Payment Providers Regulatory Updates

Key dates

2020-10-27

FinCEN and the Federal Reserve Board published the NPRM proposing a $250 threshold and CVC-related clarifications at 85 FR 68005.

2026-11-09

Withdrawal of the NPRM takes effect upon publication in the Federal Register; no final rule will be issued from the withdrawn proposal without a new opportunity for public comment.

Suggested considerations

• Compliance teams may wish to document that the $250 threshold was proposed but never finalized, and that the applicable threshold remains $3,000 under the existing Recordkeeping Rule and Travel Rule framework.
• Firms may wish to validate that transaction-monitoring, case-management, record-retention, and payment-message controls have not been configured on the assumption that the withdrawn $250 threshold became effective.
• Covered institutions may wish to continue collecting, retaining, and transmitting the information required by 31 CFR 1010.410(e), 31 CFR 1010.410(f), and, where applicable, 31 CFR 1020.410(a) for transactions within the existing rule scope.
• Crypto businesses and their banking or payment partners may wish to retain existing risk-based controls for CVC transactions rather than treating withdrawal of the clarification as a removal of applicable AML obligations.
• Firms may wish to monitor for a future NPRM addressing CVC, stablecoins, digital assets with legal tender status, or transaction thresholds, because the agencies expressly left open the possibility of future amendments after additional public feedback.
• Remittance and payment providers may wish to assess whether procedures, customer disclosures, vendor specifications, and interinstitutional messaging agreements were prepared for the proposed $250 threshold and should now be revised or archived.

What changed

The agencies withdrew the NPRM published at 85 FR 68005 on October 27, 2020, and stated that they will take no further action on that proposal. The proposed reduction of the Recordkeeping Rule threshold under 31 CFR 1010.410(e) and 31 CFR 1020.410(a) from $3,000 to $250 for funds transfers and transmittals of funds beginning or ending outside the United States will not take effect. The proposed reduction of FinCEN's Travel Rule threshold under 31 CFR 1010.410(f) from $3,000 to $250 for transmission of information to other financial institutions in the payment chain will also not take effect.

Key dates

2026-11-02

WBF amended Annex 2 of the Ordinance of 25 May 2005 on Measures against Sudan (SR 946.231.18), modifying three individual entries.

2026-11-03 Deadline

The amended Sudan sanctions measures enter into force at 23:00 Swiss time; affected financial intermediaries must apply the relevant prohibitions, freeze assets and report affected relationships and blocked assets as required by the ordinance.

Suggested considerations

• Compliance teams should consider updating sanctions-screening data, including aliases and identifying information, from SESAM and the amended Annex 2 before the 23:00 effective time on 3 November 2026.
• Firms should consider screening customers, beneficial owners, counterparties, payment beneficiaries, securities positions and existing business relationships against all three modified entries, including historical and transliterated names where relevant.
• Where a potential match is identified, firms should consider applying the Article 2 financial-sanctions restrictions, preventing further availability of assets or economic resources, preserving relevant records and escalating the case for false-positive resolution and sanctions governance review.
• Firms should consider notifying SECO of affected business relationships and blocked assets in accordance with SR 946.231.18 and maintaining evidence of the decision, controls applied and notification submitted.
• Compliance teams may wish to assess whether a sanctions hit or related transaction creates additional money-laundering concerns requiring enhanced inquiries under Article 6 GwG and, if suspicions cannot be dispelled, an immediate Article 9 GwG report to the Money Laundering Reporting Office.
• Firms with cross-border operations should consider separately assessing whether the modified persons are also subject to EU, UK, US or other sanctions regimes, because the Swiss listing and any foreign restrictions may differ in scope and ownership or control consequences.
• Firms should consider validating batch-screening, real-time payment-screening, case-management and alert-escalation controls after the SESAM update, given the short notice between publication and effectiveness.

What changed

Three individual entries in Annex 2 were modified; the update is implemented through the Swiss SESAM sanctions database. The amended listings are subject to the financial sanctions in Article 2 paragraph 1 of SR 946.231.18, including the freezing of assets and economic resources and the prohibition on directly or indirectly making assets or economic resources available to listed persons. The relevant travel-ban provisions under Article 4 paragraph 1 also apply. Financial intermediaries must report affected business relationships and blocked assets to SECO.

Key dates

2018-08-03

iSignthis represented that less than 15% of quarterly revenue came from one-off or set-up fees; the Court found that the proportion exceeded 75% and that approximately AUD 3 million of one-off revenue and AUD 2.85 million of related one-off costs were not disclosed.

2020-05-12

iSignthis received Visa's letter communicating the finality of Visa's decision to terminate its relationship; the Court found that disclosure to the ASX was required on or shortly after this date.

2020-12-07

ASIC commenced civil penalty proceedings against iSignthis and Nickolas John Karantzis.

2022-05-11

iSignthis changed its name to Southern Cross Payments Ltd.

2022-11-04

Southern Cross Payments Ltd was delisted from the ASX.

2024-06-21

The Federal Court found that iSignthis had contravened disclosure laws and that Karantzis had breached relevant director duties.

2025-08-08

The Federal Court ordered iSignthis to pay a AUD 10 million penalty and ordered Karantzis to pay AUD 1 million and be disqualified from managing corporations for six years.

2025-09-05

iSignthis and Karantzis lodged appeals against the liability and penalty decisions.

Suggested considerations

• Firms should consider reviewing continuous-disclosure procedures against Corporations Act 2001 section 674 and ASX Listing Rule 3.1, including escalation criteria for operational, commercial and revenue information.
• Compliance teams may wish to test whether financial reporting distinguishes recurring revenue from one-off or set-up fees and discloses material associated costs consistently with market communications.
• Listed entities should consider documenting how they assess materiality, finality and reasonable grounds for delay when a major counterparty indicates that a contract or relationship may end.
• Boards and senior officers may wish to review controls ensuring that information provided to the ASX is accurate, complete and not misleading, including verification of statements made in analyst briefings and investor presentations.
• Firms should consider confirming that trading suspensions do not cause disclosure controls to stop operating and that market-sensitive developments continue to be assessed during a suspension.
• Companies may wish to retain contemporaneous records of disclosure decisions, legal advice, board or committee deliberations and communications with counterparties where disclosure timing is disputed.
• Compliance teams should consider whether director and officer accountability frameworks adequately address the risk of personal civil penalties and disqualification for failures to take reasonable steps to ensure ASX information is accurate.

What changed

The appeal did not introduce a new statutory obligation, but it confirms the substantial enforcement consequences of existing Australian continuous-disclosure and director-duty requirements. The Court upheld findings concerning iSignthis's failure to accurately disclose the extent of one-off revenue and related costs, and its failure from 12 May 2020 to disclose Visa's decision to terminate its relationship and the reasons communicated by Visa.

Key dates

2026-10-26

Current date and FCA publication context for the review; firms have been told to take prompt action, but this is not a statutory compliance deadline.

2028-12-01

The FCA says the point-in-time publication may be treated as retired by December 2028 if it has not been removed sooner; this is not stated as a mandatory implementation deadline.

Suggested considerations

• Compliance teams may wish to map how the firm identifies direct defence businesses, defence supply-chain participants, dual-use technology businesses and relevant customers that are not accurately captured by SIC codes.
• Firms should consider testing whether onboarding and enhanced due diligence requests are risk-based, non-duplicative and proportionate to the individual customer's activities, jurisdictions, products, end use and supply chain, rather than triggered solely by a broad defence-sector label.
• Firms should consider reviewing blanket exclusions, revenue thresholds, automatic escalation rules and approval stages affecting defence customers, documenting why any retained restrictions are justified by legal, financial-crime, reputational or commercial-risk considerations.
• Firms should consider defining and governing reputational, ESG and sustainability criteria used in account opening, servicing, product access, restriction or closure decisions, with evidence that the criteria are consistently applied and aligned with stated risk appetite.
• Firms should consider establishing or improving management information covering defence-sector identification, application volumes, approval and rejection rates, onboarding duration, repeated information requests, escalation frequency, restrictions, closures, complaints and outcomes by customer risk category.
• Senior management and relevant committees may wish to review whether the available information allows them to challenge inconsistent treatment, unexplained delays or outcomes that arise from internal processes rather than the customer's actual risk.
• Where legally permissible and appropriate, firms should consider keeping applicants informed about additional checks, progress and likely decision timescales, and explaining decisions sufficiently to reduce avoidable uncertainty.
• Firms should continue to apply customer due diligence, enhanced due diligence, sanctions and other financial-crime controls required by applicable law; the FCA's message is to make those controls targeted and proportionate, not to reduce them.

What changed

No binding regulatory obligations or new thresholds have been introduced. The FCA has nevertheless written to firms providing banking services to SMEs and expects prompt action under existing requirements. Firms should review whether onboarding, enhanced due diligence, escalation, servicing, restriction and closure processes distinguish among different defence activities and reflect the specific customer, geographic, product, supply-chain, end-use, financial-crime and reputational risks.

Key dates

2026-10-23

FCA consultation CP26/38 opened and published.

2026-12-24 Deadline

Deadline for submitting responses to the FCA consultation.

2027-10-01

The FCA describes the new cryptoasset regime as applying from October 2027; the precise commencement date should be confirmed against the final legislation and FCA rules.

Suggested considerations

• Compliance teams may wish to review the proposed changes and submit consultation responses through the FCA online form by 24 December 2026, particularly where the proposals would create material implementation costs or operational challenges.
• Firms should consider mapping current fraud, AML/CTF, sanctions, proliferation-financing, data-security and financial-crime systems-and-controls frameworks against the consultation themes, while recognising that the proposals are not yet final guidance.
• Cryptoasset businesses and firms intending to provide regulated cryptoasset services may wish to assess readiness for the new regime expected in October 2027, including AML/KYC controls, blockchain analytics, Travel Rule processes, sanctions screening, transaction monitoring and governance.
• Firms using AI or external technology providers for transaction monitoring, customer screening or other financial-crime controls should consider documenting model governance, validation, parameter testing, explainability, human oversight, data security, third-party oversight and retention of decision records.
• Senior management and boards may wish to review whether financial-crime management information, risk assessments and escalation arrangements adequately cover proliferation financing, sanctions evasion, cryptoasset risks and reliance on outsourced or AI-enabled controls.
• Firms may wish to monitor the FCA's final Policy Statement and consolidated Financial Crime Guide, since the final text may differ from the consultation proposals and is likely to inform future supervisory assessments.

What changed

No new binding rules have been made by this consultation. The FCA proposes to revise non-Handbook guidance and practical examples in the Financial Crime Guide to reflect emerging risks and regulatory developments, including AI and third-party tools used in financial-crime controls, cryptoasset-specific risks, evolving financial and trade sanctions, proliferation financing, data security, fraud, and AML/CTF systems and controls.

Key dates

2024-04-01

Bank of America self-identified the inaccurate wire-transmittor information issue, according to the OCC enforcement order; the date is included as an approximate month-level historical reference represented by the first day of the month.

2024-10-01

Bank of America stopped the inaccurate transmittor-information practice in 2024; the OCC order does not provide an exact day, so this is an approximate month-level historical reference represented by the first day of the month.

2026-10-08

The OCC announced the American Express National Bank cease-and-desist order and $350 million civil money penalty.

2026-10-13

The OCC announced the Bank of America $750 million civil money penalty, described as the largest penalty in OCC history, in coordination with Treasury and FinCEN actions.

2026-10-22

The OCC published the October 2026 consolidated enforcement-actions release.

Suggested considerations

• Firms should consider reassessing whether their BSA/AML risk assessments cover the risks of all material products and services, rather than concentrating on narrower deposit activity while underweighting credit-card, charge-card, correspondent, or payment activity.
• Compliance teams may wish to test end-to-end transaction-monitoring workflows for alert generation, escalation, investigation, disposition, and SAR filing, including backlog governance, aging thresholds, management information, and evidence that suspected trade-based money laundering is escalated promptly.
• Firms should consider validating that customer identification, customer due diligence, beneficial-ownership information, and ongoing-risk-rating processes are complete, accurate, risk-based, and aligned to the institution's actual customer and product populations.
• Banks may wish to perform a targeted review of outgoing wire data to confirm that originator or transmittor names and other required fields are accurate, consistently populated, retained, and not overwritten by deficient interfaces or manual processes.
• Boards and senior management should consider documenting sufficient staffing, subject-matter expertise, training, independent testing, audit coverage, and issue-remediation ownership for BSA/AML programs.
• Institutions operating under prior supervisory findings should consider independent validation that corrective actions are complete, effective, sustainable, and supported by evidence, rather than merely implemented procedurally.
• Compliance teams should consider reviewing whether third-party, correspondent, and payment-processing arrangements create data-quality or monitoring dependencies that could delay SAR filing or impair law-enforcement traceability.

What changed

This publication announces enforcement outcomes rather than a new rule or generally applicable deadline. American Express National Bank is subject to a cease-and-desist order and a $350 million penalty for an inadequately designed and monitored BSA/AML program, inadequate resources and expertise, internal-control weaknesses, weak independent testing and training, systemic failures involving approximately $13 billion of suspected trade-based money-laundering activity, and customer identification and customer due diligence deficiencies.

Key dates

2020-11-01

Beginning of the period during which the Central Bank found Coinbase Ireland breached safeguarding and outsourcing obligations under the Electronic Money Regulations 2011.

2025-08-19

End of the enforcement period identified by the Central Bank.

2026-10-21

Central Bank of Ireland and Coinbase Ireland reached the settlement under the undisputed-facts settlement process.

2026-10-22

Central Bank published the enforcement outcome and announced the proposed reprimand and discounted monetary penalty.

Suggested considerations

• Firms should map all safeguarding responsibilities to the specific Irish or EU-authorised entity that holds the regulatory obligation and document how the entity retains effective control despite group or third-party outsourcing.
• Compliance teams may wish to assess whether the regulated entity has sufficient local expertise, decision-making authority and management information to oversee safeguarding and challenge outsourced providers on an ongoing basis.
• Firms should consider independently validating the design of safeguarding calculations, reconciliations, treasury-rebalancing processes and designated safeguarding-account funding, including testing for data, systems and mapping errors.
• Firms may wish to perform daily or otherwise risk-appropriate reconciliations between customer liabilities, safeguarding obligations and funds held in designated accounts, with documented investigation and remediation of exceptions.
• Boards and senior management should consider whether control testing covers the complete safeguarding process, including outsourced components, and whether testing is sufficiently independent and frequent to identify prolonged shortfalls.
• Firms should review escalation procedures for safeguarding incidents, control failures, underfunding and material changes to operating models, including criteria and ownership for notifying the Central Bank of Ireland.
• Authorised firms should compare their current operating model with representations, commitments and governance arrangements submitted during authorisation and assess whether any material changes were notified to the Central Bank.
• Outsourcing registers, contracts and service-level arrangements should be reviewed to confirm clear regulatory access, audit rights, information rights, incident reporting, business-continuity provisions and accountability for safeguarding outcomes.

What changed

The publication does not introduce a new statutory rule; it applies existing obligations under the Electronic Money Regulations 2011 and establishes a substantial enforcement precedent. Coinbase Ireland admitted that it lacked an adequate outsourcing-governance framework, relied excessively on a US Coinbase Group entity, lacked sufficient local skill and expertise to oversee safeguarding, used inadequately designed and tested systems that left its designated safeguarding account underfunded, and lacked adequate escalation and reporting arrangements for material safeguarding changes.

Key dates

2026-10-21

CSSF published the communiqué warning about CVE-2026-109618 and CVE-2026-109619; PHP also released security updates addressing the vulnerabilities on this date.

Suggested considerations

• Firms should consider urgently inventorying internet-facing and internally accessible services that run PHP, including PHP embedded in outsourced, cloud-hosted and vendor-managed applications.
• Technology and security teams may wish to determine the installed PHP branch and apply the relevant fixed release, including PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 where applicable, after validating compatibility and deployment integrity.
• Where immediate patching is not feasible, firms should consider isolating or taking affected internet-facing services offline, placing them behind network-layer authentication or equivalent compensating controls, and restricting PHP execution to required functions.
• Security teams may wish to review web-server, PHP, application, endpoint and identity logs for exploitation indicators, unusual child processes, unexpected outbound connections, persistence and activity associated with unauthenticated requests.
• Firms should consider assessing whether any unauthorised remote code execution, suspected compromise or material service disruption meets the applicable major ICT-related incident criteria and documenting the classification decision.
• DORA entities should consider preparing the notification required under Circular CSSF 25/893 and the applicable DORA implementing rules if the incident is classified as major; the initial notification is generally due within four hours of classification and no later than 24 hours after awareness, followed by an intermediate report within 72 hours and a final report within one month.
• Entities subject to CSSF Circular 24/847 should consider following that circular's notification process for a major ICT-related incident and confirming whether any parallel obligations arise under applicable NIS or sectoral requirements.
• Compliance teams may wish to retain evidence of the affected-asset inventory, patch or mitigation decisions, threat monitoring, incident assessment and communications with relevant ICT third-party providers.

What changed

The publication does not introduce a new standalone rule or compliance deadline; it provides an urgent supervisory warning and links the risk to existing ICT incident-reporting obligations. Until the affected versions were officially confirmed, the CSSF's stated position was that all PHP-powered services should be treated as potentially exposed. Independent security analysis reported that PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with both vulnerabilities rated CVSS 4.0 at 9.2 and capable of execution under the web-worker account.

Key dates

2026-09-30

The application period opened for existing UK cryptoasset businesses seeking to conduct new regulated cryptoasset activities and benefit from the savings provision.

2026-10-21

FCA consultation CP26/36 opened and was published.

2026-11-18 Deadline

Deadline for responses to FCA consultation CP26/36.

2027-01-01

FCA aims to publish final perimeter guidance after considering consultation responses.

2027-02-28 Deadline

Application period closes for firms seeking to rely on the savings provision for newly regulated cryptoasset activities.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are scheduled to bring the new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Firms should map each proposed and existing cryptoasset activity against the statutory regulated activities in the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 and the proposed PERG guidance, documenting the factual basis for any exclusion relied upon.
• Technical-service providers should assess whether they merely provide access to a third-party service or decentralised protocol, or whether they also arrange, execute, safeguard, operate, control or otherwise provide a service to users; the use of automation or decentralised technology should not be treated as determinative.
• Stablecoin and payment businesses should identify the precise duration, purpose, parties and asset flows associated with temporary holding and backing-asset arrangements and test whether the relevant statutory conditions are met.
• Trading firms and market makers should distinguish genuine proprietary trading from activity performed as a service for another person and retain evidence supporting any reliance on the proprietary-trading or qualifying-cryptoasset-trading-platform market-maker exclusion.
• Firms should review safeguarding and settlement structures, including structures involving central securities depositaries and third-country central securities depositaries, for possible inclusion within the proposed exclusions or within regulated custody-related activities.
• Businesses that may need authorisation should consider submitting responses to CP26/36 by 18 November 2026 and should not defer application planning while the guidance remains in consultation.
• Existing UK cryptoasset businesses seeking to conduct newly regulated activities should consider submitting an otherwise complete application between 30 September 2026 and 28 February 2027 to preserve access to the applicable savings provision.
• Firms materially affected by uncertainty about the technical-services-provider exclusion should consider engaging the FCA through its pre-application support service and retaining evidence of how that uncertainty affected application preparation.

What changed

The FCA proposes guidance on exclusions from regulated cryptoasset activities introduced by the draft Cryptoassets (Miscellaneous Amendments) Regulations 2026. The examples include temporary settlement arrangements; temporary arrangements for holding UK qualifying stablecoins in connection with payment transactions; arrangements involving backing assets held in relation to a UK qualifying stablecoin; proprietary trading where the person is not providing a service to another person; proprietary trading by a market maker on a qualifying cryptoasset trading platform; and technical services that...

Key dates

2026-10-21

OCC publishes Bulletin 2026-52, revised PS-01 and PS-02 forms for public comment, and issues its GENIUS Act implementing final rule.

2027-01-18

The OCC final rule implementing the GENIUS Act and the GENIUS Act take effect, according to the OCC’s related final-rule materials.

2027-01-25 Deadline

First weekly PS-01 report date, subject to OMB approval of the information collection.

2027-03-31 Deadline

First quarterly PS-02 report date, subject to OMB approval of the information collection.

Suggested considerations

• Compliance teams at affected issuers should review the revised PS-01 and PS-02 workbooks and instructions and identify every required data element, reporting frequency, aggregation rule, and responsible control owner.
• Firms should consider submitting comments within 30 days after publication of the information-collection notice in the Federal Register, with particular attention to data availability, calculation methodology, confidentiality, reporting burden, and transition timing.
• Issuers should map daily issuance, redemption, reserve, ownership-concentration, and trading data to PS-01 and test whether systems can produce a complete weekly submission for the January 25, 2027 report date, subject to OMB approval.
• Issuers should assess whether finance and regulatory-reporting systems can produce PS-02 information on income, assets, liabilities, off-balance-sheet activities, and capital for the March 31, 2027 report date.
• Firms should establish governance for data certification, reconciliation to general-ledger and reserve records, exception management, senior review, and retention of supporting documentation for OCC examination.
• Issuers should assess the interaction between the reporting forms and the final rule’s reserve, redemption, risk-management, audit, capital, custody, and supervisory requirements, rather than treating the forms as an isolated reporting exercise.
• Foreign issuers should confirm their OCC registration status, reporting perimeter, U.S. activities, and allocation of information-production responsibilities between U.S. operations, parent entities, and service providers.

What changed

The OCC is reopening public comment on revised weekly Form PS-01 and quarterly Form PS-02 and their instructions. PS-01 requires daily data compiled and submitted weekly for each payment stablecoin, covering issuance, reserves, ownership concentration, and trading activity. PS-02 requires quarterly reporting on the issuer’s condition and income, including balance-sheet assets and liabilities, off-balance-sheet activities, income, and capital.

Key dates

2026-10-21

The OCC issued Bulletin 2026-51 and stated that applications and waiver requests will be accepted only after OMB approves the related information collection.

2027-01-18 Deadline

The GENIUS Act and OCC final rule become effective; the Prior Approval Requirement generally applies, and unauthorized issuance of a payment stablecoin in the United States may carry criminal penalties.

2028-01-18 Deadline

The maximum statutory period for a waiver beginning on January 18, 2027 expires, subject to the terms and shorter duration of any individual waiver.

Suggested considerations

• Firms should determine whether they are currently issuing a payment stablecoin in the United States and whether they fall within the OCC application pathway or another primary federal payment stablecoin regulator's pathway.
• Existing issuers should consider preparing and submitting a substantially complete OCC application as soon as the agency announces that applications are accepted, rather than relying on the waiver as a substitute for authorization.
• Applicants should map their submission against every prescribed application question and documentation requirement, including the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML, OFAC, third-party risk, enterprise risk, compliance risk, and audit functions.
• Compliance teams may wish to prepare a separate written waiver request addressing the Prior Approval Requirement, identifying any additional GENIUS Act or final-rule requirements that cannot be met by January 18, 2027, and explaining the requested duration and operational rationale.
• Issuers should monitor the OCC's GENIUS Act landing page and press releases for OMB approval and the opening of the application and waiver process, because the bulletin does not provide a fixed application-opening date.
• Firms should maintain evidence supporting the completeness and accuracy of their applications and establish a process to respond promptly to OCC requests for missing information within the 30-day review cycles.
• Prospective issuers that are not already operating in the United States should consider planning for operations to begin only after OCC approval, consistent with the agency's stated position on waiver eligibility.
• Regulatory change teams should continue tracking separate FinCEN, OFAC, OCC, and other agency rulemakings concerning AML, CFT, sanctions, and customer-identification requirements rather than assuming that an OCC application or Prior Approval Requirement waiver resolves those obligations.

What changed

Beginning January 18, 2027, a person generally must be approved as a permitted payment stablecoin issuer before issuing a payment stablecoin in the United States; unauthorized issuance may carry criminal penalties. Under GENIUS Act section 5(f) and 12 CFR 15.30(g), an issuer with a substantially complete OCC application pending on January 18, 2027 may request a written waiver of the Prior Approval Requirement and other statutory or final-rule requirements that it cannot satisfy by the effective date.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule and related application, waiver and reporting materials.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment stablecoin issuance generally requires permitted payment stablecoin issuer status, and a substantially complete application must be pending by this date to support eligibility for an OCC waiver request.

2027-01-25

Proposed first weekly OCC reporting date, subject to OMB approval of the information collection.

2027-03-31

Proposed first quarterly OCC reporting date, subject to OMB approval of the information collection.

Suggested considerations

• Firms seeking permitted payment stablecoin status should consider mapping their licensing strategy, corporate structure and applicable OCC pathway under 12 CFR part 15 before 2027-01-18.
• Existing U.S. issuers that need transitional relief should consider submitting a substantially complete OCC application on or before 2027-01-18 and preparing a written waiver request promptly after the OCC begins accepting applications and waiver requests.
• Applicants should consider documenting business plans, management, reserve assets, issuance and redemption processes, capital and liquidity, risk management, third-party and shared-services arrangements, audit functions and compliance governance in the application package.
• Issuers should consider validating reserve composition, one-to-one backing, liquidity, concentration, counterparty exposure, stress-testing and redemption controls against the final rule rather than relying on the proposal's reserve assumptions.
• Issuers should consider testing operational capacity to process redemptions within two business days and to notify the OCC within 24 hours when the 10% redemption-demand trigger is reached.
• Issuers and distribution partners should consider reviewing stablecoin rewards, yield, rebate and promotional arrangements on a transaction-by-transaction basis because pre-existing programs are not automatically grandfathered and the final rule provides no general safe harbor.
• Covered firms should consider establishing governance for audits, reporting, examination responses, custody controls, foreign-issuer oversight and potential approval revocation or rescission.
• Compliance teams should track the separate Treasury-coordinated BSA, AML and OFAC rulemaking and avoid treating this final rule as the complete GENIUS Act compliance framework.

What changed

The final rule applies to national banks and their subsidiaries, federal savings associations and their subsidiaries, federal branches and their subsidiaries, federal qualified payment stablecoin issuers, foreign payment stablecoin issuers, and state qualified payment stablecoin issuers over which the OCC has regulatory or enforcement authority.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule, application and waiver guidance, and revised proposed reporting forms.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment-stablecoin issuance generally requires permitted payment stablecoin issuer approval, and existing issuers seeking a waiver generally must have a pending substantially complete OCC application by this date.

2027-01-25 Deadline

Proposed effective report date for the weekly reporting form, subject to Office of Management and Budget approval.

2027-03-31 Deadline

Proposed effective report date for the quarterly reporting form, subject to Office of Management and Budget approval.

Suggested considerations

• Firms considering U.S. payment-stablecoin issuance should assess whether they qualify as a permitted payment stablecoin issuer, a federal qualified issuer, a state-qualified issuer subject to OCC authority, or a foreign issuer within the rule's scope.
• Existing U.S. issuers should consider preparing a substantially complete OCC application and evaluating whether a waiver request is needed by January 18, 2027; the OCC may grant waivers for up to 12 months beginning on that date, generally where an eligible application is pending.
• Applicants should prepare documentation covering the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML/OFAC controls, third-party risk, enterprise risk, compliance risk, and audit functions.
• Issuers should map reserve assets to the final rule's 1:1 backing, daily-liquidity, diversification, and counterparty-concentration requirements and establish controls capable of supporting generally timely redemption within two business days.
• Compliance and product teams should inventory interest, yield, cashback, loyalty, referral, and exchange rewards arrangements involving payment stablecoins and document the business purpose and consideration supporting each payment, because the OCC has not provided a categorical safe harbor and will apply the statutory prohibition case by case.
• Issuers should design weekly reserve and payment-stablecoin activity reporting and quarterly reports of condition and income, subject to confirming the final OMB-approved forms and effective reporting dates.
• Banks and other OCC-supervised custodians should review custody arrangements, segregation and control frameworks, third-party dependencies, and contractual allocation of responsibility for stablecoin and reserve-asset custody.
• Firms should track the separate Treasury, FinCEN, OFAC, Federal Reserve, and FDIC implementation work because the OCC final rule does not complete BSA, AML, or sanctions requirements and is only one component of the GENIUS Act framework.

What changed

New 12 CFR part 15 establishes requirements for permitted payment stablecoin issuers, foreign payment stablecoin issuers subject to OCC authority, certain state-qualified issuers, and specified custody activities conducted by OCC-supervised entities. The framework covers issuer activities, reserve assets, redemption, risk management, audits, reports, examinations, supervision, custody, applications and registrations, state-to-federal transitions, foreign-issuer supervision, approval revocation or rescission, and capital and operational backstops.

Key dates

2026-10-21

The French Treasury, AMF, Banque de France and ACPR published their joint response to the European Commission consultation on the MiCA review.

2026-09-30 Deadline

The European Commission consultation deadline identified in independent legal commentary; this date had passed before publication of the French authorities' response.

Suggested considerations

• Compliance teams may wish to maintain the existing MiCA control framework because this publication does not create an immediate amendment, authorisation requirement or prohibition.
• Firms should consider mapping each token, service and distribution channel against the definitions and perimeter provisions of MiCA, MiFID II and payment-services legislation, with particular attention to products that could require more than one authorisation.
• EU-authorised crypto-asset service providers should consider reviewing onboarding, asset-admission, execution, custody, trading and distribution controls for exposure to asset-referenced tokens or e-money tokens that may not satisfy MiCA requirements.
• Stablecoin issuers and groups using the same fungible token across EU and third-country markets should consider documenting issuance structures, reserve segregation, redemption rights, equivalence assumptions and supervisory-cooperation dependencies in anticipation of possible multi-issuance rules.
• Significant crypto-asset service providers and crypto-conglomerates should consider assessing governance, prudential, group-risk and supervisory-reporting readiness for a possible future shift of direct or enhanced oversight toward ESMA.
• Banks, payment firms and investment firms should consider assessing strategic opportunities and regulatory dependencies arising from euro-denominated e-money tokens and tokenised bank deposits without treating the French position as approval of any specific product.
• DeFi, staking and crypto-lending businesses should consider identifying responsible intermediaries, documenting due-diligence controls and preserving evidence of protocol governance and risk assessments pending any future EU framework.
• Industry participants may wish to monitor the Commission's MiCA review, subsequent legislative proposals, ESMA and EBA opinions, and national implementation developments before changing operating models.

What changed

No legal requirements changed on 2026-10-21. The French authorities proposed streamlining MiCA and clarifying when an activity falls under MiCA, the legislation governing financial instruments, or payment-services legislation, including where one business model could require multiple authorisations. They stated that a financial instrument should remain fully subject to the financial-instruments regime irrespective of the technology used for issuance or trading, and that the same principle should apply to payment instruments.

Key dates

2026-10-16

ESMA published Q&As 2949, 2950, 2936, 2937 and 2938.

2025-06-25

The EMIR 3 active account regime began applying to counterparties already within scope after the six-month implementation period.

Suggested considerations

• CASPs should consider mapping each client-funds flow against MiCA Article 70(2) and (3), documenting the end-of-next-business-day transfer control and verifying that any intermediary-held credit-institution account is specifically held for the CASP and technically segregated.
• CASPs and their payment-service-provider partners may wish to review contractual terms, account mandates, insolvency protections, reconciliation processes and evidence demonstrating clients’ ownership rights and prohibition of proprietary use.
• Crowdfunding providers using registration, membership or access fees should consider documenting why their model does or does not constitute a crowdfunding service under Regulation (EU) 2020/1503 and reviewing website disclosures, fee descriptions, client communications and investor-protection controls.
• AAR counterparties should recalculate the 12-month aggregate month-end average gross notional position, including the applicable group perimeter and excluding client-clearing activity, against the EUR 6 billion and EUR 100 billion thresholds.
• AAR counterparties relying on the 85% exemption should consider testing the one-half rule across the relevant derivative classes, retaining the underlying EU-CCP clearing data and avoiding any assumption that the exemption removes the representativeness requirement.
• Affected counterparties should review trade-level residual-maturity data, bucket allocation, annual-average trade counts and reporting calendars so that representative clearing can be demonstrated at the applicable reporting date.
• Compliance teams may wish to update policies, procedures, management information and regulatory inventories to distinguish ESMA Q&A interpretive expectations from directly binding Level 1 and Level 2 requirements.

What changed

For CASPs, ESMA clarifies that client funds may be temporarily held in an account with a non-bank payment service provider, such as a payment institution or electronic money institution, provided the funds are transferred to an account with a credit institution or central bank no later than the end of the business day following receipt.

Key dates

2026-09-30

The extended sector-wide no-action position associated with INFO 225 ended.

2026-11-27 Deadline

Deadline for submissions on ASIC Consultation Paper 392, at 5pm AEDT.

2027-04-08

The DAF Act and the new DAP and TCP framework are scheduled to commence.

2027-10-07 Deadline

The proposed transition deadline by which platforms already operating as DAPs or TCPs should apply for an AFS licence or variation.

Suggested considerations

• Firms should assess whether their products, custody arrangements and platform activities fall within the DAP or TCP definitions under the DAF Act and the proposed ASIC guidance.
• Affected operators should consider whether they need a new Australian financial services licence or a variation to an existing licence, including whether any streamlined process may apply.
• Compliance teams may wish to map current custody, segregation, asset-control, reconciliation, trading, settlement and incident-management processes against the proposed standards.
• Firms should assess the likely impact of the proposed net tangible asset and other financial requirements on capital planning, liquidity and licence documentation.
• Operators should review proposed customer disclosure documents and platform rules, including how digital-asset risks, custody arrangements, execution and settlement are explained to clients.
• Businesses affected by the framework should consider submitting comments to ASIC by 2026-11-27 and engaging with ASIC's consultation events or targeted roundtables.
• Firms should maintain evidence of their licensing analysis and transition planning, particularly because the sector-wide INFO 225 no-action position ended on 2026-09-30 and independent commentary indicates that existing licensing obligations apply outside the relief period.

What changed

CP 392 proposes implementation guidance for digital asset platforms (DAPs), which hold digital tokens for clients and provide associated platform services, and tokenised custody platforms (TCPs), which record underlying client assets as digital tokens. ASIC is proposing standards covering asset holding, trading and settlement activities, and financial requirements including net tangible asset requirements where relevant.

Key dates

2026-10-14

The EBA announced that USDC issued by Circle Internet Financial Europe SAS had been classified as a significant EMT under MiCA.

2026-11-12 Deadline

Dual supervision of USDC begins: the EBA assumes direct responsibility for own funds, reserve of assets, liquidity requirements, and recovery and redemption plans, while the ACPR retains specified governance and organisational responsibilities.

Suggested considerations

• Circle and its regulatory counsel should map existing own-funds, reserve-of-assets, liquidity, recovery, and redemption controls to the EBA’s supervisory expectations and establish clear evidence and reporting channels before 2026-11-12.
• Circle should confirm the allocation of responsibilities between the EBA and ACPR, including supervisory contacts, escalation procedures, information requests, and documentation ownership for prudential and organisational matters.
• Crypto-asset service providers should reassess their USDC due diligence, product governance, liquidity, redemption, custody, safeguarding, and operational-risk controls in light of the significant-EMT designation.
• Firms using USDC should identify exposures in client assets, settlement, treasury, collateral, and payment flows and assess whether updated counterparty, liquidity, concentration, and business-continuity assessments are appropriate.
• Compliance teams should monitor EBA and ACPR communications, supervisory-college activity, and any subsequent guidance or requests concerning significant EMT reporting and recovery or redemption planning.
• Firms operating across the EU and United States should review information-sharing, incident-notification, and cross-border supervisory arrangements, noting the EBA’s memorandum of understanding with the New York State Department of Financial Services.

What changed

USDC will be subject to the MiCA framework for significant EMTs from 2026-11-12. The EBA will assume direct supervisory responsibility for own-funds requirements, the reserve of assets, liquidity requirements, and recovery and redemption plans; the ACPR will continue supervising governance, qualifying holdings, fit and proper assessments, outsourcing, and conflicts of interest. Under MiCA Articles 56 and 43(1), an EMT is classified as significant where at least three significance criteria are met during the applicable reporting periods.

Key dates

2026-10-14

The CFPB announced the debanking investigation and enforcement initiative; the OCC released its report on the nine largest national banks on the same date.

Suggested considerations

• Compliance teams may wish to inventory account closures, service restrictions, onboarding denials, credit denials, and material service-friction decisions since 2020, with particular attention to political or religious affiliations and lawful activities in firearms, oil and gas, coal, tobacco, digital assets, and other sectors identified by the OCC.
• Firms should consider testing whether customer-facing reasons for adverse decisions accurately and specifically reflect the documented internal rationale, including compliance with ECOA and Regulation B adverse-action notice requirements and applicable FCRA adverse-action notice requirements.
• Institutions may wish to review reputation-risk policies, sector restrictions, escalation criteria, committee materials, employee guidance, and risk taxonomies to confirm that decisions are based on objective, individualized, documented, and legally supportable risk considerations rather than generalized political, social, or reputational preferences.
• Compliance teams should consider preserving relevant complaints, account-review records, escalation communications, decision logs, adverse-action notices, and policy versions in anticipation of CFPB information requests or supervisory examination.
• Banks and covered nonbanks may wish to compare complaint-portal submissions and internal complaint data against account-closure and service-denial populations to identify unexplained patterns, inconsistent reasons, or failures to provide required notices.
• Firms should consider assessing whether deposit-account and payment-service decisions create potential UDAAP exposure even where ECOA or FCRA does not directly apply, while continuing to apply legitimate safety, soundness, sanctions, fraud, AML, credit, and operational-risk controls.
• Senior compliance and legal personnel may wish to establish governance for politically sensitive or sector-based account decisions so that risk-based controls are not removed indiscriminately and exceptions are documented, consistently applied, and subject to appropriate review.

What changed

The CFPB did not issue a new regulation or impose a new compliance deadline. It announced a supervisory and enforcement initiative implementing Executive Order 14331 and responding to the OCC's report covering conduct identified between 2020 and September 2025. The CFPB stated that it will investigate potential violations of the Equal Credit Opportunity Act, including Regulation B adverse-action requirements, the Fair Credit Reporting Act adverse-action requirements, and the prohibition on unfair, deceptive, or abusive acts or practices under the Consumer Financial Protection Act.

Key dates

2026-10-08

Federal Reserve and OCC announced coordinated enforcement actions; the OCC imposed a $350 million civil money penalty on American Express National Bank and issued a cease-and-desist order. The Federal Reserve action applied to American Express Company and American Express Travel Related Services Company, Inc.

2027-01-06 Deadline

Approximate deadline for American Express National Bank to submit the OCC-required written Action Plan within 90 days of the October 8, 2026 order, subject to the order's day-counting conventions.

Suggested considerations

• Compliance teams may wish to reassess whether the institution's BSA/AML risk assessment adequately covers its largest and most economically significant products, customer segments, transaction channels, and trade-related activity.
• Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and transaction-monitoring scenarios are appropriately calibrated to credit-card, charge-card, merchant, cross-border, and trade-based money-laundering risks.
• Management may wish to inventory staffing, subject-matter expertise, escalation capacity, data quality, model and rules governance, internal controls, independent testing, and BSA/AML training for employees and directors against the deficiencies identified in the coordinated orders.
• Compliance teams may wish to conduct a lookback of previously generated alerts and transactions to assess whether suspicious activity was timely investigated, escalated, documented, and reported through SARs, including whether systemic monitoring gaps affected historical activity.
• Boards and senior management should consider obtaining documented evidence that enterprise AML oversight is operating effectively at subsidiaries and that parent-level governance does not rely solely on narrow subsidiary or product risk assessments.
• Affected American Express entities should track the 90-day Action Plan submission requirement and prepare supporting remediation evidence, governance reporting, milestone tracking, and supervisory communications.
• Other regulated firms should consider treating the action as a supervisory signal that risk assessments, transaction monitoring, and SAR controls must be aligned to actual business volume and risk rather than to the products that are easiest to administer.

What changed

This is an enforcement action rather than a generally applicable new rule, but it establishes concrete remediation expectations for a large, complex card issuer. The coordinated OCC order requires American Express National Bank to submit, within 90 days of the October 8, 2026 order, an acceptable written Action Plan addressing all BSA/AML deficiencies and incorporating the order's substantive requirements; the OCC must provide prior written supervisory non-objection.

Key dates

2026-10-08

ESMA published its opinion on the provision of crypto-asset services in relation to non-MiCA-compliant asset-referenced tokens and e-money tokens.

2027-01-08 Deadline

Latest date by which National Competent Authorities should require remediation of remaining pre-existing exposures, calculated as three months after publication; firms may be required to act earlier.

Suggested considerations

• Firms should inventory every ART and EMT made available to EU clients and classify whether each token satisfies the applicable MiCA requirements, including any relevant authorisation, notification, offer, and admission-to-trading conditions.
• Compliance teams may wish to map each affected token across trading, exchange, execution, placing, order-routing, advice, transfer, custody, and portfolio-management workflows, including bundled or indirect services.
• Firms should consider suspending onboarding, purchases, subscriptions, trading, swaps, staking-related access where relevant, and other activities that could allow EU clients to acquire or increase exposure to a non-MiCA-compliant token.
• Technology and operations teams should assess geolocation, account, wallet, order-management, token-listing, transfer, and API controls, with testing and monitoring designed to prevent EU-client access or increased exposure.
• Legal and product teams should review client terms, token-listing policies, disclosures, contractual restrictions, and arrangements with issuers, liquidity providers, exchanges, and other intermediaries.
• Firms should identify pre-existing client exposures and prepare a documented wind-down or remediation plan capable of completion by 2027-01-08, subject to any earlier NCA requirement.
• Firms may wish to define narrowly controlled exit-only services for liquidation, conversion, withdrawal, transfer, and safekeeping, with time limits, risk controls, client communications, records, and escalation to the relevant NCA.
• Governance functions should document the interpretation of the ESMA opinion, approvals for affected product changes, control ownership, exceptions, surveillance, management information, and evidence available for supervisory review.

What changed

The opinion covers the full range of MiCA crypto-asset services, including operating trading platforms, exchanging crypto-assets for funds or other crypto-assets, executing orders, placing crypto-assets, reception and transmission of orders, investment advice, transfers, custody and administration, and portfolio management. ESMA expects National Competent Authorities to supervise so that CASPs do not maintain, introduce, or facilitate EU-client access to non-MiCA-compliant ARTs or EMTs.

Key dates

2026-10-08

FINMA published the final partial revision of Circular 2016/7.

2026-11-01 Deadline

The revised Circular 2016/7 enters into force and the new supervisory expectations for digital onboarding apply.

2027-11-01 Deadline

Market commentary reports a transitional deadline for firms using qualified electronic signatures to add liveness detection and residence verification.

Suggested considerations

• Compliance teams should map each digital onboarding journey to the revised Circular 2016/7 method requirements, distinguishing video identification, online identification, Swiss e-ID and qualified electronic-signature workflows.
• Firms should assess whether their liveness-detection controls reliably establish that the applicant is a physically present living person and can resist photographs, replayed video, deepfakes and other AI-enabled manipulation.
• Firms should review identity-document validation rules and testing so that approved QR-code documents, including the Swiss driving licence, are handled on an equivalent basis to documents with an MRZ where the circular permits this.
• Firms should validate digital residence-verification processes, including whether the process reliably links the contracting party and the relevant device or infrastructure to the declared place of residence.
• Firms planning to use the Swiss e-ID should confirm technical readiness, evidence retention and treatment of the e-ID's non-copyable, non-archivable characteristics, while avoiding use of the e-ID for workflows limited to video identification.
• Firms should update AML, fraud-risk and onboarding policies, vendor requirements, testing scripts, staff procedures and customer disclosures before the effective date.
• Compliance teams may wish to reassess whether supplementary controls are warranted for higher-risk channels, such as device intelligence, fraud databases, transfer-account verification, duplicate-account detection or enhanced review, because FINMA's circular does not eliminate risk-based control expectations.
• Firms using qualified electronic signatures should confirm any transitional implementation requirements identified in the final circular and related commentary, including the reported 1 November 2027 date for adding liveness and residence verification to that route.

What changed

The Swiss e-ID may be used as an identification method when onboarding clients through digital channels under the Anti-Money Laundering Act, although market commentary indicates that it is available for online identification rather than video identification. Official identification documents bearing a QR code are treated as equivalent to documents containing a machine-readable zone, expanding the acceptable document formats for digital onboarding.

Key dates

2026-02-09

AMLA opened the public consultation on the draft RTS concerning business relationships, occasional and linked transactions, lower thresholds, and customer due diligence.

2026-04-16

AMLA opened the public consultation on the draft RTS concerning group-wide requirements and additional measures for subsidiaries and branches in third countries.

2026-05-08

Public consultation closed for the business-relationship, transaction and customer-due-diligence draft RTS.

2026-06-15

Public consultation closed for the group-wide arrangements and third-country legal-impediment draft RTS.

2026-10-01

AMLA announced that it had finalised the three draft RTS and submitted them to the European Commission for formal adoption.

2026-10-07

CSSF published its communiqué drawing Luxembourg professionals’ attention to the draft RTS and recommending preparatory gap analysis and control work.

Suggested considerations

• Compliance teams may wish to complete a gap analysis against the AMLA final reports, particularly for customer and beneficial-owner information, verification sources, electronic identification, non-face-to-face onboarding and PEP screening.
• Firms should consider mapping current customer journeys and transaction-monitoring logic to the proposed distinction between business relationships, occasional transactions and linked transactions.
• Firms may wish to identify products, sectors and transaction types that could be affected by lower CDD thresholds for higher-risk activities, while avoiding reliance on unfinalised monetary thresholds.
• Financial groups should consider reviewing group-wide AML/CFT governance, risk assessments, policies, internal controls, training and secure information-sharing arrangements, including structures involving common ownership, management, compliance control, networks or partnerships.
• Groups with branches or subsidiaries in third countries should consider inventorying legal impediments to applying EU AMLR and group policies and preparing escalation, risk-mitigation and supervisory-response procedures.
• IT and operations teams may wish to assess changes needed for customer-data fields, linked-transaction detection, identity-verification evidence, electronic identification and intra-group information exchange.
• Firms should monitor the European Commission’s adoption process and the Official Journal publication because the final text, effective date and any amendments remain unknown; preparatory work should be calibrated to the proposed six-month transition period rather than treated as a current binding deadline.

What changed

The draft RTS under Article 19(9) of Regulation (EU) 2024/1624 would establish criteria for distinguishing business relationships, occasional transactions and linked transactions, and would identify high-risk obliged entities, sectors or transactions for which lower CDD thresholds should apply. The draft RTS under Article 28(1) would specify information and verification requirements for standard, simplified and enhanced CDD, including reliable and independent verification sources, electronic identification means, qualified trust services, non-face-to-face verification, and relevant treatment...

Key dates

2020-12-23

FinCEN published the NPRM at 85 FR 83840 proposing additional reporting, recordkeeping, and identity-verification requirements for certain transactions involving unhosted or otherwise covered wallets.

2026-10-06

FinCEN withdrew the NPRM and stated that it would take no further action on that rulemaking.

Suggested considerations

• Compliance teams may wish to remove implementation workstreams, testing scenarios, and policy language that were created solely for the withdrawn NPRM's proposed $3,000 recordkeeping or $10,000 reporting thresholds.
• Firms should consider documenting that the NPRM was never effective and that its withdrawal does not eliminate existing obligations under the Bank Secrecy Act or applicable implementing regulations in 31 CFR parts 1010, 1020, and 1022.
• Banks and MSBs may wish to reassess whether current controls for transfers involving unhosted wallets remain risk-based and supported by documented AML risk assessments, rather than treating the withdrawn proposal's thresholds as mandatory rules.
• Crypto businesses should continue reviewing applicable customer-identification, customer-due-diligence, suspicious-activity-reporting, recordkeeping, transaction-monitoring, and OFAC sanctions requirements independently of this withdrawal.
• Regulatory-monitoring teams may wish to track whether FinCEN or Treasury develops a replacement digital-asset framework, particularly in light of the stated policy objective that digital-asset regulation be fit for purpose.

What changed

FinCEN withdrew the NPRM published at 85 FR 83840 and stated that it will take no further action on that rulemaking. The withdrawn proposal would have required banks and money services businesses to file reports when a transaction involving an unhosted or otherwise covered wallet exceeded $10,000, or multiple such transactions exceeded $10,000 in 24 hours. It also would have required records, counterparty information, and customer identity verification for covered transactions exceeding $3,000.

Key dates

2023-10-23

FinCEN published the proposed section 311 finding and special measure concerning international CVC mixing at 88 FR 72701.

2026-10-06

FinCEN's withdrawal of the finding and proposed rulemaking became effective upon Federal Register publication at 91 FR 63513.

Suggested considerations

• Compliance teams should discontinue implementation work that was undertaken solely for the withdrawn section 311 CVC-mixing proposal, including plans for the proposal-specific data fields, reporting workflows, and enhanced customer records.
• Firms should not interpret the withdrawal as authorization to process illicit mixer activity without controls; they should continue applying existing risk-based AML, sanctions, transaction-monitoring, escalation, and suspicious activity reporting procedures.
• Crypto exchanges and other covered institutions should review whether current transaction-monitoring scenarios appropriately identify mixer exposure and other indicators of money laundering or terrorist financing under existing requirements, without treating all privacy-preserving activity as inherently suspicious.
• Firms may wish to document the withdrawal in their regulatory inventory, rulemaking-impact assessments, and model or procedure change logs, while preserving controls that address independently applicable BSA or sanctions requirements.
• Compliance teams should monitor future FinCEN notices, section 311 actions, enforcement activity, and interpretive guidance because FinCEN expressly reserved the possibility of future measures concerning mixers.
• Legal and compliance functions should reassess any customer, product, or transaction restrictions adopted specifically in anticipation of the proposed rule and determine whether they remain justified by the firm's risk assessment, other legal requirements, or contractual obligations.

What changed

FinCEN withdrew the proposed rule published at 88 FR 72701 and the underlying section 311 finding concerning international CVC mixing. The proposed special measure one regime would have required covered financial institutions to report specified information for transactions they knew, suspected, or had reason to suspect involved international CVC mixing, including CVC type and amount, mixer and wallet information, transaction hashes, transaction dates, IP addresses, customer-identifying information, and a narrative description.

Key dates

2023-01-01

The Economic Crime and Corporate Transparency Act 2023 received Royal Assent during 2023; its voluntary information-sharing provisions are identified by the FCA as a potential mechanism for firms to share information concerning economic crime. The specific commencement date for any relevant provision should be verified against the applicable commencement instruments.

2025-01-01

Cifas introduced a dedicated funds received for money muling filing category and revised filing criteria and guidance, making 2025 filing data not directly comparable with 2023 and 2024. The date is stated as January 2025 rather than a specific day.

2026-09-23

The FCA published its multi-firm review on money-mule activity and cashing out findings.

Suggested considerations

• Firms should consider refreshing their business-wide and customer-risk assessments to reflect mule-chain activity, including the concentration of cashing out between the second and fifth accounts and the higher concentration at the second account.
• Compliance and fraud teams may wish to test whether transaction-monitoring scenarios identify linked accounts, repeated use of accounts across fraud types, rapid onward transfers, fragmented card spending, international destinations and higher-value crypto-related cash-outs.
• Firms should consider reviewing controls across the full payment chain rather than focusing only on the first account receiving suspected fraud proceeds, including internal account link analysis and escalation between fraud, AML and investigations teams.
• Banks, payment institutions and EMIs may wish to compare detection and response performance by account tenure, customer type and channel, noting that 74.1% of EMI closures and 56.9% of PI closures in the survey occurred within six months of account opening.
• Firms should consider assessing whether their use of the National Fraud Database is effective and whether suspected cases meet the applicable Cifas evidential and category criteria; the FCA data should not be interpreted as requiring Cifas filings to equal account closures.
• Firms should consider whether the Economic Crime and Corporate Transparency Act 2023 information-sharing provisions can lawfully support prevention, detection or investigation of linked mule activity, with appropriate governance, records and data-protection controls.
• MLROs and nominated officers may wish to prepare for the further FCA and National Economic Crime Centre alert and retain evidence showing how the review findings were considered and, where appropriate, incorporated into control enhancements.

What changed

The FCA has provided new supervisory findings on the scale, profile and mechanics of money-mule activity based on a survey of 35 firms and analysis by a 22-firm public-private cell covering 140 cases across seven fraud types. It expects firms to use the findings in their own money-mule risk assessments and to review and strengthen controls for detecting, preventing and disrupting mule activity.

Key dates

2026-09-17

The FCA published its findings on payments firms delivering good outcomes for consumers in vulnerable circumstances.

Suggested considerations

• Compliance teams may wish to map the four vulnerability drivers in FG21/1 against the firm’s customer base, products, channels and transaction journeys, including digital-only and automated interactions.
• Firms should consider testing whether vulnerability identification, recording, flagging and information-sharing operate consistently in practice through call listening, complaints analysis, quality assurance, customer research and sample-based file reviews.
• Firms may wish to document how identified needs translate into specific support, such as alternative channels, assisted onboarding, additional time, accessible communications, language support or human intervention, and how those interventions produce good outcomes.
• Management information may need to cover the prevalence and characteristics of vulnerability, support provided, customer outcomes, complaints, failed or delayed payments, access barriers, vulnerable-customer journey performance and trends over time; smaller firms may use proportionate qualitative evidence but should still demonstrate effective oversight.
• Boards and senior management may wish to receive sufficiently frequent reporting to challenge whether arrangements are working, investigate root causes and track whether remedial actions improve outcomes rather than relying solely on annual Consumer Duty reporting or isolated case studies.
• Firms using intermediaries should consider how they assess the intermediary’s identification, training, support, communications, recording and outcomes-monitoring arrangements, and how issues are escalated and remediated.
• When collecting or sharing vulnerability information, firms should consider compliance with UK GDPR, the Data Protection Act 2018 and applicable confidentiality and data-minimisation requirements.
• Smaller firms may wish to record why their systems, controls and management information are proportionate to their business model, customer base and potential harm, while retaining evidence that individual circumstances can be addressed flexibly.

What changed

No new binding requirements or prescribed operating model were introduced. The FCA has nevertheless clarified the evidence it expects firms to maintain under the existing Consumer Duty and its vulnerable-customer guidance, including an understanding of the four vulnerability drivers—health, life events, financial resilience and financial capability—identification and recording across customer journeys, appropriate support and communications, outcome-focused management information, senior-management or board oversight, testing and assurance, intermediary oversight, and continuous improvement.

Key dates

2026-09-16

The FCA published PS26/18 and its final cryptoasset perimeter guidance.

2026-09-30

The application window opened for firms seeking to use the transitional arrangements.

2027-02-28 Deadline

The application window closes for firms wishing to use the transitional arrangements.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 introduce the new regulated cryptoasset activities into the FCA perimeter.

Suggested considerations

• Firms should map each current and planned cryptoasset service against the PERG 18 regulated-activity analysis, including whether the activity is conducted in the UK and by way of business.
• Firms registered under the Money Laundering Regulations should assess separately whether FCA authorisation or a variation of permission is required, because existing registration does not convert automatically into authorisation.
• Existing FCA-authorised firms should review their permissions and consider whether a variation of permission will be needed for cryptoasset activities.
• Firms intending to rely on transitional or savings arrangements should assess eligibility and submit an application within the 30 September 2026 to 28 February 2027 application window.
• Compliance teams may wish to inventory custodial wallets, trading venues, brokerage and arranging models, staking services, stablecoin issuance, lending products, market-making and technology or infrastructure services.
• Firms should review UK territoriality, customer location, solicitation, marketing and operating-model assumptions, particularly for overseas businesses serving UK consumers.
• Firms should monitor the FCA's further consultation on amendments to the perimeter guidance and reassess their analysis when the underlying regulations and final amended guidance change.
• Applicants should prepare governance, business-model, financial, operational, safeguarding, systems and controls material expected for authorisation and may wish to obtain independent legal and compliance advice.

What changed

The FCA has finalised new PERG 18 guidance on determining whether a cryptoasset activity is regulated, whether it is carried on in the UK, whether it is carried on by way of business, and whether an exemption or transitional provision applies. The perimeter covers activities such as issuing qualifying stablecoins, operating cryptoasset trading platforms, dealing in or arranging deals in cryptoassets, safeguarding cryptoassets and arranging cryptoasset staking.

Key dates

2026-08-27

The Bank of England announced deferral of the entire November 2026 RTGS standards release, including CHAPS messaging standards; Swift announced the corresponding Standards Release delay on the same date.

2026-12-31

Swift has indicated that it will provide an update on the optimal timing and approach for the structured-address change by December 2026 at the latest; this is an expected communications milestone, not a confirmed implementation deadline.

Suggested considerations

• Firms should update regulatory-change inventories and project plans to record that the November 2026 RTGS and CHAPS standards release has been deferred, without assuming that the change has been cancelled.
• CHAPS and RTGS participants should obtain the BoE’s revised implementation timetable and monitor the BoE ISO 20022 implementation page, participant communications and Swift governance updates, including the expected update by December 2026 at the latest.
• Compliance and payments teams may wish to preserve completed analysis and technical preparations for structured or hybrid postal addresses, while reassessing sequencing, testing windows, release dependencies and vendor delivery dates against the revised timetable.
• Firms should distinguish the deferred BoE/CHAPS release from any other payment-system or bilateral requirements that may continue on their original schedules, and should confirm the treatment of address validation, message rejection, exception handling and operational support with relevant counterparties and vendors.
• Technology and operations teams should maintain regression-test environments and data-quality remediation plans so that implementation can resume without restarting discovery or delaying future mandatory testing.
• Firms using both CHAPS/RTGS and Swift CBPR+ should assess whether the coordinated deferral changes their customer communications, correspondent-bank testing, operational-resilience scenarios, payment-routing controls and incident-management assumptions.
• Governance committees may wish to record the deferral as a schedule and dependency change rather than as a reduction in scope, because the BoE states that the November release is deferred in its entirety and provides no indication that the underlying standards work is withdrawn.

What changed

The November 2026 RTGS standards release will not proceed as originally planned and has been deferred in its entirety rather than being split into separate changes. This includes the RTGS messaging standards applicable to CHAPS payments. The decision maintains alignment with Swift’s deferred CBPR+ release and means that the previously expected 2026-11-14 removal of fully unstructured postal addresses should not be treated as the operative BoE/Swift implementation date; Swift has indicated that it will consult market participants and provide an update by December 2026 at the latest.

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying [email protected] by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.

Key dates

2025-01-17

DORA began applying to in-scope financial entities supervised by the CSSF.

2025-12-17

The European Commission confirmed through DORA Q&A 102 that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF’s extended best-efforts deadline for the first register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2026-08-27

Circular CSSF 26/915 was published and took effect immediately; the listed CSSF circulars were amended to include or remove qualifying third-country branches as applicable.

2027-03-31 Deadline

Target date identified by CSSF for the required-quality register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2027-01-11

Relevant CRD VI third-country-branch provisions are scheduled to take effect, subject to national transposition and applicable transitional rules.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the counterfactual test in Circular 26/915: whether the head-office undertaking would qualify under Article 2(1)(a) to (t) of DORA if established in the relevant third country.
• Affected branches should update their regulatory-perimeter inventories, governance documents, ICT-risk policies, outsourcing inventories, incident-classification procedures and DORA control testing to reflect immediate inclusion in the DORA-specific CSSF circulars.
• Compliance teams may wish to separate non-ICT outsourcing, which remains subject to Part I of Circular CSSF 22/806, from ICT outsourcing, which is governed by DORA and Circular CSSF 25/882 rather than the legacy Part II framework.
• Affected entities should validate their register-of-information process under DORA and Circular CSSF 25/882, including branch-level data, ICT third-party contracts, intra-group arrangements and submission ownership. The 30 June 2026 best-efforts deadline for third-country branches of credit institutions has passed, and firms should prepare for the 31 March 2027 collection and any CSSF remediation requests.
• Incident-response teams should test access to the CSSF eDesk procedure and S3 API and document an escalation process for emailing [email protected] when technical impossibility prevents electronic submission.
• Firms should assess whether they qualify for the microenterprise exclusion in Circular CSSF 25/892; the exclusion applies to entities employing fewer than 10 persons with annual turnover and/or annual balance-sheet total not exceeding EUR 2 million, subject to the DORA definition and exclusions for specified market infrastructures.
• Third-country banking groups should coordinate DORA implementation with the CRD VI third-country-branch analysis, including the 11 January 2027 effective date for relevant CRD VI provisions, rather than assuming that the two regimes have identical scope or timing.

What changed

Qualifying third-country branches are added to the scope of Circulars CSSF 25/882, 25/892 and 25/893, covering DORA ICT third-party-service information and reporting, estimation of aggregated annual costs and losses from major ICT-related incidents under Article 11(11) of DORA and the Joint ESA Guidelines JC/GL/2024/34, and reporting of major ICT-related incidents and significant cyber threats.

Key dates

2025-01-17

DORA became applicable to financial entities within its scope, subject to the specific DORA provisions and technical standards applicable to each entity.

2025-04-09

Circular CSSF 25/881 was published and took effect, removing DORA financial entities from Circular 20/750 and retaining 20/750 for entities outside DORA; PSP-specific provisions were reorganised under Circular 25/880.

2026-06-30 Deadline

CSSF extended the first Register of Information submission for Luxembourg branches of third-country credit institutions to this date on a best-efforts basis; the CSSF indicated that the required level of quality should be achieved for the 2027 submission.

2026-08-27

Circular CSSF 26/915 was published, confirming the DORA treatment of qualifying third-country branches and removing them from the full scope of Circular 20/750 and related overlapping circular provisions.

2027-03-31 Deadline

Target date identified by the CSSF for the required-quality Register of Information submission by Luxembourg branches of third-country credit institutions.

Suggested considerations

• Firms should classify each Luxembourg entity and branch against DORA Article 2 and the amended scope of Circular 20/750, including an assessment of whether a third-country head office would qualify under DORA Article 2(1)(a) to (t).
• Compliance teams may wish to determine whether the entity should operate under DORA rather than 20/750, and document the rationale, legal-entity perimeter and treatment of any Luxembourg branch.
• Firms remaining within Circular 20/750 should consider reviewing their ICT and security-risk-management framework, governance approvals, risk assessments, incident processes, business-continuity arrangements and control testing against the continuing requirements.
• Payment service providers should consider replacing references to the PSP provisions formerly contained in Circular 20/750 with the applicable requirements in Circular CSSF 25/880 and EBA/GL/2025/02.
• Third-country branches treated as DORA entities should consider validating their DORA governance, ICT-risk framework, incident-reporting arrangements, ICT contractual inventory and Register of Information processes, taking account of CSSF reporting communications.
• Firms should update policies, regulatory inventories, outsourcing and ICT-third-party registers, training materials and regulatory mapping to distinguish DORA obligations from the residual Circular 20/750 obligations.
• Compliance teams may wish to retain evidence of the scope assessment and implementation date, because the 2025 amendment was effective immediately and the 2026 amendment changes the treatment of a previously identified 20/750 population.

What changed

Circular 25/881 provides that DORA financial entities supervised by the CSSF no longer fall within Circular 20/750; for entities covered by 20/750 but outside DORA, the circular continues to apply in full. Payment-service-provider-specific ICT and security-risk provisions were removed from 20/750 and regrouped in Circular CSSF 25/880, reflecting the revised EBA Guidelines on ICT and security risk management for payment service providers, including EBA/GL/2025/02.

Key dates

2025-01-17

DORA began applying to financial entities within its scope, subject to the relevant provisions and transitional arrangements.

2025-04-09

Circular CSSF 25/883 was published and applied with immediate effect, amending Circular CSSF 22/806 and introducing the DORA-based division between ICT and business-process outsourcing.

2025-12-17

The European Commission confirmed through a DORA Q&A that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF-extended submission date for the 2026 DORA register of information for third-country branches of credit institutions headquartered in a third country; entities were invited to submit on a best-efforts basis.

2026-08-27

Circular CSSF 26/915 was published and applied with immediate effect, confirming the DORA treatment of qualifying Luxembourg third-country branches and updating Circular CSSF 22/806 accordingly.

2027-03-31 Deadline

Target CSSF submission deadline for the DORA register of information for affected third-country branches following the initial 2026 collection.

Suggested considerations

• Firms should classify each outsourcing arrangement as ICT or non-ICT and determine whether the entity and arrangement fall within DORA, Circular 22/806, or both regimes in their respective areas of application.
• DORA entities should consider moving ICT arrangements from their Circular 22/806 outsourcing inventory and controls into the DORA ICT third-party register, while retaining Circular 22/806 controls for business-process outsourcing.
• Non-DORA entities should consider continuing to apply the full Circular 22/806 framework to ICT and business-process outsourcing, including due diligence, governance, critical-or-important assessments, monitoring, sub-outsourcing and exit planning.
• Third-country branches should assess whether their head office would qualify under Article 2(1)(a) to (t) of DORA and, if so, align ICT governance, contractual arrangements, registers and reporting with DORA rather than relying solely on Circular 22/806.
• Compliance teams may wish to review cloud contracts and avoid carrying forward legacy EEA governing-law or hosting clauses where DORA now provides the applicable framework, while preserving enforceable audit, access, cooperation, security, business-continuity and exit rights.
• Firms should use the revised CSSF notification form for new critical or important ICT outsourcing arrangements and preserve evidence supporting the three-month notification period, or the one-month period for arrangements involving a support PSF.
• Firms should consider validating that existing ICT outsourcing notifications remain complete under the applicable DORA register-of-information requirements, even though Circular 25/883 does not require their re-submission.
• Affected third-country branches should consider submitting and maintaining the DORA register of information through the CSSF process, with the 2027 collection requiring data quality suitable for the 31 March 2027 submission deadline.

What changed

From 9 April 2025, DORA entities generally no longer apply the ICT-outsourcing provisions of Circular CSSF 22/806 to ICT arrangements; those arrangements are governed by DORA, including its ICT third-party risk-management, contractual, register-of-information and oversight requirements, together with Circular CSSF 25/882. Circular 22/806 continues to apply to business-process outsourcing by DORA entities, and continues to apply in full to non-DORA entities, including their ICT outsourcing. Chapter 16 management companies remain subject to Circular 22/806 for ICT outsourcing.

Key dates

2025-05-19

The Joint ESA Guidelines JC/GL/2024/34 apply at ESA level.

2025-05-31

Circular CSSF 25/892 applies to its original in-scope Luxembourg entities, excluding DORA microenterprises.

2026-08-27

Circular CSSF 26/915 is issued and applies with immediate effect, bringing qualifying Luxembourg third-country branches into the scope of Circular CSSF 25/892.

Suggested considerations

• Compliance teams may wish to determine whether each Luxembourg entity or third-country branch falls within the amended scope, including whether a third-country head-office undertaking would qualify under DORA Article 2(1)(a) to (t).
• Firms should consider documenting their microenterprise analysis against DORA Article 3(60), including the fewer-than-10-employees and EUR 2 million annual turnover and/or balance-sheet-total thresholds, while noting that the DORA definition excludes trading venues, central counterparties, trade repositories and central securities depositories from the microenterprise exemption.
• Firms should consider maintaining an incident-level ledger linking major ICT-related incidents, DORA final-report reference codes, gross costs, losses, provisions, recoveries and subsequent adjustments.
• Finance, operational-risk and ICT-incident teams may wish to agree whether the firm will use a completed calendar year or completed accounting year as its reference basis and establish controls to apply that basis consistently.
• Firms should consider reconciling estimates to financial-statement or supervisory-reporting data where available, while retaining documented estimation methodology and assumptions where accurate data is unavailable.
• Firms should consider tracking quantifiable financial impacts from prior-year major incidents because those impacts may need to be included in a later reference year without reopening the original final incident report.
• Third-country branches may wish to confirm reporting ownership and data availability with their head office, because the amended CSSF scope is at branch level but the required cost and loss information may arise across the undertaking.
• Compliance teams may wish to monitor CSSF communications for a specific request, reporting channel and submission deadline; the circular itself establishes an upon-request obligation rather than a fixed automatic annual filing deadline.

What changed

From 2025-05-31, in-scope Luxembourg financial entities other than DORA microenterprises must be able, upon CSSF request, to provide an entity-level estimate of aggregated annual costs and losses arising from major ICT-related incidents. The estimate must use the ESA common template and identify each relevant incident by the same reference code used in its DORA final incident report.

Key dates

2025-01-17

DORA provisions became applicable to financial entities in scope and supervised by the CSSF.

2025-05-28

Circular CSSF 25/893 was published and established the Luxembourg DORA incident and significant cyber-threat reporting modalities.

2025-11-28 Deadline

End of the six-month transition period granted to payment service providers outside DORA for implementation of the Circular 25/893 framework.

2026-08-27

Circular CSSF 26/915 was published and the 25/893 page was updated to clarify DORA applicability to qualifying third-country branches in Luxembourg; the amendment applies immediately.

Suggested considerations

• Compliance teams may wish to confirm the entity-by-entity scope analysis against DORA Article 2, including whether a Luxembourg third-country branch is covered following the 27 August 2026 clarification.
• Firms should consider documenting incident-classification criteria and decision records against Commission Delegated Regulation (EU) 2024/1772, including the quantitative thresholds for clients, transactions, duration, geographical spread, data loss, economic impact and reputational impact.
• Firms should consider testing an escalation timetable that supports classification, initial notification within four hours and no later than 24 hours after awareness, the 72-hour intermediate report and the one-month final report.
• PSPs outside DORA may wish to update policies so that all ICT-related incidents, rather than only payment-service incidents, are assessed under the DORA framework and to verify that the six-month transition requirements were completed by 28 November 2025.
• Firms should consider ensuring that eDesk access, authorised users, templates, internal approvals and S3 API connectivity are operational before an incident occurs.
• Incident-response procedures may wish to prohibit aggregation of separate major incidents where the CSSF reporting process requires event-specific submissions and should assign ownership even where reporting support is outsourced.
• Third-country branches may wish to align their Luxembourg reporting playbooks, head-office escalation arrangements and local CSSF contacts with the immediate-effect scope clarification.
• Firms should consider retaining evidence of classification, notification times, report versions, management approvals and communications with ICT third parties to demonstrate timely compliance.

What changed

DORA financial entities supervised by the CSSF must classify ICT-related incidents using the criteria and thresholds in Commission Delegated Regulation (EU) 2024/1772 and report each major ICT-related incident using the DORA reporting templates and procedures. Reporting is phased: an initial notification is generally due within four hours after classification as major and in any event no later than 24 hours after the entity becomes aware of the incident; an intermediate report is generally due within 72 hours after the initial notification; and a final report is generally due within one month...

Key dates

2022-04-22

Circular CSSF 22/806 was published and replaced or amended specified earlier CSSF and IML outsourcing, governance and control circulars.

2022-06-30

Circular CSSF 22/806 became applicable according to the CSSF implementation framework.

2025-01-17

DORA Regulation (EU) 2022/2554 became applicable to in-scope financial entities, creating the primary EU framework for ICT third-party risk management.

2025-04-09

Circular CSSF 25/883 was published; the amended Circular 22/806 applies to outsourcing arrangements entered into, reviewed or amended on or after this date.

2025-12-17

The European Commission confirmed that DORA also applies to qualifying third-country branches in an EU Member State where the third-country head-office entity would fall within DORA Article 2(1)(a) to (t).

2026-08-27

Circular CSSF 26/915 was published and the CSSF webpage consolidated the amended version of Circular 22/806, confirming the DORA treatment of qualifying Luxembourg third-country branches.

Suggested considerations

• Firms should map each outsourcing and third-party technology arrangement against the applicable regime: DORA, Circular 22/806 business-process outsourcing requirements, or the full Circular 22/806 framework for non-DORA entities.
• Compliance teams may wish to review whether Luxembourg third-country branches have a head-office activity that corresponds to a DORA Article 2(1)(a) to (t) financial entity and document the resulting DORA scope assessment.
• Firms should update outsourcing policies, risk assessments, governance approvals, materiality or criticality assessments, due-diligence files, monitoring controls and exit strategies to reflect the split between DORA ICT third-party risk management and Circular 22/806 business-process outsourcing.
• Firms should maintain or update the DORA register of information for ICT third-party arrangements where DORA applies, and reconcile it with the outsourcing inventory and CSSF notification processes.
• Firms should review legacy cloud contracts and remove reliance on the repealed Circular 22/806 EEA-law and EEA-resilience clauses where DORA is the applicable ICT third-party regime, while retaining contract terms needed to satisfy DORA and any applicable national requirements.
• Non-DORA entities should consider whether their existing contracts still address Circular 22/806 requirements for access and audit rights, sub-outsourcing, confidentiality, data location, business continuity, termination and exit.
• Management companies authorised solely under Article 125-1 should consider retaining the full Circular 22/806 control framework for ICT outsourcing rather than assuming that DORA displaces it.
• Firms should assess whether outsourcing arrangements entered into, reviewed or amended from 9 April 2025 require remediation or re-papering under the amended framework.

What changed

Circular 25/883 amended Circular 22/806 following DORA Regulation (EU) 2022/2554 becoming applicable on 17 January 2025. For entities subject to DORA, the ICT-outsourcing provisions of Circular 22/806 were largely repealed or displaced by DORA's ICT third-party risk-management requirements, while Circular 22/806 remains applicable to business-process outsourcing.

Key dates

2020-08-25

Circular CSSF 20/750 was originally published, establishing CSSF expectations for ICT and security risk management.

2025-01-17

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector became applicable to DORA-defined financial entities supervised by the CSSF.

2025-04-09

Circular CSSF 25/881 amended Circular 20/750, narrowing it primarily to non-DORA entities and moving PSP-specific requirements to Circular CSSF 25/880.

2026-08-27

Circular CSSF 26/915 was published and applies with immediate effect; DORA-equivalent third-country branches are removed from Circular 20/750 and addressed through the DORA-related CSSF framework.

Suggested considerations

• Firms with Luxembourg third-country branches should document an entity-by-entity DORA scoping analysis, including the classification of the non-EU head-office undertaking under Article 2(1)(a) to (t) of Regulation (EU) 2022/2554 and the relevance of Article 2(2).
• Affected branches should consider retiring Circular 20/750 as their primary ICT framework and mapping controls instead to DORA and the applicable CSSF circulars, including Circular CSSF 25/882 on ICT third-party services and Circular CSSF 25/893 on major ICT-related incidents and significant cyber threats.
• Firms should review ICT third-party inventories, contracts, due diligence files, exit strategies and, where relevant, the DORA Register of Information so that all ICT services are captured regardless of whether the arrangement is formally classified as outsourcing.
• Entities remaining within Circular 20/750 should consider confirming that the management body has approved the ICT and security risk-management framework and that it is reviewed at least annually.
• Remaining in-scope entities should consider refreshing their annual ICT and security risk assessment, critical-function and information-asset mapping, threat and vulnerability monitoring, access controls, patching, backup, recovery, incident-response and business-continuity documentation.
• Compliance teams may wish to verify that critical ICT systems undergo security testing at least annually, non-critical systems are tested regularly and at least every three years, and critical business continuity arrangements are tested at least annually.
• Branches and PSP-related entities should consider validating incident-reporting channels and escalation procedures, including the CSSF alternative email channel for exceptional technical failures where the prescribed DORA reporting channel cannot be used.
• Firms should consider preserving evidence of proportionality assessments, control testing, audit findings, remediation, management-body reporting and staff security training for CSSF supervisory review.

What changed

Circular 26/915 applies with immediate effect and removes DORA-equivalent third-country branches from the scope of Circular 20/750. A third-country branch is treated as DORA-relevant where, in the jurisdiction of its head office, the undertaking would qualify as an entity listed in Article 2(1)(a) to (t) of Regulation (EU) 2022/2554, subject to the applicable exclusions and Article 2(2) conditions.