AFR and TFR for the 2026/27 fee year

15 May 2026 Deadline

– Deadline for firms to submit consultation responses on CP7/26 to the PRA

Early July 2026

– PRA publishes PS17/26 setting the final regulated fees and levies, including final 2026/27 PRA Levy, FMI Levy, Bank of England Levy amounts, and the application of the Cost of Transition mechanism for the 2026/27 fee year

From July 2026

– FCA/PRA joint invoicing cycle for 2026/27 periodic fees and levies begins; firms start to receive invoices incorporating the PRA Levy, Bank of England Levy, FMI Levy, and related statutory levies for the 2026/27 fee year

Suggested considerations

• Review the PS17/26 final numbers and tables to identify your firm’s applicable PRA fee‑block(s), the applicable Bank of England Levy and FMI Levy components, and quantify the 2026/27 impact relative to 2025/26.
• Update internal regulatory fee and levy forecasts, budgets, and accrual models to incorporate the 3% increase in core Bank levies, the 1% reduction in the PRA Levy, and any firm‑specific changes driven by business volumes or fee‑block allocations.
• For treasury and finance teams, model the Cost of Transition by stress‑testing scenarios where Bank Rate is above or below the legacy CRD gilt return, to understand potential upward or downward adjustments to the Bank of England Levy and reflect this in multi‑year financial planning.
• Ensure that board and relevant governance committees (e.g. Audit Committee, Risk Committee) are briefed on the 2026/27 levy changes, including the Cost of Transition mechanism, and that any material budget variances versus prior plans are explained and approved.
• For firms previously affected by the CRD scheme, update internal regulatory funding documentation and policies to remove references to CRD funding and to describe the new levy‑based and Cost of Transition arrangements, ensuring consistency with PS17/26 and the 2024 Bank of England Levy Framework.

What changed

• - The Bank’s core levies (Bank of England Levy, PRA Levy, FMI Levy, and other core levies) are constrained to grow by no more than CPI in 2026/27, with the Bank’s operating costs and associated core...
• Within this 3% cap, the Bank of England Levy (operational policy cost component) is budgeted to increase from £328 million (2025/26 budget) to £353 million in 2026/27, an 8% year‑on‑year rise driven...
• The PRA Levy is set to decrease slightly from £350 million (2025/26) to £345 million in 2026/27, a 1% reduction reflecting the PRA’s lower overall Total Funding Requirement and a different investment...
• The FMI Levy is budgeted to increase from £17 million (2025/26 budget) to £18 million in 2026/27, representing a 3% rise in costs for financial market infrastructure supervision.
• Overall, the Bank’s core levies (Bank of England Levy, PRA Levy, FMI Levy) are forecast to move from £695 million (2025/26 budget) to £715 million in 2026/27, a £20 million (3%) increase within the...

Key dates

07 July 2026

- MAS publishes Circular ID 08/26 and Consultation Paper P013-2026 on the Proposed Framework for Protected Cell Companies in Singapore, opening the consultation

07 August 2026

- Closing date for submissions to MAS on the PCC consultation paper

Suggested considerations

• Review the MAS Consultation Paper P013-2026 in detail and map proposed PCC requirements against your current and planned captive, reinsurance, ILS and sovereign risk pool structures.
• Conduct an internal impact assessment on how PCC introduction would affect corporate structuring, capital allocation, risk management, and policyholder/investor protections within your group.
• Identify potential use cases for PCCs (e.g. multi‑cell captives, collateralised reinsurance platforms, ILS issuance vehicles, sovereign risk pools) and assess legal, tax, accounting and regulatory implications for each use case.
• Engage legal, compliance, actuarial and treasury functions to develop a coordinated response to MAS addressing prudential treatment, segregation mechanics, governance expectations and disclosure considerations for PCCs.
• Prepare and submit detailed consultation feedback to MAS by 07 August 2026, including any requested clarifications, suggested safeguards, or recommended scope limitations or expansions for PCC usage.

What changed

• - MAS proposes introducing a Protected Cell Company (PCC) as a new corporate structure comprising a single legal entity with assets and liabilities statutorily segregated into distinct cells within...
• The PCC structure is intended to be available only to MAS-licensed entities engaged in captive insurance, insurance‑linked securities (ILS) and sovereign risk pooling activities, not generally to all...
• Each PCC will have a core and multiple cells, with ring‑fencing of assets and liabilities such that creditors of one cell should not have recourse to assets of other cells or the core, subject to...
• The framework is positioned to enable multiple risk issuances and programs within one vehicle, improving cost and operational efficiency compared with establishing multiple standalone insurers or...
• MAS signals that the PCC framework will complement existing special purpose reinsurance and alternative risk‑transfer structures, and is conceptually aligned with Singapore’s broader approach to...

Key dates

01 July 2026

- ESMA launches its public consultation on simplifying the EU Taxonomy disclosure framework and technical advice on selected KPIs under the Taxonomy Disclosures Delegated Act

22 July 2026

- ESMA holds a public hearing to present its proposals and engage with stakeholders on the consultation

12 August 2026 Deadline

- Deadline for stakeholders to submit responses to ESMA’s consultation on Taxonomy disclosure simplification

By October 2026

- ESMA (and other ESAs) are expected to deliver final technical advice on the Taxonomy Disclosures Delegated Act KPIs to the European Commission

Q1 2027

- Target date for the European Commission to complete its review of the Taxonomy Disclosures Delegated Act based on ESAs’ advice

Suggested considerations

• Conduct an internal impact assessment of current Taxonomy Article 8 KPI calculation and reporting processes, focusing on OpEx, Commissions and Fees, Trading Book, and Underwriting KPIs, to identify pain points and simplification priorities.
• Prepare and submit a response to ESMA’s consultation by 12 August 2026, either directly or via industry associations, articulating specific operational, data, and system challenges and concrete proposals for simplification.
• Register for and attend ESMA’s public hearing on 22 July 2026 to understand the detailed proposals, ask clarifying questions, and align internal positions ahead of submission.
• Coordinate with regulatory affairs, sustainability, risk, and finance functions to develop a unified institutional position on the desired design of revised KPIs and group‑level reporting under the Taxonomy Disclosures Delegated Act.
• Map dependencies between Taxonomy Article 8 data and other ESG reporting (including SFDR product disclosures and CSRD/ESRS reporting) to anticipate how changes to KPIs may affect cross‑framework consistency and data architecture.

What changed

• - ESMA is consulting on technical advice to the European Commission specifically targeting selected KPIs under the Taxonomy Disclosures Delegated Act (Article 8 of the Taxonomy Regulation), including...
• The stated policy objective is simplification of the EU Taxonomy disclosure framework while preserving decision‑useful information for investors and supervisors.
• ESMA aims to reduce reporting burdens for market participants, notably corporates and financial institutions subject to Taxonomy Article 8 disclosures.
• The consultation covers selected KPIs under the Taxonomy Disclosures Delegated Act, with the European Commission having requested focused advice on: OpEx KPI of non‑financial firms; Commissions and...
• ESMA is proposing more pragmatic approaches to group‑level reporting for mixed groups, including reporting at parent‑undertaking level to reduce complexity for conglomerates.

Key dates

01 April 2025

- Start of the reporting period for the Bank of England and PRA’s 2025/26 Prescribed Persons whistleblowing report

31 March 2026

- End of the reporting period for the 2025/26 whistleblowing disclosures referenced in the Bank and PRA report

By 30 September 2026 (within six months of 31 March 2026) Deadline

- Latest date by which the Bank and PRA are required under the Prescribed Persons (Reports on Disclosures of Information) Regulations 2017 to publish the written annual report on disclosures for the 2025/26 period

Suggested considerations

• Establish clear internal processes for responding when the PRA or Bank contacts the firm following a whistleblowing disclosure, including immediate escalation to Compliance, Legal, and relevant Senior Managers, coordinated responses, and robust documentation of remedial actions.

What changed

• - Prescribed Persons reporting obligations under the Prescribed Persons (Reports on Disclosures of Information) Regulations 2017 continue to apply, requiring the Bank and PRA to publish, within six...
• For the 2025/26 period, the Bank and PRA report that 271 disclosures were received and assessed against the Public Interest Disclosure Act 1998 and their own statutory requirements to determine...
• Of the 271 disclosures, 257 were reasonably believed to be protected disclosures within Part IVA of the Public Interest Disclosure Act 1998 and within the Bank’s and PRA’s remit as Prescribed...
• Fourteen disclosures were assessed as not protected, including disclosures about firms not regulated by the Bank or PRA, issues outside the Bank’s or PRA’s regulatory remit, and individuals who do...
• Regardless of statutory protection status, the Bank and PRA’s whistleblowing team provided supervisory colleagues with all disclosures (protected and non‑protected) for consideration or for...

Key dates

01 March 2025

- Start of the reporting period covered by the EDMC annual report

Summer 2026 Deadline

- Remaining EDMC members, including the incoming Chair and Deputy Chair, are due to be appointed

28 February 2026

- End of the reporting period covered by the EDMC annual report

28 February 2026

- As of this date, the PRA enforcement team was overseeing five cases, including investigations into five firms and five individuals

June 2026

- The EDMC annual report for 2025/26 was published

Suggested considerations

• Review your firm’s PRA enforcement response plan to ensure it supports rapid collection, review, and production of material that may be disclosed in a contested case.
• Ensure legal and compliance teams are prepared to make both written and oral representations to the EDMC if the firm becomes subject to a contested enforcement matter.
• Confirm that internal governance provides for independent escalation and board-level oversight when a PRA investigation enters the decision stage.
• Maintain an updated settlement strategy for PRA matters, including documented positions on fairness, scope of admissions, and mitigation, because the EDMC may review settlement processes retrospectively.
• Map exposure across all PRA enforcement regimes relevant to the business, including prudential regulation, FMI, resolution, securitisation, wholesale cash distribution, critical third parties, and S&NI banknote matters.

What changed

• - The EDMC completed its annual reporting cycle for the period 1 March 2025 to 28 February 2026, confirming the continued operation of the PRA’s contested-case decision framework.
• The report confirms that the EDMC continues to provide functional separation between investigation/enforcement staff and decision-makers in PRA contested enforcement cases.
• The report confirms that the EDMC’s role covers enforcement cases under the Bank’s statutory regimes for prudential regulation, financial market infrastructure, resolution, securitisation, wholesale...
• The EDMC confirms that contested enforcement decisions are made independently, with disclosure of relevant material and the opportunity for both written and oral representations.
• The EDMC confirms that its decision is the final stage of administrative decision-making in contested PRA enforcement cases, after which the subject may refer the matter to the Upper Tribunal.

Key dates

May 2023

- The PRA published Consultation Paper CP9/23, which proposed changes later reflected in the updated enforcement approach

30 January 2024

- The Bank of England unveiled changes to the PRA’s enforcement approach, including the Early Account Scheme and the Enhanced Settlement Discount

24 June 2026

- David Chaplin delivered the speech at the 5th Conference on Financial Law and Regulation at the University of Leeds School of Law

Suggested considerations

• Review current investigation-response procedures to ensure the firm can produce a factually complete written account and supporting evidence at short notice.
• Build escalation protocols that trigger early internal fact-finding when a potential prudential breach is identified.
• Train relevant staff to distinguish between cooperation, factual admissions, and without-prejudice settlement positions so that engagement does not inadvertently prejudice legal strategy.
• Reassess whether current incident-management playbooks are aligned with the PRA’s expectation of early candour and remediation.
• Ensure legal, compliance, and business stakeholders can rapidly agree on breach acknowledgment, remediation steps, and document preservation.

What changed

• - The PRA is now explicitly encouraging earlier engagement by investigation subjects, including proactive identification, acknowledgement, and remediation of breaches.
• The familiar enforcement pattern is changing from a late-stage admission model toward a front-loaded investigative model in which firms provide information earlier in the process.
• The PRA’s enforcement approach now places greater emphasis on written factual accounts and supporting materials during the initial investigative stage.
• Firms that participate early and make early admissions may obtain enhanced settlement discounts, while non-participants remain on a lower discount path.
• The Bank says this is not a new policy launch but an explanation of how the existing approach is operating in practice across live cases.

Key dates

10 December 2025

– CBI publishes its roadmap “Regulating & Supervising Well – a more effective and efficient framework”, committing to a public consultation on a new Regulatory Impact Assessment (RIA) Framework in H1 2026 and outlining a multi‑year programme of regulatory and supervisory reforms from H1 2026 to H1 2028

22 June 2026

– CBI launches the public consultation on its approach to RIA and stakeholder consultation, alongside references to its new supervisory approach and roadmap of regulatory initiatives

H1 2026

– Target window identified in the roadmap for the public consultation on the new RIA Framework; this is now operationalised by the consultation launched on 22 June 2026

TBD (post‑30 September 2026)

– CBI will consider all submissions and publish a feedback statement setting out its finalised approach to RIA and consultation, which will then guide the design of future regulatory initiatives

H2 2026

– Roadmap foresees drafting of revised Corporate Governance Codes for consultation, which are likely to be shaped by, and potentially used to pilot, the new RIA framework and consultation approach once finalised

Suggested considerations

• Conduct an internal review of your firm’s experience with recent CBI consultations (e.g. Consumer Protection Code, governance, outsourcing, AML, reporting) and document challenges, costs, and data gaps that could be addressed through a more robust RIA and consultation framework.
• Prepare and submit a response to the CBI consultation by 30 September 2026, either directly or via relevant industry associations, setting out detailed expectations on how RIA should address compliance costs, operational impacts, proportionality for smaller firms, and implementation lead times.
• Update your regulatory affairs or public policy strategy to explicitly incorporate the emerging CBI RIA framework, including criteria for when to engage, escalation thresholds for high‑impact proposals, and internal approval processes for consultation submissions.
• For Irish‑authorised groups operating cross‑border, align your approach to CBI RIA engagement with EU‑level impact assessment practices (e.g. European Commission and ESAs) to ensure consistency in messaging and evidence on cumulative regulatory burden and competitiveness.
• Monitor subsequent CBI publications (including the forthcoming feedback statement, revised Corporate Governance Codes, and sectoral plans) to identify where the new RIA framework is being applied and to anticipate where the CBI may seek additional data or structured feedback from firms.

What changed

• - The CBI has opened a public consultation on its approach to Regulatory Impact Assessment (RIA), seeking views on how it should weigh evidence, assess costs and impacts, and structure its analysis...
• The consultation also covers the CBI’s approach to stakeholder consultation, including how it engages with industry, civil society, consumer representatives, the public, policymakers, and peer...
• The initiative sits within the CBI’s broader “more effective and efficient regulatory framework” programme, which includes a new supervisory approach and a roadmap of regulatory initiatives,...
• The CBI aims to make regulation clear, coherent and proportionate, explicitly linking rule‑making to protections for consumers, investors, and financial stability, and to the resilience of the...
• The CBI is moving towards a more structured, transparent, and evidence‑based policymaking process, where the rationale for regulatory interventions, the analysis of options, and the assessment of...

Key dates

08 June 2012

- Original Ordinance on Measures against Syria (SR 946.231.172.7) entered into force, establishing the sanctions framework and Annex 7

15 June 2026

- WBF amended the list of sanctioned persons, companies, and organisations in Annex 7 of the Syria sanctions ordinance and updated the Swiss SESAM sanctions database; SECO published the updated list on its website

16 June 2026 Deadline

- The amended measures, including changes to the Annex 7 Syria sanctions list, enter into force at 23:00, from which time financial intermediaries must fully apply the new listings and obligations

Suggested considerations

• Perform an immediate update of sanctions screening lists and tools to incorporate the revised Syria Annex 7 entries as reflected in the SESAM database.
• Identify all customers, beneficial owners, counterparties, and transactions that match or potentially match the updated Syria sanctions list, including retrospective screening where systems permit.
• Freeze without delay all assets and economic resources held or controlled by persons, entities, or organisations that are newly listed or affected by changes under the updated Annex 7.
• Block any new or pending transactions that would make funds or economic resources available, directly or indirectly, to persons and entities designated under the updated Syria list.
• Report all affected business relationships and frozen assets to SECO in accordance with the reporting requirements of the Syria sanctions ordinance and SECO guidance.

What changed

• - The WBF has amended Annex 7 of the Ordinance of 8 June 2012 on Measures against Syria (SR 946.231.172.7), changing the list of sanctioned persons, companies, and organisations connected to Syria.
• The Swiss sanctions database SESAM (SECO Sanctions Management) has been updated to reflect these changes, and SECO has published the amended list on its website.
• The updated measures, including asset-freeze and prohibition obligations, enter into force on 16 June 2026 at 23:00, making the revised Syria list immediately enforceable for Swiss-supervised...
• Financial intermediaries are explicitly required to implement the applicable prohibitions, including restrictions on making funds or economic resources available to listed persons, entities, and...
• Financial intermediaries must freeze the assets and economic resources of the persons, companies, and organisations newly listed, relisted, or otherwise affected by the Annex 7 amendment.

Key dates

08 June 2026

– Publication of the interview with the CNC chairman in Paperjam announcing that Luxembourg accounting legislation will be overhauled

15 June 2026

– CSSF press release published, drawing attention to CNC Q&A 26/037 and the CNC chairman’s interview and signaling supervisory expectations that entities consider this doctrine when preparing annual accounts

Suggested considerations

• Obtain and review the full CNC Q&A 26/037 and the CNC chairman’s interview (French‑language originals), ensuring that finance, accounting, and compliance teams understand the clarified distinctions between statutory and contractual/voluntary annual accounts.
• Map all sets of financial statements prepared by each Luxembourg entity (statutory accounts, covenant‑based or lender‑specific accounts, group reporting packages, management accounts, etc.) and classify each set as statutory or contractual/voluntary in line with CNC Q&A 26/037 definitions.
• Update internal accounting policies and manuals to explicitly define statutory versus contractual/voluntary annual accounts, specify the applicable accounting principles and disclosures for each, and describe any differences in measurement, presentation, or scope.
• Assess current practices for communicating financial information to lenders, investors, regulators, and other stakeholders to confirm that non‑statutory accounts are not labeled or presented in a way that could be misinterpreted as statutory accounts approved under Luxembourg company law.
• Implement clear labeling and disclosure conventions on the face of financial statements and in accompanying notes (e.g., in engagement reports, board minutes, and management communications) to distinguish statutory annual accounts from any contractual or voluntary accounts.

What changed

• - The CSSF formally draws regulated entities’ attention to CNC Q&A 26/037, elevating it as a key interpretative reference on the concepts of annual accounts prepared for legal/statutory purposes...
• The CNC Q&A 26/037 provides clarified definitions of “comptes annuels établis à fins légales” (statutory annual accounts) and “comptes annuels établis à des fins contractuelles ou sur base...
• The Q&A gives practical answers to frequently asked questions from preparers about when accounts qualify as statutory versus merely contractual or voluntary, and how this affects applicable...
• The Q&A addresses related issues, such as the extent to which CNC doctrine and Luxembourg GAAP must be followed for contractual or voluntary accounts, and the risks of presenting non‑statutory...
• The CSSF also highlights an interview with the CNC chairman announcing that Luxembourg accounting legislation will undergo a refonte (major overhaul), signaling that current CNC doctrine, including...