Insurance Regulatory Updates

Key dates

2026-11-03

DP26/2 opened and was first published by the FCA jointly with the DWP and TPR.

2026-12-22 Deadline

Deadline for responses to the Guided Retirement policy consultation.

Suggested considerations

• Firms should consider submitting responses to the DWP Guided Retirement Policy Team by 22 December 2026, including evidence on feasibility, consumer outcomes, product design, costs, data and operational dependencies.
• Contract-based providers should assess how potential Guided Retirement requirements could interact with their existing COBS 9B targeted-support processes, governance, suitability or appropriateness controls, customer communications and record keeping.
• Providers, trustees and administrators should map current retirement journeys and identify gaps in member data, administration systems, payment capabilities, transfer processes, decumulation products and management information.
• Scheme operators should consider which default retirement-income models could meet the emerging policy objectives, including approaches involving staged or flexible access and protection against longevity risk, while avoiding premature conclusions before the FCA rules and DWP regulations are consulted on.
• Governance teams should establish ownership for Guided Retirement readiness and monitor the FCA, DWP and TPR consultations expected to follow, including the FCA consultation on draft rules and guidance planned for the second half of 2027.
• Firms should assess interactions with other workplace-pension reforms, particularly value-for-money requirements, consumer-support arrangements, conflicts management and member communications, because independent commentary has identified a risk of overlapping or inconsistent standards.

What changed

The Discussion Paper sets out initial joint proposals for implementing Guided Retirement, under which workplace pension schemes would provide a clear, high-quality default route into retirement for eligible savers who do not make complex active choices. The framework is intended to apply across both FCA-regulated contract-based schemes and trust-based schemes, with the FCA required to introduce rules that achieve, so far as possible, the same outcomes as the duties imposed on trustees by the Pension Schemes Act 2026.

Key dates

2026-10-07

PRA published CP13/26 proposing automatic indexation of in-scope regulatory thresholds every five years, with a proposed first update on 1 July 2031.

2026-10-14

PRA published PS19/26 setting out the final policy on high loan-to-income lending.

2026-10-22

PRA published CP14/26 consultation on phase 2 of SM&CR reform.

2026-10-26

Bank of England and FCA published the 2026 survey results on artificial intelligence and machine learning in UK financial services.

2026-10-28

PRA rules and supervisory statement on high-LTI lending commenced; the firm-specific 15% cap was removed and the revised monitoring and governance framework became effective.

2027-01-22 Deadline

Consultation deadline reported for the PRA and FCA phase 2 SM&CR consultations.

2027-02-07 Deadline

Consultation deadline for CP13/26 and the associated discussion of additional thresholds potentially suitable for indexation.

2031-07-01

Proposed date for the first automatic update of in-scope regulatory thresholds under CP13/26, subject to final policy and implementation.

Suggested considerations

• Mortgage lenders should assess their high-LTI lending strategy against risk appetite, capital and credit-risk tolerances now that the firm-specific 15% cap has been removed.
• Mortgage lenders should establish or validate rolling four-quarter calculations for individual high-LTI flows and retain evidence supporting any adjustments, limits or risk appetite decisions.
• Relevant firms should review governance, underwriting, affordability, concentration and stress-testing controls to demonstrate prudent management of high-LTI lending under the new PRA expectations.
• Compliance and regulatory-reporting teams should monitor the PRA’s quarterly aggregate high-LTI publications and assess whether lending plans remain consistent with the FPC’s aggregate 15% limit.
• PRA-regulated firms should map current Rulebook and supervisory-statement thresholds against the 128 proposed in-scope thresholds and identify systems, permissions, reporting and policy documents that would require future updates.
• Affected firms should consider submitting responses to CP13/26 and its associated discussion questions by 7 February 2027, particularly where indexation could alter regulatory categorisation, reporting, capital, liquidity, governance or investment-flexibility requirements.
• SM&CR compliance teams should assess CP14/26 against current senior-manager responsibilities, certification processes, fitness and propriety controls, governance maps, handover arrangements and recordkeeping, while treating the proposals as non-final.
• Firms should monitor the related FCA SM&CR consultation and coordinate any response because implementation may require changes across PRA and FCA regimes.

What changed

PS19/26 removes the firm-specific 15% limit on high-LTI mortgage lending, while retaining the Financial Policy Committee’s aggregate 15% limit as the benchmark for overall market lending. Firms’ individual high-LTI flows and any required adjustments will be assessed on a rolling four-quarter basis, whereas aggregate high-LTI lending will continue to be monitored quarterly. The final rules and supervisory statement also introduce governance and risk-management expectations, and the PRA intends to publish aggregate high-LTI flow data quarterly.

Key dates

2026-11-02

MAS announced the grant scheme, commenced Consultation Paper P018-2026, and the Infrastructure Capability Development Grant took effect.

2026-12-18 Deadline

Deadline for comments on MAS Consultation Paper P018-2026 concerning capital treatment for securitisation and infrastructure investments under RBC 2.

2026-03-31

Earlier RBC 2 revisions concerning differentiated capital treatment for qualifying infrastructure investments took effect; this is relevant background to the current consultation.

Suggested considerations

• Compliance and regulatory affairs teams should review Consultation Paper P018-2026 and consider submitting comments to MAS by 18 December 2026.
• Insurers should distinguish the currently effective RBC 2 requirements from the proposed capital treatments and avoid applying the proposed lower charges before the relevant amendments take effect.
• Investment, risk and actuarial teams should inventory infrastructure debt, infrastructure equity and securitisation exposures and assess which assets could potentially satisfy the proposed credit-quality, contractual-revenue, demand-risk, counterparty, securitisation, diversification and liquidity criteria.
• Firms should review their investment due-diligence, valuation, credit-assessment and documentation processes so that qualifying characteristics can be evidenced and maintained throughout the investment lifecycle.
• Insurers considering the grant should contact MAS to obtain the Infrastructure Capability Development Grant terms, eligibility requirements, application process, eligible-cost rules and reporting conditions.
• Firms should monitor MAS updates on standardised disclosure templates, assessment guidance and fund-manager declarations and assess whether investment mandates and manager reporting can support those formats.
• Insurers should monitor MAS recognition of additional external credit assessment institutions and review whether expanded recognised-rating coverage could affect sourcing, eligibility or capital calculations.
• Governance committees should consider whether proposed infrastructure allocations remain consistent with policyholder protection, asset-liability management, concentration limits, liquidity needs and existing investment-risk policies.

What changed

The Infrastructure Capability Development Grant takes effect on 2 November 2026 and will be funded through the Financial Sector Development Fund. It may support dedicated investment teams, staff capability development, and professional services used to establish or expand infrastructure investment activities in Singapore; insurers must approach MAS for scheme details and eligibility conditions. MAS is consulting on further amendments to the insurance capital framework under RBC 2.

Key dates

2026-11-02

MAS published Circular ID 12/26 and opened consultation P018-2026 on capital treatment for securitisation and infrastructure investments under RBC 2.

2026-11-02

The S$30 million Infrastructure Capability Development Grant for Insurers took effect, subject to MAS grant arrangements.

2026-12-18 Deadline

Deadline for submitting comments on consultation P018-2026.

2026-03-31

Earlier finalised RBC 2 revisions to the capital treatment of securitisation and infrastructure investments took effect; the current consultation proposes further refinements to that framework.

Suggested considerations

• Compliance and capital teams should review the consultation paper and consider submitting comments to MAS by 18 December 2026, particularly on eligibility tests, evidence requirements, capital calibrations and implementation timing.
• Firms should map current and planned infrastructure debt, infrastructure equity, infrastructure-fund and securitisation exposures against the proposed qualifying criteria, distinguishing assets that could benefit from lower charges from assets that would remain subject to existing treatment.
• Investment, risk and finance functions should assess whether existing due diligence, valuation, credit assessment, look-through analysis and documentation can evidence contractual revenues, demand-risk limitations, counterparty strength, tranche seniority, investment grade status, diversification, liquidity and simplicity, transparency and comparability.
• Firms should monitor amendments to MAS Notice 133 and Notice FHC-N133 and avoid reflecting proposed capital relief in regulatory capital planning, pricing or investment limits until the proposals are finalised and effective.
• Insurers may wish to assess whether they qualify for or could benefit from the Infrastructure Capability Development Grant and identify capability gaps in origination, underwriting, infrastructure valuation, credit analysis and ongoing monitoring.
• Governance teams should establish a process for monitoring the additional external credit assessment institutions, standardised disclosure templates, fund-manager declarations and assessment guidance that MAS may introduce.
• Groups with infrastructure investments held through funds or structured products should confirm whether the final treatment will permit look-through and should not assume that infrastructure-backed structured products qualify for infrastructure treatment rather than structured-product treatment.

What changed

This is a consultation and does not itself amend Notice 133 or impose new binding capital requirements. MAS is proposing lower capital charges for rated infrastructure debt that satisfies specified credit-quality and other qualifying criteria; for qualifying infrastructure equity and debt investments with risk mitigants such as long-term contractual or regulated revenues, limited demand-risk exposure and strong counterparties; and for senior investment-grade securitisation tranches meeting relevant simplicity, transparency and comparability criteria or specified diversification and liquidity...

Key dates

2017-09-01

Start of the period identified by ASIC for the alleged directors’ and officers’ duty breaches concerning the Crown insurance arrangements; the date is approximate because ASIC states only September 2017.

2018-11-30

End of the period identified by ASIC for the alleged directors’ and officers’ duty breaches; ASIC states November 2018.

2022-03-01

ACBF entities entered liquidation; ASIC states March 2022, without specifying the exact day.

2026-02-01

The contested liability hearing concerning Jones took place in February 2026; ASIC has not specified the exact day.

2026-06-30 Deadline

Closing date for applications to the Government’s Youpla Support Program.

2026-10-30

ASIC announced the findings against Jones and Pattenden and the orders agreed with Pattenden.

2026-12-01

Payments under the Youpla Support Program are scheduled to continue being processed until this date.

Suggested considerations

• Firms should consider reviewing board and committee processes for identifying, disclosing and managing actual or potential conflicts involving directors, officers and related parties.
• Compliance teams may wish to test whether related-party insurance, reinsurance, outsourcing and service arrangements are demonstrably in the company’s interests, supported by independent analysis and properly documented board decisions.
• Boards may wish to review whether premium changes, counterparty concentration, offshore structures and insurer solvency risks are escalated promptly and communicated appropriately to affected customers.
• Insurers and other firms serving vulnerable or First Nations consumers should consider whether product governance, distribution controls and customer communications adequately address cultural, language, literacy and affordability risks.
• Companies should consider retaining evidence showing that directors challenged management assumptions, considered viable alternatives and monitored the ongoing financial and consumer consequences of material arrangements.
• Legal and compliance teams may wish to monitor the later penalty hearing for Jones and the reserved decisions concerning Jonathan Law, Michael Wilson and Geoffrey Clayton, as those outcomes may provide further indications of ASIC’s approach to individual accountability and director disqualification.
• Firms should distinguish this case from a new industry-wide rule: the immediate orders apply to Pattenden, while the broader compliance significance is the enforcement precedent and ASIC’s stated priority of protecting vulnerable consumers.

What changed

This is an enforcement outcome rather than a new rule or general compliance obligation. Pattenden is subject to a $250,000 civil penalty and a 15-year prohibition on managing corporations; Jones has been found liable, with penalties to be determined at a later hearing. ASIC’s case concerns alleged breaches of sections 180, 181 and 182 of the Corporations Act 2001 arising from insurance arrangements with Vanuatu-based Crown Insurance Services Limited, which ASIC alleged was beneficially owned and controlled by Pattenden and Jonathan Law and was not in the interests of the ACBF entities.

Key dates

2026-03-04

The European Commission issued its call for technical advice to the European Supervisory Authorities on targeted simplification of the Taxonomy Disclosures Delegated Act.

2026-07-01

ESMA launched its consultation on selected Taxonomy KPIs and proposed simplification measures.

2026-08-12 Deadline

ESMA’s consultation period closed.

2026-10-29

ESMA submitted its Final Report and technical advice to the European Commission for consideration in the review of the Taxonomy Disclosures Delegated Act.

Suggested considerations

• Compliance teams should continue applying the currently effective Taxonomy Regulation and Taxonomy Disclosures Delegated Act until any Commission amendment enters into force.
• Firms should monitor the Commission’s review of the Disclosures Delegated Act and assess any subsequent delegated act, scrutiny period, entry-into-force date and transitional provisions before changing reporting controls.
• Corporate reporting teams may wish to model the effect of an R&D-only mandatory OpEx KPI, including the IAS 38 or national-GAAP population, numerator mapping and interaction with existing materiality reliefs.
• Groups should inventory parent and subsidiary business lines, assess whether secondary businesses could exceed a cumulative 10% consolidated-turnover threshold, and prepare for possible parent-regime and simplified secondary-business templates.
• Asset managers and other financial undertakings should avoid treating the proposed absence of voluntary OpEx reporting as current law and should document the basis for any voluntary Taxonomy metrics under existing disclosure and anti-greenwashing controls.
• Issuers and sustainability-reporting teams should review sustainable-bond, internal-sales, contextual-information and CapEx Type C data processes so they can adapt if the Commission adopts ESMA’s recommendations.
• Reporting governance should track whether any future voluntary alternative metric is reconciled to the mandatory KPI and subject to applicable ESMA Guidelines on Alternative Performance Measures.

What changed

ESMA recommends that the mandatory Article 8 Taxonomy Regulation OpEx KPI focus on non-capitalised R&D expenditure, with the denominator based on expenditure recognised under IAS 38 or relevant national GAAP and the numerator drawn from the existing Annex I categories. It does not recommend introducing a mandatory voluntary OpEx+ metric, and advises against allowing financial undertakings, including asset managers, to use an OpEx KPI voluntarily for Taxonomy disclosures.

Key dates

2026-10-22

The FCA and PRA published parallel Phase 2 SM&CR consultations.

2027-01-22 Deadline

Deadline for responses to the FCA and PRA SM&CR Phase 2 consultations.

Suggested considerations

• Compliance teams may wish to review the FCA consultation CP26/37 and PRA consultation CP14/26 and consider submitting responses by 22 January 2027.
• Firms should continue operating existing SM&CR approval, certification, Directory, Conduct Rule and responsibility-mapping processes unless and until final rules and any required legislation take effect.
• Firms may wish to map current Senior Management Functions and identify Chief Actuary, Risk Committee Chair and Audit Committee Chair roles that could move from pre-approval to notification, while retaining evidence of fitness, propriety, competence and suitability assessments.
• Compliance teams should identify employees who could fall outside the proposed Certification Regime and assess how internal competence, performance, disciplinary and conduct controls would operate without annual regulatory certification.
• Firms may wish to model the effect of the proposed Enhanced-regime threshold increases on their classification, governance documentation, prescribed responsibilities and approval processes.
• Firms should review Conduct Rule breach-reporting workflows and training curricula, but should not apply a higher reporting threshold or reduced training scope until the relevant final rules are published and effective.
• Governance teams may wish to assess the proposed removal of ongoing Statements of Responsibilities and Management Responsibilities Map submissions and determine what internal records will still be needed to demonstrate clear accountability.
• Firms with cryptoasset activities or planned authorisation may wish to consider the interaction between these proposals, the FCA's modification-by-consent approach for cryptoasset firms and the wider cryptoasset perimeter work.

What changed

The regulators propose removing pre-approval for a range of functions, including Chief Actuaries and Chairs of Risk and Audit Committees, with firms instead notifying the regulators and retaining responsibility for fitness and propriety. Chief Executive, Chief Financial Officer and Chair roles would generally remain subject to regulatory pre-approval, while regulators could require pre-approval for otherwise notified roles in high-risk cases.

Key dates

2026-10-22

PRA CP14/26 was published and the Phase 2 consultation opened.

2027-01-22 Deadline

Deadline for responses to the PRA consultation.

Suggested considerations

• Compliance teams may wish to map current SMFs against the proposed pre-approved and notified categories, with particular attention to Chief Actuary, Risk Committee Chair, Audit Committee Chair and SMF7 roles.
• Firms should consider how they would evidence fitness, propriety, competence and conduct decisions if formal Certification Regime assessments, certificates and regulatory references are removed.
• Governance functions may wish to assess the proposed reduction in Prescribed Responsibilities and the future frequency of Statements of Responsibilities and Management Responsibilities Maps, while preserving clear accountability records.
• Firms may wish to review succession and contingency arrangements against the proposed 18-week temporary SMF cover period and assess whether internal approval workflows can support faster interim appointments.
• Dual-regulated firms should compare PRA CP14/26 with FCA CP26/37 and identify differences in scope, timing, forms, conduct-breach notifications and transitional arrangements.
• PRA-authorised firms may wish to prepare a consultation response addressing the proposed implementation period before the 2027 final policy.
• Firms should continue operating existing SM&CR approval, certification, fitness and propriety, regulatory-reference and notification obligations unless and until final rules and applicable legislative changes take effect.
• Compliance teams may wish to monitor the passage and commencement of the Financial Services and Markets Bill 2026 because the principal Phase 2 reforms depend on those legislative steps.

What changed

The PRA proposes to introduce a notification approach for almost half of current Senior Management Functions, including Chief Actuaries and Chairs of Risk and Audit Committees, while retaining an anticipated power to require pre-approval for an otherwise notified role in exceptional cases. Group Entity Senior Manager Function SMF7 would be divided between pre-approved and notified roles.

Key dates

2026-10-19

The FCA publication was issued as part of its wider AI supervisory and industry-engagement work.

Suggested considerations

• Firms should consider maintaining an inventory of AI use cases, including internally developed, embedded and outsourced tools, with a named accountable senior manager and documented risk classification for each use case.
• Compliance teams may wish to map each consumer-facing AI use case to Consumer Duty outcomes, the target market, foreseeable harms, vulnerable-customer considerations, fair value where relevant, complaints handling and available redress.
• Firms should consider documenting why AI is appropriate for the identified consumer need, which activities remain staff-led, where the system must abstain or escalate, and how those controls have been tested in practice.
• Model and risk functions may wish to test accuracy, bias, error rates, explainability, data quality, drift and robustness across relevant consumer characteristics, including vulnerability, accessibility, digital capability and financial capability.
• Firms should consider testing consumer understanding of AI disclosures and outputs with representative user groups, rather than relying solely on technical model explanations or generic disclaimers.
• Operations and technology teams may wish to implement proportionate live monitoring, clear escalation thresholds, sample-based human review, incident and near-miss processes, fallback arrangements and channel continuity where an AI system fails or produces harmful outputs.
• Firms should consider retaining auditable records of prompts, inputs, outputs, model and vendor versions, filters, approvals, overrides, escalations, complaints and remediation decisions for a period consistent with the applicable record-keeping requirements.
• Outsourcing and third-party risk assessments may wish to address concentration and dependency risks, access to testing and performance information, change control, data use, subcontracting, service continuity and the firm’s ability to challenge or replace an AI provider.

What changed

The publication consolidates the FCA’s expectations under the existing framework, including the Principles for Businesses, Threshold Conditions, SYSC, operational resilience, outsourcing and critical third-party requirements, Consumer Duty, vulnerable-customer guidance, SM&CR and DISP. It identifies good practice such as defining the consumer need and target market before deployment, testing outcomes across consumer characteristics and vulnerability scenarios, setting human escalation and abstention controls, maintaining auditable records of prompts, outputs, model versions and decisions, and...

Key dates

2026-06-10

The FSB published the consultation report proposing 12 sound practices for responsible AI adoption.

2026-07-22

The FSB consultation closed; approximately 160 responses were received.

2026-10-15

The FSB published the overview of consultation responses and the final report containing the 12 sound practices.

Suggested considerations

• Firms should consider mapping existing AI inventories, model-risk controls, operational-resilience arrangements, cyber controls, outsourcing registers, and board reporting against all 12 FSB practices.
• Compliance teams may wish to introduce or validate a documented, risk-based materiality assessment for each AI use case at inception and throughout its lifecycle, including uses embedded in products or obtained from vendors.
• Boards and senior management should consider whether AI adoption is aligned with business strategy, risk appetite, accountability structures, and existing risk-management frameworks.
• Firms using generative or agentic AI should consider defining permitted actions, autonomy limits, escalation paths, human-approval triggers, monitoring thresholds, and tested stop or safe-interruption procedures.
• Firms should consider retaining records sufficient to identify the AI system, data, model or vendor, intended purpose, materiality assessment, testing, approvals, monitoring results, changes, incidents, and reconstructed decisions or actions.
• Procurement and third-party-risk teams may wish to assess AI providers for performance, transparency, data quality, supply-chain exposure, concentration risk, exit options, resilience, and business-continuity arrangements.
• Technology and operational-resilience teams should consider adding AI-specific cyber and ICT scenarios to testing and exercises, including model manipulation, data poisoning, prompt or agent compromise, erroneous autonomous actions, provider outage, and loss of vendor access.
• Firms should consider reviewing the interaction between the FSB practices and binding local requirements, including the EU Digital Operational Resilience Act, EU AI Act, sectoral outsourcing rules, model-risk requirements, data-protection law, and senior-management accountability regimes.

What changed

The final framework retains 12 practices covering board and senior-management oversight, governance and accountability, AI risk integration and documentation, organisational adaptability, materiality assessment, model selection, data governance, explainability and transparency, performance management, human oversight, cyber and ICT risk, and third-party AI risk.

Key dates

2026-10-15

FSB published the final report on Sound Practices for Responsible Adoption of Artificial Intelligence.

Suggested considerations

• Firms should consider inventorying all material AI use cases, including internally developed tools, vendor-provided models, embedded productivity tools, generative AI and agentic or multi-agent systems, with ownership, purpose, data sources, model dependencies and deployment status recorded.
• Compliance teams may wish to map each use case to a documented materiality and risk classification performed at inception and refreshed after material model, data, vendor, scope or operating-environment changes.
• Boards and senior management should consider whether AI governance, risk appetite statements, delegated authorities and management information clearly cover autonomous actions, prohibited uses, escalation thresholds and accountability for AI-supported decisions.
• Firms should consider integrating AI-specific controls into existing model risk management, operational-risk, ICT-risk, cybersecurity, outsourcing and business-continuity frameworks rather than creating disconnected governance.
• Model and technology teams may wish to maintain evidence of data provenance, data quality, testing, validation, performance metrics, drift monitoring, incident handling, explainability assessments and compensating controls where explainability is limited.
• For higher-risk or autonomous use cases, firms should consider mandatory human approval triggers, bounded permissions, segregation of duties, real-time or near-real-time monitoring, complete audit trails, emergency stop or rollback capability and periodic reassessment of whether human oversight remains effective.
• Procurement and third-party-risk functions should consider enhancing due diligence and contracts for AI providers to address model performance, transparency, training and input data, subcontracting, security, audit access, incident notification, portability, exit planning, concentration risk and service continuity.
• Cybersecurity teams should consider adding AI-enabled attacks, prompt injection, data poisoning, model manipulation, deepfakes, automated exploitation and misuse of AI-assisted coding or defensive tools to threat assessments, testing and exercises.

What changed

The FSB replaced its June 2026 consultation with a final framework of 12 proportionate sound practices. The practices require firms to align AI adoption with business strategy and risk appetite; define accountability; incorporate AI risks into enterprise risk management; document AI use and materiality assessments; select models according to business, technical and risk requirements; govern data quality and security; address explainability and stakeholder transparency; test and monitor performance; apply human oversight proportionate to autonomy, complexity, risk and explainability; manage...

Key dates

2026-10-15

OSFI published its statement endorsing the FSB Sound Practices for Responsible Adoption of Artificial Intelligence; the FSB also published the final Sound Practices on this date.

Suggested considerations

• Compliance teams may wish to map the 12 FSB practices against existing controls under OSFI’s Corporate Governance Guideline, Integrity and Security Guideline, Guideline B-10, Guideline B-13, Guideline E-21 and Guideline E-23.
• Firms should consider maintaining an enterprise-wide inventory of AI use cases, including internally developed systems, embedded vendor functionality and generative or agentic AI, with documented owners, intended purposes, materiality assessments and lifecycle status.
• Boards and senior management may wish to review whether the institution’s business strategy, risk appetite and governance framework clearly address AI adoption, accountability, escalation and human oversight.
• Firms should consider assessing AI use cases for operational, technology, cyber, third-party, model, data, privacy, conduct and governance risks, with controls proportionate to the materiality and risk of each use case.
• Compliance and risk functions may wish to review AI development and deployment documentation, validation, monitoring, change management, testing, incident escalation, explainability and retirement processes, including for systems supplied by third parties.
• Institutions should consider evaluating whether existing B-10 outsourcing and third-party risk controls address vendor model changes, data access, subcontracting, concentration risk, resilience, audit rights and exit arrangements for AI-enabled services.
• Internal audit or an equivalent independent assurance function may wish to assess whether AI governance and lifecycle controls operate effectively and whether management reporting to the board is sufficiently complete.
• Firms may wish to monitor subsequent OSFI technology risk bulletins, supervisory communications and future revisions to the FSB practices, since OSFI stated that it will continue monitoring how AI changes the risk environment and institutional operations.

What changed

OSFI formally endorsed the FSB Sound Practices and identified them as complementary to existing OSFI expectations. The FSB practices cover organization-wide AI governance and management across the AI lifecycle, including strategic direction, accountability, risk management, human oversight, data governance, controls, adaptability and coordination. The publication is non-binding guidance rather than a new OSFI rule, capital requirement, reporting obligation or prescribed compliance deadline.

Key dates

2026-10-15

The proposed rule is published in the Federal Register.

2026-12-14 Deadline

Public comments on the proposed amendments to 12 CFR parts 704 and 713 are due.

Suggested considerations

• Compliance teams may wish to review the proposal against existing policies and procedures under 12 CFR 704.18, 12 CFR 713, and 12 CFR 741.201, distinguishing provisions that would be removed from obligations that would remain.
• Credit unions should continue to maintain existing fidelity-bond coverage, deductibles, renewal processes, and NCUA-related approvals unless and until a final rule becomes effective.
• Boards and management may wish to assess whether current coverage remains adequate for fraud, dishonesty, theft, burglary, robbery, and other covered losses, and preserve documentation supporting the required board review.
• Credit unions and insurers may wish to evaluate whether the proposed flexibility in coverage amounts and deductibles affects policy terms, underwriting, renewal timing, or internal risk assessments.
• Interested parties may wish to submit comments by December 14, 2026, addressing the proposed treatment of coverage calculations, deductibles, bond forms, purchase and renewal procedures, and any transition or implementation concerns.

What changed

The proposal would amend 12 CFR part 713 and related corporate-credit-union requirements in 12 CFR 704.18 by eliminating or modifying prescriptive procedural requirements concerning fidelity-bond purchases and renewals, simplifying the rules governing coverage amounts and deductibles, and removing outdated requirements. The proposal would preserve the requirement that a federally insured credit union maintain adequate fidelity-bond coverage against losses involving fraud, dishonesty, theft, and other covered risks.

Key dates

2026-10-14

FSB published the consultation report proposing eight high-level regulatory and supervisory modernisation principles.

2027-01-08 Deadline

Deadline for submitting responses to the FSB consultation through the secure online form.

2027-01-01

FSB expects to publish the final report in the first half of 2027; the exact publication date is not specified.

Suggested considerations

• Compliance teams may wish to monitor the consultation and identify whether proposed approaches to proportionality, tailoring, materiality and impact analysis could affect the firm’s prudential, supervisory or reporting perimeter.
• Firms should consider preparing evidence-based comments or case studies, directly or through trade associations, on regulatory duplication, cliff effects, implementation costs, resilience outcomes and the consequences of applying complex-institution requirements to simpler business models.
• Regulatory affairs teams may wish to map current and planned consultations by home and host authorities against the FSB themes, particularly risk-based supervision, technology-enabled supervision, responsible innovation and framework coherence.
• Prudential and risk functions may wish to assess whether current data can demonstrate the firm’s size, complexity, systemic relevance, business-model risks and resilience if authorities introduce more differentiated requirements.
• Firms should not treat the consultation as permission to reduce existing controls or as a change to applicable law; existing internationally agreed standards and jurisdiction-specific requirements remain in force unless separately amended.
• Stakeholder-relations teams may wish to review communications about any future tailoring proposals so that efficiency measures are not characterised as reducing resilience or supervisory safeguards.

What changed

The FSB has proposed eight principles addressed to financial authorities rather than directly applicable obligations for regulated firms. The principles seek to improve the effectiveness, efficiency, risk focus, coherence and forward-looking nature of regulatory and supervisory frameworks, while remaining consistent with internationally agreed standards, national legal frameworks and jurisdiction-specific circumstances.

Key dates

2026-10-13

Instruction DOC-2026-05 was published; it applies to the specified OPCIs and evergreen FCPRs, and the two-year transition period begins for funds established before this date.

2028-10-13 Deadline

End of the two-year transition period for OPCIs and evergreen FCPRs established before 2026-10-13. Management companies should have notified the AMF of compliance through ROSA and filed the prospectus or rules and required stress tests by this date.

Suggested considerations

• Firms should identify every OPCI and evergreen FCPR in scope and map its redemption frequency, notice period, current liquid-asset holdings and applicable minimum cushion under Instruction DOC-2026-05.
• Management companies should calculate whether each fund satisfies the applicable permanent cushion and assess whether the potentially reduced regime for funds marketed exclusively through eligible insurance or savings products is available and properly evidenced.
• Compliance teams may wish to update prospectuses, evergreen FCPR rules and related investor disclosures to state the minimum liquid-asset cushion using the applicable Annex VII format.
• Firms should produce or refresh liquidity stress tests using all scenarios specified in DOC-2026-05, including evidence that redemption requests can be met, and establish governance for periodic review and escalation of shortfalls.
• Management companies should review whether any proposed change to redemption frequency or notice period would alter the required cushion and, if so, plan for prior AMF approval, specific investor notification and the applicable fee-free redemption right.
• For funds existing on 2026-10-13, firms should plan the ROSA filing of the amended prospectus or rules and compliant stress tests before the end of the two-year transition period.
• Product, distribution and insurance teams should verify that marketing materials and product documentation do not imply liquidity inconsistent with the fund’s redemption terms, liquid-asset cushion or stress-test assumptions.
• Firms should monitor the forthcoming French transposition of Directive (EU) 2024/927 and assess whether subsequent statutory liquidity-management-tool requirements impose additional controls beyond DOC-2026-05.

What changed

The former authorisation approach, under which management companies generally demonstrated liquid assets equal to 30% to 40% of net assets and submitted stress tests, is replaced or formalised through a permanent liquidity cushion calibrated to the fund’s redemption frequency or redemption notice period. The AMF gives a monthly-redemption fund as an example requiring at least 25% of net assets in liquid assets.

Key dates

2021-10-31

The insured family lodged the storm-related home insurance claim after roof damage in October 2021.

2022-08-01

A structural engineering assessment occurred approximately eight months after the need for one was identified; the source gives August 2022 but not an exact day.

2022-12-01

After the family complained to Hollard in late 2022, Hollard offered a $1,000 goodwill payment, which was rejected; the source gives only the month and year.

2023-04-01

Hollard made its final claim decision and rejected the claim approximately 15 months after initially accepting it; the source gives April 2023 but not an exact day.

2025-04-01

ASIC commenced Federal Court proceedings alleging breaches of section 13(2A) of the Insurance Contracts Act 1984 (Cth); the source gives April 2025 but not an exact day.

2026-10-09

The Federal Court ordered Hollard to pay a $2 million civil penalty for breach of the duty of utmost good faith.

Suggested considerations

• Compliance teams may wish to review open and recently closed home and property claims for extended periods of inactivity, delayed expert assessments, repeated reassignment, late temporary accommodation and decisions inconsistent with available expert evidence.
• Insurers should consider testing whether claims systems identify deterioration risks, vulnerable customers, habitability issues and requests for emergency accommodation, and whether those matters trigger timely management escalation.
• Firms should consider documenting clear ownership, next actions, decision dates and customer communications throughout the claim, including reasons for any investigation or decision delay.
• Insurers may wish to assess whether rejection decisions are supported by appropriate technical evidence and whether new evidence is properly reconciled with earlier inspections or admissions of cover.
• Claims governance functions should consider reviewing outsourced-provider service levels, escalation controls and management information for aging claims, complaint recurrence, temporary accommodation delays and claims exceeding internal handling targets.
• Legal and compliance teams may wish to map controls against Insurance Contracts Act 1984 (Cth), section 13(2A), and Corporations Act 2001 (Cth), section 912A(1)(a), while considering ASIC's 2024 claims-handling letter, 2025 review findings and 2026 enforcement priority.

What changed

The judgment establishes a binding enforcement precedent that an insurer may incur a civil penalty under section 13(2A) of the Insurance Contracts Act 1984 (Cth) where claims handling falls materially below the duty of utmost good faith. It does not introduce a new statutory claims-handling rule or compliance deadline, but confirms that insurers must handle claims fairly, communicate clearly, progress investigations and decisions without unnecessary delay, and respond appropriately when delay risks further insured loss.

Key dates

2024-02-28

Directive (EU) 2024/825 was adopted, amending the Unfair Commercial Practices Directive and the Consumer Rights Directive.

2026-03-27 Deadline

EU Member States were required to adopt and publish national transposition measures.

2026-06-24

The Dutch Implementatiewet richtlijn betere duurzaamheidsinformatie voor consumenten was published in the Staatsblad, according to the AFM publication.

2026-07-16

The Dutch implementation legislation entered into force, according to the AFM publication.

2026-09-27

The ECGT rules became applicable to consumer-facing commercial communications across the EU, including relevant financial-services marketing; the regime is applicable as at the publication date of 2026-10-09.

Suggested considerations

• Compliance teams may wish to inventory all consumer-facing sustainability claims, labels and environmental references used in websites, fund marketing, advertisements, product names, brochures, social media, sales scripts and corporate marketing.
• Firms should consider mapping each claim to the specific product, service, activity or business component to avoid implying whole-product or whole-enterprise sustainability where the evidence covers only part of the offering.
• Firms should consider maintaining an evidence file for every material claim, including the scope of the claim, methodology, data sources, verification, assumptions, limitations and approval owner.
• Marketing and product-governance reviews may wish to identify generic terms such as green, sustainable, environmentally friendly, climate positive and eco-friendly and confirm whether the required recognised excellent environmental performance can be demonstrated.
• Firms should consider removing or rewriting claims that describe products or services as climate neutral, carbon neutral or having reduced climate impact where the claim depends solely or materially on offsetting emissions, and should distinguish mitigation from compensation.
• Compliance teams may wish to review all sustainability labels, badges and proprietary ESG marks and confirm that each is supported by an eligible certification scheme or public scheme with appropriate independent verification.
• Firms communicating net-zero, climate-neutrality or other future environmental objectives should consider documenting a detailed and realistic implementation plan with measurable interim targets, deadlines, governance, monitoring and evidence of progress.
• Firms should consider testing claims against both the ECGT/BW 6 requirements and applicable Wft, SFDR, MiFID II, IDD and other sectoral disclosure and conduct standards, because satisfying a sectoral disclosure rule does not cure a claim prohibited under the consumer-law framework.

What changed

The Dutch Implementatiewet richtlijn betere duurzaamheidsinformatie voor consumenten amended Book 6 of the Dutch Civil Code, including the rules on unfair commercial practices in Articles 6:193a et seq., to implement Directive (EU) 2024/825, which amends Directive 2005/29/EC on unfair commercial practices and Directive 2011/83/EU on consumer rights. For consumer-facing commercial communications, sustainability claims should be specific, accurate, verifiable and supported by appropriate evidence.

Key dates

2026-10-08

FCA consultation CP26/35 opened and was first published.

2026-12-11 Deadline

Deadline for responses to the FCA consultation.

Suggested considerations

• AFMs may wish to identify NURS funds with at least 50% exposure to inherently illiquid assets and compare their current dealing frequency, redemption notice periods and liquidity profile with the proposed monthly and 90-day minimum terms.
• AFMs may wish to assess whether fund constitutional documents, prospectuses, application forms, investor communications and distribution agreements would need amendment if the proposals are adopted.
• AFMs may wish to review liquidity risk-management frameworks, asset-sale assumptions, valuation processes, cash-flow stress testing and governance arrangements for consistency between investment strategy, liquidity profile and redemption policy.
• Compliance teams may wish to assess the effect on the FIIA regime, suspension and deferred-redemption tools, depositary oversight and escalation procedures for liquidity mismatches.
• Distributors, platforms, advisers, SIPP operators and unit-linked product providers may wish to assess how longer notice periods and less frequent dealing would be displayed, explained and operationally administered for retail customers.
• Affected firms may wish to submit responses to the FCA by 11 December 2026, focusing on implementation feasibility, customer communications, operational dependencies and the treatment of indirect investors.
• Firms may wish to monitor the FCA's expected final rules in H1 2027 and avoid treating the consultation proposals as currently binding requirements.

What changed

This is a consultation rather than a binding rule change. For NURS funds with at least 50% of scheme property invested in inherently illiquid assets and offering regular liquidity, the FCA proposes minimum redemption terms aligned with LTAF requirements: redemption determinations no more frequently than once a month and a notice period of at least 90 days after acceptance of a redemption request. The FCA also proposes allowing other NURS fund managers to introduce comparable limited redemption arrangements voluntarily, subject to related rule and disclosure changes.

Key dates

2025-10-22

The SFC published its consultation paper on proposed amendments to the UT Code.

2026-01-21

The consultation period closed.

2026-10-16

The revised UT Code and consequential revised PRF, MPF, ILAS and REIT codes are scheduled to be gazetted.

2026-11-01

The revised UT Code and consequential revised PRF, MPF, ILAS and REIT codes become effective.

2027-11-01 Deadline

The generally applicable 12-month transitional period for existing SFC-authorised funds is scheduled to end.

Suggested considerations

• Compliance teams may wish to map each SFC-authorised fund’s current derivative exposure methodology against the revised UT Code and assess whether adopting relative or absolute VaR would be operationally and commercially appropriate.
• Fund managers considering VaR may wish to validate reference-portfolio selection, VaR models, calibration, stress testing, back-testing, independent validation, governance approvals, limit monitoring and escalation procedures against the final revised UT Code and forthcoming SFC guidance.
• Managers may wish to review liquidity-risk frameworks, redemption terms, asset-liability liquidity matching, stress-testing scenarios, anti-dilution tools and disclosures, particularly for funds with exposure to less liquid assets.
• Money market fund managers may wish to test compliance with the 7.5% daily-liquid-assets and 15% weekly-liquid-assets thresholds and document monitoring of investor concentration, redemption behaviour, asset liquidity, days to trade, cost to trade and maturity profiles.
• Product, legal and disclosure teams may wish to update offering documents, constitutive documents, investment-management agreements, risk disclosures, derivatives policies and fund supplements where the revised requirements affect a fund’s strategy or operating model.
• Managers may wish to assess whether existing UCITS or other overseas risk-management documentation can be leveraged while confirming that Hong Kong-specific requirements and SFC-authorised-fund classifications are satisfied.
• Trustees, custodians and oversight committees may wish to confirm their revised oversight responsibilities, reporting arrangements and escalation processes before the transition period expires.
• Firms may wish to monitor the SFC’s forthcoming supplementary guidance, frequently asked questions and revised templates and incorporate them into implementation plans.

What changed

The revised UT Code will permit eligible retail funds to manage derivative exposure using either the existing net derivative exposure approach or a VaR approach. The proposed VaR framework uses a relative VaR limit of 200% of the VaR of a designated unleveraged reference portfolio or an absolute VaR limit of 20% of the fund’s NAV, together with associated governance, risk-management and monitoring requirements.

Key dates

2026-10-07

PRA consultation CP13/26 opens.

2027-02-07 Deadline

PRA consultation CP13/26 closes and responses are due.

2031-07-01

First proposed automatic threshold update would take effect, subject to the consultation outcome and final rules.

Suggested considerations

• Compliance teams may wish to review CP13/26 and identify which of the 128 proposed thresholds currently determine the firm's prudential categorisation, reporting obligations or application of specific rules.
• Firms should consider submitting consultation responses by 7 February 2027, particularly on the suitability of nominal UK GDP as the index, the five-year adjustment interval, the treatment of thresholds near business-planning boundaries and the thresholds excluded from the main proposal.
• Banks and building societies may wish to model how the proposed mechanism could affect future eligibility for the Small Domestic Deposit Takers regime and detailed capital-reporting requirements, while recognising that no 2031 value has been specified in the publication.
• Insurers may wish to assess potential future effects on Solvency UK scope and related governance, reporting and capital-planning assumptions.
• Credit unions may wish to inventory member-related monetary thresholds, including the £7,500 threshold, and assess whether systems and monitoring processes can accommodate future indexed values.
• Regulatory change teams should track the outcome of CP13/26 and the parallel Section 4 discussion on excluded and FCA-joint thresholds rather than treating the proposed increases as current law.
• Firms operating across UK and non-UK regimes may wish to consider potential divergence between UK automatic indexation and static or differently indexed thresholds in other jurisdictions.

What changed

CP13/26 proposes that 128 thresholds determining which PRA rules apply, how those rules apply and what firms must report should be indexed to nominal UK GDP published by the Office for National Statistics. The proposed indexation cycle is every five years, using nominal GDP because it captures both price changes and real economic growth.

Key dates

2027-02-07 Deadline

Deadline for responses to CP13/26 and the associated discussion-paper section.

2031-07-01

Proposed effective date for the first automatic update of in-scope thresholds, subject to finalisation of the framework.

Suggested considerations

• Consider submitting responses on the proposed framework, the proposed in-scope threshold list, the methodology and the separate discussion-paper thresholds by 2027-02-07.
• Map the firm's current and forecast assets, exposures, liabilities, lending and reporting metrics against relevant PRA thresholds, including proposed thresholds that may be revised before finalisation.
• Assess whether nominal GDP indexation could move the firm out of, or into, a threshold-defined prudential treatment from 2031 onwards, while recognising that firms growing faster than nominal GDP would still be expected to cross thresholds.
• Review regulatory reporting, capital, liquidity, governance, risk-management and policy systems that hard-code fixed threshold values or effective dates, and consider designing controlled update mechanisms for future indexed values.
• Assess the effect of the proposed five-year update cycle on business planning, acquisitions, balance-sheet growth, lending strategies and group-structure decisions.
• Consider providing quantitative evidence to the PRA on implementation costs, cliff-edge effects, reporting impacts and whether additional discussion-paper thresholds should be included.
• Monitor the final PRA policy statement, the final automatic-indexation statement of policy and the consolidated threshold list before treating any proposed uprating as a binding change.

What changed

The PRA proposes to replace the current predominantly ad hoc threshold-review process for eligible fixed nominal thresholds with a rules-based framework. In-scope thresholds would be indexed using UK nominal GDP, based on data produced by the Office for National Statistics, on a common five-year cycle; the first automatic update would take effect on 1 July 2031, subject to final policy.

Key dates

2026-10-07

MAS published its written parliamentary reply stating that LIA’s next review of severe-stage critical illness definitions will commence in 2027 and that updated definitions will apply to new products sold.

2027-01-01

The LIA review is expected to commence during 2027; the publication does not specify an exact commencement date or impose a firm for firms to act by this date.

2025-10-01

The LIA Critical Illness Framework 2024 was required to be adopted for new products no later than this date, according to independent industry and LIA-related materials; this is relevant background rather than a new deadline created by the MAS reply.

Suggested considerations

• Compliance teams may wish to monitor the LIA’s 2027 review, consultation materials, final framework amendments, implementation dates, and any MAS communications that follow.
• Insurers should consider mapping current severe-stage definitions to the procedures and clinical severity criteria that may be affected, including identifying products whose claims triggers are particularly dependent on a named surgical procedure.
• Product governance, actuarial, underwriting, claims, legal, and compliance functions may wish to assess how alternative disease- and severity-based triggers could affect coverage scope, expected claims frequency, reserves, reinsurance, and pricing.
• Firms should consider documenting whether existing policy wordings can continue to be administered consistently with their contractual terms and should avoid treating any future framework revision as automatically applicable to in-force policies.
• Insurers developing new products should consider preparing customer disclosures explaining the relevant disease, severity, diagnostic evidence, exclusions, waiting periods, and any procedure-independent claims criteria.
• Compliance teams may wish to review product approval and change-control processes so that future LIA definition changes are reflected consistently in policy documents, benefit illustrations, sales materials, claims manuals, staff training, and complaint-handling procedures.
• Actuarial and product teams should consider reassessing premiums and claims assumptions before launching products using revised definitions, since MAS expressly notes that premiums depend on the probability of claims materialising.

What changed

No immediate statutory requirement, product withdrawal, or mandatory amendment to existing policies was introduced. LIA’s 2027 review will consider procedure-neutral or less procedure-dependent definitions for certain medical conditions, while retaining the use of procedures where they provide objective evidence of severity, recovery duration, and financial impact. Any resulting changes will apply to new products sold; existing policies remain governed by their contractual definitions and terms.

Key dates

2026-10-07

MAS issued the Guidelines on Artificial Intelligence Risk Management following its November 2025 consultation.

2027-10-07 Deadline

The Guidelines take effect. FIs should meet the expectations in Sections 3 and 4 from this date.

2027-10-07

MAS intends to consult the financial sector during 2027 on what additional guidance on agentic AI would be useful.

2028-10-07 Deadline

FIs should meet the expectations in Sections 5 and 6 by this date under the phased implementation timetable.

Suggested considerations

• FIs should establish or update an enterprise inventory of AI systems, models, embedded AI functionality and third-party AI services, using a level of granularity appropriate to their risk profile.
• Compliance and risk teams may wish to classify individual AI use cases by materiality, including potential effects on customers, prudential soundness, operational resilience, other financial institutions and the wider financial system.
• Boards and senior management should consider documenting AI risk appetite, ownership, escalation routes and the allocation of responsibilities across business, risk, compliance, technology, cybersecurity, data and model-governance functions.
• FIs should map existing AI controls across the lifecycle, including data governance, development and validation, testing, human oversight, cybersecurity, monitoring, incident management and change management, and identify gaps against the Guidelines.
• Procurement, outsourcing and third-party-risk functions should consider adding AI-specific due diligence, assurance, contractual rights, performance monitoring, incident notification and exit or substitution arrangements for external AI providers.
• FIs should assess whether existing governance committees and risk frameworks provide sufficient cross-functional oversight, rather than assuming that a new dedicated AI committee is necessary.
• FIs may wish to define evidence that supports proportionality decisions, including why basic policies and procedures are adequate for lower-materiality AI use cases.
• Implementation planning should distinguish the expectations in Sections 3 and 4, which should be met from 7 October 2027, from Sections 5 and 6, which should be met by 7 October 2028.

What changed

The Guidelines introduce an enterprise- and use-case-level framework for managing AI risk. Boards and senior management are expected to oversee AI risk, define accountabilities, set risk appetite, and maintain suitable risk-management frameworks, policies and procedures; existing governance structures may be used and a dedicated AI committee is not required solely for compliance.

Key dates

2026-04-30

APRA issued its letter to banks, insurers and superannuation trustees calling for a step-change in governance, risk management, assurance and operational resilience for AI-related risks.

2026-05-08

ASIC issued its open letter to all licensees and market participants urging urgent strengthening of cyber resilience as frontier AI intensifies the global cyber-risk environment.

2026-06-01

ASIC and APRA began the June–July 2026 series of nine industry roundtables on frontier-AI preparedness and resilience; the source identifies June as the starting month but does not provide an exact day.

2026-07-31

ASIC and APRA completed the June–July 2026 roundtable period; the source does not provide an exact closing day.

2026-08-27

ASIC published the joint warning and related information paper and preparedness checklist, urging entities to move from awareness to action.

Suggested considerations

• Firms should consider presenting the ASIC and APRA roundtable themes, together with the available board and executive preparedness checklist, to the board and relevant risk or technology committees.
• Compliance teams may wish to map frontier-AI cyber and operational risks to existing obligations and controls under APRA CPS 230 Operational Risk Management, APRA CPS 234 Information Security, APRA CPS 220 Risk Management where applicable, and the entity's ASIC licence, governance and cyber-resilience arrangements.
• Firms should consider identifying critical assets, systems, data flows and material third-party dependencies, including common providers and concentration points that could create sector-wide disruption.
• Technology and security teams may wish to test patching, identity and privileged-access controls, attack-surface reduction, backup integrity, recovery-time priorities and incident-response playbooks against AI-accelerated attack scenarios.
• Boards and executives should consider documenting risk appetite, incident escalation authority, recovery priorities, internal and external communication strategies and decision rights before a frontier-AI-related crisis occurs.
• Firms should consider testing response and recovery arrangements under compressed timeframes and retaining evidence of exercise results, lessons learned, remediation owners and completion status.
• Entities using or procuring AI should consider applying existing model, data, supplier, change-management and assurance controls to internally developed models, vendor tools and embedded AI functionality, including defensive-AI tools used for threat intelligence, vulnerability detection, code review or incident response.
• Procurement and outsourcing functions may wish to strengthen supplier assurance, obtain relevant information on providers' AI and cyber controls, map material dependencies and assess substitutability and exit arrangements.

What changed

The regulators have consolidated a cross-sector expectation that entities address frontier-AI risk through cyber fundamentals, critical-asset identification, timely patching, strong identity and access controls, attack-surface reduction, reliable backups, tested response and recovery arrangements, and third-party risk management.

Key dates

2025-01-17

DORA began applying to in-scope financial entities supervised by the CSSF.

2025-12-17

The European Commission confirmed through DORA Q&A 102 that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF’s extended best-efforts deadline for the first register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2026-08-27

Circular CSSF 26/915 was published and took effect immediately; the listed CSSF circulars were amended to include or remove qualifying third-country branches as applicable.

2027-03-31 Deadline

Target date identified by CSSF for the required-quality register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2027-01-11

Relevant CRD VI third-country-branch provisions are scheduled to take effect, subject to national transposition and applicable transitional rules.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the counterfactual test in Circular 26/915: whether the head-office undertaking would qualify under Article 2(1)(a) to (t) of DORA if established in the relevant third country.
• Affected branches should update their regulatory-perimeter inventories, governance documents, ICT-risk policies, outsourcing inventories, incident-classification procedures and DORA control testing to reflect immediate inclusion in the DORA-specific CSSF circulars.
• Compliance teams may wish to separate non-ICT outsourcing, which remains subject to Part I of Circular CSSF 22/806, from ICT outsourcing, which is governed by DORA and Circular CSSF 25/882 rather than the legacy Part II framework.
• Affected entities should validate their register-of-information process under DORA and Circular CSSF 25/882, including branch-level data, ICT third-party contracts, intra-group arrangements and submission ownership. The 30 June 2026 best-efforts deadline for third-country branches of credit institutions has passed, and firms should prepare for the 31 March 2027 collection and any CSSF remediation requests.
• Incident-response teams should test access to the CSSF eDesk procedure and S3 API and document an escalation process for emailing [email protected] when technical impossibility prevents electronic submission.
• Firms should assess whether they qualify for the microenterprise exclusion in Circular CSSF 25/892; the exclusion applies to entities employing fewer than 10 persons with annual turnover and/or annual balance-sheet total not exceeding EUR 2 million, subject to the DORA definition and exclusions for specified market infrastructures.
• Third-country banking groups should coordinate DORA implementation with the CRD VI third-country-branch analysis, including the 11 January 2027 effective date for relevant CRD VI provisions, rather than assuming that the two regimes have identical scope or timing.

What changed

Qualifying third-country branches are added to the scope of Circulars CSSF 25/882, 25/892 and 25/893, covering DORA ICT third-party-service information and reporting, estimation of aggregated annual costs and losses from major ICT-related incidents under Article 11(11) of DORA and the Joint ESA Guidelines JC/GL/2024/34, and reporting of major ICT-related incidents and significant cyber threats.

Key dates

2025-12-30

MAS issued the revised Notices FAA-N27, 508 and SFA 04-N24 and published its response to feedback.

2026-08-24

MAS published the circular and FAQs explaining the revised misconduct-reporting requirements and the discontinuation of the existing system.

2027-01-01 Deadline

The revised Notices FAA-N27, 508 and SFA 04-N24 take effect; the existing Notices FAA-N14, 504 and SFA 04-N11 are cancelled; and the existing misconduct reporting system is discontinued.

2027-01-22 Deadline

Default deadline for reporting qualifying pre-2027 misconduct matters that were not reported under the cancelled Notice, calculated as 21 calendar days after 1 January 2027, unless MAS permits a longer period in writing.

Suggested considerations

• Compliance teams may wish to map existing misconduct, incident, whistleblowing, investigation, HR and police-referral processes to the revised definition and categories of reportable misconduct.
• Firms should consider establishing a documented escalation test for when reasonable grounds to believe misconduct occurred arise, rather than waiting for a final investigation finding, and configuring workflow controls around the 21-calendar-day initial-reporting deadline.
• Firms may wish to obtain and operationalise the prescribed misconduct-report, investigation-report and update-report formats before the existing system is discontinued.
• Internal investigation procedures should be reviewed to ensure that the prescribed investigation information, supporting evidence, investigator assessment, corrective action and appeal information can be produced concurrently with the initial MAS report where an investigation has commenced.
• Police-report handling should be updated so that available police reports and required accompanying details are captured and submitted with the misconduct report, with subsequent police or criminal-proceeding developments tracked for update reporting.
• Firms should consider controls for providing representatives with copies of initial misconduct reports and subsequent updates within the prescribed timelines, including appropriate treatment of former representatives and confidentiality or privilege issues.
• A transitional review of open matters may be appropriate to identify cases where reasonable grounds arose before 1 January 2027 but no report was filed under the cancelled Notice; those matters may need to be reported by 22 January 2027, subject to any written extension from MAS.
• Record-retention policies, case-management systems and management information should be tested against the minimum five-year retention requirement and the requirement that electronic records remain accessible, retrievable and readable.

What changed

From 1 January 2027, Notices FAA-N27, 508 and SFA 04-N24 replace and cancel the existing Notices FAA-N14, 504 and SFA 04-N11. The initial misconduct report must generally be submitted within 21 calendar days after the firm has reasonable grounds to believe that reportable misconduct was committed or is likely to have been committed; a conclusive investigation finding is not required before reporting.

Suggested considerations

• Compliance teams may wish to check whether any bundled, embedded, or referral-based cover could be characterised as insurance business requiring authorisation.
• Firms may wish to compare current products and distribution models against the licensing perimeter under the Short-term Insurance Act and Insurance Act.
• Compliance functions may wish to review complaint-handling controls to ensure perimeter issues are escalated promptly when customer complaints arise.
• Firms may wish to assess whether document-production and response procedures are adequate for FSCA investigations under the FSR Act.
• Senior management may wish to review governance over third-party arrangements and product approval processes where non-insurance businesses market insurance-like protection.

What changed

This is an enforcement outcome, not a new rule or consultation. The FSCA’s action confirms that operating an insurance-like business without the required short-term insurance authorisation can result in both a substantial monetary penalty and an individual debarment. The publication also indicates that obstruction or non-cooperation during an FSCA investigation can aggravate the matter and is treated as a breach of the Financial Sector Regulation Act framework.

Key dates

2026-03-03

FSCA confirmed it had completed its investigation into the South African Army Foundation and two senior officials and said enforcement action would follow.

2016-02-01

Start of the conduct period cited in reporting for the unlawful practices identified by the FSCA.

2022-03-31

End of the conduct period cited in reporting for the unlawful practices identified by the FSCA.

Suggested considerations

• Compliance teams may wish to review whether client-money segregation controls are strong enough to prevent commingling of funds where administration fees and member contributions pass through shared accounts.
• Firms may wish to test whether regulatory reporting processes include sufficient validation, approval, and escalation controls to reduce the risk of misleading submissions.
• Boards and senior management may wish to assess whether payment-authorization controls over senior personnel, related-party payments, and expense cards are independently reviewed and well documented.
• Risk and internal-audit teams may wish to examine whether bank-reconciliation and anomaly-detection procedures would identify unusual outflows to personal accounts or related entities quickly enough.
• Firms handling member deductions or insurance premiums may wish to confirm that end-to-end flow tracing exists for funds paid to insurers and third parties, with evidence that money is applied only for its intended purpose.
• Governance teams may wish to test whether fit-and-proper, debarment, and accountability frameworks are capable of detecting senior misconduct early and limiting harm.
• Businesses relying on legacy or outsourced administration structures may wish to confirm that interim management and contingency arrangements exist for rapid stabilisation if misconduct or licence risk emerges.

What changed

The FSCA confirmed that its investigation was complete and that enforcement action would follow, which is reflected in the later licence withdrawal, penalties, and debarment orders. The reported findings indicate unlawful practices between February 2016 and March 2022, including commingling client funds, submitting misleading regulatory reports, failing to exercise proper care over funds, and making unauthorised payments from the SANDF Group Life Insurance Scheme account.

Suggested considerations

• Compliance teams may wish to review whether client-money segregation and reconciliation controls are robust enough to prevent commingling or unauthorized use of funds.
• Firms may wish to reassess governance over senior executives, key individuals, related-party payments, and delegated authority limits.
• Institutions handling payroll deductions or benefit contributions may wish to test whether payment flows, beneficiary remittances, and audit trails are transparent and independently traceable.
• Compliance functions may wish to review statutory reporting sign-off, escalation, and challenge procedures for anomalies or inaccuracies.
• Boards and risk committees may wish to consider whether ongoing fit-and-proper monitoring of key individuals is sufficiently documented and frequent.
• Firms relying on affiliated or outsourced intermediaries may wish to confirm counterparties’ licence status and the scope of their authorisation before continuing service arrangements.

What changed

The Foundation’s authorisation to act as a financial services provider was withdrawn under the FAIS regulatory framework, ending its licence-based ability to render regulated financial services. Two senior individuals were also debarred from rendering financial services for 30 years, and the FSCA imposed administrative penalties of R24 million and R20.7 million, respectively, based on reported misconduct including commingling client funds, misleading regulatory reports, failure to exercise proper care over funds, and unauthorised payments to themselves.

Key dates

07 August 2023

- Law of 7 August 2023 introducing the new accounting regime for associations and foundations enters into force and defines classification as “small associations”, “medium‑sized associations” and “large associations” with corresponding accounting obligations

Autumn 2026

- CNC plans to publish an accounting guide dedicated to the new accounting regime for ASBLs classified as small, medium‑sized and large associations, and associations recognised as being of public utility

04 August 2026

- CSSF press release is published, formally drawing supervisory attention to CNC Q&A 26/038 and the related upcoming CNC accounting guide

Suggested considerations

• Identify all Luxembourg associations, public‑utility associations and foundations within or related to the group that are impacted by the Law of 7 August 2023 and confirm their size classification (small, medium‑sized, large) and whether they fall under the “medium‑sized undertakings” regime.
• Review existing accounting policies, charts of accounts and annual accounts formats for affected entities to ensure alignment with LRCS statutory layouts, including non‑abridged balance sheet, appropriate profit and loss format, and required notes disclosures.
• Decide at governing‑body level whether each affected entity will voluntarily adopt the PCN or maintain an internal chart of accounts, documenting the rationale, governance approvals and compliance impacts of the chosen option.
• Where PCN is not adopted, design, implement and document a robust mapping from the internal chart of accounts to the statutory LRCS balance sheet and profit and loss layouts, ensuring audit‑ready documentation and traceability.
• Update accounting systems and reporting tools for affected entities to support LRCS statutory layouts, consistent layout adaptations, and classic‑format filing with the RCS, including necessary changes to interfaces and data capture.

What changed

• - Large associations, associations recognised as being of public utility and foundations are now subject to the accounting regime applicable to “medium‑sized undertakings” under the amended...
• Annual accounts for affected entities must include a non‑abridged balance sheet, a profit and loss account (at least in abridged format), and notes to the accounts containing disclosures required by...
• Affected entities must use statutory LRCS layouts for the balance sheet and profit and loss account and file their annual accounts in classic format with the Luxembourg Trade and Companies Register...
• Large associations, public‑utility associations and foundations remain exempt from the mandatory use of the Standard Chart of Accounts (Plan Comptable Normalisé – PCN) and from eCDF standard data...
• Affected entities may voluntarily adopt the PCN; if they do not adopt PCN, they must maintain an internal chart of accounts and ensure robust, documented mapping between internal accounts and...

Key dates

03 August 2026

- ESAs publish the Final Report and draft RTS proposing amendments to Delegated Regulation (EU) 2016/2251 to simplify bilateral margin requirements for counterparties below the EUR 8 billion initial margin threshold

TBD (European Commission adoption)

- The European Commission reviews and, if satisfied, endorses the draft RTS amending the EMIR bilateral margin Delegated Regulation; exact date to be set by the Commission’s internal process

TBD (European Parliament and Council scrutiny)

- Following Commission endorsement, the RTS are subject to scrutiny by the European Parliament and the Council under the standard RTS procedure before publication in the Official Journal

TBD (Entry into force – OJ publication + 20 days)

- The amended RTS enter into force on the date specified in the Official Journal (typically 20 days after publication), from which firms can legally apply the new exemption regime

TBD (Three years after entry into force) Deadline

- By the date three years after entry into force, the ESAs must complete a review of the application and impact of the exemption from initial margin requirements in Article 28(1), potentially informing further changes

Suggested considerations

• Map all EMIR in-scope entities within the group and identify those whose AANA of non-centrally cleared OTC derivatives is close to or below the EUR 8 billion threshold, to assess which relationships may benefit from the expanded exemption.
• Review current collateral and margin frameworks to identify legacy contracts where initial margin is still being exchanged solely because the regime requires continuation despite the counterparty having fallen below the EUR 8 billion threshold.
• Prepare an internal policy update so that, once the RTS enter into force, initial margin requirements are switched off for counterparties below the EUR 8 billion threshold on both new and existing uncleared OTC derivatives, subject to group risk appetite.
• Update EMIR margin procedures and AANA calculation processes to ensure accurate annual determination of whether each counterparty is above or below the EUR 8 billion threshold, including documentation of the March–May calculation methodology.
• Review and amend collateral agreements, credit support annexes (CSAs) and associated legal documentation to incorporate the revised treatment for below-threshold counterparties, including terms for stopping margin exchange and potentially releasing segregated collateral.

What changed

• - Counterparties whose average aggregate notional amount (AANA) of non-centrally cleared OTC derivatives falls below the EUR 8 billion threshold will no longer be required to exchange initial margin...
• The current framework, under which below-threshold counterparties are exempt from initial margin for new trades but must continue to exchange initial margin for pre-existing “legacy” contracts, will...
• Article 28(1) of Delegated Regulation (EU) 2016/2251 will be amended to explicitly extend the exemption from initial margin requirements to outstanding contracts where one of the two counterparties...
• The RTS introduce a clearer operational framework for entry into and exit from the initial margin regime based on the annual AANA calculation for March–May, including scenarios where one or both...
• Once a counterparty falls below the EUR 8 billion threshold under the revised rules, firms will be permitted to terminate related initial margin processes, including ceasing ongoing calculation,...