Payment Providers Regulatory Updates

Key dates

2026-08-27

The Bank of England announced deferral of the entire November 2026 RTGS standards release, including CHAPS messaging standards; Swift announced the corresponding Standards Release delay on the same date.

2026-12-31

Swift has indicated that it will provide an update on the optimal timing and approach for the structured-address change by December 2026 at the latest; this is an expected communications milestone, not a confirmed implementation deadline.

Suggested considerations

• Firms should update regulatory-change inventories and project plans to record that the November 2026 RTGS and CHAPS standards release has been deferred, without assuming that the change has been cancelled.
• CHAPS and RTGS participants should obtain the BoE’s revised implementation timetable and monitor the BoE ISO 20022 implementation page, participant communications and Swift governance updates, including the expected update by December 2026 at the latest.
• Compliance and payments teams may wish to preserve completed analysis and technical preparations for structured or hybrid postal addresses, while reassessing sequencing, testing windows, release dependencies and vendor delivery dates against the revised timetable.
• Firms should distinguish the deferred BoE/CHAPS release from any other payment-system or bilateral requirements that may continue on their original schedules, and should confirm the treatment of address validation, message rejection, exception handling and operational support with relevant counterparties and vendors.
• Technology and operations teams should maintain regression-test environments and data-quality remediation plans so that implementation can resume without restarting discovery or delaying future mandatory testing.
• Firms using both CHAPS/RTGS and Swift CBPR+ should assess whether the coordinated deferral changes their customer communications, correspondent-bank testing, operational-resilience scenarios, payment-routing controls and incident-management assumptions.
• Governance committees may wish to record the deferral as a schedule and dependency change rather than as a reduction in scope, because the BoE states that the November release is deferred in its entirety and provides no indication that the underlying standards work is withdrawn.

What changed

The November 2026 RTGS standards release will not proceed as originally planned and has been deferred in its entirety rather than being split into separate changes. This includes the RTGS messaging standards applicable to CHAPS payments. The decision maintains alignment with Swift’s deferred CBPR+ release and means that the previously expected 2026-11-14 removal of fully unstructured postal addresses should not be treated as the operative BoE/Swift implementation date; Swift has indicated that it will consult market participants and provide an update by December 2026 at the latest.

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying [email protected] by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.

Key dates

2025-01-17

DORA began applying to in-scope financial entities supervised by the CSSF.

2025-12-17

The European Commission confirmed through DORA Q&A 102 that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF’s extended best-efforts deadline for the first register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2026-08-27

Circular CSSF 26/915 was published and took effect immediately; the listed CSSF circulars were amended to include or remove qualifying third-country branches as applicable.

2027-03-31 Deadline

Target date identified by CSSF for the required-quality register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2027-01-11

Relevant CRD VI third-country-branch provisions are scheduled to take effect, subject to national transposition and applicable transitional rules.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the counterfactual test in Circular 26/915: whether the head-office undertaking would qualify under Article 2(1)(a) to (t) of DORA if established in the relevant third country.
• Affected branches should update their regulatory-perimeter inventories, governance documents, ICT-risk policies, outsourcing inventories, incident-classification procedures and DORA control testing to reflect immediate inclusion in the DORA-specific CSSF circulars.
• Compliance teams may wish to separate non-ICT outsourcing, which remains subject to Part I of Circular CSSF 22/806, from ICT outsourcing, which is governed by DORA and Circular CSSF 25/882 rather than the legacy Part II framework.
• Affected entities should validate their register-of-information process under DORA and Circular CSSF 25/882, including branch-level data, ICT third-party contracts, intra-group arrangements and submission ownership. The 30 June 2026 best-efforts deadline for third-country branches of credit institutions has passed, and firms should prepare for the 31 March 2027 collection and any CSSF remediation requests.
• Incident-response teams should test access to the CSSF eDesk procedure and S3 API and document an escalation process for emailing [email protected] when technical impossibility prevents electronic submission.
• Firms should assess whether they qualify for the microenterprise exclusion in Circular CSSF 25/892; the exclusion applies to entities employing fewer than 10 persons with annual turnover and/or annual balance-sheet total not exceeding EUR 2 million, subject to the DORA definition and exclusions for specified market infrastructures.
• Third-country banking groups should coordinate DORA implementation with the CRD VI third-country-branch analysis, including the 11 January 2027 effective date for relevant CRD VI provisions, rather than assuming that the two regimes have identical scope or timing.

What changed

Qualifying third-country branches are added to the scope of Circulars CSSF 25/882, 25/892 and 25/893, covering DORA ICT third-party-service information and reporting, estimation of aggregated annual costs and losses from major ICT-related incidents under Article 11(11) of DORA and the Joint ESA Guidelines JC/GL/2024/34, and reporting of major ICT-related incidents and significant cyber threats.

Key dates

2025-01-17

DORA became applicable to financial entities within its scope, subject to the specific DORA provisions and technical standards applicable to each entity.

2025-04-09

Circular CSSF 25/881 was published and took effect, removing DORA financial entities from Circular 20/750 and retaining 20/750 for entities outside DORA; PSP-specific provisions were reorganised under Circular 25/880.

2026-06-30 Deadline

CSSF extended the first Register of Information submission for Luxembourg branches of third-country credit institutions to this date on a best-efforts basis; the CSSF indicated that the required level of quality should be achieved for the 2027 submission.

2026-08-27

Circular CSSF 26/915 was published, confirming the DORA treatment of qualifying third-country branches and removing them from the full scope of Circular 20/750 and related overlapping circular provisions.

2027-03-31 Deadline

Target date identified by the CSSF for the required-quality Register of Information submission by Luxembourg branches of third-country credit institutions.

Suggested considerations

• Firms should classify each Luxembourg entity and branch against DORA Article 2 and the amended scope of Circular 20/750, including an assessment of whether a third-country head office would qualify under DORA Article 2(1)(a) to (t).
• Compliance teams may wish to determine whether the entity should operate under DORA rather than 20/750, and document the rationale, legal-entity perimeter and treatment of any Luxembourg branch.
• Firms remaining within Circular 20/750 should consider reviewing their ICT and security-risk-management framework, governance approvals, risk assessments, incident processes, business-continuity arrangements and control testing against the continuing requirements.
• Payment service providers should consider replacing references to the PSP provisions formerly contained in Circular 20/750 with the applicable requirements in Circular CSSF 25/880 and EBA/GL/2025/02.
• Third-country branches treated as DORA entities should consider validating their DORA governance, ICT-risk framework, incident-reporting arrangements, ICT contractual inventory and Register of Information processes, taking account of CSSF reporting communications.
• Firms should update policies, regulatory inventories, outsourcing and ICT-third-party registers, training materials and regulatory mapping to distinguish DORA obligations from the residual Circular 20/750 obligations.
• Compliance teams may wish to retain evidence of the scope assessment and implementation date, because the 2025 amendment was effective immediately and the 2026 amendment changes the treatment of a previously identified 20/750 population.

What changed

Circular 25/881 provides that DORA financial entities supervised by the CSSF no longer fall within Circular 20/750; for entities covered by 20/750 but outside DORA, the circular continues to apply in full. Payment-service-provider-specific ICT and security-risk provisions were removed from 20/750 and regrouped in Circular CSSF 25/880, reflecting the revised EBA Guidelines on ICT and security risk management for payment service providers, including EBA/GL/2025/02.

Key dates

2025-01-17

DORA began applying to financial entities within its scope, subject to the relevant provisions and transitional arrangements.

2025-04-09

Circular CSSF 25/883 was published and applied with immediate effect, amending Circular CSSF 22/806 and introducing the DORA-based division between ICT and business-process outsourcing.

2025-12-17

The European Commission confirmed through a DORA Q&A that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF-extended submission date for the 2026 DORA register of information for third-country branches of credit institutions headquartered in a third country; entities were invited to submit on a best-efforts basis.

2026-08-27

Circular CSSF 26/915 was published and applied with immediate effect, confirming the DORA treatment of qualifying Luxembourg third-country branches and updating Circular CSSF 22/806 accordingly.

2027-03-31 Deadline

Target CSSF submission deadline for the DORA register of information for affected third-country branches following the initial 2026 collection.

Suggested considerations

• Firms should classify each outsourcing arrangement as ICT or non-ICT and determine whether the entity and arrangement fall within DORA, Circular 22/806, or both regimes in their respective areas of application.
• DORA entities should consider moving ICT arrangements from their Circular 22/806 outsourcing inventory and controls into the DORA ICT third-party register, while retaining Circular 22/806 controls for business-process outsourcing.
• Non-DORA entities should consider continuing to apply the full Circular 22/806 framework to ICT and business-process outsourcing, including due diligence, governance, critical-or-important assessments, monitoring, sub-outsourcing and exit planning.
• Third-country branches should assess whether their head office would qualify under Article 2(1)(a) to (t) of DORA and, if so, align ICT governance, contractual arrangements, registers and reporting with DORA rather than relying solely on Circular 22/806.
• Compliance teams may wish to review cloud contracts and avoid carrying forward legacy EEA governing-law or hosting clauses where DORA now provides the applicable framework, while preserving enforceable audit, access, cooperation, security, business-continuity and exit rights.
• Firms should use the revised CSSF notification form for new critical or important ICT outsourcing arrangements and preserve evidence supporting the three-month notification period, or the one-month period for arrangements involving a support PSF.
• Firms should consider validating that existing ICT outsourcing notifications remain complete under the applicable DORA register-of-information requirements, even though Circular 25/883 does not require their re-submission.
• Affected third-country branches should consider submitting and maintaining the DORA register of information through the CSSF process, with the 2027 collection requiring data quality suitable for the 31 March 2027 submission deadline.

What changed

From 9 April 2025, DORA entities generally no longer apply the ICT-outsourcing provisions of Circular CSSF 22/806 to ICT arrangements; those arrangements are governed by DORA, including its ICT third-party risk-management, contractual, register-of-information and oversight requirements, together with Circular CSSF 25/882. Circular 22/806 continues to apply to business-process outsourcing by DORA entities, and continues to apply in full to non-DORA entities, including their ICT outsourcing. Chapter 16 management companies remain subject to Circular 22/806 for ICT outsourcing.

Key dates

2025-05-19

The Joint ESA Guidelines JC/GL/2024/34 apply at ESA level.

2025-05-31

Circular CSSF 25/892 applies to its original in-scope Luxembourg entities, excluding DORA microenterprises.

2026-08-27

Circular CSSF 26/915 is issued and applies with immediate effect, bringing qualifying Luxembourg third-country branches into the scope of Circular CSSF 25/892.

Suggested considerations

• Compliance teams may wish to determine whether each Luxembourg entity or third-country branch falls within the amended scope, including whether a third-country head-office undertaking would qualify under DORA Article 2(1)(a) to (t).
• Firms should consider documenting their microenterprise analysis against DORA Article 3(60), including the fewer-than-10-employees and EUR 2 million annual turnover and/or balance-sheet-total thresholds, while noting that the DORA definition excludes trading venues, central counterparties, trade repositories and central securities depositories from the microenterprise exemption.
• Firms should consider maintaining an incident-level ledger linking major ICT-related incidents, DORA final-report reference codes, gross costs, losses, provisions, recoveries and subsequent adjustments.
• Finance, operational-risk and ICT-incident teams may wish to agree whether the firm will use a completed calendar year or completed accounting year as its reference basis and establish controls to apply that basis consistently.
• Firms should consider reconciling estimates to financial-statement or supervisory-reporting data where available, while retaining documented estimation methodology and assumptions where accurate data is unavailable.
• Firms should consider tracking quantifiable financial impacts from prior-year major incidents because those impacts may need to be included in a later reference year without reopening the original final incident report.
• Third-country branches may wish to confirm reporting ownership and data availability with their head office, because the amended CSSF scope is at branch level but the required cost and loss information may arise across the undertaking.
• Compliance teams may wish to monitor CSSF communications for a specific request, reporting channel and submission deadline; the circular itself establishes an upon-request obligation rather than a fixed automatic annual filing deadline.

What changed

From 2025-05-31, in-scope Luxembourg financial entities other than DORA microenterprises must be able, upon CSSF request, to provide an entity-level estimate of aggregated annual costs and losses arising from major ICT-related incidents. The estimate must use the ESA common template and identify each relevant incident by the same reference code used in its DORA final incident report.

Key dates

2025-01-17

DORA provisions became applicable to financial entities in scope and supervised by the CSSF.

2025-05-28

Circular CSSF 25/893 was published and established the Luxembourg DORA incident and significant cyber-threat reporting modalities.

2025-11-28 Deadline

End of the six-month transition period granted to payment service providers outside DORA for implementation of the Circular 25/893 framework.

2026-08-27

Circular CSSF 26/915 was published and the 25/893 page was updated to clarify DORA applicability to qualifying third-country branches in Luxembourg; the amendment applies immediately.

Suggested considerations

• Compliance teams may wish to confirm the entity-by-entity scope analysis against DORA Article 2, including whether a Luxembourg third-country branch is covered following the 27 August 2026 clarification.
• Firms should consider documenting incident-classification criteria and decision records against Commission Delegated Regulation (EU) 2024/1772, including the quantitative thresholds for clients, transactions, duration, geographical spread, data loss, economic impact and reputational impact.
• Firms should consider testing an escalation timetable that supports classification, initial notification within four hours and no later than 24 hours after awareness, the 72-hour intermediate report and the one-month final report.
• PSPs outside DORA may wish to update policies so that all ICT-related incidents, rather than only payment-service incidents, are assessed under the DORA framework and to verify that the six-month transition requirements were completed by 28 November 2025.
• Firms should consider ensuring that eDesk access, authorised users, templates, internal approvals and S3 API connectivity are operational before an incident occurs.
• Incident-response procedures may wish to prohibit aggregation of separate major incidents where the CSSF reporting process requires event-specific submissions and should assign ownership even where reporting support is outsourced.
• Third-country branches may wish to align their Luxembourg reporting playbooks, head-office escalation arrangements and local CSSF contacts with the immediate-effect scope clarification.
• Firms should consider retaining evidence of classification, notification times, report versions, management approvals and communications with ICT third parties to demonstrate timely compliance.

What changed

DORA financial entities supervised by the CSSF must classify ICT-related incidents using the criteria and thresholds in Commission Delegated Regulation (EU) 2024/1772 and report each major ICT-related incident using the DORA reporting templates and procedures. Reporting is phased: an initial notification is generally due within four hours after classification as major and in any event no later than 24 hours after the entity becomes aware of the incident; an intermediate report is generally due within 72 hours after the initial notification; and a final report is generally due within one month...

Key dates

2022-04-22

Circular CSSF 22/806 was published and replaced or amended specified earlier CSSF and IML outsourcing, governance and control circulars.

2022-06-30

Circular CSSF 22/806 became applicable according to the CSSF implementation framework.

2025-01-17

DORA Regulation (EU) 2022/2554 became applicable to in-scope financial entities, creating the primary EU framework for ICT third-party risk management.

2025-04-09

Circular CSSF 25/883 was published; the amended Circular 22/806 applies to outsourcing arrangements entered into, reviewed or amended on or after this date.

2025-12-17

The European Commission confirmed that DORA also applies to qualifying third-country branches in an EU Member State where the third-country head-office entity would fall within DORA Article 2(1)(a) to (t).

2026-08-27

Circular CSSF 26/915 was published and the CSSF webpage consolidated the amended version of Circular 22/806, confirming the DORA treatment of qualifying Luxembourg third-country branches.

Suggested considerations

• Firms should map each outsourcing and third-party technology arrangement against the applicable regime: DORA, Circular 22/806 business-process outsourcing requirements, or the full Circular 22/806 framework for non-DORA entities.
• Compliance teams may wish to review whether Luxembourg third-country branches have a head-office activity that corresponds to a DORA Article 2(1)(a) to (t) financial entity and document the resulting DORA scope assessment.
• Firms should update outsourcing policies, risk assessments, governance approvals, materiality or criticality assessments, due-diligence files, monitoring controls and exit strategies to reflect the split between DORA ICT third-party risk management and Circular 22/806 business-process outsourcing.
• Firms should maintain or update the DORA register of information for ICT third-party arrangements where DORA applies, and reconcile it with the outsourcing inventory and CSSF notification processes.
• Firms should review legacy cloud contracts and remove reliance on the repealed Circular 22/806 EEA-law and EEA-resilience clauses where DORA is the applicable ICT third-party regime, while retaining contract terms needed to satisfy DORA and any applicable national requirements.
• Non-DORA entities should consider whether their existing contracts still address Circular 22/806 requirements for access and audit rights, sub-outsourcing, confidentiality, data location, business continuity, termination and exit.
• Management companies authorised solely under Article 125-1 should consider retaining the full Circular 22/806 control framework for ICT outsourcing rather than assuming that DORA displaces it.
• Firms should assess whether outsourcing arrangements entered into, reviewed or amended from 9 April 2025 require remediation or re-papering under the amended framework.

What changed

Circular 25/883 amended Circular 22/806 following DORA Regulation (EU) 2022/2554 becoming applicable on 17 January 2025. For entities subject to DORA, the ICT-outsourcing provisions of Circular 22/806 were largely repealed or displaced by DORA's ICT third-party risk-management requirements, while Circular 22/806 remains applicable to business-process outsourcing.

Key dates

2020-08-25

Circular CSSF 20/750 was originally published, establishing CSSF expectations for ICT and security risk management.

2025-01-17

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector became applicable to DORA-defined financial entities supervised by the CSSF.

2025-04-09

Circular CSSF 25/881 amended Circular 20/750, narrowing it primarily to non-DORA entities and moving PSP-specific requirements to Circular CSSF 25/880.

2026-08-27

Circular CSSF 26/915 was published and applies with immediate effect; DORA-equivalent third-country branches are removed from Circular 20/750 and addressed through the DORA-related CSSF framework.

Suggested considerations

• Firms with Luxembourg third-country branches should document an entity-by-entity DORA scoping analysis, including the classification of the non-EU head-office undertaking under Article 2(1)(a) to (t) of Regulation (EU) 2022/2554 and the relevance of Article 2(2).
• Affected branches should consider retiring Circular 20/750 as their primary ICT framework and mapping controls instead to DORA and the applicable CSSF circulars, including Circular CSSF 25/882 on ICT third-party services and Circular CSSF 25/893 on major ICT-related incidents and significant cyber threats.
• Firms should review ICT third-party inventories, contracts, due diligence files, exit strategies and, where relevant, the DORA Register of Information so that all ICT services are captured regardless of whether the arrangement is formally classified as outsourcing.
• Entities remaining within Circular 20/750 should consider confirming that the management body has approved the ICT and security risk-management framework and that it is reviewed at least annually.
• Remaining in-scope entities should consider refreshing their annual ICT and security risk assessment, critical-function and information-asset mapping, threat and vulnerability monitoring, access controls, patching, backup, recovery, incident-response and business-continuity documentation.
• Compliance teams may wish to verify that critical ICT systems undergo security testing at least annually, non-critical systems are tested regularly and at least every three years, and critical business continuity arrangements are tested at least annually.
• Branches and PSP-related entities should consider validating incident-reporting channels and escalation procedures, including the CSSF alternative email channel for exceptional technical failures where the prescribed DORA reporting channel cannot be used.
• Firms should consider preserving evidence of proportionality assessments, control testing, audit findings, remediation, management-body reporting and staff security training for CSSF supervisory review.

What changed

Circular 26/915 applies with immediate effect and removes DORA-equivalent third-country branches from the scope of Circular 20/750. A third-country branch is treated as DORA-relevant where, in the jurisdiction of its head office, the undertaking would qualify as an entity listed in Article 2(1)(a) to (t) of Regulation (EU) 2022/2554, subject to the applicable exclusions and Article 2(2) conditions.

Key dates

2026-05-22

Switzerland added 115 natural persons and organisations to its Russia-related sanctions list; approximately 2,790 persons, companies, and organisations are now subject to asset freezes in connection with Russia’s war against Ukraine.

2026-08-19

The Federal Council decided to adopt the further measures of the EU’s 20th Russia sanctions package according to Switzerland’s established practice.

2026-08-20 Deadline

The new measures entered into force, including the prohibition on using Russian platforms for crypto-asset transfers and exchanges and the prohibition on supporting development of specified Russian crypto-assets such as the digital rouble.

Suggested considerations

• Firms should consider updating sanctions screening rules, prohibited-platform lists, wallet and counterparty controls, and transaction-monitoring scenarios to identify Russian crypto-asset platforms and indirect use of those platforms.
• Crypto-asset firms should consider mapping all transfer, exchange, custody, brokerage, technical-support, wallet-access, and infrastructure services against the applicable provisions of the Ordinance on Measures connected with the Situation in Ukraine, including the newly prohibited Russian platforms and specified Russian crypto-assets.
• Compliance teams may wish to review exposure to the digital rouble and other Russian or rouble-linked crypto-assets, including holdings, listings, liquidity provision, development support, transfers, and third-party integrations, and document any required exit or blocking decisions.
• Firms should consider validating that assets of sanctioned natural persons, companies, and organisations are blocked and that affected business relationships are reported to SECO in accordance with the sanctions ordinance.
• Firms should consider establishing or refreshing procedures for prompt escalation of sanctions-related suspicions, including additional clarifications under Article 6 GwG and an immediate Article 9 GwG report to the Money Laundering Reporting Office where suspicions cannot be dispelled.
• Senior compliance and operations owners may wish to evidence implementation from 2026-08-20 through control attestations, blocked-transaction testing, vendor and platform due diligence, and documented review of open Russian-related relationships.

What changed

The Switzerland-Russia sanctions regime now prohibits the use of Russian platforms for crypto-asset transfers and exchanges, targeting alternative payment channels that could facilitate sanctions circumvention. It also prohibits support for the development of specified Russian crypto-assets, including the digital rouble; independent market commentary places this measure alongside restrictions concerning Russian crypto-asset service providers, sanctioned trading venues, wallet or account access, technical assistance, and certain rouble-backed assets such as RUBx and A7A5, although the FINMA...

Key dates

2021-01-01

The FCA’s permanent restriction on marketing speculative illiquid securities, including relevant mini-bonds and loan notes, to retail investors took effect under COBS 4.14.

2026-01-01

The UK regime regulating offers of securities to the public came into force under the Public Offers and Admissions to Trading Regulations 2024.

2026-07-16

Robert Goodhew and Andrew Stoneman of Kroll Advisory were appointed joint administrators of Woodville Consultants Ltd.

2026-08-20

The FCA publication was updated and warned consumers and market participants about risky mini-bonds, loan notes and related financial promotions.

Suggested considerations

• Compliance teams should inventory current and proposed promotions, introducer arrangements and distribution channels involving loan notes, mini-bonds, litigation funding, private credit or other potentially speculative illiquid securities.
• Firms should document the classification analysis under FCA COBS 4.14, including whether the security is speculative and illiquid, whether it is excluded from the restriction, and the precise exemption relied upon for any retail communication.
• Authorised firms should verify that every financial promotion is made or approved within the firm’s permission and competence, is fair, clear and not misleading under FCA Principle 7 and COBS 4, and contains sufficiently prominent explanations of capital-loss, liquidity, issuer-default and compensation-scheme risks.
• Firms should not rely solely on an investor’s self-certification as a high-net-worth or sophisticated investor; compliance teams may wish to test the basis, timing, wording and evidence for each investor-status declaration against the applicable Financial Promotion Order exemptions.
• Banks, payment firms and professional intermediaries should consider enhanced onboarding and transaction-monitoring controls for unusual high-yield investment flows, unexplained introducer commissions, overseas exchange references, trust structures and claims of FCA-regulated involvement that may create a misleading halo effect.
• Distribution agreements should clearly identify fees, commissions, conflicts and the party responsible for the promotion, with controls to prevent unauthorised introducers from soliciting UK retail investors or passing them to unauthorised issuers.
• Firms should assess whether a proposed public offer engages the Public Offers and Admissions to Trading Regulations 2024 and related FCA requirements, while treating that assessment as separate from financial-promotion, authorisation, conduct and investor-protection analysis.
• Relevant firms and professional intermediaries should retain evidence of due diligence, approvals, investor categorisation, risk disclosures, payment flows and complaints handling, and consider reporting suspicious activity or unlawful promotions to the FCA.

What changed

The FCA has reiterated that speculative illiquid securities, including most mini-bonds and loan notes, have been subject to a permanent restriction on their marketing to retail investors since 1 January 2021 under FCA COBS 4.14. The restriction does not make every loan note unlawful or bring every issuer within FCA authorisation; firms must separately assess whether the instrument falls within the restricted category, whether an exemption applies, and whether the promotion is made or approved by an authorised person in accordance with the Financial Services and Markets Act 2000 and the...

Key dates

2026-08-18

The competent UN Sanctions Committee amended the ISIL (Da’esh) and Al-Qaida sanctions list; the amendment became directly applicable in Switzerland.

2026-08-19

SECO updated the SESAM database and published the Swiss sanctions-list adjustment.

2026-08-20

FINMA published the updated sanctions notice describing the amendment and related financial-intermediary obligations.

Suggested considerations

• Compliance teams may wish to obtain the 2026-08-19 SESAM update and identify precisely which persons, companies or organisations were added, amended or removed.
• Firms should consider refreshing sanctions-screening data and screening customers, beneficial owners, counterparties, payment parties, securities positions and existing business relationships against the amended entries without delay.
• Where a potential match is identified, firms should consider applying the relevant prohibitions, preventing disposal or transfer of assets, documenting the match analysis and escalating the case under their sanctions procedures.
• Firms should consider reporting affected business relationships and frozen assets to SECO in accordance with SR 946.231.08 and retaining evidence of the report and asset-freeze decision.
• A SECO sanctions report should not be treated as a substitute for AML controls; where indicators give rise to suspicion, compliance teams may wish to conduct the additional clarifications required by Article 6 GwG and file an immediate MROS report under Article 9 GwG if the suspicion cannot be dispelled.
• Firms with delegated or outsourced screening may wish to verify that vendors refreshed their Swiss sanctions data after 2026-08-19 and that payment and transaction-monitoring controls cover the amended list.

What changed

The sanctions list under the Swiss Ordinance of 2025-03-21 on measures against persons and organisations associated with ISIL (Da’esh) and Al-Qaida (SR 946.231.08) was amended following the UN committee decision of 2026-08-18. The publication does not identify the amended entries or specify whether they are new designations, amendments or delistings; firms should therefore reconcile the current SESAM data against their prior screening population. The amendment applies in Switzerland directly and without a separate Swiss legislative adoption step.

Key dates

2026-08-14

The competent UN sanctions committee amended the ISIL (Da’esh) and Al-Qaida sanctions list; the amendment became directly applicable in Switzerland under the applicable automatic-implementation framework.

2026-08-17

SECO updated the Swiss-authoritative SESAM sanctions database and published the corresponding list adjustment.

2026-08-19

FINMA published its notice reporting the SECO sanctions-list update.

Suggested considerations

• Compliance teams may wish to retrieve the 17 August 2026 SESAM update and reconcile it against the prior list, recording all additions, removals and amendments and preserving the source version used.
• Firms should consider rerunning customer, beneficial-owner, counterparty, payment, trade and custody screening against the amended list, including historical transactions and open orders where their risk-based controls require retrospective review.
• Firms should consider reviewing transliterations, aliases, dates of birth, nationality, incorporation data and other identifiers for any newly listed individual or entity to reduce false negatives and false positives.
• Where a potential match is identified, firms should consider applying the prohibitions and asset-freeze requirements under SR 946.231.08, escalating the case under their sanctions procedures and assessing whether notification to SECO is required.
• Compliance teams may wish to verify that vendor feeds, transaction-screening systems, watchlists, case-management workflows and manual escalation procedures reflect the direct-applicability model and the 17 August SESAM update date.
• Firms should consider documenting the timing of list ingestion, screening completion, disposition of alerts, any blocked or frozen assets, and any reports or licence requests submitted to SECO for audit and supervisory purposes.

What changed

The UN sanctions committee changed the list of sanctioned individuals, companies and organisations covered by SR 946.231.08. Switzerland applies the change directly, without a separate Swiss legislative or regulatory adoption step. SECO updated SESAM, the SECO Sanctions Management database described as authoritative for Switzerland, on 17 August 2026 and published the amendment on its website.

Key dates

2026-08-17

EAER amended Annexes 12, 13 and 14 and SECO updated the SESAM sanctions database.

2026-08-18 Deadline

The amendment became legally effective at 23:00 Swiss time; affected prohibitions, asset freezes and SECO reporting obligations applied from that time.

Suggested considerations

• Compliance teams may wish to obtain the effective 2026-08-18 23:00 SESAM dataset and run an immediate rescreening of customers, beneficial owners, authorised signatories, counterparties, payment beneficiaries, securities positions and relevant transaction history.
• Firms should consider applying the Article 16 asset-freeze and availability prohibitions to positive matches, including assets or economic resources controlled indirectly, and escalating potential matches for ownership-and-control analysis rather than relying only on exact-name screening.
• Financial intermediaries should consider reporting affected business relationships and frozen assets to SECO without delay in accordance with the ordinance, while documenting the screening timestamp, match disposition, freeze decision and notification trail.
• Teams may wish to review pending and recurring Iran-related payments against Article 21, including the CHF 10,000 SECO reporting threshold, the five-working-day reporting period, and the CHF 50,000 prior-authorisation threshold.
• A SECO sanctions report should not be treated as a substitute for AMLA analysis: where circumstances create suspicion, firms should consider additional clarifications under Article 6 AMLA/GwG and an immediate MROS report under Article 9 AMLA/GwG if the suspicion cannot be dispelled.
• Firms should consider reviewing delisted and amended entries separately, because removal from an Iran annex does not necessarily resolve exposure under other Swiss, UN or foreign sanctions regimes or eliminate unrelated AML, proliferation-financing or reputational-risk concerns.
• Compliance and operations teams may wish to confirm that screening vendors, payment filters, case-management workflows, correspondent-bank controls and sanctions procedures recognise the 23:00 Swiss-time effective moment and preserve an auditable change-management record.

What changed

The amendment updates the Swiss SESAM sanctions database and the designation annexes of the Ordinance of 12 December 2025 on measures against the Islamic Republic of Iran. Six individuals were delisted, one entity record was amended, and two individuals and one entity were newly listed; the publication does not identify the parties in the FINMA notice itself, so firms should rely on the current SECO SESAM data rather than the notice's entry counts alone.

Key dates

2026-08-13

The competent UN Sanctions Committee amended the ISIL (Da’esh) and Al-Qaida list; independent notices describe amendments to four entries.

2026-08-14

SECO updated the Swiss SESAM database and published the corresponding Swiss sanctions-list update.

2026-08-17

FINMA published its updated sanctions notice drawing attention to the directly applicable Swiss list change.

Suggested considerations

• Compliance teams may wish to obtain the amended UN list and the updated SESAM data, identify the three amended individuals and one amended entity, and map all aliases, dates of birth, nationalities, addresses, registration details and other identifiers into screening systems.
• Firms should consider immediate rescreening of customers, beneficial owners, authorised signatories, counterparties, vendors, payment beneficiaries and relevant historical transactions against the amended data.
• Where a potential match is identified, firms should consider suspending the relevant transaction or relationship pending a documented false-positive assessment and escalating a confirmed or unresolved match to sanctions, legal and MLRO governance channels.
• For a confirmed match, firms should consider applying the asset-freeze restrictions under SR 946.231.08, preventing funds or economic resources from being made available directly or indirectly to or for the benefit of the designated person or entity, and assessing applicable Swiss notification and reporting requirements.
• Firms should retain evidence of the SESAM and screening-data update, screening timestamps, alert dispositions, approvals, transaction holds and any regulatory or law-enforcement communications.
• Control owners may wish to test whether outsourced screening providers, payment filters, correspondent-bank interfaces and crypto blockchain analytics received the update without delay.
• Compliance teams may wish to note the market reading reflected in parallel official-industry notices: the practical expectation is operational list maintenance and prompt rescreening, not merely awareness of the FINMA publication.

What changed

The list entries covered by the Ordinance of 2025-03-21 on Measures Against Persons and Organisations Connected with ISIL (Da’esh) and Al-Qaida (SR 946.231.08) were amended; the available public notices indicate amendments to three individuals and one entity, rather than a new standalone FINMA rule. The amendments became directly applicable in Switzerland through the UN sanctions-list mechanism, and SECO incorporated them into SESAM on 2026-08-14.

Key dates

10 August 2026

- The WBF amended the list of sanctioned persons, companies, and organizations under the South Sudan measures

11 August 2026

- FINMA published the updated sanctions notice and stated that the urgent amendment would be published on the WBF website the same day

11 August 2026, 23:00

- The updated sanctions entry takes effect and becomes enforceable in Switzerland

Suggested considerations

• Re-screen customers, counterparties, beneficial owners, and payment flows against the updated SESAM sanctions data immediately.
• Freeze any assets or economic resources that match the updated South Sudan sanctions list as soon as the entry becomes effective.
• Block prohibited dealings and ensure no funds or economic resources are made available, directly or indirectly, to listed persons or entities.
• Report any affected business relationships to SECO without delay where a match is identified.
• Perform additional clarifications under Art. 6 GwG when sanctions hits or related suspicion indicators arise.

What changed

• - The WBF amended Annex 2 of the Swiss ordinance on measures against the Republic of South Sudan (SR 946.231.169.9), and FINMA relayed that the authoritative Swiss sanctions database SESAM has been...
• The urgent amendment takes effect today at 23:00, meaning firms must treat the revised list as enforceable from that time onward.
• Financial intermediaries must implement the prohibitions contained in the ordinance for the sanctioned parties.
• Financial intermediaries must freeze assets of sanctioned persons, companies, and organizations.
• Financial intermediaries must report affected business relationships to SECO.

Key dates

2026-08-11

Effective date of the Geographic Targeting Order

2027-02-06 Deadline

Order period ends after 180 days unless renewed

Suggested considerations

• Compliance teams may wish to identify all branches, subsidiaries, and offices in Hennepin and Ramsey Counties and map which payment flows meet the Order’s definition of a Covered Transaction.
• Firms may wish to update transaction-monitoring and customer due diligence workflows to capture the additional data elements required for bank or money transmitter reports, including beneficiary or recipient contact details and government-benefits-related funding questions.
• Operational teams may wish to confirm readiness to submit reports through the FI Portal and to generate the required CSV files using the Minnesota Fraud GTO template and naming convention.
• Records-management teams may wish to set a retention control ensuring all reports and related compliance records are preserved for five years from the last day the Order is effective.
• Banks and money transmitters may wish to review whether any existing BSA or sanctions screening processes can be leveraged to identify covered international transfers meeting the $3,000 threshold.
• Compliance teams may wish to test month-end reporting processes so filings occur by the end of the month following the month in which each Covered Transaction took place.

What changed

The Order creates a temporary, geographically targeted recordkeeping and reporting regime under 31 CFR Part 1010 for covered institutions in Hennepin and Ramsey Counties. A “Covered Business” is any bank under 31 CFR 1010.100(d) or money transmitter under 31 CFR 1010.100(ff)(5) with a branch, subsidiary, or office in the covered area.

Key dates

20 March 2026

- The FCA published the statement announcing increased scrutiny of Annex 1 firms and warning that registration applications should be expected to take longer

TBD (ongoing, from the date of publication)

- Annex 1 firms that are not registered should submit a registration application before continuing Annex 1 activity, because the FCA states such firms need to be registered for AML purposes

TBD (ongoing supervisory cycle)

- Around 900 Annex 1 firms are subject to FCA information requests to support supervisory risk assessment and intelligence gathering

Suggested considerations

• Confirm whether any UK business line falls within Annex 1 scope and, if so, verify that the entity is registered with the FCA for AML purposes before continuing the activity.
• Submit a registration application immediately if the firm carries on Annex 1 activity without being registered.
• Reassess the firm’s AML framework at entity level, rather than relying on group-level policies or parent-company controls, and document why the controls are appropriate for the firm’s own risks and operations.
• Replace any generic or off-the-shelf procedures with policies, controls, and procedures tailored to the firm’s actual products, customers, geographies, and delivery model.
• Prepare evidence of MLR compliance for FCA review, including risk assessment logic, governance arrangements, customer due diligence processes, and monitoring controls.

What changed

• - The FCA is closely scrutinising applications to register as an Annex 1 firm, indicating a tougher gateway for new registrations and potentially more refusals or delay where evidence is weak.
• Annex 1 firms must demonstrate compliance with the Money Laundering Regulations, rather than merely assert that controls exist.
• The FCA is warning firms that registration applications will take longer, which affects launch plans, transaction timing, and group structuring decisions.
• The FCA has sent an information request to around 900 Annex 1 firms to better understand their activities, business models, and risks.
• The FCA says it will use this information, together with other intelligence, to identify and disrupt financial crime risks in the sector.

Key dates

2026-06-24

Venezuela experienced a pair of strong earthquakes off the northern coast west of Caracas, triggering the humanitarian crisis referenced by the agencies.

2026-07-27

FinCEN issued a substantively similar statement of enforcement policy regarding Venezuela-related financial services.

2026-07-31

The OCC, Federal Reserve, FDIC, and NCUA issued the joint enforcement policy.

2026-07-31

Start of the period during which authorized financial services to persons or entities in Venezuela are covered by the enforcement commitment.

2027-01-29 Deadline

End of the covered period for the joint enforcement commitment.

Suggested considerations

• Compliance teams may wish to confirm whether current Venezuela-related activity falls within the scope of authorized financial services covered by the joint statement.
• Institutions may wish to verify that their BSA compliance program remains current and that ongoing controls reflect reasonable efforts to comply during the relief period.
• Firms may wish to check whether they have had any final FinCEN or OCC enforcement action involving BSA violations in the prior 24 months before relying on the policy.
• Sanctions teams may wish to confirm continued compliance with all applicable OFAC-administered sanctions regulations and authorizations.
• Institutions with Venezuela exposure may wish to document how they will evidence reliance on the policy and monitor the January 29, 2027 end date.

What changed

The agencies stated that eligible U.S. financial institutions that choose to provide authorized financial services to persons or entities in Venezuela will not be subject to supervisory action, including a citation for a violation of law, or enforcement action related to a Bank Secrecy Act requirement, for those services. The commitment is limited to authorized financial services provided from 2026-07-31 through 2027-01-29 and applies only to statutes or regulations specifically addressed in the joint statement.

Key dates

2026-07-31

Joint ESA statement on ICT risks from frontier AI models in the EU financial sector published

Suggested considerations

• Compliance teams may wish to map existing and planned uses of frontier AI models (including large language models and other advanced generative or predictive systems) to current ICT risk and cyber resilience frameworks under Regulation (EU) 2022/2554 (DORA) to demonstrate that these models are covered by documented risk assessments, controls and monitoring.
• Firms should consider reviewing governance arrangements for frontier AI, including board and senior management oversight, clear accountability, and integration of AI-related ICT risks into the firm’s risk appetite, risk taxonomy and operational risk frameworks, with specific escalation and reporting lines.
• Risk and technology functions may wish to update ICT and cyber risk management policies to explicitly address frontier AI threats (e.g. prompt injection, model poisoning, data leakage, adversarial attacks) and to align detection, logging and incident response capabilities with the ESAs’ emphasis on prevention, detection and management of AI-related cyber risks.
• Operational resilience teams should consider conducting scenario analysis and testing around frontier AI incidents (such as compromised AI-enabled customer interaction tools or automated decision engines) to evidence the ability to maintain critical services in line with DORA requirements on ICT-related incident management and business continuity.
• Compliance and procurement teams may wish to review contracts and due diligence for critical ICT third‑party providers that supply or host frontier AI models, assessing how provider controls, service levels and incident processes meet DORA expectations and the ESAs’ focus on frontier AI risks.
• Supervisory engagement teams should consider preparing to discuss the firm’s frontier AI strategy, risk management and governance with competent authorities, using the ESA statement as a reference point for how existing supervisory expectations on ICT risk and cyber resilience are applied to AI use cases.
• Internal audit and second‑line control functions may wish to plan thematic reviews of frontier AI deployments to assess coverage of AI-specific ICT risks within existing control frameworks, including documentation quality, model oversight, and alignment with DORA and sectoral guidance.
• Firms should consider monitoring forthcoming ESA and national competent authority publications on frontier AI and DORA oversight activities, as the statement signals that supervisory practices and expectations in this area are evolving and may be further operationalised.

What changed

The publication introduces a consolidated supervisory expectation that frontier AI models be treated explicitly as a source of ICT and cyber risk within existing EU operational resilience and ICT risk management frameworks, rather than as a separate technology domain. It emphasises the need for robust governance, risk management, and controls around the prevention, detection and management of cyber risks stemming from frontier AI, including model governance, validation, monitoring and incident handling.

Key dates

End of 2026

- The ECB Governing Council is expected to make the final decision on the new banknote design

23 July 2026

- The Central Bank of Ireland publishes the press release encouraging public participation in the ECB consultation

21 September 2026

- The public survey on the shortlisted euro banknote designs closes

Suggested considerations

• Review the ECB consultation materials and assess whether your firm has any direct operational exposure to future euro banknote changes.
• Monitor ECB and Central Bank of Ireland updates for the final design decision expected around the end of 2026.
• Prepare internal stakeholder briefings for cash operations, branch operations, payments, customer service, and communications teams on the expected euro banknote redesign timeline.
• If your firm accepts or processes cash, begin a preliminary review of any systems, controls, or vendor dependencies that could be affected by future note specifications, authentication features, or rollout timing.
• Update external messaging and FAQs only after the ECB publishes the final banknote design and implementation details.

What changed

• - The ECB has published ten shortlisted design proposals for the next series of euro banknotes, based on the themes “European culture” and “Rivers and birds.”
• The ECB has opened an online public survey to gather feedback on the proposed designs.
• The survey is open until 21 September 2026.
• The ECB Governing Council is expected to make the final design decision around the end of 2026.
• The current publication does not impose any immediate compliance obligation on firms; it is a consultation and design-selection step, not an enacted regulatory rule.

Key dates

Late 2026

- Expected Governing Council decision on the final design proposal for the new euro banknote series

Subsequent years (post‑2026)

- Progressive introduction of new‑series euro banknotes into circulation, co‑circulating with existing series which retain value

21 September 2026

- Closure of the ECB public online survey on the ten shortlisted euro banknote design proposals

Suggested considerations

• Establish an internal project workstream to monitor ECB communications on the banknote redesign and plan for operational impacts on cash handling, ATM networks and merchant devices.
• Conduct a preliminary impact assessment of how new banknote security and design features may affect existing banknote sorting, authentication and recycling equipment, and identify likely upgrade or replacement needs.
• Engage with ATM and cash‑handling hardware vendors to understand expected firmware, sensor and software changes required to support the new banknote series and to secure upgrade slots ahead of issuance.
• Review and update internal cash‑handling and banknote authentication procedures, including staff training materials, to incorporate new design and security features once technical specifications are published.
• Plan customer communications strategies to explain the coexistence of old and new series banknotes, reaffirm the continued validity of previous series, and address any fraud or counterfeiting concerns.

What changed

• - The ECB has published ten shortlisted design proposals for the next series of euro banknotes, based on the two themes “European culture” and “Rivers and birds”.
• An EU‑wide online public survey has been launched to collect feedback on the shortlisted designs, forming part of the ECB’s inclusive approach to banknote design.
• The ECB’s Governing Council will select a single design proposal around the end of 2026, informed by the Design Contest Jury conclusions, technical assessments and survey results.
• The chosen design will undergo further development and testing before production, including integration of new and improved security features.
• The new series of euro banknotes will be introduced into circulation in subsequent years, alongside existing series, which will retain their legal value and continue to circulate.

Key dates

2026-07-23

EBA launches consultations on draft ITS on depositor information, ITS on information exchange, RTS on DGS payouts of client funds deposits, and Guidelines on investment of available financial means under DGSD3

2026-09-21 Deadline

Registration deadline (12:00 CEST) for public hearing on all four regulatory products

2026-09-24

Public hearing on the four DGSD3-related regulatory products (10:00–13:00 CEST)

2026-10-23 Deadline

Deadline for submission of comments to the four consultation papers

Suggested considerations

• Compliance teams at EU credit institutions should consider reviewing existing depositor information sheets, account-opening documentation and ongoing communications to assess alignment with the emerging harmonised formats and content envisaged by the draft ITS on depositor information, particularly for merger and failure scenarios.
• DGSs and banks may wish to map current data flows and reporting processes for covered deposits, available financial means and bank failure events against the proposed ITS on information exchange, to identify gaps in data granularity, timeliness, and standardisation that could require system and process changes.
• Firms that hold client funds in pooled or intermediary deposit accounts (such as investment firms or payment institutions) should consider analysing how client identification and segregation data are captured and shared with DGSs, in light of the draft RTS on client funds that aim to ensure accurate and timely reimbursement of underlying clients and avoidance of duplicate payouts.
• DGS operators and finance teams may wish to review investment policies, risk limits, eligible instruments and liquidity management frameworks for DGS financial means, to anticipate adjustments needed to comply with the forthcoming Guidelines on diversification, low risk and liquidity, including readiness to support resolution financing within the DGSD3 mandate.
• All affected stakeholders should consider preparing internal positions and impact assessments and submit consultation responses to the EBA by the stated deadline, highlighting operational challenges, data availability issues, and any potential conflicts with existing national frameworks for depositor protection and crisis management.
• Risk and treasury functions in banks may wish to engage with DGSs and supervisors to understand how enhanced reporting on covered deposits and DGS financial means under the ITS on information exchange could affect crisis-preparedness expectations, stress-testing assumptions and disclosure practices.
• Legal and regulatory affairs teams should consider monitoring the progression of these four draft instruments alongside the remaining eight technical standards and guidelines mandated by DGSD3, to plan for a coordinated implementation programme once final texts and application dates are confirmed.

What changed

The publication launches consultations on four draft regulatory products mandated by DGSD3: (i) Implementing Technical Standards on depositor information, which define harmonised content and format for depositor information sheets at account opening and on a regular basis, and specify communication requirements in special situations such as bank mergers or failures; (ii) Implementing Technical Standards on information exchange between credit institutions, Deposit Guarantee Schemes (DGSs) and other relevant authorities, introducing standardised procedures, templates and minimum information...

Key dates

20 January 2026

– CSSF Circular 26/906 on central administration, internal governance and risk management for payment institutions, electronic money institutions and account information service providers is published

23 March 2026

– Decision date of the administrative sanction imposed on members of the board of directors of an electronic money institution

30 June 2026

– Application date of CSSF Circular 26/906, from which its governance and risk‑management requirements formally apply to payment institutions and electronic money institutions

21 July 2026

– CSSF publicly releases the notice “Administrative sanction of 23 March 2026 – Administrative sanction imposed on the members of the board of directors of an electronic money institution.”

Suggested considerations

• Review and map the institution’s current governance framework, board charter and committee mandates against the detailed requirements of CSSF Circular 26/906, including central administration, board composition, responsibilities and functioning.
• Ensure that the board of directors collectively has the required expertise, independence, diversity and time commitment, and that this is documented and periodically reassessed in line with CSSF expectations.
• Update board policies to explicitly assign responsibility for strategy, risk appetite, safeguarding of client funds, information security, outsourcing, conflicts of interest and AML/CFT, and ensure these responsibilities are effectively discharged and evidenced.
• Confirm that the institution’s central administration, decision‑making centre and administrative centre are physically located in Luxembourg and that members of the management body are sufficiently present on site, as required under the governance framework.
• Establish or reinforce the “three lines of defence” model by clearly separating business units, control functions (compliance and risk) and internal audit, and ensure reporting lines to the board are independent and robust.

What changed

• - The CSSF demonstrates that it is prepared to impose administrative sanctions directly on members of the board of directors of electronic money institutions, not just on the institution as a legal...
• Board members of Luxembourg‑authorised electronic money institutions are now clearly exposed to personal regulatory liability for governance, risk management and safeguarding failures under the CSSF...
• This enforcement confirms that CSSF Circular 26/906 on central administration, internal governance and risk management for payment institutions and electronic money institutions is not only a formal...
• The sanction underscores CSSF expectations that the supervisory body (board of directors) must ensure sound and prudent management, continuity of the institution and protection of its reputation, and...
• The case signals a stricter enforcement posture by the CSSF towards the payments and e‑money sector, aligning its expectations and enforcement intensity more closely with bank‑equivalent governance...

Key dates

24 June 2013

– Earlier ESA Board of Appeal case law clarifies that appeals are reserved for “decisions” that produce binding legal effects and that the Board lacks jurisdiction over acts that are not such decisions, including certain complaints‑handling outcomes

21 July 2022

– In Decision BoA‑D‑2022‑01 (appeal “C” v EBA), the Board of Appeal holds that an appeal against EBA’s decision not to initiate an investigation into alleged non‑application of EU law in relation to payment accounts is inadmissible under Article 60(2) of Regulation (EU) No 1093/2010

16 July 2026

– The ESAs’ Joint Board of Appeal issues the present decision dismissing, as inadmissible, an individual’s appeal against EBA’s decision not to open an investigation into a possible breach of Union law by the Finnish FIN‑FSA in relation to a bank account closure

Suggested considerations

• Review internal complaints‑handling and escalation procedures to ensure that disputes over account closures and related supervisory decisions are managed through national complaint bodies and courts, rather than assuming EBA or Board of Appeal review will be available.
• Update legal and compliance guidance notes to reflect that EBA’s decision whether to initiate a breach‑of‑Union‑law investigation is discretionary and generally not subject to appeal before the Board of Appeal, limiting external escalation avenues.
• Train front‑office, customer‑service and complaints staff to provide accurate information to customers about available redress routes, emphasising national ombudsman, national competent authority and judicial mechanisms rather than ESMA/EBA appeals.
• For groups operating across the EU, map national complaint and judicial mechanisms for account closures in each jurisdiction and integrate them into group‑wide conduct risk frameworks and customer communication templates.
• Monitor further ESA and EU court case law on which ESA acts are susceptible to appeal before the Board of Appeal, and adjust litigation and escalation strategies accordingly.

What changed

• - The decision clarifies that EBA’s decision whether or not to initiate an investigation into a possible breach or non‑application of Union law under Article 17 of Regulation (EU) No 1093/2010 is a...
• The Board of Appeal confirms that a decision not to open a Union law breach investigation does not constitute a reviewable “decision” for the purposes of Article 60(1)–(2) of the ESA Regulations and...
• The Board of Appeal confirms that individual complaints about account closures and associated supervisory handling remain primarily within the remit of national competent authorities and national...
• The decision reiterates that only certain categories of ESA acts that produce binding legal effects (for example, decisions adopted under Articles 17, 18 or 19 of the ESA Regulations, and acts within...
• The outcome aligns with prior Board of Appeal and EU court case law confirming that persons outside the specific categories listed in Article 17(2) of the ESA Regulations have no right of appeal to...

Key dates

12 November 2024

- UK regulators publish final policy and supervisory materials setting out the CTP oversight regime, including Fundamental Rules and operational risk and resilience requirements

01 January 2025

- CTP rules and oversight regime take legal effect, but only apply once a provider is designated as a CTP

13 July 2026

- Regulations for CTP oversight come into effect for the first designated CTPs; Bank of England, PRA and FCA formally start supervising AWS EMEA, Google Cloud EMEA, Microsoft Ireland Operations and Oracle UK as CTPs

Suggested considerations

• Review and update the firm’s operational resilience framework, including impact tolerances and scenario testing, to explicitly incorporate systemic risk arising from reliance on the designated CTPs and potential correlated failures affecting multiple services or regions.
• Re‑assess outsourcing and third‑party risk management policies to ensure they clearly distinguish between obligations placed on regulated firms and those placed directly on CTPs, while maintaining robust due diligence, ongoing monitoring and exit strategies for all CTP‑hosted services.
• Engage with designated CTPs (through account management, risk and security channels) to understand their approach to compliance with the CTP regime, including incident reporting arrangements, resilience testing, communication protocols and any new assurance artifacts they plan to provide.
• Update board and senior management reporting so that reliance on designated CTPs, associated systemic risk and regulatory developments under the CTP regime are regularly monitored and discussed at appropriate governance forums (e.g. risk committee, operational resilience committee).
• Review major incident management and crisis communication playbooks to ensure they include specific escalation paths, contact points and joint incident handling procedures with designated CTPs and relevant regulators.

What changed

• - A new CTP oversight regime becomes operational on 13 July 2026, under which the Bank of England, PRA and FCA will jointly supervise certain technology and service providers whose failure could...
• HM Treasury has made the first formal CTP designations: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited.
• Designated CTPs must identify and manage risks to their critical services effectively, including governance, risk management and operational resilience arrangements specifically focused on services...
• CTPs are required to maintain open, timely communication with regulators and with firms that rely on them, particularly during major incidents, implying strengthened incident reporting,...
• The three regulators will jointly oversee CTPs under a proportionate regime focused on resilience of “critical services”, including assessing and mitigating system‑level risks and reducing the risk...

Key dates

31 July 2023

– Consumer Duty (Principle 12 and PRIN 2A) applies to all new and existing in‑scope products and services open to new business for retail customers

31 July 2024

– Consumer Duty applies to closed products and services (legacy books), extending the expectations on product design, monitoring and fair value to those products

Suggested considerations

• Review and update product governance frameworks to ensure they explicitly incorporate Consumer Duty outcomes, including structured consideration of customer needs, characteristics and objectives at every stage of product design and lifecycle.
• Define and document granular target markets for each retail product and service, clearly articulating which customer segments the product is designed for, and excluding groups for whom the product could cause foreseeable harm.
• Map products and services against vulnerable‑customer characteristics and update design, features, pricing and servicing models to mitigate risks and support good outcomes for vulnerable groups.
• Implement or enhance processes to collect comprehensive management information on consumer outcomes (complaints, customer feedback, usage patterns, lapse and cancellation data, arrears and forbearance metrics) for each product.
• Establish governance mechanisms to ensure that insights from monitoring and MI lead to timely, documented actions to improve products, pricing, communications or customer journeys where emerging risks or poor outcomes are identified.

What changed

• - FCA reinforces that product design must be explicitly based on evidenced consumer needs, characteristics and behaviours, rather than generic assumptions or internal commercial priorities.
• Firms are expected to define target markets at a granular level, avoiding broad or generic categories that mask differing needs or risks (especially for vulnerable customers).
• Product governance must be embedded into business‑as‑usual decision‑making with clear ownership, challenge and accountability, not treated as a one‑off Consumer Duty implementation project.
• Manufacturers and distributors must maintain robust, ongoing monitoring of consumer outcomes using a wide range of management information, including complaints, usage patterns, early cancellations...
• There must be a clear, demonstrable link between monitoring and remedial action; collecting data without acting on emerging risks is characterised as weak practice.

Key dates

20 January 2026

– CSSF publishes Circular 26/906 on central administration, internal governance and risk management for payment and e‑money institutions, raising supervisory expectations for the sector

2 March 2026

– CSSF issues the administrative sanction decision imposing an administrative fine of EUR 12,000 on PingPong Europe S.A. as an electronic money institution

30 June 2026

– Effective date of CSSF Circular 26/906, from which strengthened governance, risk management and safeguarding requirements apply to payment and e‑money institutions

8 July 2026

– CSSF publicly publishes the administrative sanction of 2 March 2026, formally informing the market and stakeholders

Suggested considerations

• Review the CSSF sanction against PingPong Europe S.A. and identify which categories of requirements (e.g. governance, safeguarding of client funds, reporting, outsourcing, internal controls) were implicated, then map these to your own control framework.
• Conduct a gap analysis against CSSF Circular 26/906, focusing on central administration, internal governance, risk management, and safeguarding of client funds for payment and e‑money institutions.
• Update policies, procedures and internal control documentation governing payment services, e‑money issuance, safeguarding (segregation, reconciliations), outsourcing and IT connectivity to ensure alignment with CSSF Circular 26/906.
• Ensure that a clearly designated member of the management body holds documented responsibility for oversight of safeguarding arrangements and compliance with CSSF requirements for payment and e‑money institutions.
• Implement or enhance daily reconciliations and robust segregation of client funds accounts, supported by periodic internal reviews and testing of safeguarding controls.

What changed

• (From the enforcement notice itself, there are no new rules; the impact is interpretative and enforcement‑related.)
• CSSF confirms that authorised electronic money institutions are subject to active supervisory and enforcement scrutiny, including public administrative sanctions for regulatory breaches.
• The sanction demonstrates that failures which may appear operational or procedural can nonetheless result in monetary fines and public naming, reinforcing the need for robust compliance frameworks in...
• The case is likely to be assessed by CSSF in light of the new governance, risk management and safeguarding expectations introduced under CSSF Circular 26/906 for payment and e‑money institutions,...
• The public nature of the sanction underscores CSSF’s use of transparency as a deterrent tool, increasing reputational risk for firms that do not comply with licensing, governance, reporting or...

Key dates

Early 2Q 2024

- JFSA previously indicated additional jurisdictions would be added to the travel rule scope, signaling the ongoing evolution of the jurisdiction list and the need for firms to monitor regulatory updates

July 2026

- JFSA publishes the finalized partial amendment to the designation of countries/regions under Articles 17-2 and 17-3 of the Order for Enforcement of the APTCP following public consultation, confirming five additional jurisdictions

03 August 2026

- The finalized amendment to the designation of countries and regions under Articles 17-2 and 17-3 of the Order for Enforcement of the APTCP takes effect; travel rule obligations for transfers to VASPs in the newly added jurisdictions become legally binding from this date

Suggested considerations

• Review and obtain the official Attachment to identify the five newly added jurisdictions and verify their exact legal names and any specific conditions attached to their designation.
• Update internal jurisdiction lists and travel rule mapping to reflect all currently designated countries and regions under Articles 17-2 and 17-3, including the newly added five jurisdictions, ensuring that this mapping is embedded in transaction routing and screening engines.
• Revise travel rule implementation procedures so that originator and beneficiary information is consistently transmitted for all transfers of cryptoassets and electronic payment instruments from Japanese VASPs to foreign VASPs located in designated jurisdictions, including the new additions.
• Confirm that no de minimis threshold is applied in practice to covered transactions and that systems are configured to send travel rule data regardless of transaction size when the counterparty is in a designated jurisdiction.
• Update customer and counterparty onboarding documentation and contractual terms for foreign VASPs in newly designated jurisdictions to reflect their status as travel rule counterparties and any data-sharing, security, and retention requirements.

What changed

• - Japan has finalized a partial amendment to the list of designated countries/regions under Articles 17-2 and 17-3 of the Order for Enforcement of the Act on Prevention of Transfer of Criminal...
• The amendment expands the set of foreign jurisdictions for which Japanese firms must apply travel rule obligations when transferring cryptoassets and electronic payment instruments to foreign VASPs,...
• For transfers of cryptoassets and electronic payment instruments from Japanese VASPs to foreign VASPs, travel rule obligations apply only when the counterparty VASP is located in a jurisdiction...
• Transfers to foreign VASPs in non-designated jurisdictions remain outside the Japanese travel rule transmission obligation, reflecting JFSA’s concern about regulatory ineffectiveness where equivalent...
• The amendment confirms that the travel rule applies to both cryptoassets (virtual assets, VAs) and electronic payment instruments, including stablecoins (SCs) handled by Cryptoasset Exchange Service...

Key dates

Autumn 2026

(TBD) - PVDC expected to publish its detailed **strategy for retail payments infrastructure**, setting key priorities for next‑generation infrastructure and aligning with the National Payments Vision

Q2 2026

(already in train) - HM Treasury consultation on retained EU payments law and FCA engagement paper (Payments Forward Plan context; relevant for alignment with infrastructure changes)

25 June 2026

- Retail Payments Infrastructure Board consultation on the design of the Future Retail Payments Infrastructure is launched

11 September 2026 Deadline

- Deadline for submission of responses to the RPIB consultation on the future retail payments infrastructure

Suggested considerations

• Assess and document your firm’s current and projected use of UK retail interbank payments (including Faster Payments, account‑to‑account, and cross‑border flows) to inform your response to the RPIB consultation.
• Prepare and submit a coordinated consultation response to the RPIB by 11 September 2026, covering your views on payment journeys, design choices, consumer protection needs and financial crime controls.
• Review your firm’s commercial and pricing models for interbank payments to understand how potential changes to the future infrastructure’s commercial model could affect revenue, costs and access.
• Map dependencies between your operational resilience framework and the existing UK retail payments infrastructure, and identify key risks and mitigants under a transition to the next‑generation infrastructure.
• Engage with industry bodies, Pay.UK and relevant trade associations to align positions on access, interoperability, fraud management, and technical standards for next‑generation retail payments.

What changed

• - A new governance and delivery model for UK retail payments infrastructure is being operationalised, with strategy set by the PVDC, design work led by the RPIB, and implementation by a new...
• The RPIB has launched a formal consultation on the design of the future retail payments infrastructure, seeking views on payment journeys, key design choices and priorities.
• The PVDC has published additional context to support stakeholders’ reading of the consultation, including expectations for the commercial model, consumer protection outcomes and financial crime...
• Responsibilities across the ecosystem are being reset, with clearer roles for public authorities (HM Treasury, Bank of England, FCA, PSR), Pay.UK, and industry participants in designing and...
• Next‑generation infrastructure is expected to support account‑to‑account payments at point of sale, enhanced cross‑border payments, and interoperability with new forms of digital money (including...

Key dates

Q2 2026 (April–June 2026)

- Period covered by MAS’ “Key Enforcement Actions Taken by MAS in Q2 2026” enforcement round-up

14 May 2026

- Effective date of MAS’ revocation of the Major Payment Institution licence of Bsquared Technology Pte Ltd (BSQ)

18 May 2026

- MAS announced reprimands against senior management of Havenport Investments Pte Ltd and a $40,000 composition fine on the firm for regulatory breaches

19 May 2026

- Mr Tan Chun Yong and Mr Xie Jianfeng were convicted and sentenced (10 weeks’ imprisonment and a $200,000 fine respectively) for trading-related offences under the SFA

20 May 2026

- MAS published the outcomes of the SFA trading-related convictions and confirmed revocation of BSQ’s MPI licence with effect from 14 May 2026

Suggested considerations

• Review and, where necessary, enhance senior management and board-level oversight frameworks to ensure that responsibilities for MAS regulatory compliance are clearly allocated, documented, and evidenced (e.g. through committee charters, management information, and challenge records).
• Conduct a targeted compliance review at fund managers and other CMS licence holders to assess adherence to MAS regulations, focusing on areas previously cited in MAS enforcement actions (e.g. internal controls, client asset safeguards, and recordkeeping).
• For Major Payment Institutions and other payment providers, perform a comprehensive gap analysis of risk management frameworks, conflict-of-interest policies, and compliance with MAS Guidelines on Outsourcing, including due diligence, ongoing monitoring, and intra-group/related-party arrangements.
• Implement or strengthen formal governance around the accuracy and completeness of all information submitted to MAS (licence applications, regulatory returns, inspection responses), including sign-off controls, documentation standards, and verification procedures.
• For licensed trust companies and other AML/CFT-obliged entities, review and update AML/CFT policies, customer due diligence (CDD) and enhanced due diligence (EDD) procedures, ongoing monitoring, and suspicious transaction reporting processes in line with MAS Notices and Guidelines.

What changed

• - MAS reaffirmed its willingness to hold senior management personally accountable where they fail to ensure their institution complies with MAS regulations, as illustrated by reprimands against...
• MAS demonstrated continued zero tolerance for trading-related offences under the Securities and Futures Act (SFA), supporting criminal prosecutions that resulted in imprisonment and substantial fines...
• MAS confirmed that Major Payment Institution (MPI) licences can and will be revoked where inspections reveal significant weaknesses in risk management, conflict-of-interest policies, and...
• MAS signalled continued priority on AML/CFT supervision and enforcement by imposing a $300,000 composition penalty on a licensed trust company (Padang Trust Singapore Pte.
• MAS underscored its ongoing focus on insider trading and market abuse by imposing a civil penalty on an individual for insider trading in shares of a Singapore-listed (now delisted) company.

Key dates

10 November 2025

- Bank of England consultation paper issued on the proposed regulatory framework for sterling‑denominated systemic stablecoins and systemic payment system operators

Late 2026

- Bank of England intends to finalise the Code of Practice and supporting materials by the end of 2026, confirming the prudential and structural regime for systemic stablecoins

From 2026

- UK introduces new regulatory authorisation requirements for stablecoin issuers, including FCA authorisation for qualifying issuance and custody activities

10 February 2026

- Consultation period closes for the Bank of England’s systemic stablecoin regime proposals

June 2026

- Bank of England publishes its policy statement and draft Code of Practice for systemic stablecoin issuers, setting out detailed prudential and backing‑asset rules and confirming joint work with the FCA on an end‑to‑end regime

Suggested considerations

• Map all existing and planned sterling‑denominated stablecoin products against the UK’s systemic and non‑systemic regimes and assess whether their intended use in UK payments could trigger HM Treasury systemic recognition.
• Initiate or update FCA authorisation applications for stablecoin issuance and cryptoasset custody activities, ensuring business models, governance and safeguarding arrangements align with CP25/14 and the forthcoming stablecoin regime.
• Design and implement reserve‑management frameworks capable of maintaining backing assets equal to outstanding coins, in the proposed 70/30 mix between short‑term UK government debt and Bank of England deposits, with appropriate stress testing and liquidity risk oversight.
• Establish statutory trust and segregation structures for backing assets and liquid‑asset reserves, including appointing UK‑authorised third‑party custodians and aligning documentation with FCA client‑asset‑style protections and coinholder proprietary claims.
• Develop capital planning processes and ICAAP‑style assessments to meet the Bank of England’s requirements for capital against general business risk and dedicated reserves for financial risk and wind‑down costs.

What changed

• - UK stablecoin issuance will be subject to a dual regulatory regime: non‑systemic stablecoins will be supervised solely by the FCA, while systemic stablecoins used for payments will be jointly...
• Issuing a qualifying sterling‑denominated stablecoin in the UK will become a regulated activity, requiring FCA authorisation for non‑bank issuers and bringing them within the FCA’s prudential,...
• HM Treasury will apply statutory systemic tests under the Banking Act (e.g. scale, interconnectedness, substitutability, impact on confidence in sterling) to decide whether a stablecoin payment...
• Once recognised as systemic, stablecoin issuers and systemic payment system providers will fall under the Bank of England’s remit under the Banking Act 2009, including powers to obtain information,...
• Systemic sterling‑denominated stablecoin issuers will be required to maintain backing reserves equal to all outstanding coins, with backing assets held on statutory trust in the UK and ring‑fenced...

Key dates

26 June 2026

- CBI publishes the warning notice against Loan Empower Solution as an unauthorised retail credit firm and lists the firm under section 53 of the Central Bank (Supervision and Enforcement) Act 2013

Suggested considerations

• Review and update internal unauthorised-firm and scam monitoring procedures to ensure Loan Empower Solution and its identifiers (name, website, address, email, telephone number) are captured in watchlists, fraud rules, and staff guidance.
• Screen recent and ongoing customer transactions and communications for any references to Loan Empower Solution or similar lending scams requesting upfront “loan fees”, and escalate any matches to fraud and compliance teams.
• Update customer-facing communications and website scam warnings to highlight the risk of advance fee fraud in retail credit, referencing the need to check the CBI registers and unauthorised-firms list before engaging with lenders.
• Ensure call centre, branch, and digital support staff are trained to identify and respond to customers approached by unauthorised lenders, including how to advise customers to verify authorisation status on the CBI website and to report suspected scams.
• Incorporate checks against the CBI unauthorised firms search into onboarding, due diligence, and third-party risk management processes for any lending-related partnerships, introducers, or lead generators.

What changed

• - The CBI has added Loan Empower Solution (website: lesolution.eu) to its public list of unauthorised firms and explicitly categorised it as an unauthorised retail credit firm operating without the...
• The CBI has publicly stated that Loan Empower Solution appears to be operating an advance fee fraud model, where upfront payments are requested for credit services that are never provided.
• The CBI has confirmed that the firm is using a purported Irish business address (The Merrion Buildings, 18–20 Merrion Street, Dublin 2, D02 XH98), a non-Irish telephone number, and a specified...
• The firm’s name has been published under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, reaffirming the CBI’s use of its statutory power to publicly identify entities...
• The CBI has directed the public to its unauthorised firms search and financial scams information pages, implicitly reinforcing expectations that firms promote use of these tools in their consumer...

Key dates

18 June 2025

- FATF adopts modifications to Recommendation 16 to enhance payment transparency, including strengthened travel‑rule standards

24 June 2026

- FATF launches public consultation on guidance for the implementation of the updated Recommendation 16

21 August 2026 Deadline

- FATF public consultation period closes; this is the deadline for private‑sector contributions highlighted by the CSSF

End 2030

- FATF’s revised Recommendation 16 framework is expected to be fully effective, with jurisdictions having implemented the standard into national law or regulation by this date

Suggested considerations

• Map and document all existing and planned cross‑border payment and value‑transfer flows (including virtual asset transfers) to identify where FATF Recommendation 16 and travel‑rule obligations currently apply or will apply by 2030.
• Review the June 2025 FATF modifications to Recommendation 16 and the current consultation materials, and perform a gap analysis against your existing AML/CTF, KYC and payments data standards, including thresholds, data fields, and monitoring use‑cases.
• Establish an internal project for travel‑rule implementation and enhancement that spans AML, operations, technology, legal and data‑protection teams, with explicit ownership and governance.
• Strengthen beneficiary‑side transaction‑monitoring rules to use incoming travel‑rule data for sanctions, fraud and AML detection, including controls to identify misdirected or unusual payments based on name, location, and other attributes.
• Review and, where necessary, update customer due diligence and KYC procedures to ensure the availability and verification of data fields that will be required to travel with transactions (for example, address, town and country, identification numbers, date of birth).

What changed

• *(Based on the CSSF notice plus the 2025 FATF revisions to Recommendation 16 and existing travel‑rule standards; details may be further refined by the new guidance now under consultation.)*
• FATF is issuing implementation guidance for the updated Recommendation 16, which already increased obligations regarding payment transparency, including more granular beneficiary data and expanded...
• Cross‑border payments and value transfers above 1,000 USD/EUR are expected to include additional mandatory beneficiary information, such as beneficiary name, account or unique reference, and at least...
• Beneficiary institutions are given enhanced responsibilities to use travel‑rule information (not just receive it) for transaction monitoring, including detecting misdirected payments and indicators...
• The revised travel rule continues to apply to both traditional wire transfers and value transfers involving virtual assets, reinforcing that Virtual Asset Service Providers (VASPs) must collect,...

Key dates

26 June 2026

- ECB announces the comprehensive review of around 130 supervisory guidance publications, confirms discontinuation of about 40 outdated documents, and signals targeted and in‑depth revisions for the remaining guidance set

Q3 2026 (approx.)

- Revised **Guide to the internal capital adequacy assessment process** is expected to be published “shortly” after the press release, incorporating clarified treatment of the management buffer and its relationship to Pillar 2 guidance

Q3–Q4 2026 (approx.)

- Removal of supervisory expectations on **credit conversion factor (CCF)** from the **Guide to internal models** and the removal of **CVA references** from the **Guide on assessment methodology** and the **Guide on materiality assessment** are implemented as part of the ongoing review and alignment with EBA guidance and CRR III

Q4 2026–2027 (TBD)

- **Public consultations** will be launched on those guidance documents identified as needing substantial revision, ahead of finalising the updated versions

Q1 2027

- Publication of the new **report on good practices in governance and risk culture**, replacing the existing Draft guide on governance and risk culture, following finalisation of the revised EBA Guidelines on internal governance

Suggested considerations

• Review the ECB press release and associated lists of discontinued publications to identify any ECB guides, reports, letters or methodologies currently referenced in your internal policies, risk frameworks or model documentation that are now labelled as discontinued.
• Update internal policy inventories, regulatory mapping and compliance registers to reflect the new classification of ECB supervisory guidance as non‑binding and to distinguish clearly between binding EU/national law and non‑binding ECB expectations.
• For banks using the ICAAP Guide, perform a gap analysis of capital planning and management buffer practices against the forthcoming clarified expectations, ensuring internal documentation clearly differentiates management buffers from Pillar 2 requirements and guidance.
• For institutions using internal models for credit risk, remove any reliance on the ECB’s former CCF expectations by re‑mapping modelling policies and documentation to forthcoming EBA guidelines on credit conversion factors and to CRR/CRD provisions, once those guidelines are finalised.
• For risk and finance functions, review the CVA treatment in internal capital and risk methodologies to verify alignment with CRR III and ensure that internal references to ECB guidance (assessment methodology, materiality assessment) are updated to reflect the removed CVA content.