Regulatory Guidance

Key dates

2024-06-30

MiCAR provisions concerning asset-referenced tokens and e-money tokens became applicable.

2024-12-30

Most remaining MiCAR provisions, including the principal Title II framework for offers and admissions to trading of other crypto-assets and Title V CASP requirements, became applicable.

2026-11-06

The AFM published its warning and reminder concerning public crypto-asset offerings, memecoins, white papers and marketing communications.

Suggested considerations

• Compliance teams may wish to identify every token launched, distributed or promoted to EU users and document whether the activity is an issuance, public offer, admission to trading or a crypto-asset service under MiCAR.
• Firms should consider confirming that the issuer is a legal person and recording the basis on which any MiCAR exemption is relied upon, including the relevant investor-count or EUR 1,000,000 12-month threshold where applicable.
• Before marketing or distribution, firms should consider preparing, notifying and publishing the required MiCAR white paper and ensuring that its content follows the applicable regulatory technical standards and AFM submission expectations.
• Marketing, influencer activity, website content and social-media posts should be reviewed for fair, clear and non-misleading presentation, clear advertising identification, balanced risk disclosure and consistency with the white paper.
• Firms should consider retaining approval records, versions of promotional content, influencer instructions, audience and jurisdiction controls, and evidence supporting any exemption or risk classification.
• Trading platforms and CASPs may wish to assess onboarding and listing controls for tokens whose issuer, white paper, promotional claims or market-abuse risk indicators are unclear.
• Compliance teams should consider escalation procedures for exaggerated profit claims, undisclosed paid promotion, misleading statements about token utility or supply, and conduct suggesting fraud or market manipulation.
• Firms should consider checking whether the token is instead a financial instrument or an asset-referenced token or e-money token, in which case MiFID II or MiCAR Titles III or IV and their associated authorisation requirements may apply rather than, or in addition to, the ordinary Title II analysis.

What changed

The publication does not introduce a new regulation or effective date; it restates and foregrounds existing obligations under Regulation (EU) 2023/1114 on markets in crypto-assets (MiCAR). Under MiCAR Title II, a person intending to make a public offer of a crypto-asset other than an asset-referenced token or e-money token, or seeking its admission to trading, generally must be a legal person, draw up a crypto-asset white paper, notify it to the competent authority and publish it.

Key dates

2026-11-05

CFTC issued the interpretation of the impartial access requirements in 17 CFR 38.151(b).

2026-12-05 Deadline

Thirty-day period expires for DCMs to cease domestic geographic restrictions that violate the impartial-access requirements or submit an explanation to the Division of Market Oversight why compliance is not feasible; the same period applies to addressing intermediary impediments or explaining why compliance is not feasible.

Suggested considerations

• DCMs should inventory all domestic geographic eligibility, onboarding, trading, product-access, and account-management restrictions and assess them against 17 CFR 38.151(b)'s requirements for impartial, transparent, and non-discriminatory access.
• DCMs should review whether state-based restrictions affect members, persons with trading privileges, independent software vendors, or access to particular products, including event contracts.
• DCMs should identify and review contractual, technical, and operational controls used by futures commission merchants, introducing brokers, and other intermediaries to determine whether they impose geographic restrictions inconsistent with the DCM's impartial-access requirements.
• DCMs should document the legal and operational basis for removing each restriction or, where removal is not feasible, prepare a fact-specific explanation for the Division of Market Oversight before the 30-day period expires.
• Compliance teams at intermediaries should map state-based geofencing, customer-location verification, product blocking, and position-management restrictions affecting access to DCM markets and assess whether those controls are required by applicable law, regulation, or court order.
• Affected firms should assess conflicts between the CFTC's interpretation and any state requirements or judicial orders, obtain legal analysis, and avoid treating the interpretation as automatically vacating an injunction or other binding court order.
• DCMs should retain evidence of governance review, intermediary oversight, customer communications, access testing, and remediation decisions in anticipation of possible fact-specific CFTC inquiry or enforcement.

What changed

The CFTC has applied the existing impartial-access requirements in 17 CFR 38.151(b) expressly to domestic geographic restrictions, including restrictions based on a market participant's state or location. DCMs must cease geographic restrictions that violate the rule within 30 days of the November 5, 2026 publication, or submit an explanation to the Division of Market Oversight stating why compliance is not feasible.

Key dates

2026-11-05

CFTC Division of Clearing and Risk issued the no-action letter and accompanying public release addressing trust companies used for daily settlements.

Suggested considerations

• Compliance teams may wish to identify any existing or proposed trust-company settlement arrangements and determine whether each arrangement is being governed under the DCO’s settlement-bank policies and procedures.
• DCOs should consider documenting that each trust company satisfies the applicable 17 CFR 39.14 settlement-bank criteria, including capitalization, creditworthiness, liquidity access, operational reliability, and regulatory status.
• Firms should consider reviewing account structures, settlement agreements, payment workflows, and legal opinions to confirm that transfers are irrevocable and unconditional no later than the time the relevant DCO or clearing-member account is debited or credited.
• DCOs may wish to assess credit, liquidity, concentration, and intraday settlement exposures arising from the use of each trust company and confirm that monitoring, escalation, collateral, and contingency arrangements remain adequate.
• Operations and resilience teams may wish to test the trust company’s connectivity, payment-failure procedures, recovery arrangements, and coordination with the DCO’s business-continuity and disaster-recovery plans.
• Legal and compliance teams should consider recording the no-action letter’s conditions and limits in the DCO’s regulatory inventory, noting that the relief is staff relief rather than a binding amendment to Part 39 and may not extend to materially different structures or facts.
• Clearing members may wish to confirm that their agreements with the DCO and trust company allocate settlement, segregation, insolvency, operational, and account-control risks consistently with the DCO’s approved procedures.

What changed

The letter provides staff no-action relief for a DCO that uses a trust company to conduct daily settlement, notwithstanding the distinction between a trust company and a settlement bank under the CFTC framework. It does not create a generally applicable exemption or amend 17 CFR Part 39; instead, it allows the arrangement provided the trust company is managed and controlled as a settlement bank.

Key dates

2024-07-09

Directive (EU) 2024/1619 (CRD VI) entered into force, introducing or strengthening governance requirements including responsibility mapping and a dedicated framework for third-country branches.

2025-01-01

The CRD VI banking package began applying according to the EBA consultation materials, with the revised Guidelines intended to support implementation of the updated framework.

2026-11-05

The EBA published the final revised Guidelines and the final report on internal governance.

Suggested considerations

• Compliance teams may wish to identify the competent authority’s expected adoption or comply-or-explain treatment once the final Guidelines are translated and formally notified, because no application date is specified in the published final report.
• Firms should consider performing a gap assessment against the final provisions on management-body responsibilities, senior-management and key-function-holder role statements, responsibility mappings, reporting lines, organisational structures and internal-control arrangements.
• Institutions may wish to review board and committee terms of reference, chair and executive-role combinations, conflict-of-interest registers, recusal controls and escalation procedures against the clarified expectations.
• Third-country-branch operators should consider mapping the new branch-specific governance requirements to the local branch manager, head-office governance, risk management, internal control, oversight and reporting arrangements, using the proportionality available in the final text.
• Firms should consider checking consistency between internal-governance documentation and DORA-related ICT risk, operational resilience, business-continuity and third-party-risk arrangements.
• Groups may wish to determine which entities fall within the Guidelines and whether responsibility mappings should be maintained at entity, branch and group levels, documenting the rationale for the chosen scope.
• Compliance teams may wish to retain evidence of proportionality assessments based on size, nature, scale and complexity, rather than removing governance controls solely because the final Guidelines are less granular than the consultation draft.
• Firms should monitor publication of the final Guidelines in all EU official languages and subsequent national competent-authority communications before setting internal implementation deadlines.

What changed

The Guidelines clarify the responsibilities of the management body, senior management and key function holders, including documented statements of roles and duties and a mapping of responsibilities. They address organisational structures, management of conflicts of interest—including situations where the chair also has executive functions—and key elements of internal control frameworks. They introduce or clarify governance expectations for third-country branches under CRD VI, with greater proportionality than in the consultation draft.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the Supervisory Framework on Bank Use of Super Intelligence for examiner use.

Suggested considerations

• Compliance teams may wish to inventory current and planned SI and agentic-SI use cases, including embedded functionality supplied by vendors, and map each use case to its business owner, permitted actions, autonomy level, human oversight, data sources, and potential consequences of failure or misuse.
• Banks should consider documenting a risk-based classification methodology focused on potential consequences, transfer of agency, and degree of human oversight rather than technical sophistication alone.
• Risk and control owners may wish to assess whether existing model-risk, governance, data-governance, privacy, cybersecurity, compliance, operational-resilience, vendor-management, testing, monitoring, documentation, auditability, and independent-challenge controls adequately address SI-enabled activities.
• Higher-consequence or more autonomous use cases should be considered for stronger restrictions on permitted actions, more direct human oversight, independent validation or challenge, enhanced performance monitoring, audit trails, testing, fallback procedures, and resilience measures.
• Boards and senior management may wish to clarify accountability for SI deployments without creating a separate SI risk appetite unless the bank determines that one is useful internally; the OCC framework does not require one.
• Internal audit and compliance teams may wish to retain evidence showing how SI risks are identified, measured, monitored, controlled, and escalated within existing risk-management frameworks, particularly because examiners may use the framework during ordinary examinations despite its nonbinding status.
• Banks should consider reviewing contracts and oversight arrangements for SI vendors, including access to data, model changes, incident notification, testing rights, service continuity, explainability or transparency, subcontracting, and termination or fallback arrangements.
• Compliance teams may wish to monitor future OCC revisions and stakeholder feedback because the framework is expressly intended to be a living document.

What changed

The OCC provided examiners with a risk-based, proportionate framework covering SI used in activities including credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities. Examiners are instructed to consider the bank’s size, complexity, risk profile, and the nature, consequences, autonomy, and complexity of each SI use case; banks are not required to create a separate SI risk category or SI-specific risk appetite. The framework identifies 16 components across six pillars: purpose, risk, control, oversight, resilience, and assurance.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the accompanying supervisory framework for examiner use.

2026-10-02

Executive Order 14434 was published in the Federal Register and is cited by the OCC as the source for the “super intelligence” terminology and broader definition.

Suggested considerations

• Firms should consider maintaining an inventory of SI and agentic use cases, documenting each system’s purpose, permitted actions, accessible data and systems, prohibited uses, degree of autonomy, human-oversight model, and business owner.
• Compliance teams may wish to prioritize review of use cases according to potential consequences of failure or misuse, transfer of decision-making agency, reversibility, customer or market impact, data sensitivity, and the practical ability of personnel to intervene.
• Banks should consider testing whether human reviewers can meaningfully understand, reject, pause, or stop system outputs and actions, rather than relying solely on nominal approval checkpoints or high-volume bulk approvals.
• Risk functions may wish to map SI-enabled activities to existing model risk management, operational-risk, cybersecurity, privacy, consumer-protection, compliance, and business-continuity controls instead of creating a standalone SI risk category.
• Governance teams should consider assigning accountable owners across the system lifecycle, including approval, deployment, change management, incident response, suspension, retirement, and post-incident remediation.
• Banks should consider establishing monitoring capable of detecting model drift, erroneous or harmful actions, unauthorized activity, control exceptions, low-frequency high-impact events, and customer harm, with defined escalation and containment procedures.
• Third-party risk teams may wish to review contracts for vendor notification of model changes and new SI functionality, incident and notification timelines, audit and testing rights, data-use restrictions, responsibility for model errors, service suspension rights, and operational-resilience obligations.
• Internal audit and independent validation functions should consider whether they can reconstruct material outputs and actions, assess control effectiveness, and provide effective challenge to developers, business owners, and validation teams.

What changed

The OCC provided examiners with a framework that supplements existing model risk management, governance, technology, compliance, cybersecurity, and operational-risk practices. It covers 16 components organized around purpose, risk, control, oversight, resilience, and assurance, including permitted use and authority, criticality assessment, human-in-the-loop and human-on-the-loop controls, governance and accountability, performance monitoring, operational resilience, documentation and auditability, vendor risk, testing, and independent challenge.

Key dates

2026-11-02

The FCA published its expectations for lenders making voluntary motor finance settlement offers; the page was updated on 2026-11-03.

2026-10-01

Barclays Partner Finance identified customers whose complaints had been acknowledged on or before this date as a cohort for some early settlement offers.

2027-02-16

The scheduled start of the legal challenges to the FCA motor finance compensation scheme.

2027-03-03

The scheduled end date of the hearing window for the legal challenges to the FCA motor finance compensation scheme.

Suggested considerations

• Firms considering early settlements should assess each offer against the maximum redress that would have been available under the FCA motor finance compensation scheme, rather than using a lower discretionary amount.
• Compliance teams may wish to establish governance and second-line review for the methodology, calculations, customer segmentation and approval of settlement communications.
• Firms should consider notifying the FCA before making offers and supplying the FCA factsheet with each customer communication.
• Offer letters should clearly state the amount, calculation basis, the full-and-final effect of acceptance, the inability to claim more later, the option to reject and remain within the scheme, and the consequences for the existing complaint.
• Firms should consider allowing at least one month for customers to respond and retaining evidence that customers had sufficient information and time to make an informed decision.
• Marketing, customer-service and complaints teams should avoid language suggesting FCA endorsement, approval or validation of an individual offer.
• Firms should consider controls to prevent accepted settlements from being subsequently processed as scheme claims or referred to the Financial Ombudsman Service.
• Motor finance lenders should continue preparing for the compensation scheme and progress complaints as far as possible during the partial suspension, even if scheme compensation is not currently calculated or paid.

What changed

Lenders may make voluntary settlement offers before the partially suspended FCA motor finance compensation scheme is implemented, but the FCA expects each offer to provide at least the compensation the customer would receive under the scheme, calculated by reference to the relevant agreement and the scheme methodology. Firms intending to make offers are expected to notify the FCA, provide the FCA factsheet to customers, and ensure communications are clear, fair and not misleading.

Key dates

2026-09-30

The FCA’s application window for the new UK cryptoasset regime opened.

2026-10-01

The application window opened for the FCA Regulatory Sandbox themed cohort on climate scenario models.

2026-11-02

The FCA published Wholesale banks supervision - Insights 3 (Autumn 2026).

2026-11-30 Deadline

The application window closes for the FCA Regulatory Sandbox climate scenario models cohort.

2027-02-28 Deadline

FCA-encouraged deadline for wholesale banks to submit a variation-of-permission application for new regulated cryptoasset activities to obtain the stated pre-regime application treatment.

2027-10-25

The new UK cryptoasset regime comes into force.

Suggested considerations

• Firms should consider performing a control-by-control review of critical data ingestion, including completeness checks, reconciliation, coding-change testing, source-to-consumption lineage and evidence of design and operating effectiveness for financial-crime and surveillance controls.
• Compliance and technology teams may wish to test communications surveillance after system changes, including lexicon configuration, geographic and channel coverage, third-party-provider interfaces, ingestion completeness and retention or auditability of records for in-scope activities.
• Firms should consider reconciling the technology-asset inventory to procurement, disposal, redeployment, identity and endpoint-management records across all regions, assigning clear lifecycle accountability and confirming that assets cannot leave service without security and inventory updates, including encryption status.
• Algorithmic-trading firms should consider testing enhancements across the complete order lifecycle, including near-simultaneous and geographically distributed fills, order-management and fill-notification interactions, overfills, stop-loss scenarios, venue behaviour, pre-trade limits, kill or cancel mechanisms and post-implementation monitoring, with governance aligned to UK MiFID RTS 6.
• Firms should consider testing DLP controls against deliberate circumvention, including split messages, altered classifications, changed file formats, embedded images and misleading subjects, while reviewing staff training, monitoring, escalation and privacy safeguards.
• Operational-resilience owners may wish to refresh important-business-service impact tolerances using potential disruption to trading, settlement, clients, counterparties and time-critical market processes rather than relying solely on generic recovery-time or availability metrics.
• Firms should consider separating current resilience capability from planned remediation in self-assessments, linking incidents, near misses and test results to mapping and remediation decisions, and validating completed remediation through retesting.
• Settlement-related firms should consider the effect of T+1 on post-trade dependencies, reconciliation, funding, exception management, recovery capability, scenario testing and impact-tolerance calibration.

What changed

The FCA has not introduced new binding rules through this publication; it has consolidated supervisory findings and clarified areas against which wholesale banks may be assessed. Firms are expected to be able to evidence complete data lineage and ingestion controls, auditable recording and communications surveillance even where third parties are used, reliable asset inventories, end-to-end algorithmic-trading testing and controls consistent with UK MiFID RTS 6, and DLP controls capable of addressing adaptive evasion techniques.

Key dates

2026-05-11

The European Commission published its MMF adequacy report identifying market-resilience WLA benchmarks of 20% for VNAV MMFs and 40% for public debt CNAV and LVNAV MMFs, compared with MMFR minima of 15% and 30%, respectively.

2026-06-08

The CSSF launched its consultation on guidance for MMF weekly liquid asset levels.

2026-08-03 Deadline

Deadline for stakeholders to submit responses to the CSSF consultation.

2026-10-30

The CSSF published the final guidance and feedback statement and began a three-month implementation period.

2027-01-30 Deadline

Expected end of the CSSF's three-month implementation period, calculated from publication on 30 October 2026.

Suggested considerations

• Firms should identify each in-scope MMF's applicable WLA benchmark, distinguishing VNAV funds from public debt CNAV and LVNAV funds, and document the classification rationale.
• Managers should review daily liquidity, weekly liquidity, portfolio composition and liquidity-buffer targets against both the binding MMFR minima and the higher CSSF market-resilience benchmarks.
• Risk teams should enhance monitoring and escalation procedures for WLA levels approaching or falling below 20% or 40%, including ownership, management-information frequency, escalation thresholds and evidence of reinforced decision-making.
• Managers should update MMFR Article 28 stress-testing methodologies and governance to reflect the 20% VNAV and 40% public debt CNAV/LVNAV resilience levels, while retaining the existing MMFR regulatory minima and applicable ESMA stress-test requirements.
• Firms should establish a documented process for counting consecutive business days below the applicable benchmark and for notifying the CSSF after more than 10 business days or when a prolonged or substantial deviation is expected.
• Where stress testing identifies vulnerability, compliance and risk functions should assess whether Article 28(4) immediate notification, Article 28(5) reporting and an action plan are required.
• Managers should prepare records explaining any sustained deviation, including investor-liability characteristics, redemption patterns, liquidity-risk-system outputs, stress-test results and remedial measures, because the CSSF may increase supervisory scrutiny and review available information.
• Firms should assess whether prospectus disclosures, internal liquidity-risk policies, investment guidelines, delegation arrangements and board or conducting-officer reporting need updating during the three-month implementation period.

What changed

The final guidance follows the CSSF consultation launched on 8 June 2026 and contains only slight clarifications after stakeholder feedback. MMF managers are expected to treat 20% WLA for VNAV funds and 40% WLA for public debt CNAV and LVNAV funds as market-resilience reference levels within their liquidity-risk-management and stress-testing frameworks. When WLA approaches or falls below the applicable level, managers should apply enhanced vigilance, timely escalation and reinforced internal decision-making.

Key dates

2026-10-29

FCA published Fair value in consumer finance and associated supervisory commentary; the examples are effective as supervisory guidance and do not create new rules.

Suggested considerations

• Compliance teams may wish to inventory every financial and non-financial charge across each product's full customer journey and lifetime, including contingent, arrears, repeat and cumulative charges.
• Firms should consider refreshing fair value assessments to reconcile current pricing and charging data with quantified or otherwise evidenced customer benefits, product limitations, service quality and foreseeable risks.
• Firms may wish to document how assumptions, management information, customer outcomes and governance challenge support each fair value conclusion, with clear ownership and audit trails.
• Firms should consider segmenting analysis by relevant customer groups, including vulnerability characteristics, credit risk, product usage, distribution channel and customers experiencing financial difficulty, and testing whether outcomes differ materially.
• Compliance teams may wish to establish monitoring for arrears, complaints, cancellations, usage, enquiries, refunds, waivers, repeat charges and customer understanding, with defined escalation thresholds and remediation options.
• Firms should consider testing whether fees and charges are communicated clearly, prominently and at the point customers need them to make informed decisions, including through customer-understanding testing.
• Firms may wish to review controls for grace periods, charge caps, fee waivers and refunds and evidence that those controls are appropriately designed, operating effectively and reducing foreseeable harm.
• Where late or missed repayment charges are justified by reasonable costs, firms should consider documenting the cost methodology, evidence relied upon and relationship between the methodology and the charge level, alongside the separate fair value assessment.

What changed

The publication does not amend the FCA Handbook or create new mandatory actions. It consolidates good and poor practice under the existing price and value outcome in PRIN 2A.4 and FG22/5, including the requirement for manufacturers under PRIN 2A.4.2R(2) to conduct and regularly review value assessments at intervals appropriate to the product's nature and duration.

Key dates

2026-12-07 Deadline

First phased requirements under the amended RTS on settlement discipline and related ESMA guidelines apply to allocations and confirmations, including electronic, standardised and machine-readable communications, subject to the temporary technical disruption exception.

2027-07-01 Deadline

Additional phased requirements under the amended RTS on settlement discipline become applicable, as specified in the regulation’s transitional provisions.

2027-10-11 Deadline

Regulation (EU) 2025/2075 applies and the EU standard securities settlement cycle changes from T+2 to T+1; the final phase of related settlement-layer requirements also applies.

Suggested considerations

• Firms should map every affected transaction type, market, currency, venue, CSD, custodian, broker, client and outsourcing provider across the full trading and settlement ecosystem rather than assessing only internal readiness.
• Compliance and operations teams may wish to confirm whether allocations and confirmations can be completed on trade date and transmitted through electronic, standardised and machine-readable channels from 7 December 2026, including accurate place-of-settlement data where required.
• Firms should assess and test ISO or other applicable international messaging standards, matching platforms, standing settlement instruction governance, exception handling and the documented process for temporary technical disruptions.
• Firms should identify manual processing steps that cannot reliably operate within the shortened timetable and consider automation, straight-through processing, reconciliation, controls over data quality and resilient fallback arrangements.
• Firms should obtain implementation commitments and test plans from clients, brokers, custodians, CSD participants, CSDs, CCPs, vendors and outsourcing providers, with evidence of end-to-end testing and defect remediation.
• Firms should review liquidity, collateral, margin, FX funding, corporate-action, securities-lending, fund dealing and investment-operation processes for the reduced interval between trade and settlement.
• Firms should maintain a regulatory change plan covering the phased milestones on 7 December 2026, 1 July 2027 and 11 October 2027, with senior management oversight, documented risk acceptance and escalation of unresolved dependencies.

What changed

Regulation (EU) 2025/2075 amends Regulation (EU) No 909/2014 (CSDR) and provides for the EU settlement cycle to apply on a T+1 basis from 11 October 2027. Commission Delegated Regulation (EU) 2026/1536 amends the RTS on settlement discipline in Commission Delegated Regulation (EU) 2018/1229, with phased application beginning on 7 December 2026. From 7 December 2026, the allocation and confirmation process must use electronic, standardised communication channels and international messaging standards, with machine-readable communications required except during temporary technical disruptions.

Key dates

2025-10-22

The SFC issued its consultation paper on proposed amendments to the UT Code.

2026-10-07

The SFC published consultation conclusions announcing the enhancements to Hong Kong's retail fund regime.

2026-10-16

The revised UT Code was gazetted.

2026-11-01 Deadline

The revised UT Code takes effect. New funds must comply with the revised requirements immediately, and the 12-month transitional period for existing funds begins.

2027-10-31 Deadline

The 12-month transitional period ends. Existing funds generally must comply with the revised UT Code requirements by this date.

2027-11-01 Deadline

Existing funds continuing to be offered to the Hong Kong public must use KFSs containing the enhanced disclosure requirements after expiry of the transitional period.

Suggested considerations

• Compliance teams may wish to map each existing fund against the revised UT Code requirements and determine which requirements fall within the 12-month transitional period.
• Managers should consider documenting whether each fund will use the existing net derivative exposure approach or the new VaR approach, and assess the required models, data, governance, validation, stress testing, limits and reporting processes.
• Managers should consider reviewing fund asset liquidity, portfolio liquidity and redemption terms, including whether daily-dealing funds investing mainly in less liquid assets require anti-dilution liquidity management tools.
• Compliance teams may wish to inventory available liquidity management tools, assess their calibration and activation triggers, and verify that the fund documentation and operational procedures describe their use consistently.
• MMF managers should consider testing compliance with the revised minimum credit-quality standards and eligible-instrument and deposit requirements, including the additional safeguards applicable to constant-NAV MMFs.
• Fund boards, trustees and management companies may wish to review governance and escalation arrangements for derivatives exposure, liquidity risk and use of liquidity management tools.
• Managers should consider updating KFSs, offering documents, product classifications, liquidity disclosures and related marketing materials using the revised SFC templates.
• Applications for new funds submitted from 1 November 2026 should be prepared against the revised UT Code and updated application guides rather than the former requirements.

What changed

The revised UT Code introduces a Value-at-Risk approach alongside the existing net derivative exposure approach, with accompanying calculation methodology and standards. Funds complying with the applicable NDE or VaR limits will generally be treated as non-complex products, although the SFC retains discretion to classify products as complex based on their features and risks.

Key dates

2026-10-28

ADGM published the Guidance on Crypto Mining Activities in and from ADGM under section 23 of the Commercial Licensing Regulations 2025.

Suggested considerations

• Firms considering establishment or continued operation in ADGM should perform the RA pre-application self-assessment and document why their activities fall within commercial mining rather than an FSRA-regulated financial service.
• Operators should assess whether they require or should apply for the dedicated commercial licence associated with activity code 7230 and should avoid representing the licence as an authorisation to conduct regulated financial services.
• Compliance teams may wish to prepare an up-to-date corporate structure and ultimate-beneficial-owner information for RA review, together with governance documentation proportionate to the scale and risk of the operation.
• Operators should identify all blockchain addresses used to receive mining rewards and establish controlled procedures for making the required confidential on-chain address disclosures to the RA.
• ADGM-headquartered groups should map global mining activities, reporting lines, outsourced infrastructure, jurisdictional controls and board oversight so that the ADGM entity can demonstrate reasonable supervision of overseas operations.
• Firms should review whether staking, validator, custody, brokerage, token issuance, investment management or other associated activities separately require FSRA permission or create an additional regulatory perimeter.
• Operators may wish to monitor the RA’s forthcoming consultation on the second-phase regulatory framework and preserve records supporting their current perimeter analysis, licensing basis, governance and operational-risk controls.
• Firms should consider the practical implications identified in independent commentary, including operational resilience, cybersecurity, infrastructure security, energy management, transparent service terms and any applicable UAE federal tax, accounting and AML/CFT requirements, without treating those commentary points as additional requirements expressly created by this publication.

What changed

Commercial crypto mining conducted in or from ADGM is associated with dedicated RA commercial activity code 7230 and requires the applicable commercial licensing pathway. The Guidance is technology-neutral and covers Proof-of-Work, Proof-of-Stake and future consensus mechanisms. It establishes a pre-application self-assessment to help applicants distinguish mining from FSRA-regulated financial activities, and highlights expectations concerning corporate structure, ultimate beneficial ownership, and confidential disclosure of on-chain addresses used for reward flows.

Key dates

2026-10-28

MAS published its statement reinforcing banks’ existing environmental-risk management expectations in the context of transboundary haze, pollution and deforestation.

Suggested considerations

• Banks should consider mapping customers, counterparties and financed activities that may be linked to open burning, deforestation, peatland development or other haze-related pollution, at both customer and portfolio level.
• Compliance and risk teams may wish to establish a process for capturing, validating and escalating relevant NEA information and notices issued under the Transboundary Haze Pollution Act.
• Banks should consider enhancing customer due diligence for potentially haze-linked customers, including obtaining evidence of land ownership or control, fire-prevention and response arrangements, concession and supply-chain information, environmental permits, incident history and remediation measures.
• Banks may wish to document customer engagement, responses, management decisions and escalation criteria so that the rationale for continuing, conditioning, reducing or terminating exposure is demonstrable.
• Credit committees and relationship teams should consider incorporating environmental-risk findings into new-financing approvals, renewals, covenant-setting, pricing, collateral assessments and ongoing monitoring.
• For higher-risk customers, banks may wish to consider enhanced measures such as site visits, independent environmental expertise, satellite or geospatial monitoring and contractual rights to obtain information or suspend further drawdowns.
• Banks should consider defining governance triggers for cases involving suspected or confirmed breaches, with senior-management or board escalation where exposure limits or relationship exit is contemplated.
• Banks may wish to review public environmental-risk disclosures and transition plans for consistency with the strengthened supervisory focus, while recognising that the statement itself does not create a new disclosure deadline.

What changed

MAS has expressly linked banks’ environmental-risk processes to haze-related pollution and deforestation risks. Banks should consider relevant information released by the National Environment Agency under the Transboundary Haze Pollution Act and engage customers potentially connected to haze-producing activities to obtain sufficient information about their role, including controls to prevent, detect and stop fires.

Key dates

2026-10-26

Current date and FCA publication context for the review; firms have been told to take prompt action, but this is not a statutory compliance deadline.

2028-12-01

The FCA says the point-in-time publication may be treated as retired by December 2028 if it has not been removed sooner; this is not stated as a mandatory implementation deadline.

Suggested considerations

• Compliance teams may wish to map how the firm identifies direct defence businesses, defence supply-chain participants, dual-use technology businesses and relevant customers that are not accurately captured by SIC codes.
• Firms should consider testing whether onboarding and enhanced due diligence requests are risk-based, non-duplicative and proportionate to the individual customer's activities, jurisdictions, products, end use and supply chain, rather than triggered solely by a broad defence-sector label.
• Firms should consider reviewing blanket exclusions, revenue thresholds, automatic escalation rules and approval stages affecting defence customers, documenting why any retained restrictions are justified by legal, financial-crime, reputational or commercial-risk considerations.
• Firms should consider defining and governing reputational, ESG and sustainability criteria used in account opening, servicing, product access, restriction or closure decisions, with evidence that the criteria are consistently applied and aligned with stated risk appetite.
• Firms should consider establishing or improving management information covering defence-sector identification, application volumes, approval and rejection rates, onboarding duration, repeated information requests, escalation frequency, restrictions, closures, complaints and outcomes by customer risk category.
• Senior management and relevant committees may wish to review whether the available information allows them to challenge inconsistent treatment, unexplained delays or outcomes that arise from internal processes rather than the customer's actual risk.
• Where legally permissible and appropriate, firms should consider keeping applicants informed about additional checks, progress and likely decision timescales, and explaining decisions sufficiently to reduce avoidable uncertainty.
• Firms should continue to apply customer due diligence, enhanced due diligence, sanctions and other financial-crime controls required by applicable law; the FCA's message is to make those controls targeted and proportionate, not to reduce them.

What changed

No binding regulatory obligations or new thresholds have been introduced. The FCA has nevertheless written to firms providing banking services to SMEs and expects prompt action under existing requirements. Firms should review whether onboarding, enhanced due diligence, escalation, servicing, restriction and closure processes distinguish among different defence activities and reflect the specific customer, geographic, product, supply-chain, end-use, financial-crime and reputational risks.

Key dates

2026-10-23

The FCA published the multi-firm review findings and associated supervisory expectations.

Suggested considerations

• Firms should consider performing a documented gap assessment against the review findings, including whether their conflict framework reflects the substance of UK activities rather than only formal delegation or legal arrangements.
• Compliance teams may wish to refresh business-model and transaction-level conflict inventories to cover multiple funds, vintages, continuation and evergreen vehicles, affiliated businesses, shared services, capital-structure conflicts, remuneration, valuation, financing, redemptions, asset transfers and exit decisions.
• Firms should consider testing whether conflict identification occurs repeatedly from origination through valuation, allocation, monitoring, restructuring and exit, rather than only at onboarding or transaction approval.
• Firms may wish to define and evidence materiality thresholds, escalation triggers, accountable decision-makers and governance forums for complex or material conflicts, including when engagement with LPs or LP advisory committees is appropriate.
• For cross-fund transfers and continuation transactions, firms should consider independent challenge, valuation oversight, analysis of competing investor interests, documented alternatives and evidence supporting the fairness of the outcome; investor consent or disclosure alone may not demonstrate adequate management.
• Firms should consider reviewing gifts and entertainment controls beyond monetary thresholds, including purpose, recipient, frequency, patterns, inducement risk, approvals, record keeping and compliance monitoring.
• Firms may wish to assess whether information barriers use physical, organisational and system controls, with monitoring and oversight of information sharing, rather than relying primarily on staff judgement and training.
• Senior management and control functions should consider whether second-line compliance has sufficient independence and authority, and whether periodic internal-audit or other third-line reviews provide effective assurance and challenge.

What changed

This is supervisory guidance and a statement of FCA expectations, not a new rule or formal implementation deadline. The FCA expects firms to identify, assess, record, manage, mitigate and disclose actual, potential and perceived conflicts across the full investment lifecycle, based on the substance, scale and complexity of their UK activities rather than their formal legal structure.

Key dates

2026-10-13

ESMA published its European Common Enforcement Priorities for the 2026 annual financial reports of listed issuers.

2026-10-21

The AFM published its guidance identifying the ESMA priorities and continuing Dutch focus areas for 2026 reporting.

Suggested considerations

• Issuers should map the ESMA 2026 priorities against their 2026 IFRS financial statements, sustainability statement, annual report and ESEF package, documenting conclusions for each material issue.
• Finance and risk teams should assess how geopolitical developments affect assumptions, impairment testing, liquidity, going-concern assessments, provisions, commitments and other relevant IFRS disclosures, rather than relying only on generic risk-factor language.
• Companies undertaking restructurings or debt modifications should consider whether IAS 37 provisions, IFRS 9 derecognition or modification accounting, covenant effects, liquidity disclosures and related management judgments are complete and internally consistent.
• Sustainability reporting teams should retain evidence supporting the double materiality assessment and consider whether positive and negative impacts are presented with comparable granularity, including for ESRS E1 and ESRS S1 where relevant.
• Issuers should reconcile each material impact, risk and opportunity to the relevant policies, actions, targets and metrics, explain gaps where no policy, action or target exists, and ensure targets are measurable, time-bound and outcome-oriented.
• Reporting owners should perform a cross-document consistency review between the sustainability statement, management report, financial statements, risk disclosures and other parts of the annual report.
• ESEF specialists should validate the statement of changes in equity taxonomy selections, anchoring, sign conventions, extensions and completeness of tags, and should conduct technical validation before filing.
• Preparers should use the AFM’s cash-flow points of attention and self-assessment to test classification, non-cash transactions, reconciliation disclosures, consistency with the financial statements and clarity of significant judgments.

What changed

The AFM has stated that its 2026 supervisory work will focus on ESMA’s priorities for annual reports of issuers admitted to trading on EEA regulated markets. For IFRS financial statements, this covers geopolitical risks and uncertainties, restructuring provisions, and debt restructuring. For sustainability reporting under the ESRS, issuers should demonstrate a robust double materiality assessment and connected disclosures linking impacts, risks and opportunities with related policies, actions, targets and metrics, with market commentary indicating particular attention to balanced treatment of...

Key dates

2026-10-21

The OCC issued Bulletin 2026-51 and stated that applications and waiver requests will be accepted only after OMB approves the related information collection.

2027-01-18 Deadline

The GENIUS Act and OCC final rule become effective; the Prior Approval Requirement generally applies, and unauthorized issuance of a payment stablecoin in the United States may carry criminal penalties.

2028-01-18 Deadline

The maximum statutory period for a waiver beginning on January 18, 2027 expires, subject to the terms and shorter duration of any individual waiver.

Suggested considerations

• Firms should determine whether they are currently issuing a payment stablecoin in the United States and whether they fall within the OCC application pathway or another primary federal payment stablecoin regulator's pathway.
• Existing issuers should consider preparing and submitting a substantially complete OCC application as soon as the agency announces that applications are accepted, rather than relying on the waiver as a substitute for authorization.
• Applicants should map their submission against every prescribed application question and documentation requirement, including the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML, OFAC, third-party risk, enterprise risk, compliance risk, and audit functions.
• Compliance teams may wish to prepare a separate written waiver request addressing the Prior Approval Requirement, identifying any additional GENIUS Act or final-rule requirements that cannot be met by January 18, 2027, and explaining the requested duration and operational rationale.
• Issuers should monitor the OCC's GENIUS Act landing page and press releases for OMB approval and the opening of the application and waiver process, because the bulletin does not provide a fixed application-opening date.
• Firms should maintain evidence supporting the completeness and accuracy of their applications and establish a process to respond promptly to OCC requests for missing information within the 30-day review cycles.
• Prospective issuers that are not already operating in the United States should consider planning for operations to begin only after OCC approval, consistent with the agency's stated position on waiver eligibility.
• Regulatory change teams should continue tracking separate FinCEN, OFAC, OCC, and other agency rulemakings concerning AML, CFT, sanctions, and customer-identification requirements rather than assuming that an OCC application or Prior Approval Requirement waiver resolves those obligations.

What changed

Beginning January 18, 2027, a person generally must be approved as a permitted payment stablecoin issuer before issuing a payment stablecoin in the United States; unauthorized issuance may carry criminal penalties. Under GENIUS Act section 5(f) and 12 CFR 15.30(g), an issuer with a substantially complete OCC application pending on January 18, 2027 may request a written waiver of the Prior Approval Requirement and other statutory or final-rule requirements that it cannot satisfy by the effective date.

Key dates

2026-10-19

The FCA publication was issued as part of its wider AI supervisory and industry-engagement work.

Suggested considerations

• Firms should consider maintaining an inventory of AI use cases, including internally developed, embedded and outsourced tools, with a named accountable senior manager and documented risk classification for each use case.
• Compliance teams may wish to map each consumer-facing AI use case to Consumer Duty outcomes, the target market, foreseeable harms, vulnerable-customer considerations, fair value where relevant, complaints handling and available redress.
• Firms should consider documenting why AI is appropriate for the identified consumer need, which activities remain staff-led, where the system must abstain or escalate, and how those controls have been tested in practice.
• Model and risk functions may wish to test accuracy, bias, error rates, explainability, data quality, drift and robustness across relevant consumer characteristics, including vulnerability, accessibility, digital capability and financial capability.
• Firms should consider testing consumer understanding of AI disclosures and outputs with representative user groups, rather than relying solely on technical model explanations or generic disclaimers.
• Operations and technology teams may wish to implement proportionate live monitoring, clear escalation thresholds, sample-based human review, incident and near-miss processes, fallback arrangements and channel continuity where an AI system fails or produces harmful outputs.
• Firms should consider retaining auditable records of prompts, inputs, outputs, model and vendor versions, filters, approvals, overrides, escalations, complaints and remediation decisions for a period consistent with the applicable record-keeping requirements.
• Outsourcing and third-party risk assessments may wish to address concentration and dependency risks, access to testing and performance information, change control, data use, subcontracting, service continuity and the firm’s ability to challenge or replace an AI provider.

What changed

The publication consolidates the FCA’s expectations under the existing framework, including the Principles for Businesses, Threshold Conditions, SYSC, operational resilience, outsourcing and critical third-party requirements, Consumer Duty, vulnerable-customer guidance, SM&CR and DISP. It identifies good practice such as defining the consumer need and target market before deployment, testing outcomes across consumer characteristics and vulnerability scenarios, setting human escalation and abstention controls, maintaining auditable records of prompts, outputs, model versions and decisions, and...

Key dates

2026-06-05

Relevant amendments introduced by Regulation (EU) 2024/2809, the Listing Act, began applying; intermediate information in protracted processes generally ceased to require immediate ad hoc disclosure before completion, subject to the amended MAR conditions.

2026-10-16

ESMA announced the final revised guidelines. They become applicable from their publication on ESMA's website in all 24 official EU languages.

Suggested considerations

• Review inside-information and delayed-disclosure policies against the final ESMA guidelines and Article 17 of Regulation (EU) No 596/2014, including the five new legitimate-interest scenarios.
• Update decision trees and escalation procedures so that a proposed delay is assessed against all MAR Article 17(4) conditions rather than being approved solely because it matches an ESMA example.
• Reassess controls for protracted processes in light of Regulation (EU) 2024/2809: distinguish intermediate steps that are no longer subject to ad hoc disclosure from final outcomes and from information whose confidentiality has ceased to be maintained.
• Add a specific check that a proposed delay does not contradict the issuer's latest public announcement or other communication on the same matter.
• Maintain contemporaneous written records of the inside-information assessment, legitimate interest, expected prejudice from immediate disclosure, confidentiality controls, rationale for the delay and the point at which disclosure must resume; consider whether and how the competent-authority notification and explanation required by Article 17(4) and Article 17(5) apply.
• Coordinate disclosure assessments across parent and subsidiary issuers where information about one group company could prejudice another company's delay, with clear ownership of confidentiality and announcement decisions.
• Train directors, senior managers, investor-relations personnel, transaction teams and advisers on the new examples, particularly public-authority requests, sensitive commercial opportunities and key-person appointments.
• Monitor the ESMA website for the publication of the final guideline text in all 24 official EU languages and record the applicable version used in the firm's disclosure framework.

What changed

The revised guidelines retain a non-exhaustive list of circumstances that may support delayed disclosure and add five situations: a public authority requests non-disclosure; the issuer needs additional information to enable market participants to assess the information correctly; disclosure of sensitive commercial information could cause the loss of a business opportunity; disclosure could jeopardise the appointment of a governing-body member or manager in a key position; and disclosure of information concerning another group company could directly prejudice the issuer or undermine that...

Key dates

2026-10-16

ESMA published Q&As 2949, 2950, 2936, 2937 and 2938.

2025-06-25

The EMIR 3 active account regime began applying to counterparties already within scope after the six-month implementation period.

Suggested considerations

• CASPs should consider mapping each client-funds flow against MiCA Article 70(2) and (3), documenting the end-of-next-business-day transfer control and verifying that any intermediary-held credit-institution account is specifically held for the CASP and technically segregated.
• CASPs and their payment-service-provider partners may wish to review contractual terms, account mandates, insolvency protections, reconciliation processes and evidence demonstrating clients’ ownership rights and prohibition of proprietary use.
• Crowdfunding providers using registration, membership or access fees should consider documenting why their model does or does not constitute a crowdfunding service under Regulation (EU) 2020/1503 and reviewing website disclosures, fee descriptions, client communications and investor-protection controls.
• AAR counterparties should recalculate the 12-month aggregate month-end average gross notional position, including the applicable group perimeter and excluding client-clearing activity, against the EUR 6 billion and EUR 100 billion thresholds.
• AAR counterparties relying on the 85% exemption should consider testing the one-half rule across the relevant derivative classes, retaining the underlying EU-CCP clearing data and avoiding any assumption that the exemption removes the representativeness requirement.
• Affected counterparties should review trade-level residual-maturity data, bucket allocation, annual-average trade counts and reporting calendars so that representative clearing can be demonstrated at the applicable reporting date.
• Compliance teams may wish to update policies, procedures, management information and regulatory inventories to distinguish ESMA Q&A interpretive expectations from directly binding Level 1 and Level 2 requirements.

What changed

For CASPs, ESMA clarifies that client funds may be temporarily held in an account with a non-bank payment service provider, such as a payment institution or electronic money institution, provided the funds are transferred to an account with a credit institution or central bank no later than the end of the business day following receipt.

Key dates

2026-10-15

ESMA published the updated transparency manual and added the OTC derivative reference-data guidance, tick-size Q&As and recommendations.

Suggested considerations

• Compliance teams may wish to map OTC derivatives currently treated as subject to transparency against the identifying reference-data requirements in Commission Delegated Regulation (EU) 2025/1003.
• Firms should consider reviewing instrument-master, transaction-reporting and transparency-publication workflows to ensure OTC derivative identifiers and related reference data can be supplied consistently to relevant publication and consolidated-tape processes.
• Trading venues may wish to assess tick-size logic for subscription rights and verify that the liquidity band applied is aligned with the underlying share, while documenting any intervention or exception decisions against the manual's recommendations.
• Investment firms and trading venues should consider reviewing existing MiFID II/MiFIR transparency procedures, controls and vendor specifications in light of the manual's Q&As and the distinction between current guidance and draft OTC reference-data guidance.
• Firms should monitor the entry into force of the related RTS 2 and consolidated tape provider input/output standards and be prepared to refresh implementation plans, testing and contractual data specifications when those standards become applicable.
• Nationally supervised firms may wish to retain evidence showing how tick-size decisions, venue interventions and escalation to competent authorities were assessed against the updated supervisory-convergence material.

What changed

The manual clarifies that OTC derivatives subject to transparency must be identified using the identifying reference data specified by Commission Delegated Regulation (EU) 2025/1003, supporting consistent reporting and publication through the consolidated tape. It also explains how that reference data should be provided for transparency purposes; ESMA states this part should be treated as draft until the related RTS 2 and RTS on consolidated tape provider input/output data enter into force.

Key dates

2025-11-07

The FCA published its multi-firm review of CFD providers’ provision of price and value, identifying concerns including narrow fair value assessments, opaque overnight funding charges and charges on matched long and short positions.

2026-05-01

The FCA surveyed 81 CFD firms about changes made or planned after the November 2025 review; the source identifies May 2026 but does not specify an exact day.

Suggested considerations

• Compliance teams may wish to document a comprehensive fair value assessment covering spreads, commissions, overnight funding, ancillary fees, cash-balance interest and all other amounts charged to consumer accounts, rather than focusing primarily on execution costs.
• Firms should consider testing whether overnight funding rates are reasonable against prevailing reference or base rates, relevant UK-regulated peers, the underlying asset class and the benefits delivered, with documented rationale for material outliers and wide long-versus-short spreads.
• Firms may wish to assess separately the treatment of matched or hedged positions, including whether applying the full funding spread to both legs is proportionate where there is no net market exposure and whether any reduced-margin or promotional arrangements encourage clients to maintain costly open positions.
• Firms should consider reviewing client-facing disclosures at each relevant stage of the journey, including onboarding, product pages, deal tickets and account interfaces, and explaining the calculation, rate, frequency, leverage effect and potential cumulative impact of overnight charges in accessible language.
• Firms may wish to present projected overnight costs using an annualised percentage measure alongside daily or monetary charges, while retaining clear explanations that actual costs may vary.
• Appropriateness and target-market processes should be reviewed for robustness, including any income thresholds, enhanced scrutiny, vulnerability monitoring and escalation arrangements introduced after the November 2025 review.
• Firms should consider whether interest paid on client cash or margin balances, and the absence of such interest, has been properly assessed as part of the overall price and value outcome.
• Management information may need to evidence the review of charges, peer comparisons, complaints, customer understanding, vulnerable-client outcomes and remediation decisions because the FCA states it will follow up individually where concerns remain.

What changed

This is supervisory guidance and good-and-poor-practice feedback, not a new binding rule or implementation deadline. The FCA expects firms to assess all costs and charges in their fair value assessments, use relevant UK-regulated peer comparisons, consider consumer outcomes rather than treating fair value as a compliance exercise, and review whether overnight funding rates are reasonable in light of prevailing base rates, peer pricing and the benefits provided.

Key dates

2026-10-15

FSB published the final report on Sound Practices for Responsible Adoption of Artificial Intelligence.

Suggested considerations

• Firms should consider inventorying all material AI use cases, including internally developed tools, vendor-provided models, embedded productivity tools, generative AI and agentic or multi-agent systems, with ownership, purpose, data sources, model dependencies and deployment status recorded.
• Compliance teams may wish to map each use case to a documented materiality and risk classification performed at inception and refreshed after material model, data, vendor, scope or operating-environment changes.
• Boards and senior management should consider whether AI governance, risk appetite statements, delegated authorities and management information clearly cover autonomous actions, prohibited uses, escalation thresholds and accountability for AI-supported decisions.
• Firms should consider integrating AI-specific controls into existing model risk management, operational-risk, ICT-risk, cybersecurity, outsourcing and business-continuity frameworks rather than creating disconnected governance.
• Model and technology teams may wish to maintain evidence of data provenance, data quality, testing, validation, performance metrics, drift monitoring, incident handling, explainability assessments and compensating controls where explainability is limited.
• For higher-risk or autonomous use cases, firms should consider mandatory human approval triggers, bounded permissions, segregation of duties, real-time or near-real-time monitoring, complete audit trails, emergency stop or rollback capability and periodic reassessment of whether human oversight remains effective.
• Procurement and third-party-risk functions should consider enhancing due diligence and contracts for AI providers to address model performance, transparency, training and input data, subcontracting, security, audit access, incident notification, portability, exit planning, concentration risk and service continuity.
• Cybersecurity teams should consider adding AI-enabled attacks, prompt injection, data poisoning, model manipulation, deepfakes, automated exploitation and misuse of AI-assisted coding or defensive tools to threat assessments, testing and exercises.

What changed

The FSB replaced its June 2026 consultation with a final framework of 12 proportionate sound practices. The practices require firms to align AI adoption with business strategy and risk appetite; define accountability; incorporate AI risks into enterprise risk management; document AI use and materiality assessments; select models according to business, technical and risk requirements; govern data quality and security; address explainability and stakeholder transparency; test and monitor performance; apply human oversight proportionate to autonomy, complexity, risk and explainability; manage...

Key dates

2017-06-30

CSSF originally published the prudential procedure for appointments to the management body and key function-holder roles in credit institutions.

2026-05-05

Luxembourg enacted the Law implementing CRD VI and related EU requirements, including tightened fit-and-proper provisions.

2026-05-06

The Law of 5 May 2026 was published in Memorial A n° 227 and its directly amended provisions became relevant from entry into force.

2026-10-15

CSSF updated the procedure publication and the related management-body and key-function-holder fit-and-proper declaration forms; the procedure is marked as being updated.

Suggested considerations

• Firms should compare their current appointment and fit-and-proper processes with the refreshed CSSF declaration forms and identify changes to information, attestations and supporting evidence.
• Compliance teams may wish to map each management-body and key-function-holder appointment to the applicable CSSF, ECB or IMAS Portal submission route, including whether the entity is significant or less significant.
• Firms should consider building a minimum 30-working-day pre-appointment submission period into planning for appointments covered by the CRD VI and Luxembourg implementation requirements, subject to confirmation in the final CSSF procedure.
• Institutions should refresh internal suitability assessments to address reputation, knowledge, skills and experience, time commitment, independence, conflicts of interest, diversity and collective suitability, and should retain evidence of the board’s assessment.
• Firms should review role descriptions, responsibility maps, reporting lines and individual statements for management-body members, senior management and key function holders, as these are identified in market commentary as areas reinforced by the CRD VI implementation framework.
• Existing appointees should be included in periodic or event-driven reassessment processes so that continuing suitability and the institution’s ability to notify material changes can be demonstrated.
• Firms should monitor the forthcoming amended EBA internal-governance guidelines and subsequent CSSF revision of Circular 12/552 and the prudential procedure before finalising policy changes.

What changed

The CSSF has refreshed the prudential-procedure publication and four related declaration templates: appointee and institution declarations for management-body members and key function holders. The page does not disclose the substantive text of the revised procedure, so it does not establish a new standalone deadline or approval requirement by itself.

Key dates

2026-07-03

The European Commission adopted the revised and simplified ESRS and the related Delegated Regulation containing the transitional options and Article 2(1)(b) reliefs.

2026-09-21

The revised and simplified ESRS were published in the Official Journal of the European Union.

2026-10-13

ESMA published the 2026 European Common Enforcement Priorities for corporate reporting, including priorities for sustainability statements.

2026-10-14

The AMF drew French listed companies’ attention to ESMA’s 2026 sustainability-reporting priorities.

2026-11-04

The AMF is scheduled to hold an educational webinar on lessons from its review of 2025 sustainability statements.

2027-01-01 Deadline

Issuers preparing sustainability statements for financial year 2027 should be prepared to use the revised ESRS and generally omit non-material information except where expressly required.

Suggested considerations

• Compliance teams may wish to document the decision to use ESRS Set 2, Set 1, or Set 1 with the Article 2(1)(b) reliefs, and include a clear statement of the selected basis in the 2026 sustainability statement.
• Companies should consider refreshing their double-materiality assessment files to evidence methodology, thresholds, data sources, stakeholder and value-chain coverage, and equivalent treatment of positive and negative impacts.
• Reporting owners may wish to create an IRO-to-PAT-to-metric mapping that identifies the topics and scopes covered, any material IROs without corresponding policies, actions or targets, and the reasons for partial coverage.
• Climate reporting teams should reconcile the organisational and operational scope of the GHG inventory with emissions-reduction targets, quantify targets in absolute terms where applicable, explain any science-based or 1.5°C alignment claim, and distinguish gross from net targets.
• Human-resources and sustainability teams should link workforce actions, such as training, to policy objectives and measurable outcomes, including discrimination-prevention objectives under ESRS S1.
• Finance, risk and sustainability functions should perform a consistency review across the sustainability statement, financial statements, risk factors, management commentary, executive summary, prior-year disclosures and other public communications.
• Companies should assess the likelihood of missing 2030 targets, document remediation or contingency plans, and disclose relevant risks where target achievement is uncertain.
• Reporting teams may wish to preserve an audit-ready evidence trail for targets, methodologies, baseline years, restatements, scope changes, financial resources and comparative information.

What changed

For financial year 2026, issuers may use the revised and simplified ESRS Set 2 adopted by the European Commission on 3 July 2026 and published in the Official Journal on 21 September 2026, the current Set 1 including the July 2025 quick-fix simplifications, or Set 1 together with the specific reliefs listed in Article 2(1)(b) of the Commission Delegated Regulation of 3 July 2026. ESMA expects issuers to identify transparently which option they have used.

Key dates

2025-07-09

The FPC made the recommendation to amend implementation of the high-LTI flow limit, allowing individual lenders to increase their share while seeking to keep the aggregate flow consistent with 15%.

2026-04-01

The FCA consultation on the proposed high-LTI lending guidance opened.

2026-07-01

The FCA consultation closed.

2026-10-14

FG26/11, the joint FCA/PRA policy changes and the PRA supervisory statement were issued and the replacement framework took effect.

Suggested considerations

• Firms should map their regulated mortgage book against the 4.5 LTI definition, the listed exclusions and the £150 million or 300-contract de minimis test over the relevant consecutive four-quarter periods.
• Compliance and risk teams may wish to update policies, risk-appetite statements, underwriting controls and management information to reflect removal of the individual 15% cap and continued exposure to the aggregate 15% safeguard.
• Firms considering a strategy that would increase high-LTI lending above 15% should consider notifying the FCA or, for PRA-authorised firms, engaging with the PRA in accordance with the applicable supervisory arrangements before implementation.
• Firms should validate Product Sales Data submissions and establish quarterly controls for calculating individual high-LTI flows and reconciling them to the regulator’s published aggregate-flow data.
• Firms should maintain documented stress testing, affordability assessment, portfolio monitoring and governance demonstrating that high-LTI lending is managed prudently under the PRA supervisory statement.
• Firms should establish escalation and contingency procedures enabling rapid adjustment of high-LTI origination if the FCA issues temporary supplemental LTI guidance.
• Compliance teams may wish to review whether product, broker and customer communications accurately explain that the reform concerns portfolio flow limits and does not create an entitlement for an individual borrower to obtain a mortgage above 4.5 times income.
• Firms should monitor further FCA temporary supplemental guidance and PRA quarterly publications, as the market-wide mechanism can result in firm-specific reduction expectations even where the firm’s own lending remains commercially appropriate.

What changed

FG26/11 applies the FPC recommendation to firms with permission to enter into regulated mortgage contracts as lender, subject to specified exclusions. High-LTI lending remains lending at an LTI of 4.5 or above, and the aggregate high-LTI flow remains subject to the FPC’s 15% limit; however, the previous expectation that each in-scope firm must not exceed 15% has been removed.

Key dates

2026-10-14

PRA publishes SS2/26 – High loan to income lending. The statement sets out supervisory expectations and the quarterly aggregate-monitoring framework.

Suggested considerations

• Firms should determine whether they were below the de minimis threshold in both relevant consecutive four-quarter periods, using both the £150 million total-credit and 300-contract tests.
• Mortgage risk and compliance teams may wish to validate the firm’s classification of high-LTI contracts at the 4.5-times income threshold and confirm that excluded products are correctly removed from internal and regulatory monitoring.
• Boards and senior management may wish to approve explicit high-LTI risk appetite limits and management information covering current flow, forecast flow, concentrations, high-risk segments, arrears and performance outcomes.
• Firms considering a strategy that would increase high-LTI flow above 15% should prepare evidence of the supporting risk-management changes and discuss them through regular PRA supervisory engagement.
• Firms above the de minimis threshold should establish controls to reconcile internal high-LTI flow data with FCA Product Sales Data and the PRA’s quarterly aggregate publication, including a process for handling revised data.
• Mortgage lenders should maintain credible scenario plans for reducing future high-LTI originations, including underwriting, product, pricing, distribution and pipeline controls, while distinguishing future lending decisions from existing approved offers.
• Groups should document whether high-LTI governance and monitoring are operated at individual-firm or group level and ensure that group-level calculations include only relevant firms above the de minimis threshold.
• Compliance teams may wish to monitor future PRA and FCA announcements for any fractional reduction rate, implementation timetable or withdrawal of adjustment expectations, since SS2/26 does not prescribe a permanent reduction rate in advance.

What changed

SS2/26 defines high-LTI lending as regulated mortgage contracts where credit is at least 4.5 times the relevant individual or joint income. It applies to firms within the Housing Part of the PRA Rulebook, including relevant UK subsidiaries, and requires high-LTI lending to be conducted prudently under an appropriate risk-management and compensating-controls framework.

Key dates

2026-10-14

CPMI and IOSCO published the final report on FMIs' management of general business risks and general business losses.

2026-02-06

The consultation period for the predecessor November 2025 report closed.

Suggested considerations

• FMIs should consider mapping their existing general business risk frameworks, loss taxonomies and financial resources against the final guidance and PFMI Principles 1, 15, 16 and 17.
• FMIs should reassess whether LNAFE is sufficient not only to meet the six-month operating-expense floor but also to cover credible one-time and recurring loss scenarios and the period needed for recovery or orderly wind-down.
• FMIs should review business continuity, recovery and orderly wind-down plans for explicit treatment of general business losses, including escalation and options for raising additional equity.
• FMIs should consider documenting the assumptions, scenarios, methodologies and governance approvals used to size LNAFE and distinguish general business losses from participant-default losses and other PFMI resources.
• FMIs should consider enhancing public and authority-facing disclosures on general business risk exposures, LNAFE, risk-management assumptions, governance responsibilities and available recovery or wind-down resources.
• Authorities should consider incorporating the supplemental guidance into supervisory assessments and reviewing whether local FMI rules, recovery plans and disclosure expectations remain aligned with the final report.
• FMI operators and participants should monitor national implementation because CPMI-IOSCO guidance is not directly binding and practical obligations will depend on the relevant jurisdiction's legal and supervisory framework.

What changed

The final report elaborates the existing PFMI requirements, especially Principle 15, rather than creating a new standalone binding standard. It provides guidance on identifying, monitoring and managing general business risks; determining the minimum LNAFE required to cover potential general business losses and support continued operations, recovery or orderly wind-down; and strengthening governance and transparency.

Key dates

2026-03-30

The FCA published PS26/3, establishing the motor finance consumer redress scheme for relevant agreements entered into from 6 April 2007 to 1 November 2024.

2026-05-31

The FCA's general pause on handling certain motor finance complaints ended; complaints outside the scheme scope generally reverted to the applicable ordinary complaint-handling framework from 1 June 2026.

2026-06-30

The implementation period for Scheme 2, covering agreements entered into from 1 April 2014 to 1 November 2024, was scheduled to end.

2026-08-31

The implementation period for Scheme 1, covering agreements entered into from 6 April 2007 to 31 March 2014, was scheduled to end.

2027-02-16

The Upper Tribunal hearing of the legal challenges to the motor finance compensation scheme is scheduled to begin.

2027-02-26

The scheduled window for the Upper Tribunal hearing of the legal challenges is due to conclude.

Suggested considerations

• Compliance teams may wish to maintain a documented inventory of complaints, agreements, commission data, consumer communications and redress calculations so that scheme preparation can resume promptly if the legal challenges fail.
• Lenders should continue complying with all motor finance scheme rules that have not been suspended, including required notifications to consumers who are not owed compensation.
• Firms should model both principal outcomes: implementation of the scheme after judgment and resumption of ordinary complaint handling if the scheme or relevant provisions are quashed.
• Operational planning may include capacity, case-management systems, data remediation, quality assurance, customer communications and escalation procedures for the ordinary DISP complaint process.
• Finance, risk and compliance teams should consider scenario-based provisions for scheme redress, litigation-related costs and ordinary complaint liabilities, and should engage auditors regarding assumptions, evidence and disclosure.
• Firms should review whether complaints outside the scheme scope are being handled under the ordinary DISP time limits, rather than being treated as covered by the suspended scheme arrangements.
• Senior management may wish to monitor the tribunal proceedings, FCA firm updates and any subsequent judgment, appeal or amendments to CONRED and DISP requirements.
• Firms should consider customer-outcome and conduct risks arising from delayed compensation, incomplete communications, duplicated claims-management fees and inconsistent treatment of consumers during the suspension.

What changed

The Upper Tribunal hearing window is now confirmed for 16 to 26 February 2027. The scheme remains partially suspended, so lenders are not required to calculate or pay compensation under the scheme until the legal process concludes, but the suspension does not remove the requirement to comply with unaffected scheme rules, including sending specified communications to consumers who are not owed compensation. The FCA has expressly warned lenders to prepare for the possibility that the scheme, or parts of it, are quashed and that there is consequently no scheme-based complaint-handling pause.

Key dates

2026-01-30

The SFC issued its earlier circular to licensed corporations carrying out sponsor work, addressing deficiencies in listing documents, sponsor conduct and resource management.

2026-09-30

The SFC’s comparison period ended: active applications exceeded 610, involving 64 sponsors and 325 signing principals; the SFC reported the September position in the October publication.

2026-10-13

The SFC published its update recognising progress in sponsors’ work and urging sustained vigilance against opaque IPO and post-IPO arrangements.

Suggested considerations

• Sponsors should consider reassessing current and proposed IPO mandates against available principals, deal-team expertise, supervision arrangements and the number of simultaneous active engagements; a principal supervising or participating in six or more active listing engagements is treated as strained under the SFC’s stated framework.
• Compliance teams may wish to enhance documented enquiries into applicant-provided subscription funding, prepayments, loans, investments, guarantees, rebates and other direct or indirect benefits involving investors or their connected parties before or after listing.
• Overall coordinators and CMIs should consider strengthening beneficial-owner and source-of-funds checks, including enquiries designed to identify concealed ultimate investors, connected parties, common funding sources and coordinated subscription activity.
• Firms should consider implementing escalation triggers for late-stage order surges, orders disproportionate to an investor’s financial profile, unusual concentration or cancellations, and order books that diverge from the agreed marketing or allocation strategy.
• Sponsors should consider ensuring that due-diligence records explain the substance of the applicant’s business, the commercial rationale for material fund flows and the basis for responses to SFC and HKEX questions, rather than relying on checklist completion or third-party representations alone.
• Relevant gatekeepers may wish to establish a documented process for promptly escalating unresolved red flags to senior management, the SFC and HKEX where appropriate, while preserving order, client, communications and allocation records.
• Firms should consider reviewing controls in light of independent market commentary describing the SFC’s 2026 approach as prioritising quality over deal volume, substantive gatekeeping and suspected misuse or diversion of offering proceeds, rather than treating the announcement as a statistical progress report.

What changed

This is supervisory guidance rather than a new rule or stated deadline. The SFC reiterated that sponsors, overall coordinators and capital market intermediaries should maintain adequate resources, effective management oversight and high-quality substantive due diligence, while escalating concerns to the SFC and the Stock Exchange of Hong Kong where appropriate.

Key dates

2026-10-12

ESMA published the thematic notes on impact claims and climate transition claims.

Suggested considerations

• Compliance teams may wish to inventory all impact and climate transition claims appearing in websites, fund marketing, factsheets, presentations, social media, bond materials and benchmark communications.
• Firms should consider documenting the causal theory behind each positive impact claim, including the investment or financing activity expected to generate the impact and the distinction between intended, expected and achieved outcomes.
• Firms should consider establishing measurable impact indicators, calculation methodologies, baselines, monitoring frequency and governance for reviewing whether claimed outcomes have occurred.
• Firms making transition claims should consider documenting the transition objective, eligibility criteria, milestones, target dates, implementation actions, dependencies on investee companies or other parties, and the process for reporting slippage.
• Marketing and product-governance reviews may wish to require prominent explanation of material assumptions, data gaps, estimates, methodological limitations and uncertainty surrounding forward-looking claims.
• Firms should consider checking that claims are consistent across regulatory disclosures, marketing communications, portfolio holdings, bond frameworks, benchmark methodologies and public sustainability reports.
• Compliance teams may wish to retain evidence supporting each claim and to review whether qualifying information is sufficiently clear, balanced and proximate to the claim rather than hidden in technical documentation.
• Firms should consider assessing whether product names, labels, comparisons, impact figures and transition terminology could create an impression of guaranteed or already-achieved environmental or social outcomes.

What changed

ESMA has provided practical do's and don'ts for non-regulatory communications containing impact or climate transition claims, based on observed market practices. Firms communicating positive impact claims should explain the intended difference, the mechanism through which impact is expected to arise, and how outcomes will be measured. Firms making climate transition claims should describe the transition ambition, implementation approach, assessment of progress, relevant assumptions, data limitations and external dependencies.

Suggested considerations

• Firms should consider conducting a documented effectiveness review of governance arrangements, covering board composition and capability, challenge and decisions, delegation and escalation, management information, conflicts and assurance.
• Boards and management bodies may wish to map collective capability against the administrator's current and emerging risks, including technology, cyber resilience, data management, innovation, methodology, market structure and user needs.
• Compliance teams may wish to test whether board and committee records capture principal challenge, decision rationale, actions, ownership and follow-through, including significant decisions taken between scheduled meetings.
• Firms should consider documenting ownership of key risks, decision rights, escalation routes and the way UK-regulated entity obligations are represented in group governance arrangements.
• Administrators may wish to review whether group reporting and escalation channels remain effective if individuals with multiple roles are unavailable, conflicted or subject to competing priorities.
• Firms should consider whether conflicts frameworks address multiple roles, group relationships, commercial pressures, competing priorities and differing stakeholder interests, and whether identified conflicts, mitigations and decisions are recorded.
• Board reporting owners may wish to distinguish information provided for awareness from matters requiring discussion, decision or escalation, and highlight changes, exceptions, emerging trends, risk movements, mitigation effectiveness and overdue actions.
• Administrators should consider whether between-meeting escalation arrangements provide directors with timely information on significant developments without disconnecting those decisions from formal governance records.

What changed

The FCA has not amended rules, introduced new thresholds or imposed a compliance deadline. Instead, it has set out supervisory observations that benchmark administrators should assess against their own activities, risks, users and operating environments. The FCA will use these observations in supervisory engagement alongside developments in the benchmarks framework.

Key dates

2024-02-28

Directive (EU) 2024/825 was adopted, amending the Unfair Commercial Practices Directive and the Consumer Rights Directive.

2026-03-27 Deadline

EU Member States were required to adopt and publish national transposition measures.

2026-06-24

The Dutch Implementatiewet richtlijn betere duurzaamheidsinformatie voor consumenten was published in the Staatsblad, according to the AFM publication.

2026-07-16

The Dutch implementation legislation entered into force, according to the AFM publication.

2026-09-27

The ECGT rules became applicable to consumer-facing commercial communications across the EU, including relevant financial-services marketing; the regime is applicable as at the publication date of 2026-10-09.

Suggested considerations

• Compliance teams may wish to inventory all consumer-facing sustainability claims, labels and environmental references used in websites, fund marketing, advertisements, product names, brochures, social media, sales scripts and corporate marketing.
• Firms should consider mapping each claim to the specific product, service, activity or business component to avoid implying whole-product or whole-enterprise sustainability where the evidence covers only part of the offering.
• Firms should consider maintaining an evidence file for every material claim, including the scope of the claim, methodology, data sources, verification, assumptions, limitations and approval owner.
• Marketing and product-governance reviews may wish to identify generic terms such as green, sustainable, environmentally friendly, climate positive and eco-friendly and confirm whether the required recognised excellent environmental performance can be demonstrated.
• Firms should consider removing or rewriting claims that describe products or services as climate neutral, carbon neutral or having reduced climate impact where the claim depends solely or materially on offsetting emissions, and should distinguish mitigation from compensation.
• Compliance teams may wish to review all sustainability labels, badges and proprietary ESG marks and confirm that each is supported by an eligible certification scheme or public scheme with appropriate independent verification.
• Firms communicating net-zero, climate-neutrality or other future environmental objectives should consider documenting a detailed and realistic implementation plan with measurable interim targets, deadlines, governance, monitoring and evidence of progress.
• Firms should consider testing claims against both the ECGT/BW 6 requirements and applicable Wft, SFDR, MiFID II, IDD and other sectoral disclosure and conduct standards, because satisfying a sectoral disclosure rule does not cure a claim prohibited under the consumer-law framework.

What changed

The Dutch Implementatiewet richtlijn betere duurzaamheidsinformatie voor consumenten amended Book 6 of the Dutch Civil Code, including the rules on unfair commercial practices in Articles 6:193a et seq., to implement Directive (EU) 2024/825, which amends Directive 2005/29/EC on unfair commercial practices and Directive 2011/83/EU on consumer rights. For consumer-facing commercial communications, sustainability claims should be specific, accurate, verifiable and supported by appropriate evidence.

Key dates

2026-10-08

ESMA published its opinion on the provision of crypto-asset services in relation to non-MiCA-compliant asset-referenced tokens and e-money tokens.

2027-01-08 Deadline

Latest date by which National Competent Authorities should require remediation of remaining pre-existing exposures, calculated as three months after publication; firms may be required to act earlier.

Suggested considerations

• Firms should inventory every ART and EMT made available to EU clients and classify whether each token satisfies the applicable MiCA requirements, including any relevant authorisation, notification, offer, and admission-to-trading conditions.
• Compliance teams may wish to map each affected token across trading, exchange, execution, placing, order-routing, advice, transfer, custody, and portfolio-management workflows, including bundled or indirect services.
• Firms should consider suspending onboarding, purchases, subscriptions, trading, swaps, staking-related access where relevant, and other activities that could allow EU clients to acquire or increase exposure to a non-MiCA-compliant token.
• Technology and operations teams should assess geolocation, account, wallet, order-management, token-listing, transfer, and API controls, with testing and monitoring designed to prevent EU-client access or increased exposure.
• Legal and product teams should review client terms, token-listing policies, disclosures, contractual restrictions, and arrangements with issuers, liquidity providers, exchanges, and other intermediaries.
• Firms should identify pre-existing client exposures and prepare a documented wind-down or remediation plan capable of completion by 2027-01-08, subject to any earlier NCA requirement.
• Firms may wish to define narrowly controlled exit-only services for liquidation, conversion, withdrawal, transfer, and safekeeping, with time limits, risk controls, client communications, records, and escalation to the relevant NCA.
• Governance functions should document the interpretation of the ESMA opinion, approvals for affected product changes, control ownership, exceptions, surveillance, management information, and evidence available for supervisory review.

What changed

The opinion covers the full range of MiCA crypto-asset services, including operating trading platforms, exchanging crypto-assets for funds or other crypto-assets, executing orders, placing crypto-assets, reception and transmission of orders, investment advice, transfers, custody and administration, and portfolio management. ESMA expects National Competent Authorities to supervise so that CASPs do not maintain, introduce, or facilitate EU-client access to non-MiCA-compliant ARTs or EMTs.

Key dates

2019-09-01

The HKEX suspension framework applies to annual results announcements for financial years commencing on or after this date; the framework generally covers disclaimer or adverse audit opinions but excludes cases relating solely to going concern, subject to disclosure requirements.

2026-10-08

The SFC, AFRC and HKEX joint statement was issued and the regulators publicly signalled enhanced monitoring and possible future Listing Rule amendments.

Suggested considerations

• Compliance teams at listed issuers should consider inventorying current and prospective going-concern uncertainties, disclaimer risks and the status of related remediation plans before the next annual reporting cycle.
• Management may wish to strengthen cash-flow forecasts, liquidity analyses, financing assumptions, covenant assessments and downside scenarios, ensuring that key inputs are supported by reliable evidence and that proposed mitigating actions are realistically executable.
• Audit committees should consider documenting robust challenge of management’s assumptions, including the feasibility, timing and funding of proposed actions, and monitoring delivery against approved milestones.
• Issuers may wish to review annual results and financial-reporting disclosures to ensure that the circumstances giving rise to any audit modification, management’s actions and remaining uncertainties are explained clearly and consistently.
• Auditors and issuer compliance functions should consider escalating deficiencies in going-concern evidence or action plans promptly to management, the audit committee and relevant governance bodies.
• Listed issuers with existing going-concern-only disclaimers should consider preparing for increased engagement with HKEX and the possibility of a future Listing Rule amendment requiring suspension; no immediate suspension deadline was created by this statement.
• Compliance teams should monitor subsequent SFC, AFRC and HKEX communications, enforcement outcomes and any consultation or rule amendment concerning suspension of issuers with going-concern-only disclaimers.

What changed

The regulators set out coordinated expectations rather than new binding rules. Issuer management should support going-concern assessments with reasonable assumptions, reliable data and feasible action plans; audit committees should challenge those assessments and oversee remedial actions; and auditors should critically evaluate the assessments, communicate deficiencies and explain clearly the basis of any disclaimer. The regulators will monitor conduct and may take regulatory, disciplinary or enforcement action for misconduct or non-compliance.

Key dates

2026-10-07

MAS issued the Guidelines on Artificial Intelligence Risk Management following its November 2025 consultation.

2027-10-07 Deadline

The Guidelines take effect. FIs should meet the expectations in Sections 3 and 4 from this date.

2027-10-07

MAS intends to consult the financial sector during 2027 on what additional guidance on agentic AI would be useful.

2028-10-07 Deadline

FIs should meet the expectations in Sections 5 and 6 by this date under the phased implementation timetable.

Suggested considerations

• FIs should establish or update an enterprise inventory of AI systems, models, embedded AI functionality and third-party AI services, using a level of granularity appropriate to their risk profile.
• Compliance and risk teams may wish to classify individual AI use cases by materiality, including potential effects on customers, prudential soundness, operational resilience, other financial institutions and the wider financial system.
• Boards and senior management should consider documenting AI risk appetite, ownership, escalation routes and the allocation of responsibilities across business, risk, compliance, technology, cybersecurity, data and model-governance functions.
• FIs should map existing AI controls across the lifecycle, including data governance, development and validation, testing, human oversight, cybersecurity, monitoring, incident management and change management, and identify gaps against the Guidelines.
• Procurement, outsourcing and third-party-risk functions should consider adding AI-specific due diligence, assurance, contractual rights, performance monitoring, incident notification and exit or substitution arrangements for external AI providers.
• FIs should assess whether existing governance committees and risk frameworks provide sufficient cross-functional oversight, rather than assuming that a new dedicated AI committee is necessary.
• FIs may wish to define evidence that supports proportionality decisions, including why basic policies and procedures are adequate for lower-materiality AI use cases.
• Implementation planning should distinguish the expectations in Sections 3 and 4, which should be met from 7 October 2027, from Sections 5 and 6, which should be met by 7 October 2028.

What changed

The Guidelines introduce an enterprise- and use-case-level framework for managing AI risk. Boards and senior management are expected to oversee AI risk, define accountabilities, set risk appetite, and maintain suitable risk-management frameworks, policies and procedures; existing governance structures may be used and a dedicated AI committee is not required solely for compliance.

Key dates

2026-01-19

The Public Offers and Admissions to Trading Regulations 2024 regime came into effect; PMB 66 finalises related Knowledge Base guidance.

2026-09-01

Revised FRC Third Country Auditor directions took effect, temporarily permitting certain qualifying Stock Connect audits of Chinese-registered entities to use Chinese Standards on Auditing.

2026-09-30

The FCA published Primary Market Bulletin No. 66 and finalised Technical Notes 619.3 and 321.5.

2026-10-28

Deadline for comments on proposed Technical Notes 803.1 and 801.5 and proposed deletion of Technical Note 802.3.

2027-01-01

UK Sustainability Reporting Standards-based UK Listing Rules requirements apply to accounting periods beginning on or after this date; Scope 3 and non-climate S1 transitional deferrals may apply.

2027-03-18

FCA operational incident and third-party reporting rules in PS26/2 come into force.

2028-01-01

The FCA expects the first reporting cycle affected by the new sustainability disclosure framework to occur in 2028, depending on the issuer's financial year.

Suggested considerations

• Issuers and advisers should reassess prospectus working capital models to determine whether each uncommitted facility can reasonably be treated as available for the entire working capital period, including under the reasonable worst-case scenario.
• Where uncommitted facilities are relied upon, firms should document the directors' assessment, the assumptions and the accompanying prospectus disclosure required by Guidelines 33.1 and 33.2 of Technical Note 619.3.
• Firms should test all risk factors, liquidity disclosures and business-plan assumptions for consistency with a clean working capital statement and consider a qualified statement where the prospectus describes risks fundamentally inconsistent with clean working capital.
• Sponsors, reporting accountants and legal advisers should update working capital checklists, verification procedures, prospectus precedents and review controls for Technical Notes 619.3 and 321.5.
• Listed companies should prepare for UK Sustainability Reporting Standards and the UK Listing Rules changes applying to accounting periods beginning on or after 2027-01-01 by identifying material sustainability risks and opportunities, reviewing governance and controls, and planning for the Scope 3 and non-climate S1 transitional deferrals.
• Issuers should maintain a documented, case-by-case process for assessing whether a cyber incident or vulnerability is inside information under Article 7 UK MAR, whether disclosure is required under Article 17(1), and whether delay under Article 17(4) remains justified and confidential.
• Firms should monitor cyber incidents after initial containment for new inside information concerning operational impact, duration, remediation costs, protection costs, reputational effects or changes to financial outlook, and should document information-sharing with authorities under Articles 10 and 17(8) UK MAR.
• Relevant firms should familiarise themselves with the operational incident and third-party reporting framework in PS26/2 ahead of its 2027-03-18 commencement.

What changed

Technical Note 619.3 now permits an issuer to take financing under certain uncommitted facilities into account when assessing working capital for the entire working capital period, where the directors judge that the facilities can be considered available throughout that period. A clean working capital statement may then be issued, provided the prospectus includes appropriate disclosure alongside the statement, including the relevant basis-of-preparation information and the fact that uncommitted facilities were taken into account.

Key dates

2026-06-30

The FCA opened consultation on the proposed CRYPTOPRU 7 guidance.

2026-07-30

Consultation on the proposed guidance closed.

2026-09-30

The FCA finalised and published FG26/10.

2027-10-25 Deadline

FG26/10 comes into force alongside the FCA's new UK cryptoasset regime.

Suggested considerations

• Firms should map their current CRYPTOPRU 7 overall risk assessment against FG26/10, documenting any gaps in risk identification, stress testing, financial-resource calculations, recovery planning and wind-down analysis.
• Compliance and prudential teams may wish to confirm that the own-funds requirement is calculated as the highest of the permanent minimum requirement, fixed overheads requirement and K-factor requirement, and that the own-funds threshold requirement is not below that amount.
• Firms should consider developing severe-but-plausible scenarios that combine cryptoasset price declines, customer withdrawal surges, counterparty or exchange failure, cyber incidents, private-key compromise, reduced market liquidity, stablecoin de-pegging and infrastructure outages.
• Firms should assess whether collateral, committed facilities, group support, banking arrangements, custody structures and other mitigants are legally, operationally and practically available under stress, rather than relying solely on their accounting treatment.
• Firms should prepare or refresh a stressed 90-day cash-flow forecast covering peak and cumulative liquidity needs, including margin calls, settlement failures, client drawdowns, pre-funding requirements and delayed or unavailable funding.
• Firms should assess their funding profile over the following 12 months, including renewal and rollover risk, withdrawal of facilities, reduced group funding and increased funding costs.
• Firms should establish a contingency funding plan with quantitative internal triggers above regulatory thresholds, credible actions within management control, implementation timelines, impediments and communication arrangements.
• Firms should distinguish recovery actions that management can execute directly from actions dependent on shareholders, banks, counterparties, group entities or buyers, and should consider whether limited recovery capacity requires earlier wind-down triggers.

What changed

FG26/10 does not create a new standalone binding rule or prescribe a single methodology; it explains how firms should evidence compliance with the binding requirements in CRYPTOPRU 7 and should be applied proportionately to the firm's nature, scale and complexity. Firms should begin with their business model, strategy and risk appetite, identify market, leverage, credit, liquidity, operational and concentration risks, assess interactions between those risks, and evaluate whether mitigants remain effective under stress.

Key dates

2026-06-30

FCA consultation on GC26/4 opened.

2026-07-30

FCA consultation on GC26/4 closed.

2026-09-30

FCA published finalised guidance FG26/9.

2027-10-25

FG26/9 comes into force as non-Handbook guidance on COREPRU 7.

Suggested considerations

• Firms should map all regulated and unregulated activities, group dependencies and outsourced services into an inventory of risks capable of causing material harm to clients or the market.
• Compliance and prudential teams may wish to document a clear chain from business model and risk appetite through material risks, controls, stress scenarios, OFTR, LATR, early-warning indicators and management actions.
• Firms should assess own funds and liquid assets separately for ongoing operations and wind-down, test the timing of cash inflows and outflows, and evidence that thresholds meet the applicable OFR, BLAR and sectoral minimums.
• Firms should consider whether their business plan, normally covering approximately three years, has been stress tested against sufficiently severe but plausible firm-specific, market-wide and concurrent scenarios, including reverse stress testing to failure.
• Firms should review whether wind-down plans specify triggers, execution steps, timing, costs, cashflow sequencing and resource needs under stressed conditions.
• Firms should establish governance, independent challenge, version control and documentation standards that preserve the rationale, assumptions, evidence and judgments supporting the ORA.
• Firms may wish to schedule implementation work ahead of 25 October 2027, notwithstanding that the underlying COREPRU 7 obligations already apply and the guidance is non-Handbook.
• Firms should plan an annual ORA review, additional reviews following material business-model or operating-model changes, and retention of the approved ORA for at least three years.

What changed

FG26/9 provides an integrated framework for complying with COREPRU 7.2.1R and the overall financial adequacy rule, covering all regulated and unregulated activities, group and outsourcing dependencies, material-harm risks, risk appetite, systems and controls, the own funds threshold requirement (OFTR), the liquid asset threshold requirement (LATR), stress and reverse stress testing, and wind-down planning.

Key dates

2023-01-01

The Economic Crime and Corporate Transparency Act 2023 received Royal Assent during 2023; its voluntary information-sharing provisions are identified by the FCA as a potential mechanism for firms to share information concerning economic crime. The specific commencement date for any relevant provision should be verified against the applicable commencement instruments.

2025-01-01

Cifas introduced a dedicated funds received for money muling filing category and revised filing criteria and guidance, making 2025 filing data not directly comparable with 2023 and 2024. The date is stated as January 2025 rather than a specific day.

2026-09-23

The FCA published its multi-firm review on money-mule activity and cashing out findings.

Suggested considerations

• Firms should consider refreshing their business-wide and customer-risk assessments to reflect mule-chain activity, including the concentration of cashing out between the second and fifth accounts and the higher concentration at the second account.
• Compliance and fraud teams may wish to test whether transaction-monitoring scenarios identify linked accounts, repeated use of accounts across fraud types, rapid onward transfers, fragmented card spending, international destinations and higher-value crypto-related cash-outs.
• Firms should consider reviewing controls across the full payment chain rather than focusing only on the first account receiving suspected fraud proceeds, including internal account link analysis and escalation between fraud, AML and investigations teams.
• Banks, payment institutions and EMIs may wish to compare detection and response performance by account tenure, customer type and channel, noting that 74.1% of EMI closures and 56.9% of PI closures in the survey occurred within six months of account opening.
• Firms should consider assessing whether their use of the National Fraud Database is effective and whether suspected cases meet the applicable Cifas evidential and category criteria; the FCA data should not be interpreted as requiring Cifas filings to equal account closures.
• Firms should consider whether the Economic Crime and Corporate Transparency Act 2023 information-sharing provisions can lawfully support prevention, detection or investigation of linked mule activity, with appropriate governance, records and data-protection controls.
• MLROs and nominated officers may wish to prepare for the further FCA and National Economic Crime Centre alert and retain evidence showing how the review findings were considered and, where appropriate, incorporated into control enhancements.

What changed

The FCA has provided new supervisory findings on the scale, profile and mechanics of money-mule activity based on a survey of 35 firms and analysis by a 22-firm public-private cell covering 140 cases across seven fraud types. It expects firms to use the findings in their own money-mule risk assessments and to review and strengthen controls for detecting, preventing and disrupting mule activity.

Key dates

2026-09-17

The FCA published its findings on payments firms delivering good outcomes for consumers in vulnerable circumstances.

Suggested considerations

• Compliance teams may wish to map the four vulnerability drivers in FG21/1 against the firm’s customer base, products, channels and transaction journeys, including digital-only and automated interactions.
• Firms should consider testing whether vulnerability identification, recording, flagging and information-sharing operate consistently in practice through call listening, complaints analysis, quality assurance, customer research and sample-based file reviews.
• Firms may wish to document how identified needs translate into specific support, such as alternative channels, assisted onboarding, additional time, accessible communications, language support or human intervention, and how those interventions produce good outcomes.
• Management information may need to cover the prevalence and characteristics of vulnerability, support provided, customer outcomes, complaints, failed or delayed payments, access barriers, vulnerable-customer journey performance and trends over time; smaller firms may use proportionate qualitative evidence but should still demonstrate effective oversight.
• Boards and senior management may wish to receive sufficiently frequent reporting to challenge whether arrangements are working, investigate root causes and track whether remedial actions improve outcomes rather than relying solely on annual Consumer Duty reporting or isolated case studies.
• Firms using intermediaries should consider how they assess the intermediary’s identification, training, support, communications, recording and outcomes-monitoring arrangements, and how issues are escalated and remediated.
• When collecting or sharing vulnerability information, firms should consider compliance with UK GDPR, the Data Protection Act 2018 and applicable confidentiality and data-minimisation requirements.
• Smaller firms may wish to record why their systems, controls and management information are proportionate to their business model, customer base and potential harm, while retaining evidence that individual circumstances can be addressed flexibly.

What changed

No new binding requirements or prescribed operating model were introduced. The FCA has nevertheless clarified the evidence it expects firms to maintain under the existing Consumer Duty and its vulnerable-customer guidance, including an understanding of the four vulnerability drivers—health, life events, financial resilience and financial capability—identification and recording across customer journeys, appropriate support and communications, outcome-focused management information, senior-management or board oversight, testing and assurance, intermediary oversight, and continuous improvement.

Key dates

2026-08-27

OCC issued revised PPM 5310-3 and PPM 5400-11; PPM 5310-3 replaces the May 25, 2023 manual, PPM 5400-11 replaces the February 27, 2026 version, and OCC Bulletin 2023-16 is rescinded.

Suggested considerations

• Compliance teams may wish to map open MRAs, enforcement orders, capital directives, and supervisory findings against the new material-harm, Deposit Insurance Fund risk, and substantive-violation thresholds.
• Banks should consider reviewing issue-management taxonomies and governance procedures so that MRAs, other violations, and supervisory observations are recorded and escalated according to their distinct consequences.
• Board and committee reporting processes may warrant review because supervisory observations do not automatically require board presentation or a corrective-action plan, whereas MRAs and enforcement actions remain subject to formal remediation and validation expectations.
• Large and complex banks should consider reassessing whether deficiencies that might previously have produced a community-bank-level supervisory response could receive faster escalation under the revised tailoring framework.
• Banks with existing enforcement actions may wish to assess whether their remediation evidence demonstrates substantial compliance with the essential requirements of each order and whether remaining issues are minor and isolated.
• Capital management teams may wish to review procedures for the institution of and termination of individual minimum capital ratios under the revised enforcement manual.
• Legal and regulatory change teams should monitor Federal Register publication of the joint OCC-FDIC final rule and calculate the actual effective date rather than relying on the bulletin date.
• Internal audit and compliance functions may wish to preserve objective factual support for responses to MRAs and other supervisory communications, particularly where the bank believes an issue does not meet the new risk-based threshold.

What changed

Revised PPM 5310-3 replaces the May 25, 2023 version and structures the OCC enforcement framework around escalation, tailoring, and focus. The OCC generally intends to provide banks an opportunity to remediate deficiencies through supervision before initiating a Section 8 enforcement action, although it retains authority to act at any time when legally supportable and warranted.

Key dates

2026-08-27

JFSA published the revision and added Question 7 to the Q&A on Financial Instruments Business.

Suggested considerations

• Firms should identify all overseas-listed ETFs distributed or made available to Japanese customers and isolate products with a single Japanese-company equity exposure and leveraged or inverse performance objectives.
• Compliance teams may wish to suspend onboarding, marketing, solicitation, and new sales of affected products pending a documented legal and compliance assessment of the revised Question 7 and any follow-up JFSA communications.
• Firms should review whether existing distribution arrangements, product lists, customer disclosures, suitability controls, and overseas-product filing processes remain defensible in light of the JFSA’s public-interest position.
• Broker-dealers should assess whether affected products can remain accessible on an execution-only basis, including the risk that continued availability could be viewed as distribution or otherwise inconsistent with the JFSA’s stated view.
• Firms should obtain product-level information on the reference asset, leverage or inverse multiple, daily reset methodology, derivatives and rebalancing arrangements, listing venue, and Japanese investor access channels.
• Market surveillance and product-governance teams may wish to evaluate whether distribution of affected products could contribute to volatility, disorderly trading, or concerns about price formation in the Japanese underlying shares.
• Senior management should document escalation, inventory decisions, customer communications, and any decision to close or restrict positions, while monitoring for amendments to the Financial Instruments and Exchange Act framework, supervisory guidelines, or additional JFSA expectations.

What changed

The JFSA added Question 7 to its Q&A on Financial Instruments Business. The revised guidance expresses the JFSA’s view that distributing overseas single-stock leveraged ETFs whose underlying assets are shares of Japanese companies is not in the public interest because the products may amplify fluctuations in the prices of the underlying shares listed on Japanese exchanges and may significantly affect price formation in Japan’s financial markets.

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying [email protected] by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.

Key dates

2025-01-17

DORA became applicable to financial entities within its scope, subject to the specific DORA provisions and technical standards applicable to each entity.

2025-04-09

Circular CSSF 25/881 was published and took effect, removing DORA financial entities from Circular 20/750 and retaining 20/750 for entities outside DORA; PSP-specific provisions were reorganised under Circular 25/880.

2026-06-30 Deadline

CSSF extended the first Register of Information submission for Luxembourg branches of third-country credit institutions to this date on a best-efforts basis; the CSSF indicated that the required level of quality should be achieved for the 2027 submission.

2026-08-27

Circular CSSF 26/915 was published, confirming the DORA treatment of qualifying third-country branches and removing them from the full scope of Circular 20/750 and related overlapping circular provisions.

2027-03-31 Deadline

Target date identified by the CSSF for the required-quality Register of Information submission by Luxembourg branches of third-country credit institutions.

Suggested considerations

• Firms should classify each Luxembourg entity and branch against DORA Article 2 and the amended scope of Circular 20/750, including an assessment of whether a third-country head office would qualify under DORA Article 2(1)(a) to (t).
• Compliance teams may wish to determine whether the entity should operate under DORA rather than 20/750, and document the rationale, legal-entity perimeter and treatment of any Luxembourg branch.
• Firms remaining within Circular 20/750 should consider reviewing their ICT and security-risk-management framework, governance approvals, risk assessments, incident processes, business-continuity arrangements and control testing against the continuing requirements.
• Payment service providers should consider replacing references to the PSP provisions formerly contained in Circular 20/750 with the applicable requirements in Circular CSSF 25/880 and EBA/GL/2025/02.
• Third-country branches treated as DORA entities should consider validating their DORA governance, ICT-risk framework, incident-reporting arrangements, ICT contractual inventory and Register of Information processes, taking account of CSSF reporting communications.
• Firms should update policies, regulatory inventories, outsourcing and ICT-third-party registers, training materials and regulatory mapping to distinguish DORA obligations from the residual Circular 20/750 obligations.
• Compliance teams may wish to retain evidence of the scope assessment and implementation date, because the 2025 amendment was effective immediately and the 2026 amendment changes the treatment of a previously identified 20/750 population.