Authorisation & Licensing

Key dates

2026-11-03

The EAER expanded and amended the Swiss sanctions lists relating to Russia and Belarus.

2026-11-04

The Federal Council decided to adopt the EU’s 21st Russia and Belarus sanctions package and related measures.

2026-11-04

The amended sanctions lists entered into force at 23:00 Swiss time.

2026-11-05

The sectoral measures, including the strengthened crypto-sector restrictions and transaction prohibitions, entered into force.

Suggested considerations

• Compliance teams may wish to refresh sanctions screening against the amended Swiss Russia and Belarus lists, including customer, beneficial-owner, authorised-signatory, counterparty and payment screening records.
• Swiss crypto-sector companies should consider reviewing ownership registers, pending acquisitions, shareholder changes, control arrangements and beneficial-ownership information for Russian nationals and persons resident in Russia, including indirect acquisition structures.
• Firms should consider mapping exposure to the newly prohibited banks, financial institutions, crypto-service providers and other entities, and placing appropriate holds on affected transactions and assets pending resolution.
• Financial intermediaries may wish to document asset-freeze decisions and report affected business relationships to SECO in accordance with the applicable Ukraine sanctions ordinance.
• Where sanctions-related facts create suspicion of money laundering or terrorist financing, firms should consider completing the additional clarifications required by Article 6 AMLA and filing an immediate report under Article 9 AMLA if the suspicion cannot be dispelled.
• Firms may wish to update sanctions procedures, transaction-monitoring scenarios, onboarding questionnaires and escalation controls to distinguish SECO sanctions reporting from separate AMLA reporting.
• Compliance teams may wish to review external exposure to EU sanctions controls as well as Swiss measures; independent Swiss sanctions commentary describes the regime as not being a general Russia or Belarus embargo, but highlights continuing expansion of financial, crypto, services and circumvention controls.

What changed

The EAER expanded and amended the Russia and Belarus sanctions lists, adding 254 individuals, companies and organisations to measures including asset freezes and restrictions on making funds or economic resources available. Switzerland also introduced transaction prohibitions covering, among others, 33 Russian banks, one bank in a third country, 17 financial institutions and crypto-service providers, five third-country companies, four Russian airports and two Russian ports.

Key dates

2025-06-12

The SFC launched the consultation on expanding section 34 of the SFO and introducing similar restrictions under the AMLO.

2025-08-11

The consultation period closed; the SFC reported receiving nine submissions from industry associations, professional bodies, a bank and other interested parties.

2026-11-06

The SFC published its consultation conclusions, updated the FAQs and announced its intention to introduce an amendment bill into LegCo.

Suggested considerations

• Compliance teams may wish to inventory legal-entity names, business names, brands, websites, domains, mobile applications, social-media handles, product names and marketing descriptions against the SFC's proposed Table A and Table B titles.
• Firms should consider mapping each relevant name to the activities actually performed, including trading, brokerage, matching, exchange, clearing, settlement, custody and virtual-asset services, and documenting whether SFO or AMLO licensing could be required.
• Unregulated entities may wish to assess whether current names imply SFC licensing, regulated status or an association with a well-known exchange, clearing house or VATP, including through abbreviations, translated names and closely resembling wording.
• Licensed VATPs and financial groups may wish to review whether group-company names, partnerships, white-label arrangements, sponsorships or marketing references could create an apparent association with an established operation that does not exist.
• Legal and compliance functions may wish to monitor the amendment bill, LegCo proceedings, commencement provisions, transitional arrangements, the final restricted-title list and any future mechanism for updating that list.
• Firms considering a new name or business launch may wish to obtain independent Hong Kong legal advice and, where appropriate, seek SFC authorisation before adopting a potentially restricted title; the SFC has not announced a final application deadline or commencement date.
• Marketing and financial-promotion controls may be updated to require enhanced review of terms such as "exchange", "trading platform", "clearing house", "virtual asset", "digital asset", "token" and "crypto" once the amendments are enacted.

What changed

The SFC will proceed with legislative amendments to expand the existing section 34 SFO restrictions beyond titles such as "stock exchange" and "commodity exchange". The expanded scope is intended to cover titles commonly used instead of "exchange", titles describing SFO-regulated products, titles referring specifically to clearing operations, and names or acronyms implying association with established or well-known exchanges, clearing houses, VATPs or similar operations, whether located in Hong Kong or elsewhere and whether regulated or unregulated.

Key dates

2026-11-05

CFTC issued the interpretation of the impartial access requirements in 17 CFR 38.151(b).

2026-12-05 Deadline

Thirty-day period expires for DCMs to cease domestic geographic restrictions that violate the impartial-access requirements or submit an explanation to the Division of Market Oversight why compliance is not feasible; the same period applies to addressing intermediary impediments or explaining why compliance is not feasible.

Suggested considerations

• DCMs should inventory all domestic geographic eligibility, onboarding, trading, product-access, and account-management restrictions and assess them against 17 CFR 38.151(b)'s requirements for impartial, transparent, and non-discriminatory access.
• DCMs should review whether state-based restrictions affect members, persons with trading privileges, independent software vendors, or access to particular products, including event contracts.
• DCMs should identify and review contractual, technical, and operational controls used by futures commission merchants, introducing brokers, and other intermediaries to determine whether they impose geographic restrictions inconsistent with the DCM's impartial-access requirements.
• DCMs should document the legal and operational basis for removing each restriction or, where removal is not feasible, prepare a fact-specific explanation for the Division of Market Oversight before the 30-day period expires.
• Compliance teams at intermediaries should map state-based geofencing, customer-location verification, product blocking, and position-management restrictions affecting access to DCM markets and assess whether those controls are required by applicable law, regulation, or court order.
• Affected firms should assess conflicts between the CFTC's interpretation and any state requirements or judicial orders, obtain legal analysis, and avoid treating the interpretation as automatically vacating an injunction or other binding court order.
• DCMs should retain evidence of governance review, intermediary oversight, customer communications, access testing, and remediation decisions in anticipation of possible fact-specific CFTC inquiry or enforcement.

What changed

The CFTC has applied the existing impartial-access requirements in 17 CFR 38.151(b) expressly to domestic geographic restrictions, including restrictions based on a market participant's state or location. DCMs must cease geographic restrictions that violate the rule within 30 days of the November 5, 2026 publication, or submit an explanation to the Division of Market Oversight stating why compliance is not feasible.

Key dates

2026-11-02

The FCA published an earlier statement warning about demands for repayment of disguised-remuneration scheme loans, the possible need for a Validation Order and undue pressure in debt collection.

2026-11-05

The FCA published the intervention and the restrictions agreed with Ethica Resolve Limited and West 28th Street Limited.

Suggested considerations

• Firms servicing or collecting historic disguised-remuneration loans should identify affected portfolios, pause demands and litigation activity falling within the FCA restrictions, and confirm the precise scope of any agreed requirements with the FCA.
• Ethica should complete and evidence the required consumer communications, including the explanation that payment is not currently enforceable, and maintain records of recipients, delivery attempts and unresolved cases.
• Compliance teams should review whether correspondence, telephone contact, default notices, letters of claim and court instructions could create undue pressure or inaccurately imply that immediate payment is legally required.
• Firms should establish a vulnerability-identification and support process covering consumers experiencing health, financial or comprehension difficulties, with appropriate escalation, reasonable adjustments and management information.
• Debt servicers should verify the creditor's ownership, the chain of assignment, the original lender's regulatory status and any applicable consumer-credit permissions or exemptions before pursuing repayment.
• Legal and compliance teams should assess whether any proposed enforcement requires an FCA Validation Order or other court permission, recognising that a Validation Order is not guaranteed and that the FCA has stated that the debt may remain unenforceable if required permission is not granted.
• Firms should ensure that no default judgment is sought in the affected claims and that consumers continue to receive accurate information that formal court documents should not be ignored.
• Senior management should review outsourcing, agency and oversight arrangements where an authorised firm acts for an unauthorised debt purchaser, including conduct risk, consumer-outcome monitoring and escalation to the FCA where harm may have occurred.

What changed

Ethica must write to affected consumers explaining that they do not currently have an enforceable obligation to pay and therefore do not need to make payment at this stage. Ethica must not make further demands for payment from affected consumers in the current proposed court claim while the relevant issues remain unresolved. Ethica and West 28 must not seek default judgments against consumers who have not responded to a legal claim. Ethica must identify affected vulnerable consumers and put additional protections in place.

Key dates

2021-12-20

The AFM published its exploratory report on finfluencing, identifying unlicensed advice, risky recommendations, cooperation with unlicensed firms and customer-referral fees as key pitfalls.

2026-08-31

The Rotterdam District Court reduced the Van den Brink fine by €52,500 to €142,500, citing proportionality, delayed AFM action and breach of the reasonable-time requirement under Article 6 ECHR.

2026-11-05

The AFM published the enforcement update describing the original €195,000 fine and the court's final €142,500 outcome.

Suggested considerations

• Compliance teams should consider inventorying all finfluencer, affiliate, introducer and referral arrangements, including website links, discount codes, lead forms and onboarding assistance.
• Firms should consider verifying the AFM authorisation status of every investment-service provider, platform or asset manager promoted by employees, affiliates or contracted influencers before publication or referral activity begins.
• Investment firms should consider testing whether any payment is calculated by reference to the number of referred customers, account openings, onboarding progress, deposits or invested assets, as these features create heightened Dutch inducement and conduct risk.
• Firms should consider separating permitted advertising services from customer-introduction or onboarding activities and documenting why each arrangement does not involve unauthorised investment advice, portfolio management or participation in unlicensed services.
• Marketing and compliance teams may wish to review influencer scripts, direct messages, Q&A responses and customer-support practices for advice, personalised recommendations or operational assistance that exceeds passive advertising.
• Firms should consider collecting and retaining contracts, commission calculations, communications, approval records and evidence of licence checks so that the commercial purpose and control framework for each promotion can be demonstrated.
• Governance committees may wish to treat unusually high or asset-based referral commissions, including percentages of customer deposits, as escalation indicators requiring enhanced legal and compliance review.
• Firms should consider reviewing legacy arrangements in light of the AFM's 2021 finfluencer findings and subsequent enforcement against referral-fee models, including arrangements involving execution-only services.

What changed

This is an enforcement action rather than a new rule or general licensing amendment. The AFM treated Van den Brink's combined activities—promotion through social media and a website, investor introduction, assistance with registration, responses to investor questions and acting as a contact person—as participation in illegal asset management, not merely advertising. The AFM stated that Grinta Invest had no required licence and that Van den Brink received substantial referral remuneration, including 10% of investors' deposited capital; the remuneration was relevant to the original fine.

Key dates

2026-01-19

The Public Offers and Admissions to Trading Regulations 2024 regime and the PRM sourcebook came into force, replacing the UK Prospectus Regulation framework for relevant new activity.

2026-07-31

The FCA’s PRM Clarificatory Amendments Instrument 2026 came into force, including amendments to PRM 1.4.12R and PRM 10.1.9R.

2026-11-04

GC26/8 consultation opened and the FCA published Primary Market Bulletin No. 67.

2026-12-09 Deadline

Deadline for comments on the proposed amendments and revocations.

Suggested considerations

• Firms should review the proposed amendments to TN 602.5 and TN 605.5 and consider submitting comments to the FCA at [email protected] by 9 December 2026.
• Issuers and advisers should reassess employee and director share-scheme prospectus-exemption analyses under PRM 1.4.12R, including whether any onward-transfer purpose could make the exemption unavailable.
• Issuers, arrangers and counsel should update precedent opinions, prospectus checklists and supplementary-prospectus procedures to use the PRM 10.1.9R “manifestly the same” formulation rather than relying on the former “fungible” wording.
• Firms should identify references to UKLA/TN/103.1 and PN 902.4 in listing manuals, training, transaction checklists and legal memoranda, and determine whether those references should be removed or replaced with current UKLR, PRM or FCA website material.
• Teams handling legacy prospectuses should distinguish the new PRM framework from saving provisions for prospectuses approved under the former UK Prospectus Regulation, including the transitional provisions in regulation 48 of the Public Offers and Admissions to Trading Regulations 2024.
• Compliance teams may wish to monitor the FCA’s final decision and the Knowledge Base after the consultation closes before treating the proposed deletions or amended notes as final guidance.

What changed

The FCA proposes to amend Primary Market/TN/602.5 so that its guidance on the prospectus exemption for securities offered, allotted or to be allotted to existing or former directors or employees refers to PRM 1.4.12(2)(c). The related PRM 1.4.12R amendment is intended to ensure that the exemption is used only for legitimate incentive and employee share schemes and is unavailable where the purpose is subsequent transfer rather than a genuine employee or director scheme.

Key dates

2026-11-03

FCA and PRA published DP26/1: Credit unions: review of the regulatory regime.

2027-03-05 Deadline

Deadline for responses to DP26/1 to be sent to the FCA.

Suggested considerations

• Credit unions should consider whether to submit a response by 5 March 2027, addressing the questions and evidence relevant to their business model, size, complexity, growth plans and risk profile.
• Boards and senior management may wish to assess how potential changes to prudential requirements, permitted activities, governance expectations, operational resilience and resolution or exit arrangements could affect strategic plans, without treating the Discussion Paper as a change to current rules.
• Compliance and regulatory-policy teams should map the firm’s current obligations under the PRA Rulebook Credit Unions Part, applicable FCA conduct requirements and the Credit Unions Act 1979, then identify areas where proportionality or regulatory barriers create material costs or risks.
• Credit unions may wish to engage with representative bodies and credit union service organisations to develop evidence on member outcomes, access to affordable credit, innovation, consolidation, operational dependencies and barriers to orderly exit.
• Firms should monitor subsequent FCA and PRA consultation papers, policy statements and rule changes because any future implementation would require a separate policy process and could include differentiated requirements for smaller and larger credit unions.

What changed

No binding regulatory requirements or policy changes have been introduced. The regulators are seeking evidence on whether the existing prudential framework remains appropriate; whether risk-based and proportionate requirements could better support growth and complexity; whether the framework provides adequate safeguards while enabling competition and innovation; and whether credit unions have effective tools for orderly market exit. The publication is relevant to credit unions in Great Britain and Northern Ireland, their members, credit union service organisations and trade associations.

Key dates

2026-11-03

FCA publishes PS26/22 and final rules for the ESG ratings regime; Part 1 of Annex D comes into force.

2027-02-01

FCA Pre-Application Support Service is expected to be available to prospective ESG ratings applicants.

2027-06-24 Deadline

FCA authorisation gateway opens. Providers with annual revenue of £500,000 or more should apply during the first application period, from 24 June to 29 July 2027.

2027-07-29 Deadline

End of the first staggered authorisation application period for providers with annual revenue of £500,000 or more.

2027-07-30

Second staggered authorisation application period opens for providers with annual revenue below £500,000.

2027-08-31 Deadline

End of the second staggered authorisation application period for providers with annual revenue below £500,000.

2028-06-29 Deadline

The ESG ratings regime takes effect. In-scope providers must be FCA-authorised and hold the relevant permission before carrying on the regulated activity, unless an exclusion applies; unauthorised activity may breach the FSMA general prohibition and constitute a criminal offence.

Suggested considerations

• Firms should map all ESG scores, assessments, opinions and rating products against article 63U, PERG 2.3 and the FCA perimeter guidance, including whether the firm both produces and makes the rating available and whether it is likely to influence a specified investment decision.
• Potential applicants should identify the legal entity requiring authorisation or variation of permission and assess whether an exemption applies, including exemptions connected with other regulated activities, investment research, fund marketing, benchmarks and overseas persons.
• Firms should perform a gap analysis against PS26/22 covering transparency disclosures, methodology governance, data validation, quality assurance, record retention, complaints handling, rated-entity engagement and advance notification of material methodology changes.
• Providers should consider documenting controls for AI and other automated processes, data limitations, model or methodology changes, reproducibility of rating outcomes and the competence, independence and integrity of rating personnel.
• Compliance teams may wish to review conflicts arising from charging models, consulting or advisory services, commercial relationships, remuneration and personal transactions, and determine how conflicts will be prevented, managed and disclosed.
• Firms should assess governance, senior-management accountability, systems and controls, outsourcing oversight, UK presence expectations and financial-resources and wind-down arrangements relevant to the authorisation application.
• Potential applicants should consider engaging with the FCA Pre-Application Support Service from February 2027 and preparing the application materials before the relevant staggered application window.
• Users of ESG ratings should consider reviewing supplier due diligence, data procurement, investment governance and sustainability disclosure processes so that ratings are interrogated rather than treated as definitive or objectively comparable ESG measures.

What changed

Providing an ESG rating becomes a regulated activity under article 63U of the Financial Services and Markets Act 2000 (Regulated Activities) Order, subject to the statutory perimeter and exclusions. A provider is generally in scope where it produces and makes the rating available, carries on the activity by way of business, and the rating is likely to influence a decision to make a specified investment; merely distributing another provider's rating is outside this activity.

Key dates

2026-11-03

FCA publishes PS26/22 and final rules; the FEES amendment relating to the regime comes into force.

2027-02-01

FCA expects its Pre-Application Support Service for ESG rating authorisation applications to become available.

2027-06-24

FCA authorisation gateway opens for ESG rating providers.

2027-07-31 Deadline

Larger firms, defined by the FCA as firms expecting at least £500,000 of UK ESG-ratings revenue in the 12 months following application, should apply during the first month of the gateway, before the end of July 2027.

2027-08-31 Deadline

Other firms should apply during the second month of the gateway, by the end of August 2027.

2028-06-29 Deadline

The ESG ratings regime comes into force. In-scope providers must have FCA authorisation and the relevant permission unless an exclusion or exemption applies.

Suggested considerations

• Firms should inventory every product, score, opinion, label, ranking, colour-coded category and platform output that assesses one or more environmental, social or governance factors, including products not marketed as ESG ratings.
• Compliance teams may wish to apply the PERG 19 decision framework to each product: whether the activity is carried on by way of business, whether the firm produces and makes the rating available, whether investment decisions are likely to be influenced, the territorial connection, and whether an exclusion or exemption applies.
• Firms should document the distinction between unranked ESG data and provider-produced ratings, including the methodology, default thresholds, categories and user-configurable outputs embedded in software or analytics platforms.
• Potential applicants should identify the legal entity requiring permission, assess whether the activity is standalone or embedded in another regulated service, and prepare a regulatory business plan, governance map, resources assessment and threshold-conditions evidence.
• Prospective applicants should use the FCA’s Pre-Application Support Service from February 2027 and consider submitting applications promptly after the 2027 gateway opens.
• Larger firms should plan to submit applications during the first month of the gateway, before the end of July 2027, where forecast UK ESG-ratings revenue is at least £500,000 in the 12 months following application. Other firms should plan to apply during the second month, by the end of August 2027.
• Firms should perform a gap analysis against PRIN, SYSC, SM&CR, GEN, DISP, ESG-sourcebook and financial-crime expectations, with particular attention to methodology governance, data quality, conflicts, complaints, records, outsourcing and senior-manager accountability.
• Providers should review commercial terms, marketing and distribution arrangements to determine whether products could reasonably be expected to influence specified investment decisions, including where outputs are supplied through third-party financial platforms.

What changed

Providing an ESG rating becomes a regulated activity under article 63U of the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001, as amended by the Financial Services and Markets Act 2000 (Regulated Activities) (ESG Ratings) Order 2025. The activity generally requires a provider to produce and make available an opinion, score or combination based on an established methodology and defined ranking system, where the rating is likely to influence a decision to make a specified investment.

Key dates

2026-11-03

PRA published CP15/26 for consultation.

2026-12-04

Northern Ireland Assembly consultation on the Credit Unions (Amendment) Bill closes; this is a legislative scrutiny date, not a stated PRA consultation deadline.

Suggested considerations

• Compliance teams may wish to track the Northern Ireland Assembly’s passage and final commencement provisions for the Credit Unions (Amendment) Bill rather than treating the consultation proposals as final requirements.
• Credit unions considering member referrals should assess governance, counterparty due diligence, member eligibility and service-specific responsibilities, and consider whether contracts prevent inappropriate transfer of credit risk back to the referring credit union.
• Credit unions considering loan participation should consider documenting originator and participant roles, borrower relationship ownership, underwriting and monitoring responsibilities, security and enforcement rights, default allocation, concentration limits, large-exposure treatment, provisioning and capital treatment.
• Boards and senior managers may wish to assess whether existing risk appetite, lending policies, management information, stress testing and internal controls are proportionate to the additional activities contemplated by the PRA.
• Firms may wish to map existing lending-limit, large-exposure, provisioning and capital processes against the proposed treatment of participation loans and identify data or systems changes needed before implementation.
• Credit unions that do not intend to undertake the new activities may wish to document that decision and retain evidence that their existing governance and control framework remains appropriate for their current business model.
• Affected firms may wish to monitor the PRA’s final policy statement and any revised SS2/23 or Rulebook text before committing to new products or contractual arrangements.

What changed

The PRA proposes amendments to the Credit Unions Part of the PRA Rulebook and SS2/23 – Supervising Credit Unions. Member referral arrangements would be treated as an additional activity; the receiving credit union would retain responsibility for the referred member’s credit risk, and firms would be expected to maintain effective governance, due diligence and clear contractual allocation of responsibilities.

Key dates

2025-10-21

The FCA commenced High Court proceedings in the Business and Property Division against Huobi Global S.A. and persons unknown concerning alleged breaches of section 21 FSMA.

2026-02-10

The FCA publicly announced its enforcement action against HTX for unlawful cryptoasset promotions to UK consumers.

2026-10-29

The FCA announced the High Court settlement and undertakings; HTX was no longer active in the UK, with no deposits or new UK registrations permitted.

2027-10-01

The FCA publication states that cryptoassets remain largely unregulated in the UK, apart from anti-money-laundering and financial-promotion requirements, until October 2027.

2031-10-21

The court order provides that Huobi Global's undertakings continue until this date.

Suggested considerations

• Compliance teams may wish to identify all UK-facing cryptoasset communications across websites, applications, email, affiliates, influencers and social-media platforms, including communications published by overseas group entities.
• Firms should consider documenting the legal basis for each UK financial promotion under section 21 FSMA, including the firm's authorisation status, any authorised-person approval and any applicable exemption under the Financial Services and Markets Act 2000 (Financial Promotion) Order 2005.
• Overseas firms should consider geo-blocking and other durable controls for UK users, while testing whether content, account access, app availability, search visibility or social-media activity remains capable of having an effect in the UK.
• Marketing and compliance teams may wish to implement pre-publication approval, withdrawal and monitoring controls for third-party affiliates, influencers and social-media operators, with records showing who approved each communication and where it was distributed.
• Firms with existing UK users should consider reviewing account-access, deposit, withdrawal and customer-communications arrangements so that any UK exit strategy does not leave consumers exposed to continuing unlawful promotions.
• Cryptoasset businesses may wish to monitor the FCA Warning List and Firm Checker and assess whether their UK activities could also trigger UK anti-money-laundering registration or other authorisation requirements.

What changed

This is a settlement and enforcement outcome rather than a new generally applicable rule. Huobi Global is bound by court undertakings not to knowingly, directly or indirectly, communicate or cause to be communicated financial promotions contravening section 21 FSMA, including promotions on HTX websites, software applications and social-media platforms. HTX will not target, solicit or actively seek to engage UK consumers; UK consumers can no longer deposit funds or open new accounts, and residual-asset withdrawals are addressed through HTX's published arrangements.

Key dates

2025-10-22

The SFC issued its consultation paper on proposed amendments to the UT Code.

2026-10-07

The SFC published consultation conclusions announcing the enhancements to Hong Kong's retail fund regime.

2026-10-16

The revised UT Code was gazetted.

2026-11-01 Deadline

The revised UT Code takes effect. New funds must comply with the revised requirements immediately, and the 12-month transitional period for existing funds begins.

2027-10-31 Deadline

The 12-month transitional period ends. Existing funds generally must comply with the revised UT Code requirements by this date.

2027-11-01 Deadline

Existing funds continuing to be offered to the Hong Kong public must use KFSs containing the enhanced disclosure requirements after expiry of the transitional period.

Suggested considerations

• Compliance teams may wish to map each existing fund against the revised UT Code requirements and determine which requirements fall within the 12-month transitional period.
• Managers should consider documenting whether each fund will use the existing net derivative exposure approach or the new VaR approach, and assess the required models, data, governance, validation, stress testing, limits and reporting processes.
• Managers should consider reviewing fund asset liquidity, portfolio liquidity and redemption terms, including whether daily-dealing funds investing mainly in less liquid assets require anti-dilution liquidity management tools.
• Compliance teams may wish to inventory available liquidity management tools, assess their calibration and activation triggers, and verify that the fund documentation and operational procedures describe their use consistently.
• MMF managers should consider testing compliance with the revised minimum credit-quality standards and eligible-instrument and deposit requirements, including the additional safeguards applicable to constant-NAV MMFs.
• Fund boards, trustees and management companies may wish to review governance and escalation arrangements for derivatives exposure, liquidity risk and use of liquidity management tools.
• Managers should consider updating KFSs, offering documents, product classifications, liquidity disclosures and related marketing materials using the revised SFC templates.
• Applications for new funds submitted from 1 November 2026 should be prepared against the revised UT Code and updated application guides rather than the former requirements.

What changed

The revised UT Code introduces a Value-at-Risk approach alongside the existing net derivative exposure approach, with accompanying calculation methodology and standards. Funds complying with the applicable NDE or VaR limits will generally be treated as non-complex products, although the SFC retains discretion to classify products as complex based on their features and risks.

Key dates

2026-10-28

ADGM published the Guidance on Crypto Mining Activities in and from ADGM under section 23 of the Commercial Licensing Regulations 2025.

Suggested considerations

• Firms considering establishment or continued operation in ADGM should perform the RA pre-application self-assessment and document why their activities fall within commercial mining rather than an FSRA-regulated financial service.
• Operators should assess whether they require or should apply for the dedicated commercial licence associated with activity code 7230 and should avoid representing the licence as an authorisation to conduct regulated financial services.
• Compliance teams may wish to prepare an up-to-date corporate structure and ultimate-beneficial-owner information for RA review, together with governance documentation proportionate to the scale and risk of the operation.
• Operators should identify all blockchain addresses used to receive mining rewards and establish controlled procedures for making the required confidential on-chain address disclosures to the RA.
• ADGM-headquartered groups should map global mining activities, reporting lines, outsourced infrastructure, jurisdictional controls and board oversight so that the ADGM entity can demonstrate reasonable supervision of overseas operations.
• Firms should review whether staking, validator, custody, brokerage, token issuance, investment management or other associated activities separately require FSRA permission or create an additional regulatory perimeter.
• Operators may wish to monitor the RA’s forthcoming consultation on the second-phase regulatory framework and preserve records supporting their current perimeter analysis, licensing basis, governance and operational-risk controls.
• Firms should consider the practical implications identified in independent commentary, including operational resilience, cybersecurity, infrastructure security, energy management, transparent service terms and any applicable UAE federal tax, accounting and AML/CFT requirements, without treating those commentary points as additional requirements expressly created by this publication.

What changed

Commercial crypto mining conducted in or from ADGM is associated with dedicated RA commercial activity code 7230 and requires the applicable commercial licensing pathway. The Guidance is technology-neutral and covers Proof-of-Work, Proof-of-Stake and future consensus mechanisms. It establishes a pre-application self-assessment to help applicants distinguish mining from FSRA-regulated financial activities, and highlights expectations concerning corporate structure, ultimate beneficial ownership, and confidential disclosure of on-chain addresses used for reward flows.

Key dates

2026-10-20

Utah filed a state-court action against Kalshi entities and two Susquehanna trading firms, alleging violations of Utah gambling laws and seeking injunctive relief and recovery of profits.

2026-10-27

The CFTC announced its federal lawsuit against Utah and its commitment to block state enforcement affecting CFTC-registered prediction markets.

Suggested considerations

• Firms operating or supporting CFTC-registered event-contract markets should consider mapping their products, legal entities, affiliates, liquidity providers and customer-access arrangements against the Utah enforcement action and the CFTC’s requested injunction.
• Compliance teams may wish to monitor the federal case in the U.S. District Court for the District of Utah, the related Kalshi appeal, and the other state proceedings because the litigation may determine whether state gambling laws can be applied to federally regulated event contracts.
• Firms should consider preserving records supporting CFTC registration, designated-contract-market compliance, product listings, trade surveillance, customer eligibility, geolocation controls and communications concerning Utah residents.
• Market operators and intermediaries may wish to assess whether their current Utah access controls and disclosures remain appropriate in light of the conflicting federal and state positions, without assuming that the CFTC’s lawsuit presently provides a final safe harbor.
• Legal and regulatory teams may wish to distinguish CFTC-regulated transactions from unregulated or differently structured products, since the Commission’s position is directed at covered transactions on CFTC-regulated markets rather than all prediction, gaming or wagering activity.

What changed

The publication announces litigation rather than a new rule, supervisory requirement, or compliance deadline. The CFTC is asking a federal court to block Utah from investigating or enforcing state laws against transactions conducted on CFTC-regulated designated contract markets, including actions involving regulated entities’ affiliates and partners. The Commission’s stated legal position is that the Commodity Exchange Act gives it exclusive federal jurisdiction over these event contracts and preempts conflicting state restrictions.

Key dates

2026-04-21

Voluntary restrictions were imposed on Kingscrown Finance Ltd.

2026-09-25

Further voluntary restrictions were imposed on Kingscrown Finance Ltd, including limits on receiving payments from existing customers and an orderly wind-down requirement.

2026-10-07

Voluntary restrictions were imposed on MOMSB Ltd and Momentus Capital Ltd, including restrictions on new customers, new lending arrangements and certain payments from existing customers, together with independent AML-framework reviews.

2026-10-09

Voluntary restrictions were imposed on Grosvenor Funding Ltd and Grosvenor Funding (North West) Ltd, including restrictions on new customers, new lending arrangements and certain payments from existing customers, together with independent AML-framework reviews.

2026-10-15

Voluntary restrictions were imposed on Abbital Ltd, including specified conditions for taking on customers, entering into lending arrangements and accepting payments, together with an independent review of its AML systems and controls.

2026-10-23

The FCA announced the restrictions and reiterated its enhanced oversight of Annex 1 firms and due-diligence expectations for regulated firms dealing with them.

Suggested considerations

• Annex 1 firms should consider reviewing their business-wide AML risk assessment, customer and beneficial-owner due diligence, ongoing monitoring, suspicious-activity escalation, governance, management information, resourcing and independent-testing arrangements against the Money Laundering Regulations 2017.
• Annex 1 firms seeking registration or under FCA assessment should consider ensuring that policies and controls are tailored to their actual lending activities, customer base, delivery channels and growth plans, rather than relying on generic or group-level documentation.
• The six named firms should consider mapping their operational processes, customer communications, payment arrangements and lending activity to the precise terms of their voluntary restrictions and preserving evidence of compliance with those terms.
• FCA-authorised firms should consider identifying all Annex 1 counterparties and refreshing onboarding and periodic-review procedures to obtain direct confirmation of registration, conduct independent verification, understand the counterparty's business model and assess whether its AML controls create heightened relationship risk.
• Regulated firms should consider recording the rationale for accepting, continuing or restricting relationships with Annex 1 firms and escalating discrepancies between a firm's registered activities, actual activities, ownership, governance or AML framework.
• Groups with multiple Annex 1 entities should consider documenting entity-specific risk assessments and controls, since group-wide or off-the-shelf procedures may not demonstrate that each entity manages its own risks effectively.
• Lenders and their service providers should consider contingency arrangements for restricted firms, including payment handling, loan-book servicing, customer communications and orderly wind-down scenarios.

What changed

Kingscrown Finance Ltd is subject to restrictions limiting how it may receive payments from existing customers and requiring an orderly wind-down of its existing loan book. MOMSB Ltd, Momentus Capital Ltd, Grosvenor Funding Ltd and Grosvenor Funding (North West) Ltd are restricted from taking on new customers or entering into new lending arrangements, subject to the specified exceptions; restrictions also apply to accepting payments from existing customers, and the firms must obtain independent reviews of their AML frameworks.

Key dates

2026-10-22

FCA published CP26/37 and opened the consultation.

2027-01-22 Deadline

Deadline for consultation responses.

2027-06-30

End of the first half of 2027, during which the FCA expects to publish final regulatory requirements; the exact publication date is not specified.

Suggested considerations

• Firms should assess the consultation proposals against their current SMF population, including whether SMF18, SMF22 or the existing SMF7 definition is used and how responsibilities would be reallocated.
• Dual-regulated and Enhanced firms should review whether SMF5 and SMF10 to SMF15 appointments would move from prior approval to notification, while considering the continuing need for documented fitness and propriety assessments.
• Compliance teams may wish to model whether the proposed £200 million, £100 billion, £75 million and £750 million Enhanced thresholds would change the firm's classification, including group-level and three-year rolling-average calculations.
• Firms should plan to preserve accurate internal Statements of Responsibilities and Management Responsibilities Maps even if routine FCA submissions are removed.
• Firms should review Prescribed Responsibility allocations and identify the impact of removing nine responsibilities, including the proposed retention of A, D, Z and J-3.
• Certification-function inventories, annual certification processes, regulatory-reference procedures and Directory reporting should be mapped so that transition arrangements can be implemented if the proposals are finalised; firms should not discontinue current obligations before final rules and commencement.
• Conduct and HR teams should assess changes to training, staff notifications, disciplinary classifications, appeal processes and breach-reporting workflows, distinguishing staff subject only to Individual Conduct Rules from those also subject to Senior Manager Conduct Rules.
• Firms should retain processes for prompt notification of matters of regulatory significance under Principle 11, SUP 15 and SUP 10C, because the consultation does not remove those obligations.

What changed

The FCA proposes to make SMF5 (Head of Internal Audit) and SMF10 to SMF15 functions notified rather than subject to prior approval at specified dual-regulated and Enhanced firms. It proposes to remove SMF18 (Other Overall Responsibility) and SMF22 (Local Responsibility), narrow SMF7 (Group Entity Senior Manager), and retain SMF24 (Chief Operations Function) as a pre-approved function.

Key dates

2026-10-22

The FCA and PRA published parallel Phase 2 SM&CR consultations.

2027-01-22 Deadline

Deadline for responses to the FCA and PRA SM&CR Phase 2 consultations.

Suggested considerations

• Compliance teams may wish to review the FCA consultation CP26/37 and PRA consultation CP14/26 and consider submitting responses by 22 January 2027.
• Firms should continue operating existing SM&CR approval, certification, Directory, Conduct Rule and responsibility-mapping processes unless and until final rules and any required legislation take effect.
• Firms may wish to map current Senior Management Functions and identify Chief Actuary, Risk Committee Chair and Audit Committee Chair roles that could move from pre-approval to notification, while retaining evidence of fitness, propriety, competence and suitability assessments.
• Compliance teams should identify employees who could fall outside the proposed Certification Regime and assess how internal competence, performance, disciplinary and conduct controls would operate without annual regulatory certification.
• Firms may wish to model the effect of the proposed Enhanced-regime threshold increases on their classification, governance documentation, prescribed responsibilities and approval processes.
• Firms should review Conduct Rule breach-reporting workflows and training curricula, but should not apply a higher reporting threshold or reduced training scope until the relevant final rules are published and effective.
• Governance teams may wish to assess the proposed removal of ongoing Statements of Responsibilities and Management Responsibilities Map submissions and determine what internal records will still be needed to demonstrate clear accountability.
• Firms with cryptoasset activities or planned authorisation may wish to consider the interaction between these proposals, the FCA's modification-by-consent approach for cryptoasset firms and the wider cryptoasset perimeter work.

What changed

The regulators propose removing pre-approval for a range of functions, including Chief Actuaries and Chairs of Risk and Audit Committees, with firms instead notifying the regulators and retaining responsibility for fitness and propriety. Chief Executive, Chief Financial Officer and Chair roles would generally remain subject to regulatory pre-approval, while regulators could require pre-approval for otherwise notified roles in high-risk cases.

Key dates

2026-10-22

PRA CP14/26 was published and the Phase 2 consultation opened.

2027-01-22 Deadline

Deadline for responses to the PRA consultation.

Suggested considerations

• Compliance teams may wish to map current SMFs against the proposed pre-approved and notified categories, with particular attention to Chief Actuary, Risk Committee Chair, Audit Committee Chair and SMF7 roles.
• Firms should consider how they would evidence fitness, propriety, competence and conduct decisions if formal Certification Regime assessments, certificates and regulatory references are removed.
• Governance functions may wish to assess the proposed reduction in Prescribed Responsibilities and the future frequency of Statements of Responsibilities and Management Responsibilities Maps, while preserving clear accountability records.
• Firms may wish to review succession and contingency arrangements against the proposed 18-week temporary SMF cover period and assess whether internal approval workflows can support faster interim appointments.
• Dual-regulated firms should compare PRA CP14/26 with FCA CP26/37 and identify differences in scope, timing, forms, conduct-breach notifications and transitional arrangements.
• PRA-authorised firms may wish to prepare a consultation response addressing the proposed implementation period before the 2027 final policy.
• Firms should continue operating existing SM&CR approval, certification, fitness and propriety, regulatory-reference and notification obligations unless and until final rules and applicable legislative changes take effect.
• Compliance teams may wish to monitor the passage and commencement of the Financial Services and Markets Bill 2026 because the principal Phase 2 reforms depend on those legislative steps.

What changed

The PRA proposes to introduce a notification approach for almost half of current Senior Management Functions, including Chief Actuaries and Chairs of Risk and Audit Committees, while retaining an anticipated power to require pre-approval for an otherwise notified role in exceptional cases. Group Entity Senior Manager Function SMF7 would be divided between pre-approved and notified roles.

Key dates

2020-11-01

Beginning of the period during which the Central Bank found Coinbase Ireland breached safeguarding and outsourcing obligations under the Electronic Money Regulations 2011.

2025-08-19

End of the enforcement period identified by the Central Bank.

2026-10-21

Central Bank of Ireland and Coinbase Ireland reached the settlement under the undisputed-facts settlement process.

2026-10-22

Central Bank published the enforcement outcome and announced the proposed reprimand and discounted monetary penalty.

Suggested considerations

• Firms should map all safeguarding responsibilities to the specific Irish or EU-authorised entity that holds the regulatory obligation and document how the entity retains effective control despite group or third-party outsourcing.
• Compliance teams may wish to assess whether the regulated entity has sufficient local expertise, decision-making authority and management information to oversee safeguarding and challenge outsourced providers on an ongoing basis.
• Firms should consider independently validating the design of safeguarding calculations, reconciliations, treasury-rebalancing processes and designated safeguarding-account funding, including testing for data, systems and mapping errors.
• Firms may wish to perform daily or otherwise risk-appropriate reconciliations between customer liabilities, safeguarding obligations and funds held in designated accounts, with documented investigation and remediation of exceptions.
• Boards and senior management should consider whether control testing covers the complete safeguarding process, including outsourced components, and whether testing is sufficiently independent and frequent to identify prolonged shortfalls.
• Firms should review escalation procedures for safeguarding incidents, control failures, underfunding and material changes to operating models, including criteria and ownership for notifying the Central Bank of Ireland.
• Authorised firms should compare their current operating model with representations, commitments and governance arrangements submitted during authorisation and assess whether any material changes were notified to the Central Bank.
• Outsourcing registers, contracts and service-level arrangements should be reviewed to confirm clear regulatory access, audit rights, information rights, incident reporting, business-continuity provisions and accountability for safeguarding outcomes.

What changed

The publication does not introduce a new statutory rule; it applies existing obligations under the Electronic Money Regulations 2011 and establishes a substantial enforcement precedent. Coinbase Ireland admitted that it lacked an adequate outsourcing-governance framework, relied excessively on a US Coinbase Group entity, lacked sufficient local skill and expertise to oversee safeguarding, used inadequately designed and tested systems that left its designated safeguarding account underfunded, and lacked adequate escalation and reporting arrangements for material safeguarding changes.

Key dates

2026-10-21

FCA published GC26/7 and opened the guidance consultation.

2026-11-18 Deadline

Deadline for consultation responses to GC26/7.

2027-01-01

FCA plans to publish final DeFi guidance during January 2027; no specific publication day has been stated.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are due to bring new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Compliance teams may wish to map each DeFi use case, protocol, smart-contract dependency, service provider and customer-facing activity against the firm's existing SYSC 15A, SYSC 6 and Money Laundering Regulations obligations.
• Firms should consider documenting governance and accountability for DeFi arrangements, including who controls or can materially influence protocol changes, access permissions, treasury assets, upgrades, emergency controls and customer outcomes.
• Operational resilience teams may wish to assess important business services, impact tolerances, vulnerabilities, third-party and smart-contract dependencies, oracle and bridge risks, key-management arrangements, cyberattack scenarios and credible disruption testing.
• Financial-crime teams should consider whether existing customer due diligence, transaction monitoring, sanctions screening, blockchain analytics, wallet-risk assessment, suspicious activity escalation and record-keeping controls remain effective for pseudonymous, automated or cross-chain activity.
• Firms may wish to review outsourcing and third-party risk assessments for protocol developers, validators, custodians, wallet providers, analytics providers, cloud infrastructure and other critical DeFi dependencies.
• Legal and regulatory teams should assess whether current and planned activities fall within the existing perimeter or the new cryptoasset activities introduced by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, including whether there is an identifiable controlling entity.
• Affected stakeholders may wish to submit responses to the FCA by 18 November 2026 and identify any areas where the illustrative guidance is unclear, disproportionate or difficult to apply to genuinely decentralised arrangements.
• Firms may wish to track the FCA's planned final guidance in January 2027 and update risk assessments, policies, control testing and implementation plans before the new cryptoasset regime commences.

What changed

The FCA is proposing guidance describing the operational resilience and financial crime risks associated with DeFi and providing illustrative measures firms may consider. The guidance is relevant to firms within SYSC 15A, SYSC 6 and the Money Laundering Regulations, including firms using distributed-ledger technology, automated protocols, open and interoperable systems or arrangements with limited traditional intermediation. It is intended to clarify application of existing requirements rather than establish a separate DeFi regime or new Handbook obligations.

Key dates

2026-09-30

The application period opened for existing UK cryptoasset businesses seeking to conduct new regulated cryptoasset activities and benefit from the savings provision.

2026-10-21

FCA consultation CP26/36 opened and was published.

2026-11-18 Deadline

Deadline for responses to FCA consultation CP26/36.

2027-01-01

FCA aims to publish final perimeter guidance after considering consultation responses.

2027-02-28 Deadline

Application period closes for firms seeking to rely on the savings provision for newly regulated cryptoasset activities.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are scheduled to bring the new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Firms should map each proposed and existing cryptoasset activity against the statutory regulated activities in the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 and the proposed PERG guidance, documenting the factual basis for any exclusion relied upon.
• Technical-service providers should assess whether they merely provide access to a third-party service or decentralised protocol, or whether they also arrange, execute, safeguard, operate, control or otherwise provide a service to users; the use of automation or decentralised technology should not be treated as determinative.
• Stablecoin and payment businesses should identify the precise duration, purpose, parties and asset flows associated with temporary holding and backing-asset arrangements and test whether the relevant statutory conditions are met.
• Trading firms and market makers should distinguish genuine proprietary trading from activity performed as a service for another person and retain evidence supporting any reliance on the proprietary-trading or qualifying-cryptoasset-trading-platform market-maker exclusion.
• Firms should review safeguarding and settlement structures, including structures involving central securities depositaries and third-country central securities depositaries, for possible inclusion within the proposed exclusions or within regulated custody-related activities.
• Businesses that may need authorisation should consider submitting responses to CP26/36 by 18 November 2026 and should not defer application planning while the guidance remains in consultation.
• Existing UK cryptoasset businesses seeking to conduct newly regulated activities should consider submitting an otherwise complete application between 30 September 2026 and 28 February 2027 to preserve access to the applicable savings provision.
• Firms materially affected by uncertainty about the technical-services-provider exclusion should consider engaging the FCA through its pre-application support service and retaining evidence of how that uncertainty affected application preparation.

What changed

The FCA proposes guidance on exclusions from regulated cryptoasset activities introduced by the draft Cryptoassets (Miscellaneous Amendments) Regulations 2026. The examples include temporary settlement arrangements; temporary arrangements for holding UK qualifying stablecoins in connection with payment transactions; arrangements involving backing assets held in relation to a UK qualifying stablecoin; proprietary trading where the person is not providing a service to another person; proprietary trading by a market maker on a qualifying cryptoasset trading platform; and technical services that...

Key dates

2026-10-21

OCC publishes Bulletin 2026-52, revised PS-01 and PS-02 forms for public comment, and issues its GENIUS Act implementing final rule.

2027-01-18

The OCC final rule implementing the GENIUS Act and the GENIUS Act take effect, according to the OCC’s related final-rule materials.

2027-01-25 Deadline

First weekly PS-01 report date, subject to OMB approval of the information collection.

2027-03-31 Deadline

First quarterly PS-02 report date, subject to OMB approval of the information collection.

Suggested considerations

• Compliance teams at affected issuers should review the revised PS-01 and PS-02 workbooks and instructions and identify every required data element, reporting frequency, aggregation rule, and responsible control owner.
• Firms should consider submitting comments within 30 days after publication of the information-collection notice in the Federal Register, with particular attention to data availability, calculation methodology, confidentiality, reporting burden, and transition timing.
• Issuers should map daily issuance, redemption, reserve, ownership-concentration, and trading data to PS-01 and test whether systems can produce a complete weekly submission for the January 25, 2027 report date, subject to OMB approval.
• Issuers should assess whether finance and regulatory-reporting systems can produce PS-02 information on income, assets, liabilities, off-balance-sheet activities, and capital for the March 31, 2027 report date.
• Firms should establish governance for data certification, reconciliation to general-ledger and reserve records, exception management, senior review, and retention of supporting documentation for OCC examination.
• Issuers should assess the interaction between the reporting forms and the final rule’s reserve, redemption, risk-management, audit, capital, custody, and supervisory requirements, rather than treating the forms as an isolated reporting exercise.
• Foreign issuers should confirm their OCC registration status, reporting perimeter, U.S. activities, and allocation of information-production responsibilities between U.S. operations, parent entities, and service providers.

What changed

The OCC is reopening public comment on revised weekly Form PS-01 and quarterly Form PS-02 and their instructions. PS-01 requires daily data compiled and submitted weekly for each payment stablecoin, covering issuance, reserves, ownership concentration, and trading activity. PS-02 requires quarterly reporting on the issuer’s condition and income, including balance-sheet assets and liabilities, off-balance-sheet activities, income, and capital.

Key dates

2026-10-21

The OCC issued Bulletin 2026-51 and stated that applications and waiver requests will be accepted only after OMB approves the related information collection.

2027-01-18 Deadline

The GENIUS Act and OCC final rule become effective; the Prior Approval Requirement generally applies, and unauthorized issuance of a payment stablecoin in the United States may carry criminal penalties.

2028-01-18 Deadline

The maximum statutory period for a waiver beginning on January 18, 2027 expires, subject to the terms and shorter duration of any individual waiver.

Suggested considerations

• Firms should determine whether they are currently issuing a payment stablecoin in the United States and whether they fall within the OCC application pathway or another primary federal payment stablecoin regulator's pathway.
• Existing issuers should consider preparing and submitting a substantially complete OCC application as soon as the agency announces that applications are accepted, rather than relying on the waiver as a substitute for authorization.
• Applicants should map their submission against every prescribed application question and documentation requirement, including the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML, OFAC, third-party risk, enterprise risk, compliance risk, and audit functions.
• Compliance teams may wish to prepare a separate written waiver request addressing the Prior Approval Requirement, identifying any additional GENIUS Act or final-rule requirements that cannot be met by January 18, 2027, and explaining the requested duration and operational rationale.
• Issuers should monitor the OCC's GENIUS Act landing page and press releases for OMB approval and the opening of the application and waiver process, because the bulletin does not provide a fixed application-opening date.
• Firms should maintain evidence supporting the completeness and accuracy of their applications and establish a process to respond promptly to OCC requests for missing information within the 30-day review cycles.
• Prospective issuers that are not already operating in the United States should consider planning for operations to begin only after OCC approval, consistent with the agency's stated position on waiver eligibility.
• Regulatory change teams should continue tracking separate FinCEN, OFAC, OCC, and other agency rulemakings concerning AML, CFT, sanctions, and customer-identification requirements rather than assuming that an OCC application or Prior Approval Requirement waiver resolves those obligations.

What changed

Beginning January 18, 2027, a person generally must be approved as a permitted payment stablecoin issuer before issuing a payment stablecoin in the United States; unauthorized issuance may carry criminal penalties. Under GENIUS Act section 5(f) and 12 CFR 15.30(g), an issuer with a substantially complete OCC application pending on January 18, 2027 may request a written waiver of the Prior Approval Requirement and other statutory or final-rule requirements that it cannot satisfy by the effective date.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule and related application, waiver and reporting materials.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment stablecoin issuance generally requires permitted payment stablecoin issuer status, and a substantially complete application must be pending by this date to support eligibility for an OCC waiver request.

2027-01-25

Proposed first weekly OCC reporting date, subject to OMB approval of the information collection.

2027-03-31

Proposed first quarterly OCC reporting date, subject to OMB approval of the information collection.

Suggested considerations

• Firms seeking permitted payment stablecoin status should consider mapping their licensing strategy, corporate structure and applicable OCC pathway under 12 CFR part 15 before 2027-01-18.
• Existing U.S. issuers that need transitional relief should consider submitting a substantially complete OCC application on or before 2027-01-18 and preparing a written waiver request promptly after the OCC begins accepting applications and waiver requests.
• Applicants should consider documenting business plans, management, reserve assets, issuance and redemption processes, capital and liquidity, risk management, third-party and shared-services arrangements, audit functions and compliance governance in the application package.
• Issuers should consider validating reserve composition, one-to-one backing, liquidity, concentration, counterparty exposure, stress-testing and redemption controls against the final rule rather than relying on the proposal's reserve assumptions.
• Issuers should consider testing operational capacity to process redemptions within two business days and to notify the OCC within 24 hours when the 10% redemption-demand trigger is reached.
• Issuers and distribution partners should consider reviewing stablecoin rewards, yield, rebate and promotional arrangements on a transaction-by-transaction basis because pre-existing programs are not automatically grandfathered and the final rule provides no general safe harbor.
• Covered firms should consider establishing governance for audits, reporting, examination responses, custody controls, foreign-issuer oversight and potential approval revocation or rescission.
• Compliance teams should track the separate Treasury-coordinated BSA, AML and OFAC rulemaking and avoid treating this final rule as the complete GENIUS Act compliance framework.

What changed

The final rule applies to national banks and their subsidiaries, federal savings associations and their subsidiaries, federal branches and their subsidiaries, federal qualified payment stablecoin issuers, foreign payment stablecoin issuers, and state qualified payment stablecoin issuers over which the OCC has regulatory or enforcement authority.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule, application and waiver guidance, and revised proposed reporting forms.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment-stablecoin issuance generally requires permitted payment stablecoin issuer approval, and existing issuers seeking a waiver generally must have a pending substantially complete OCC application by this date.

2027-01-25 Deadline

Proposed effective report date for the weekly reporting form, subject to Office of Management and Budget approval.

2027-03-31 Deadline

Proposed effective report date for the quarterly reporting form, subject to Office of Management and Budget approval.

Suggested considerations

• Firms considering U.S. payment-stablecoin issuance should assess whether they qualify as a permitted payment stablecoin issuer, a federal qualified issuer, a state-qualified issuer subject to OCC authority, or a foreign issuer within the rule's scope.
• Existing U.S. issuers should consider preparing a substantially complete OCC application and evaluating whether a waiver request is needed by January 18, 2027; the OCC may grant waivers for up to 12 months beginning on that date, generally where an eligible application is pending.
• Applicants should prepare documentation covering the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML/OFAC controls, third-party risk, enterprise risk, compliance risk, and audit functions.
• Issuers should map reserve assets to the final rule's 1:1 backing, daily-liquidity, diversification, and counterparty-concentration requirements and establish controls capable of supporting generally timely redemption within two business days.
• Compliance and product teams should inventory interest, yield, cashback, loyalty, referral, and exchange rewards arrangements involving payment stablecoins and document the business purpose and consideration supporting each payment, because the OCC has not provided a categorical safe harbor and will apply the statutory prohibition case by case.
• Issuers should design weekly reserve and payment-stablecoin activity reporting and quarterly reports of condition and income, subject to confirming the final OMB-approved forms and effective reporting dates.
• Banks and other OCC-supervised custodians should review custody arrangements, segregation and control frameworks, third-party dependencies, and contractual allocation of responsibility for stablecoin and reserve-asset custody.
• Firms should track the separate Treasury, FinCEN, OFAC, Federal Reserve, and FDIC implementation work because the OCC final rule does not complete BSA, AML, or sanctions requirements and is only one component of the GENIUS Act framework.

What changed

New 12 CFR part 15 establishes requirements for permitted payment stablecoin issuers, foreign payment stablecoin issuers subject to OCC authority, certain state-qualified issuers, and specified custody activities conducted by OCC-supervised entities. The framework covers issuer activities, reserve assets, redemption, risk management, audits, reports, examinations, supervision, custody, applications and registrations, state-to-federal transitions, foreign-issuer supervision, approval revocation or rescission, and capital and operational backstops.

Key dates

2019-01-01

In 2019, Dawkins sold Vector Wealth to a director who had previously been disqualified and who subsequently described himself as the firm's CEO; the FCA found that Dawkins falsely represented that he remained in control.

2020-09-22

Kadir Kanizi was appointed as a director of Vector Wealth.

2021-01-01

The FCA's permanent restriction on marketing speculative illiquid securities, including relevant mini-bonds and loan notes, to retail investors took effect, subject to applicable high-net-worth and sophisticated-investor exemptions.

2021-09-06

The FCA approved Kadir Kanizi for his senior management role at Vector Wealth.

2025-01-28

Vector Wealth's FCA authorisation ended.

2026-10-21

The FCA published the enforcement announcement concerning Dawkins and Kanizi.

Suggested considerations

• Compliance teams may wish to review ownership, control and governance records following any acquisition or disposal, verify that the person exercising actual control is accurately disclosed to the FCA and assess whether a change-in-control notification under FSMA sections 178 to 191 was required.
• Firms should consider testing that directors, controllers and senior managers meet the applicable fit-and-proper standards and that no disqualified person is exercising management or operational control indirectly or through nominee arrangements.
• Firms that issue, approve or distribute mini-bond, loan-note or similar promotions should consider a product-level assessment of whether the instrument is a speculative illiquid security and whether the promotion is prohibited or qualifies for a valid exemption under the FCA rules.
• Financial promotion approval processes should be reviewed to ensure that risk warnings are prominent, balanced and comprehensible, and are not undermined by claims suggesting fixed returns, simplicity, safety or FCA endorsement.
• Where high-net-worth or sophisticated-investor exemptions are used, firms should consider verifying the relevant declaration and process before providing access to the promotion, rather than treating a generic self-certification as evidence that all conduct and disclosure obligations have been satisfied.
• Firms should consider documenting who reviewed the promotion, the evidence supporting the target market and exemption, the underlying use of investor funds, liquidity and default risks, and the rationale for approving the communication.
• Boards and senior managers may wish to review escalation, oversight and record-keeping arrangements for unregulated investment activity conducted alongside regulated business, particularly where the firm's FCA authorisation could give investors a misleading impression of product safety or compensation protection.
• Firms should consider confirming that senior managers understand their individual accountability for consumer communications and risk oversight, and may wish to include high-risk investment promotions in conduct monitoring and Consumer Duty assessments where relevant.

What changed

This is a final enforcement action rather than a new rule or industry-wide implementation deadline. It applies the existing prohibition in section 21 of the Financial Services and Markets Act 2000 on unauthorised financial promotions, the FCA's financial promotion rules in COBS 4, including the restrictions applying to speculative illiquid securities, and the change-in-control notification regime under sections 178 to 191 of FSMA.

Key dates

2026-10-21

The French Treasury, AMF, Banque de France and ACPR published their joint response to the European Commission consultation on the MiCA review.

2026-09-30 Deadline

The European Commission consultation deadline identified in independent legal commentary; this date had passed before publication of the French authorities' response.

Suggested considerations

• Compliance teams may wish to maintain the existing MiCA control framework because this publication does not create an immediate amendment, authorisation requirement or prohibition.
• Firms should consider mapping each token, service and distribution channel against the definitions and perimeter provisions of MiCA, MiFID II and payment-services legislation, with particular attention to products that could require more than one authorisation.
• EU-authorised crypto-asset service providers should consider reviewing onboarding, asset-admission, execution, custody, trading and distribution controls for exposure to asset-referenced tokens or e-money tokens that may not satisfy MiCA requirements.
• Stablecoin issuers and groups using the same fungible token across EU and third-country markets should consider documenting issuance structures, reserve segregation, redemption rights, equivalence assumptions and supervisory-cooperation dependencies in anticipation of possible multi-issuance rules.
• Significant crypto-asset service providers and crypto-conglomerates should consider assessing governance, prudential, group-risk and supervisory-reporting readiness for a possible future shift of direct or enhanced oversight toward ESMA.
• Banks, payment firms and investment firms should consider assessing strategic opportunities and regulatory dependencies arising from euro-denominated e-money tokens and tokenised bank deposits without treating the French position as approval of any specific product.
• DeFi, staking and crypto-lending businesses should consider identifying responsible intermediaries, documenting due-diligence controls and preserving evidence of protocol governance and risk assessments pending any future EU framework.
• Industry participants may wish to monitor the Commission's MiCA review, subsequent legislative proposals, ESMA and EBA opinions, and national implementation developments before changing operating models.

What changed

No legal requirements changed on 2026-10-21. The French authorities proposed streamlining MiCA and clarifying when an activity falls under MiCA, the legislation governing financial instruments, or payment-services legislation, including where one business model could require multiple authorisations. They stated that a financial instrument should remain fully subject to the financial-instruments regime irrespective of the technology used for issuance or trading, and that the same principle should apply to payment instruments.

Key dates

2021-04-22

Beginning of the period in which ASIC alleges the Panacea Capital Cryptocurrency Investment Fund was offered without an AFS licence.

2022-06-17

End of the period in which ASIC alleges the Crypto Fund operated without an AFS licence.

2024-03-21

ASIC announced that Brian Creigh was permanently banned from providing financial services or being involved in a financial services business.

2026-10-19

Creigh was charged in the Melbourne Magistrates’ Court and granted conditional bail.

2026-10-20

ASIC published the enforcement release announcing the criminal charges.

Suggested considerations

• Firms should consider confirming that every entity and individual providing financial product advice, dealing, arranging or other financial services in Australia holds the required AFS licence or is properly appointed as an authorised representative for the relevant activities.
• Compliance teams may wish to map digital-asset products against the financial product and financial services definitions in Chapter 7 of the Corporations Act 2001 (Cth), including where pooled investor money is used to pursue returns from a portfolio of digital assets.
• Firms should consider reviewing marketing materials, fact sheets and investor communications for unsupported claims about licensing status, capital protection, guarantees, historical performance, targeted returns and the nature of underlying investments.
• Compliance teams may wish to strengthen onboarding and ongoing due diligence for digital-asset fund operators, directors, promoters, overseas counterparties and receiving entities, including checks against ASIC banning and disqualification records.
• Firms should consider reviewing transaction-monitoring and escalation controls for investor funds moving to offshore entities or unrelated investment vehicles, with particular attention to circumstances that could raise proceeds-of-crime or fraud concerns.
• Distributors and professional intermediaries may wish to retain evidence of licence verification, product governance reviews, investor disclosures and the basis for any representations made to prospective investors.
• Firms should consider treating the charges as allegations not yet determined by a court and separating the criminal proceeding from ASIC’s earlier administrative banning action when assessing legal, conduct and reputational risk.

What changed

No new licensing rule or general obligation was introduced. The publication announces enforcement proceedings: one charge under section 911A(1) of the Corporations Act 2001 (Cth) for carrying on a financial services business without an AFS licence, and one charge under section 400.3(1) of the Criminal Code (Cth) for dealing with proceeds of crime worth $1 million or more. The matter is being prosecuted by the Commonwealth Director of Public Prosecutions following ASIC’s referral of a criminal brief.

Key dates

2022-05-12

The CFTC filed its complaint against Alexandre and EminiFX, alleging fraudulent solicitation, misappropriation, and operation of an unregistered commodity pool.

2026-07-01

As of July 2026, the court-appointed receiver had returned more than $98 million to over 28,000 investors.

2026-10-19

The CFTC announced that the Southern District of New York had entered orders granting summary judgment, injunctive relief, and a civil monetary penalty against Alexandre and EminiFX.

Suggested considerations

• Compliance teams may wish to inventory products, investment clubs, managed accounts, and digital-asset offerings that pool customer contributions and obtain exposure to forex, futures, options, or other commodity interests.
• Firms should consider assessing whether their activities constitute operating a commodity pool or acting as a commodity pool operator or associated person under the Commodity Exchange Act and CFTC regulations, including whether registration or an available exemption is required.
• Firms should consider validating marketing claims about returns, automated trading, proprietary technology, trading results, and risk, with particular scrutiny of unusually high or consistent returns such as weekly performance representations.
• Compliance teams may wish to test segregation, custody, reconciliation, withdrawal, and use-of-funds controls to detect commingling, personal use of customer assets, payments to earlier investors, and unexplained transfers.
• Firms should consider maintaining evidence supporting reported performance, trading activity, investor statements, and asset ownership so that customer communications can be reconciled to underlying records.
• Digital-asset businesses may wish to review whether crypto terminology or a technology-focused structure obscures activities that remain subject to commodities, anti-fraud, registration, or customer-protection requirements.
• Firms should consider escalating suspected misappropriation, fabricated performance, or unregistered commodity-pool activity through applicable internal investigation, suspicious-activity, and regulatory-reporting processes.

What changed

This is a final enforcement outcome rather than a new rule or generally applicable regulatory amendment. The Southern District of New York entered summary judgment and injunctive relief against Alexandre and EminiFX, finding that the defendants made fraudulent representations, misappropriated investor funds, and operated as an unregistered commodity pool operator, with Alexandre acting in an unregistered associated-person capacity. The judgment imposes $228,576,962 of restitution, $15,049,500 of disgorgement subject to offset by restitution payments, and a $45,148,500 civil monetary penalty.