Banking & Credit

Key dates

2026-11-03

The EAER expanded and amended the Swiss sanctions lists relating to Russia and Belarus.

2026-11-04

The Federal Council decided to adopt the EU’s 21st Russia and Belarus sanctions package and related measures.

2026-11-04

The amended sanctions lists entered into force at 23:00 Swiss time.

2026-11-05

The sectoral measures, including the strengthened crypto-sector restrictions and transaction prohibitions, entered into force.

Suggested considerations

• Compliance teams may wish to refresh sanctions screening against the amended Swiss Russia and Belarus lists, including customer, beneficial-owner, authorised-signatory, counterparty and payment screening records.
• Swiss crypto-sector companies should consider reviewing ownership registers, pending acquisitions, shareholder changes, control arrangements and beneficial-ownership information for Russian nationals and persons resident in Russia, including indirect acquisition structures.
• Firms should consider mapping exposure to the newly prohibited banks, financial institutions, crypto-service providers and other entities, and placing appropriate holds on affected transactions and assets pending resolution.
• Financial intermediaries may wish to document asset-freeze decisions and report affected business relationships to SECO in accordance with the applicable Ukraine sanctions ordinance.
• Where sanctions-related facts create suspicion of money laundering or terrorist financing, firms should consider completing the additional clarifications required by Article 6 AMLA and filing an immediate report under Article 9 AMLA if the suspicion cannot be dispelled.
• Firms may wish to update sanctions procedures, transaction-monitoring scenarios, onboarding questionnaires and escalation controls to distinguish SECO sanctions reporting from separate AMLA reporting.
• Compliance teams may wish to review external exposure to EU sanctions controls as well as Swiss measures; independent Swiss sanctions commentary describes the regime as not being a general Russia or Belarus embargo, but highlights continuing expansion of financial, crypto, services and circumvention controls.

What changed

The EAER expanded and amended the Russia and Belarus sanctions lists, adding 254 individuals, companies and organisations to measures including asset freezes and restrictions on making funds or economic resources available. Switzerland also introduced transaction prohibitions covering, among others, 33 Russian banks, one bank in a third country, 17 financial institutions and crypto-service providers, five third-country companies, four Russian airports and two Russian ports.

Key dates

2026-11-06

EBA publishes its policy statement on the post-consultation direction of the supervisory reporting simplification package.

2026-12-01

EBA is expected to publish the final report on the draft ITS package; the precise publication date was not specified.

2026-12-31

EBA expects to publish guidance on designing and making supervisory and resolution data requests by the end of 2026; the precise date was not specified.

2027-01-01

Firms should take into account the EBA consideration on application of the FRTB from this date during the transition.

2027-01-01

The EU-wide public repository of supervisory and resolution data requests is expected to become operational during Q1 2027; the precise date was not specified.

2027-06-30

The EBA expects to present further proposals on reporting change management in the first half of 2027; the precise date was not specified.

2027-12-01 Deadline

First reference date for the new supervisory reporting requirements, subject to finalisation, Commission adoption and the precise legal text; the announcement specifies December 2027 but not a day.

2028-12-01 Deadline

Expected reference period for deferred liquidity, asset-encumbrance, supervisory-benchmarking and ESG reporting changes; the announcement specifies December 2028 but not a day.

Suggested considerations

• Firms should continue submitting currently applicable supervisory reporting templates until the revised ITS and technical package are legally adopted and applicable, rather than treating the announced simplifications as immediately effective.
• Compliance and regulatory-reporting teams may wish to preserve existing reporting processes for operational-risk losses while removing or suppressing only data affected by the new granular operational-risk taxonomy, consistently with transition instructions.
• Institutions participating in credit-risk or IFRS 9 benchmarking should continue using the 2026 ITS on supervisory benchmarking reporting during the transition and confirm whether they remain within the relevant benchmarking population.
• Firms should assess the impact of the 1 January 2027 FRTB implementation position on reporting, capital, data lineage and systems, including whether existing interpretations need to be revised once the EBA consideration is final.
• Reporting owners should maintain separate implementation workstreams for requirements expected from December 2027 and deferred areas expected from December 2028, including liquidity, asset encumbrance, benchmarking and ESG reporting.
• Firms should monitor the EBA final ITS report in December 2026, the Commission adoption process and the technical package expected in early 2027, including the data point model, taxonomies and validation rules.
• Institutions may wish to inventory national and supervisory data requests and identify duplicative submissions in anticipation of the EBA data-request guidance and EU-wide repository.
• Change-management plans should account for possible revisions to templates, frequencies, thresholds, validation rules, reporting ownership and consolidated-level data aggregation once the final technical package is available.

What changed

The final package, scheduled for publication in December 2026, will further simplify reporting templates, reduce collateral, stress-testing and ESG data, remove selected reporting thresholds, reduce reporting frequencies and align reporting more closely with disclosure requirements. Credit-risk and IFRS 9 benchmarking reporting will be integrated into the supervisory reporting framework, with streamlined IFRS 9 requirements and greater emphasis on consolidated-level reporting.

Key dates

2026-11-05

CFTC Division of Clearing and Risk issued the no-action letter and accompanying public release addressing trust companies used for daily settlements.

Suggested considerations

• Compliance teams may wish to identify any existing or proposed trust-company settlement arrangements and determine whether each arrangement is being governed under the DCO’s settlement-bank policies and procedures.
• DCOs should consider documenting that each trust company satisfies the applicable 17 CFR 39.14 settlement-bank criteria, including capitalization, creditworthiness, liquidity access, operational reliability, and regulatory status.
• Firms should consider reviewing account structures, settlement agreements, payment workflows, and legal opinions to confirm that transfers are irrevocable and unconditional no later than the time the relevant DCO or clearing-member account is debited or credited.
• DCOs may wish to assess credit, liquidity, concentration, and intraday settlement exposures arising from the use of each trust company and confirm that monitoring, escalation, collateral, and contingency arrangements remain adequate.
• Operations and resilience teams may wish to test the trust company’s connectivity, payment-failure procedures, recovery arrangements, and coordination with the DCO’s business-continuity and disaster-recovery plans.
• Legal and compliance teams should consider recording the no-action letter’s conditions and limits in the DCO’s regulatory inventory, noting that the relief is staff relief rather than a binding amendment to Part 39 and may not extend to materially different structures or facts.
• Clearing members may wish to confirm that their agreements with the DCO and trust company allocate settlement, segregation, insolvency, operational, and account-control risks consistently with the DCO’s approved procedures.

What changed

The letter provides staff no-action relief for a DCO that uses a trust company to conduct daily settlement, notwithstanding the distinction between a trust company and a settlement bank under the CFTC framework. It does not create a generally applicable exemption or amend 17 CFR Part 39; instead, it allows the arrangement provided the trust company is managed and controlled as a settlement bank.

Key dates

2024-07-09

Directive (EU) 2024/1619 (CRD VI) entered into force, introducing or strengthening governance requirements including responsibility mapping and a dedicated framework for third-country branches.

2025-01-01

The CRD VI banking package began applying according to the EBA consultation materials, with the revised Guidelines intended to support implementation of the updated framework.

2026-11-05

The EBA published the final revised Guidelines and the final report on internal governance.

Suggested considerations

• Compliance teams may wish to identify the competent authority’s expected adoption or comply-or-explain treatment once the final Guidelines are translated and formally notified, because no application date is specified in the published final report.
• Firms should consider performing a gap assessment against the final provisions on management-body responsibilities, senior-management and key-function-holder role statements, responsibility mappings, reporting lines, organisational structures and internal-control arrangements.
• Institutions may wish to review board and committee terms of reference, chair and executive-role combinations, conflict-of-interest registers, recusal controls and escalation procedures against the clarified expectations.
• Third-country-branch operators should consider mapping the new branch-specific governance requirements to the local branch manager, head-office governance, risk management, internal control, oversight and reporting arrangements, using the proportionality available in the final text.
• Firms should consider checking consistency between internal-governance documentation and DORA-related ICT risk, operational resilience, business-continuity and third-party-risk arrangements.
• Groups may wish to determine which entities fall within the Guidelines and whether responsibility mappings should be maintained at entity, branch and group levels, documenting the rationale for the chosen scope.
• Compliance teams may wish to retain evidence of proportionality assessments based on size, nature, scale and complexity, rather than removing governance controls solely because the final Guidelines are less granular than the consultation draft.
• Firms should monitor publication of the final Guidelines in all EU official languages and subsequent national competent-authority communications before setting internal implementation deadlines.

What changed

The Guidelines clarify the responsibilities of the management body, senior management and key function holders, including documented statements of roles and duties and a mapping of responsibilities. They address organisational structures, management of conflicts of interest—including situations where the chair also has executive functions—and key elements of internal control frameworks. They introduce or clarify governance expectations for third-country branches under CRD VI, with greater proportionality than in the consultation draft.

Key dates

2026-11-04

MPC meeting ended and the committee voted 8–1 to increase Bank Rate by 0.25 percentage points to 4%; one member voted for 4.25%.

2026-11-05

The November 2026 Monetary Policy Summary and Minutes were published and the Bank Rate increase was reported as effective.

2027-02-01

The MPC’s Market Participants Survey median expectation referenced in the minutes placed Bank Rate at 4.25% in February 2027; this is an expectation, not a scheduled regulatory change.

Suggested considerations

• Compliance, treasury and risk teams may wish to confirm that systems, product disclosures and contractual interest calculations use the revised 4% Bank Rate where applicable from the relevant effective date.
• Mortgage and consumer-credit providers should consider assessing customer communications, affordability monitoring and conduct-risk impacts for tracker, variable-rate and refinancing products affected by the increase.
• Banks and other lenders may wish to reassess interest-rate, credit, liquidity and concentration-risk assumptions, including scenarios involving inflation near 5% in 2027 Q2 and further Bank Rate increases.
• Investment firms and trading businesses should consider reviewing valuation, margin, collateral, hedging and client-risk controls for sterling rates, gilts, swaps and other rate-sensitive positions.
• Firms may wish to monitor the MPC’s identified indicators of second-round effects, including wage settlements, firms’ pricing behaviour, household and business expectations, energy-cost pass-through and economic slack.
• Governance committees may wish to document the effect of the rate decision and the Bank’s adverse and weaker-demand scenarios in applicable risk assessments, recovery planning, stress testing and customer-outcome monitoring.
• Treasury and product teams should consider verifying that forecasts and liquidity plans reflect the Bank’s warning that further tightening remains possible if elevated energy prices become persistent or feed into wages and prices.

What changed

This is a monetary-policy decision rather than a new binding compliance rule. Bank Rate increased from 3.75% to 4%, raising the reference cost relevant to floating-rate lending, tracker mortgages, treasury funding, derivatives valuation and certain contractual interest calculations. The MPC stated that monetary policy is not on a pre-set path and will be reassessed at each meeting, with particular attention to underlying pay, pricing behaviour, economic slack and the transmission of higher energy prices.

Key dates

2026-11-04

ASIC published the enforcement notice covering 22 large proprietary companies and confirmed total payments of $4,356,000.

2025-08-01

Approximate month in which ASIC commenced its data-focused surveillance of large proprietary companies and other entities for late or missing financial reports.

Suggested considerations

• Compliance teams may wish to map every Australian entity in the corporate group against its financial reporting obligations, including changes in size, ownership, control, corporate structure and operations.
• Firms should consider maintaining a central obligations register recording each entity's financial year end, applicable reporting category, audit requirements, board approval milestones and ASIC lodgement deadline.
• Finance and governance functions may wish to schedule audit planning, management accounts, director approvals and electronic lodgement sufficiently early to address audit-related delays.
• Directors and company secretaries should consider reviewing whether any financial reports, directors' reports or auditors' reports are overdue and arranging prompt lodgement rather than waiting for ASIC contact.
• Groups may wish to document controls for identifying newly reportable entities, including entities that become large proprietary companies or become foreign-controlled.
• Compliance teams should consider retaining evidence of deadline monitoring, auditor engagement, escalation of reporting delays and remediation of overdue filings in case ASIC opens a surveillance review.
• Where ASIC has contacted an entity or an infringement notice has been paid, firms should consider confirming whether all outstanding reports have been lodged because ASIC states that its investigation may continue and payment does not resolve separate reporting obligations.

What changed

No new statutory reporting rule was introduced. ASIC has escalated enforcement of existing obligations under the Corporations Act 2001, including the requirement for large proprietary companies and other prescribed entities to prepare, audit and lodge required financial reports, directors' reports and auditors' reports within the applicable statutory period. For most entities required to lodge, the general deadline is within four months after financial year end; disclosing entities, registered schemes and registrable superannuation entities generally have three months.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the Supervisory Framework on Bank Use of Super Intelligence for examiner use.

Suggested considerations

• Compliance teams may wish to inventory current and planned SI and agentic-SI use cases, including embedded functionality supplied by vendors, and map each use case to its business owner, permitted actions, autonomy level, human oversight, data sources, and potential consequences of failure or misuse.
• Banks should consider documenting a risk-based classification methodology focused on potential consequences, transfer of agency, and degree of human oversight rather than technical sophistication alone.
• Risk and control owners may wish to assess whether existing model-risk, governance, data-governance, privacy, cybersecurity, compliance, operational-resilience, vendor-management, testing, monitoring, documentation, auditability, and independent-challenge controls adequately address SI-enabled activities.
• Higher-consequence or more autonomous use cases should be considered for stronger restrictions on permitted actions, more direct human oversight, independent validation or challenge, enhanced performance monitoring, audit trails, testing, fallback procedures, and resilience measures.
• Boards and senior management may wish to clarify accountability for SI deployments without creating a separate SI risk appetite unless the bank determines that one is useful internally; the OCC framework does not require one.
• Internal audit and compliance teams may wish to retain evidence showing how SI risks are identified, measured, monitored, controlled, and escalated within existing risk-management frameworks, particularly because examiners may use the framework during ordinary examinations despite its nonbinding status.
• Banks should consider reviewing contracts and oversight arrangements for SI vendors, including access to data, model changes, incident notification, testing rights, service continuity, explainability or transparency, subcontracting, and termination or fallback arrangements.
• Compliance teams may wish to monitor future OCC revisions and stakeholder feedback because the framework is expressly intended to be a living document.

What changed

The OCC provided examiners with a risk-based, proportionate framework covering SI used in activities including credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities. Examiners are instructed to consider the bank’s size, complexity, risk profile, and the nature, consequences, autonomy, and complexity of each SI use case; banks are not required to create a separate SI risk category or SI-specific risk appetite. The framework identifies 16 components across six pillars: purpose, risk, control, oversight, resilience, and assurance.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the accompanying supervisory framework for examiner use.

2026-10-02

Executive Order 14434 was published in the Federal Register and is cited by the OCC as the source for the “super intelligence” terminology and broader definition.

Suggested considerations

• Firms should consider maintaining an inventory of SI and agentic use cases, documenting each system’s purpose, permitted actions, accessible data and systems, prohibited uses, degree of autonomy, human-oversight model, and business owner.
• Compliance teams may wish to prioritize review of use cases according to potential consequences of failure or misuse, transfer of decision-making agency, reversibility, customer or market impact, data sensitivity, and the practical ability of personnel to intervene.
• Banks should consider testing whether human reviewers can meaningfully understand, reject, pause, or stop system outputs and actions, rather than relying solely on nominal approval checkpoints or high-volume bulk approvals.
• Risk functions may wish to map SI-enabled activities to existing model risk management, operational-risk, cybersecurity, privacy, consumer-protection, compliance, and business-continuity controls instead of creating a standalone SI risk category.
• Governance teams should consider assigning accountable owners across the system lifecycle, including approval, deployment, change management, incident response, suspension, retirement, and post-incident remediation.
• Banks should consider establishing monitoring capable of detecting model drift, erroneous or harmful actions, unauthorized activity, control exceptions, low-frequency high-impact events, and customer harm, with defined escalation and containment procedures.
• Third-party risk teams may wish to review contracts for vendor notification of model changes and new SI functionality, incident and notification timelines, audit and testing rights, data-use restrictions, responsibility for model errors, service suspension rights, and operational-resilience obligations.
• Internal audit and independent validation functions should consider whether they can reconstruct material outputs and actions, assess control effectiveness, and provide effective challenge to developers, business owners, and validation teams.

What changed

The OCC provided examiners with a framework that supplements existing model risk management, governance, technology, compliance, cybersecurity, and operational-risk practices. It covers 16 components organized around purpose, risk, control, oversight, resilience, and assurance, including permitted use and authority, criticality assessment, human-in-the-loop and human-on-the-loop controls, governance and accountability, performance monitoring, operational resilience, documentation and auditability, vendor risk, testing, and independent challenge.

Key dates

2025-11-26

FINMA published its ex-post evaluation of Circular 2019/2, identifying potential improvements to proportionality and validation requirements and announcing a planned partial revision.

2026-11-04

FINMA launched the consultation on the partial revision of Circular 2019/2.

2027-01-15 Deadline

The FINMA consultation period closes; consultation responses should be submitted by this date.

Suggested considerations

• Banks should review the consultation package and consider submitting comments to FINMA by 15 January 2027, particularly on proportionality, validation burden, earnings-risk metrics and implementation timing.
• Risk and finance teams should perform an impact assessment using the Basel Committee’s July 2024 recalibrated shock methodology, including the potential effect of 25-basis-point rounding and updated historical calibration data.
• Banks should map current interest-rate-risk models, independent validation procedures and model governance against the expected clarification of minimum validation requirements.
• Compliance teams may wish to reassess whether the institution’s proportionality framework appropriately differentiates requirements by size, business model, complexity and risk profile, while retaining evidence supporting those judgments.
• Treasury and risk functions should assess whether existing interest-rate-risk reporting captures both economic-value effects and effects on net interest income or other relevant revenue measures.
• Governance bodies should record the consultation assessment, scenario-analysis results, model changes and any decision to submit industry comments, while continuing to apply the currently effective Circular 2019/2 until a final revision enters into force.

What changed

The proposed revision would update the standardised interest-rate shock scenarios used to measure interest-rate risk in the banking book, reflecting the Basel Committee’s July 2024 recalibration. The Basel recalibration uses updated historical data, a 99.9th-percentile shock-factor methodology and shock values rounded to 25 basis points; the Basel standard contemplated implementation from 1 January 2026, but the Swiss implementation timeline will depend on FINMA’s final circular.

Key dates

2020-04-27

NCUA published the interim final rule establishing the PPP risk-weighting, PPP Loan Facility total-asset exclusion, and commercial-loan treatment.

2022-01-01

NCUA’s 2015 risk-based capital final rule became effective; the December 2021 final rule had already carried forward the relevant PPP treatment into the then-current capital adequacy framework.

2026-11-04

The final rule adopting the April 27, 2020 IFR without change becomes effective and is published at 91 FR 69493.

Suggested considerations

• Compliance teams may wish to confirm that risk-based capital reporting continues to assign a 0 percent risk weight only to loans meeting the applicable SBA PPP eligibility and coverage criteria.
• Credit unions that pledged PPP loans to the Federal Reserve PPP Loan Facility may wish to verify that the loans remain appropriately identified and excluded from total assets solely for the net worth ratio calculation under 12 CFR 702.2.
• Regulatory reporting and finance teams may wish to reconcile PPP-loan classifications across the general ledger, capital calculations, Call Report processes, and supporting documentation.
• Lending compliance teams may wish to confirm that qualifying PPP loans are not included as commercial loans for purposes of 12 CFR part 723, while other applicable lending, documentation, servicing, SBA-guarantee, and record-retention requirements remain separately addressed.
• Credit unions may wish to retain evidence supporting SBA guarantees, facility pledges, non-recourse funding, and the basis for any regulatory capital exclusions, particularly where legacy PPP balances remain on the balance sheet.
• Policy owners may wish to update regulatory inventories to identify the 2026 rule as a finalization of the 2020 IFR rather than as a new operational requirement.

What changed

Under 12 CFR part 702, covered loans issued under the SBA Paycheck Protection Program continue to receive a 0 percent risk weight for risk-based capital purposes. PPP loans pledged as collateral for a non-recourse borrowing through the Federal Reserve’s PPP Loan Facility continue to be excluded from total assets when calculating the net worth ratio under 12 CFR 702.2. Under 12 CFR part 723, PPP loans remain excluded from the definition of commercial loans.

Key dates

2026-11-04

The proposed rule was published in the Federal Register at 91 FR 69642.

2027-01-04 Deadline

Comments on RIN 3064-AG35 must be received by the FDIC.

2029-10-01

First proposed inflation-based adjustment to the section 360.9 covered-institution and larger-covered-institution thresholds.

Suggested considerations

• Affected banks should assess whether they meet the proposed covered-institution or larger-covered-institution thresholds using Call Report definitions and current deposit-account and asset data.
• Current part 370 institutions should map existing output files and deposit-account records against the 26 proposed mandatory fields in 12 CFR part 360 appendices C through G, identifying gaps in account title, ownership, relationship, beneficiary, domestic-versus-foreign, and other required data.
• Part 370 institutions should evaluate the effect of replacing their own deposit-insurance calculation systems with FDIC-calculation reliance, while preserving or redeveloping the provisional-hold capabilities required by proposed section 360.9.
• Larger covered institutions should inventory transactional accounts subject to the proposed account-holder contractual or disclosure requirement and determine which mortgage-servicer, fiduciary, real-estate, IOLTA, employee-benefit-plan, and trust-related accounts may be excluded.
• Compliance, operations, legal, and technology teams should review the proposed six-month implementation period for general requirements and 18-month period for provisional-hold requirements for institutions that are larger covered institutions on the final rule's effective date.
• Banks approaching the thresholds should establish monitoring for two consecutive quarters, the proposed 12-month implementation period after becoming a larger covered institution, and the proposed release mechanism after three consecutive quarters below the relevant threshold.
• Institutions should consider whether to submit comments by January 4, 2027, particularly on field-level data requirements, provisional-hold redevelopment, account-holder disclosures, transition timing, exemptions, and the CPI-W indexing methodology.
• Industry commentary indicates that the proposal is being read primarily as a burden-reduction measure for large banks, with estimated annual savings of approximately $33 million offset by approximately $14 million in transition costs; firms should nevertheless account for operational work associated with standardized data and provisional holds.

What changed

Proposed revised 12 CFR 360.9 would apply to insured depository institutions with at least $2 billion in deposits and either at least 250,000 deposit accounts or at least $20 billion in total assets, regardless of deposit-account count. A new category of larger covered institution would include institutions with at least $2 billion in deposits and two million or more deposit accounts. Part 370 institutions would generally become larger covered institutions under section 360.9, and would no longer need to operate systems capable of calculating deposit-insurance coverage themselves.

Key dates

2026-11-02

WBF amended Annex 2 of the Ordinance of 25 May 2005 on Measures against Sudan (SR 946.231.18), modifying three individual entries.

2026-11-03 Deadline

The amended Sudan sanctions measures enter into force at 23:00 Swiss time; affected financial intermediaries must apply the relevant prohibitions, freeze assets and report affected relationships and blocked assets as required by the ordinance.

Suggested considerations

• Compliance teams should consider updating sanctions-screening data, including aliases and identifying information, from SESAM and the amended Annex 2 before the 23:00 effective time on 3 November 2026.
• Firms should consider screening customers, beneficial owners, counterparties, payment beneficiaries, securities positions and existing business relationships against all three modified entries, including historical and transliterated names where relevant.
• Where a potential match is identified, firms should consider applying the Article 2 financial-sanctions restrictions, preventing further availability of assets or economic resources, preserving relevant records and escalating the case for false-positive resolution and sanctions governance review.
• Firms should consider notifying SECO of affected business relationships and blocked assets in accordance with SR 946.231.18 and maintaining evidence of the decision, controls applied and notification submitted.
• Compliance teams may wish to assess whether a sanctions hit or related transaction creates additional money-laundering concerns requiring enhanced inquiries under Article 6 GwG and, if suspicions cannot be dispelled, an immediate Article 9 GwG report to the Money Laundering Reporting Office.
• Firms with cross-border operations should consider separately assessing whether the modified persons are also subject to EU, UK, US or other sanctions regimes, because the Swiss listing and any foreign restrictions may differ in scope and ownership or control consequences.
• Firms should consider validating batch-screening, real-time payment-screening, case-management and alert-escalation controls after the SESAM update, given the short notice between publication and effectiveness.

What changed

Three individual entries in Annex 2 were modified; the update is implemented through the Swiss SESAM sanctions database. The amended listings are subject to the financial sanctions in Article 2 paragraph 1 of SR 946.231.18, including the freezing of assets and economic resources and the prohibition on directly or indirectly making assets or economic resources available to listed persons. The relevant travel-ban provisions under Article 4 paragraph 1 also apply. Financial intermediaries must report affected business relationships and blocked assets to SECO.

Key dates

2025-11-05

FCA consultation CP25/30 opened on streamlining the UK EMIR intragroup regime.

2026-01-16

FCA consultation closed.

2026-10-21

HM Treasury made the Over-the-Counter Derivatives (Intragroup Transactions) Regulations 2026 (SI 2026/1117).

2026-11-02

FCA published PS26/21, final BTS and related EMIR Q&A changes.

2026-12-05 Deadline

FCA-recommended date by which firms seeking new exemptions under the current regime should submit complete notifications to support processing before transition.

2026-12-31 Deadline

Temporary Intragroup Exemption Regime expires.

2027-01-01 Deadline

The permanent streamlined intragroup regime takes effect; new notifications must use the Connect process and relevant overseas exemptions operate subject to the 30-calendar-day FCA non-objection period.

Suggested considerations

• Firms should inventory all existing UK EMIR intragroup clearing and margin exemptions, identify whether each exemption remains effective immediately before 2027-01-01, and retain evidence that the Article 3 group, consolidation and centralised risk-control conditions remain satisfied.
• Firms currently relying on TIGER should assess the transitional conditions and document the basis on which each exemption will continue after 2026-12-31; firms should not assume that grandfathering expands the scope of an existing exemption.
• Counterparties seeking a new exemption before 2027-01-01 should consider submitting a complete notification under the current process before 2026-12-05 so that the FCA can process it before the temporary regime expires.
• Firms expecting to submit a notification between 2026-12-05 and 2026-12-31 should contact the FCA promptly regarding transition arrangements, particularly where the notification may not be processed before year-end.
• From 2027-01-01, firms seeking exemptions for UK-to-overseas or overseas-to-overseas intragroup transactions should use the new Connect notification process and allow for the FCA’s 30-calendar-day objection period, calculated from receipt of a complete notification.
• Compliance teams may wish to update policies, notification templates, controls and legal opinions to reflect the removal of the equivalence prerequisite, the material-impediment test for margin exemptions, the removal of public disclosure, and the revised evidence requirements.
• Firms should review existing public disclosures and websites for margin-exemption information and consider whether information made unnecessary by the new regime should be removed or retained for audit-trail purposes.
• Derivatives, legal and operations teams should reconcile the final FCA BTS with the Treasury SI and identify any changes to transaction documentation, exemption registers, counterparty representations and regulatory reporting procedures.

What changed

The Over-the-Counter Derivatives (Intragroup Transactions) Regulations 2026 (SI 2026/1117), made on 21 October 2026, amend Article 3 of UK EMIR so that an intragroup transaction may involve entities in any jurisdiction, provided both counterparties are in the same group, included in the same consolidation on a full basis, and subject to appropriate centralised risk evaluation, measurement and control procedures. The reform removes the dependence of permanent intragroup exemptions on an Article 13 UK EMIR equivalence decision.

Key dates

2026-11-03

FCA and PRA published DP26/1: Credit unions: review of the regulatory regime.

2027-03-05 Deadline

Deadline for responses to DP26/1 to be sent to the FCA.

Suggested considerations

• Credit unions should consider whether to submit a response by 5 March 2027, addressing the questions and evidence relevant to their business model, size, complexity, growth plans and risk profile.
• Boards and senior management may wish to assess how potential changes to prudential requirements, permitted activities, governance expectations, operational resilience and resolution or exit arrangements could affect strategic plans, without treating the Discussion Paper as a change to current rules.
• Compliance and regulatory-policy teams should map the firm’s current obligations under the PRA Rulebook Credit Unions Part, applicable FCA conduct requirements and the Credit Unions Act 1979, then identify areas where proportionality or regulatory barriers create material costs or risks.
• Credit unions may wish to engage with representative bodies and credit union service organisations to develop evidence on member outcomes, access to affordable credit, innovation, consolidation, operational dependencies and barriers to orderly exit.
• Firms should monitor subsequent FCA and PRA consultation papers, policy statements and rule changes because any future implementation would require a separate policy process and could include differentiated requirements for smaller and larger credit unions.

What changed

No binding regulatory requirements or policy changes have been introduced. The regulators are seeking evidence on whether the existing prudential framework remains appropriate; whether risk-based and proportionate requirements could better support growth and complexity; whether the framework provides adequate safeguards while enabling competition and innovation; and whether credit unions have effective tools for orderly market exit. The publication is relevant to credit unions in Great Britain and Northern Ireland, their members, credit union service organisations and trade associations.

Key dates

2026-11-03

PRA and FCA publish the joint discussion paper and open the feedback period.

2027-03-05 Deadline

Deadline for responses to the discussion paper to be submitted to the PRA and FCA.

Suggested considerations

• Firms should assess the discussion paper against their size, growth trajectory, business model, lending mix, capital methodology, governance arrangements and operational-risk profile.
• Credit unions may wish to submit evidence to the PRA and FCA by 5 March 2027, including quantified costs and benefits of simplified requirements, risk-based capital treatment, revised reporting and any proposed thresholds.
• Compliance and risk teams should map current internal-audit, regulatory-documentation, capital, leverage-ratio, risk-weighted-asset, capital-add-on and stress-testing requirements so that the impact of possible future options can be assessed without assuming that any proposal is yet effective.
• Boards and senior management should consider whether planned growth, aggregator arrangements, mortgage or fixed-rate lending, outsourcing and technology investment are matched by appropriate governance, liquidity, credit-risk, operational-resilience and third-party oversight capabilities.
• Firms considering new products or services should identify statutory, prudential, conduct, systems and outsourcing barriers and document the safeguards that would be needed to support a credible response to the regulators.
• Credit unions should review current wind-down, transfer and restructuring plans and identify legislative or contractual barriers to sale of loan books, transfer of business or conversion to another mutual form.
• Industry bodies and service providers may wish to coordinate submissions on FCA fees, shared-service models, CUSO capability, third-party guidance and the practical consequences of applying Small Domestic Deposit Takers rules.

What changed

This is a discussion paper, not a consultation proposing or committing to specific policy changes, so existing PRA and FCA requirements continue to apply. The regulators are examining whether internal-audit and regulatory-document requirements could be reduced for smaller and simpler credit unions; whether larger or more complex credit unions should move to a risk-based framework with more flexible capital requirements; and whether relevant Small Domestic Deposit Takers rules, including the standardised approach for risk-weighted assets, could replace the current simple leverage-ratio...

Key dates

2026-11-03

PRA published CP15/26 for consultation.

2026-12-04

Northern Ireland Assembly consultation on the Credit Unions (Amendment) Bill closes; this is a legislative scrutiny date, not a stated PRA consultation deadline.

Suggested considerations

• Compliance teams may wish to track the Northern Ireland Assembly’s passage and final commencement provisions for the Credit Unions (Amendment) Bill rather than treating the consultation proposals as final requirements.
• Credit unions considering member referrals should assess governance, counterparty due diligence, member eligibility and service-specific responsibilities, and consider whether contracts prevent inappropriate transfer of credit risk back to the referring credit union.
• Credit unions considering loan participation should consider documenting originator and participant roles, borrower relationship ownership, underwriting and monitoring responsibilities, security and enforcement rights, default allocation, concentration limits, large-exposure treatment, provisioning and capital treatment.
• Boards and senior managers may wish to assess whether existing risk appetite, lending policies, management information, stress testing and internal controls are proportionate to the additional activities contemplated by the PRA.
• Firms may wish to map existing lending-limit, large-exposure, provisioning and capital processes against the proposed treatment of participation loans and identify data or systems changes needed before implementation.
• Credit unions that do not intend to undertake the new activities may wish to document that decision and retain evidence that their existing governance and control framework remains appropriate for their current business model.
• Affected firms may wish to monitor the PRA’s final policy statement and any revised SS2/23 or Rulebook text before committing to new products or contractual arrangements.

What changed

The PRA proposes amendments to the Credit Unions Part of the PRA Rulebook and SS2/23 – Supervising Credit Unions. Member referral arrangements would be treated as an additional activity; the receiving credit union would retain responsibility for the referred member’s credit risk, and firms would be expected to maintain effective governance, due diligence and clear contractual allocation of responsibilities.

Key dates

2026-11-03

PRA publication date for DP2/26 and FCA publication date for the parallel credit-union discussion paper DP26/1.

2027-03-05 Deadline

Deadline for responses to DP2/26, submitted to [email protected].

Suggested considerations

• Firms should consider whether to submit evidence or a response to DP2/26 by 2027-03-05, addressing the questions most relevant to their size, business model, activities and growth plans.
• Compliance teams may wish to map current prudential, reporting, governance and operational-resilience requirements against the proposed distinction between small and simple firms and larger or more complex credit unions.
• Credit unions considering growth should assess whether board expertise, senior-management capacity, capital and liquidity planning, credit-risk controls, member-servicing capability and operational resilience will scale with membership and lending volumes.
• Firms may wish to review governance and controls for aggregator-driven growth, mortgage lending, fixed-rate products, outsourced activities, third-party providers and CUSO relationships, because these are identified as areas where future safeguards or supervisory expectations may develop.
• Boards and senior managers should consider how existing responsibilities under Rule 11.5(3) of the Credit Unions Part of the PRA Rulebook are evidenced, including oversight of regulatory compliance, risk management and business growth.
• Credit unions may wish to evaluate their current solvent-exit and wind-down arrangements, including the feasibility of transferring business, selling a loan book, restructuring or maintaining continuity of member services.
• Trade associations and service organisations may wish to provide data on compliance costs, asset-based thresholds, barriers to permitted activities, common-bond expansion, CUSO use and the practical effects of different prudential models.
• Firms should monitor subsequent PRA and FCA consultations and any legislative proposals; no implementation plan or transition timetable has been established at this stage.

What changed

No rules, thresholds, permissions or supervisory requirements have been amended by DP2/26. The regulators are seeking evidence on six outcomes: proportionate regulation; consumer confidence and protection; competition and innovation; long-term sustainability; operational resilience and risk management; and orderly market exit.

Key dates

2026-11-02

The FCA published its expectations for lenders making voluntary motor finance settlement offers; the page was updated on 2026-11-03.

2026-10-01

Barclays Partner Finance identified customers whose complaints had been acknowledged on or before this date as a cohort for some early settlement offers.

2027-02-16

The scheduled start of the legal challenges to the FCA motor finance compensation scheme.

2027-03-03

The scheduled end date of the hearing window for the legal challenges to the FCA motor finance compensation scheme.

Suggested considerations

• Firms considering early settlements should assess each offer against the maximum redress that would have been available under the FCA motor finance compensation scheme, rather than using a lower discretionary amount.
• Compliance teams may wish to establish governance and second-line review for the methodology, calculations, customer segmentation and approval of settlement communications.
• Firms should consider notifying the FCA before making offers and supplying the FCA factsheet with each customer communication.
• Offer letters should clearly state the amount, calculation basis, the full-and-final effect of acceptance, the inability to claim more later, the option to reject and remain within the scheme, and the consequences for the existing complaint.
• Firms should consider allowing at least one month for customers to respond and retaining evidence that customers had sufficient information and time to make an informed decision.
• Marketing, customer-service and complaints teams should avoid language suggesting FCA endorsement, approval or validation of an individual offer.
• Firms should consider controls to prevent accepted settlements from being subsequently processed as scheme claims or referred to the Financial Ombudsman Service.
• Motor finance lenders should continue preparing for the compensation scheme and progress complaints as far as possible during the partial suspension, even if scheme compensation is not currently calculated or paid.

What changed

Lenders may make voluntary settlement offers before the partially suspended FCA motor finance compensation scheme is implemented, but the FCA expects each offer to provide at least the compensation the customer would receive under the scheme, calculated by reference to the relevant agreement and the scheme methodology. Firms intending to make offers are expected to notify the FCA, provide the FCA factsheet to customers, and ensure communications are clear, fair and not misleading.

Key dates

2026-09-30

The FCA’s application window for the new UK cryptoasset regime opened.

2026-10-01

The application window opened for the FCA Regulatory Sandbox themed cohort on climate scenario models.

2026-11-02

The FCA published Wholesale banks supervision - Insights 3 (Autumn 2026).

2026-11-30 Deadline

The application window closes for the FCA Regulatory Sandbox climate scenario models cohort.

2027-02-28 Deadline

FCA-encouraged deadline for wholesale banks to submit a variation-of-permission application for new regulated cryptoasset activities to obtain the stated pre-regime application treatment.

2027-10-25

The new UK cryptoasset regime comes into force.

Suggested considerations

• Firms should consider performing a control-by-control review of critical data ingestion, including completeness checks, reconciliation, coding-change testing, source-to-consumption lineage and evidence of design and operating effectiveness for financial-crime and surveillance controls.
• Compliance and technology teams may wish to test communications surveillance after system changes, including lexicon configuration, geographic and channel coverage, third-party-provider interfaces, ingestion completeness and retention or auditability of records for in-scope activities.
• Firms should consider reconciling the technology-asset inventory to procurement, disposal, redeployment, identity and endpoint-management records across all regions, assigning clear lifecycle accountability and confirming that assets cannot leave service without security and inventory updates, including encryption status.
• Algorithmic-trading firms should consider testing enhancements across the complete order lifecycle, including near-simultaneous and geographically distributed fills, order-management and fill-notification interactions, overfills, stop-loss scenarios, venue behaviour, pre-trade limits, kill or cancel mechanisms and post-implementation monitoring, with governance aligned to UK MiFID RTS 6.
• Firms should consider testing DLP controls against deliberate circumvention, including split messages, altered classifications, changed file formats, embedded images and misleading subjects, while reviewing staff training, monitoring, escalation and privacy safeguards.
• Operational-resilience owners may wish to refresh important-business-service impact tolerances using potential disruption to trading, settlement, clients, counterparties and time-critical market processes rather than relying solely on generic recovery-time or availability metrics.
• Firms should consider separating current resilience capability from planned remediation in self-assessments, linking incidents, near misses and test results to mapping and remediation decisions, and validating completed remediation through retesting.
• Settlement-related firms should consider the effect of T+1 on post-trade dependencies, reconciliation, funding, exception management, recovery capability, scenario testing and impact-tolerance calibration.

What changed

The FCA has not introduced new binding rules through this publication; it has consolidated supervisory findings and clarified areas against which wholesale banks may be assessed. Firms are expected to be able to evidence complete data lineage and ingestion controls, auditable recording and communications surveillance even where third parties are used, reliable asset inventories, end-to-end algorithmic-trading testing and controls consistent with UK MiFID RTS 6, and DLP controls capable of addressing adaptive evasion techniques.

Key dates

2026-10-07

PRA published CP13/26 proposing automatic indexation of in-scope regulatory thresholds every five years, with a proposed first update on 1 July 2031.

2026-10-14

PRA published PS19/26 setting out the final policy on high loan-to-income lending.

2026-10-22

PRA published CP14/26 consultation on phase 2 of SM&CR reform.

2026-10-26

Bank of England and FCA published the 2026 survey results on artificial intelligence and machine learning in UK financial services.

2026-10-28

PRA rules and supervisory statement on high-LTI lending commenced; the firm-specific 15% cap was removed and the revised monitoring and governance framework became effective.

2027-01-22 Deadline

Consultation deadline reported for the PRA and FCA phase 2 SM&CR consultations.

2027-02-07 Deadline

Consultation deadline for CP13/26 and the associated discussion of additional thresholds potentially suitable for indexation.

2031-07-01

Proposed date for the first automatic update of in-scope regulatory thresholds under CP13/26, subject to final policy and implementation.

Suggested considerations

• Mortgage lenders should assess their high-LTI lending strategy against risk appetite, capital and credit-risk tolerances now that the firm-specific 15% cap has been removed.
• Mortgage lenders should establish or validate rolling four-quarter calculations for individual high-LTI flows and retain evidence supporting any adjustments, limits or risk appetite decisions.
• Relevant firms should review governance, underwriting, affordability, concentration and stress-testing controls to demonstrate prudent management of high-LTI lending under the new PRA expectations.
• Compliance and regulatory-reporting teams should monitor the PRA’s quarterly aggregate high-LTI publications and assess whether lending plans remain consistent with the FPC’s aggregate 15% limit.
• PRA-regulated firms should map current Rulebook and supervisory-statement thresholds against the 128 proposed in-scope thresholds and identify systems, permissions, reporting and policy documents that would require future updates.
• Affected firms should consider submitting responses to CP13/26 and its associated discussion questions by 7 February 2027, particularly where indexation could alter regulatory categorisation, reporting, capital, liquidity, governance or investment-flexibility requirements.
• SM&CR compliance teams should assess CP14/26 against current senior-manager responsibilities, certification processes, fitness and propriety controls, governance maps, handover arrangements and recordkeeping, while treating the proposals as non-final.
• Firms should monitor the related FCA SM&CR consultation and coordinate any response because implementation may require changes across PRA and FCA regimes.

What changed

PS19/26 removes the firm-specific 15% limit on high-LTI mortgage lending, while retaining the Financial Policy Committee’s aggregate 15% limit as the benchmark for overall market lending. Firms’ individual high-LTI flows and any required adjustments will be assessed on a rolling four-quarter basis, whereas aggregate high-LTI lending will continue to be monitored quarterly. The final rules and supervisory statement also introduce governance and risk-management expectations, and the PRA intends to publish aggregate high-LTI flow data quarterly.

Key dates

2023-12-13

The SEC adopted the Treasury clearing amendments, including the trade-submission requirement implemented through Exchange Act Rule 17ad-22(e)(18)(iv)(A).

2026-10-30

The SEC issued exemptive relief for specified inter-affiliate and non-U.S. Treasury repo transactions.

2026-12-31 Deadline

Compliance date for applicable eligible secondary market cash transactions involving U.S. Treasury securities.

2027-06-30 Deadline

Compliance date for applicable eligible secondary market repo transactions involving U.S. Treasury securities.

Suggested considerations

• Firms should obtain and analyze the operative October 30, 2026 Section 36 exemptive order, including all limits, conditions, definitions, recordkeeping provisions, and any continuing reporting requirements.
• Compliance teams may wish to inventory all Treasury repo transactions by legal entity, counterparty location, direct-participant status, affiliate relationship, guarantee structure, and whether the transaction is market-facing or solely inter-affiliate.
• Firms should validate whether each proposed affiliate qualifies under Rule 17ad-22(a) as modified by the relief and confirm that the affiliate is not an investment company under Section 3 of the Investment Company Act of 1940.
• Broker-dealers and other direct participants should update trade-classification, order-management, confirmation, clearing-submission, exception-management, and surveillance controls to distinguish exempt transactions from transactions that must be submitted for clearing.
• Global firms should establish governance for monitoring any activity-based or volume-based limit applicable to non-U.S. repo relief, including data ownership, aggregation across affiliates and direct participants, calculation frequency, escalation thresholds, and evidence retained for supervisory review.
• Firms should continue implementation of the broader Treasury clearing framework and should not treat the relief as a basis for delaying preparations for the December 31, 2026 cash-market or June 30, 2027 repo compliance dates.
• Legal and compliance teams may wish to assess whether non-U.S. branches, foreign affiliates, guarantees by U.S. persons, or local-law requirements create additional obligations notwithstanding the SEC relief.

What changed

The relief applies to certain repo transactions involving non-U.S. counterparties, subject to specified limits and conditions. It also expands the inter-affiliate treatment for repos between a direct participant of a U.S. Treasury securities covered clearing agency and an affiliated entity that is not an investment company under Section 3 of the Investment Company Act of 1940, provided the affiliate otherwise meets the affiliated-counterparty definition in Rule 17ad-22(a).

Key dates

2026-10-30

FDIC Board unanimously approved the Notice of Proposed Rulemaking by notational vote.

Suggested considerations

• Compliance teams should obtain and review the complete NPRM, including proposed amendments, definitions, scope thresholds, transition provisions, and the Federal Register comment deadline, because the bulletin itself contains only a high-level announcement.
• Firms should map each insured depository institution against the current applicability criteria in 12 CFR part 370 and 12 CFR 360.9, documenting deposit-account counts, domestic deposits, total assets, existing exemptions, certifications, and any voluntary compliance elections.
• Affected institutions should inventory overlapping deposit-insurance determination, depositor-record, provisional-hold, data-format, and reporting capabilities to identify systems that could potentially be consolidated if the proposal is finalized.
• Technology, operations, deposit administration, legal, resolution-planning, and third-party-risk teams should assess whether current data lineage, account ownership and capacity coding, reconciliation, testing, and FDIC access processes would satisfy a revised standardized-record framework.
• Firms should consider submitting comments on the operational feasibility, treatment of affiliates and mergers, transition periods, testing expectations, treatment of custodial and pass-through accounts, and whether any proposed relief would create gaps in failure-day data availability.
• Institutions should continue complying with currently effective 12 CFR part 370 and 12 CFR 360.9 requirements until a final rule becomes effective and any applicable transition period expires.

What changed

The FDIC has proposed amendments concerning the framework used by large insured depository institutions to maintain depositor records and support rapid deposit-insurance determinations. Based on the FDIC’s accompanying policy direction and independent industry commentary, the proposal would likely preserve standardized depositor-record and data-access requirements while reducing or eliminating the need for institutions subject to 12 CFR part 370 to maintain separate, independent deposit-insurance determination systems.

Key dates

2026-03-04

The European Commission issued its call for technical advice to the European Supervisory Authorities on targeted simplification of the Taxonomy Disclosures Delegated Act.

2026-07-01

ESMA launched its consultation on selected Taxonomy KPIs and proposed simplification measures.

2026-08-12 Deadline

ESMA’s consultation period closed.

2026-10-29

ESMA submitted its Final Report and technical advice to the European Commission for consideration in the review of the Taxonomy Disclosures Delegated Act.

Suggested considerations

• Compliance teams should continue applying the currently effective Taxonomy Regulation and Taxonomy Disclosures Delegated Act until any Commission amendment enters into force.
• Firms should monitor the Commission’s review of the Disclosures Delegated Act and assess any subsequent delegated act, scrutiny period, entry-into-force date and transitional provisions before changing reporting controls.
• Corporate reporting teams may wish to model the effect of an R&D-only mandatory OpEx KPI, including the IAS 38 or national-GAAP population, numerator mapping and interaction with existing materiality reliefs.
• Groups should inventory parent and subsidiary business lines, assess whether secondary businesses could exceed a cumulative 10% consolidated-turnover threshold, and prepare for possible parent-regime and simplified secondary-business templates.
• Asset managers and other financial undertakings should avoid treating the proposed absence of voluntary OpEx reporting as current law and should document the basis for any voluntary Taxonomy metrics under existing disclosure and anti-greenwashing controls.
• Issuers and sustainability-reporting teams should review sustainable-bond, internal-sales, contextual-information and CapEx Type C data processes so they can adapt if the Commission adopts ESMA’s recommendations.
• Reporting governance should track whether any future voluntary alternative metric is reconciled to the mandatory KPI and subject to applicable ESMA Guidelines on Alternative Performance Measures.

What changed

ESMA recommends that the mandatory Article 8 Taxonomy Regulation OpEx KPI focus on non-capitalised R&D expenditure, with the denominator based on expenditure recognised under IAS 38 or relevant national GAAP and the numerator drawn from the existing Annex I categories. It does not recommend introducing a mandatory voluntary OpEx+ metric, and advises against allowing financial undertakings, including asset managers, to use an OpEx KPI voluntarily for Taxonomy disclosures.

Key dates

2026-10-29

FCA published Fair value in consumer finance and associated supervisory commentary; the examples are effective as supervisory guidance and do not create new rules.

Suggested considerations

• Compliance teams may wish to inventory every financial and non-financial charge across each product's full customer journey and lifetime, including contingent, arrears, repeat and cumulative charges.
• Firms should consider refreshing fair value assessments to reconcile current pricing and charging data with quantified or otherwise evidenced customer benefits, product limitations, service quality and foreseeable risks.
• Firms may wish to document how assumptions, management information, customer outcomes and governance challenge support each fair value conclusion, with clear ownership and audit trails.
• Firms should consider segmenting analysis by relevant customer groups, including vulnerability characteristics, credit risk, product usage, distribution channel and customers experiencing financial difficulty, and testing whether outcomes differ materially.
• Compliance teams may wish to establish monitoring for arrears, complaints, cancellations, usage, enquiries, refunds, waivers, repeat charges and customer understanding, with defined escalation thresholds and remediation options.
• Firms should consider testing whether fees and charges are communicated clearly, prominently and at the point customers need them to make informed decisions, including through customer-understanding testing.
• Firms may wish to review controls for grace periods, charge caps, fee waivers and refunds and evidence that those controls are appropriately designed, operating effectively and reducing foreseeable harm.
• Where late or missed repayment charges are justified by reasonable costs, firms should consider documenting the cost methodology, evidence relied upon and relationship between the methodology and the charge level, alongside the separate fair value assessment.

What changed

The publication does not amend the FCA Handbook or create new mandatory actions. It consolidates good and poor practice under the existing price and value outcome in PRIN 2A.4 and FG22/5, including the requirement for manufacturers under PRIN 2A.4.2R(2) to conduct and regularly review value assessments at intervals appropriate to the product's nature and duration.

Key dates

2026-10-29

The Bank of England published the consultation and draft Supervisory Statement on CCP acceptance of tokenised collateral.

2027-02-12 Deadline

Consultation closes; responses on the draft supervisory expectations and wider tokenised-collateral policy are requested by this date.

2028-01-01

Target year for the Bank’s planned RT2 synchronisation capability supporting settlement between digital-asset ledgers and central bank money; this is a stated implementation target, not a compliance deadline.

Suggested considerations

• CCPs and prospective CCP applicants should consider whether tokenised versions of currently accepted or eligible collateral would constitute new collateral requiring notification to, or permission from, the Bank under the existing supervisory and margin-permission processes.
• Compliance, legal and risk teams should consider mapping each proposed tokenised collateral arrangement end to end, including issuance, representation of rights, custody, transfer, settlement finality, redemption, liquidation and default management.
• CCPs should consider preparing evidence on valuation methodology, price reliability, liquidity, conversion between tokenised and conventional forms, repo or outright-sale access, stress-market behaviour and concentration treatment across identical underlying assets.
• CCPs and their service providers should consider legal opinions addressing ownership, enforceability, insolvency treatment, settlement finality under the Settlement Finality Regulations, transfer restrictions and the relationship between ledger records, CSD records and underlying assets.
• Operational-resilience assessments should consider ledger, bridge, smart-contract, custodian, wallet, key-management and other third-party failure scenarios, including alternative access, transfer, liquidation and recovery arrangements.
• CCPs should consider whether proposed arrangements require changes to models, parameters, margining, collateral haircuts, default-management procedures, investment-policy controls, outsourcing oversight or governance approvals.
• Affected firms and infrastructure providers may wish to submit responses to the Bank’s consultation by 2027-02-12, particularly on practical barriers, wider tokenised-asset use cases and whether the proposed expectations remain suitable for future collateral types.
• Firms operating cross-border collateral arrangements should consider the interaction with parallel international developments, including ESMA’s October 2026 call for evidence on tokenised collateral in EU central clearing.

What changed

The Bank proposes to assess tokenised collateral through the existing supervisory process for new collateral, including where a tokenised version has risk characteristics that differ from the approved non-tokenised asset because of its delivery method, credit risk or liquidity profile. The draft Supervisory Statement adopts a technology-neutral, outcomes-focused and proportionate approach: CCPs would need to demonstrate that tokenised collateral can be valued, transferred, controlled and realised within required timeframes in normal and stressed conditions.

Key dates

2026-03-04

The European Commission requested technical advice from the ESAs on the review of Article 8 Taxonomy disclosures.

2026-10-29

The EBA published its final technical advice and submitted its report to the European Commission.

Suggested considerations

• Compliance teams should treat the publication as forward-looking technical advice and should not cease reporting the Fees and Commissions KPI, Trading Book KPI or other existing disclosures unless and until the Commission adopts applicable amendments or transitional measures.
• Firms should map current Taxonomy data lineage, controls, templates and calculation logic against each proposed change so that implementation can be accelerated if the Commission follows the EBA advice.
• Banking groups should assess how parent-level KPIs and material secondary-activity KPIs could affect consolidation methodologies, entity-level data ownership and audit trails.
• Investment firms should inventory fees, commissions and other services currently included in the relevant KPIs, particularly capital-markets-related services, and model the effect of the proposed narrower approach.
• Credit institutions should review Green Asset Ratio template production and identify duplicated or low-value data points that may be removed or harmonised in a future delegated act.
• Firms should monitor the Commission’s review of Commission Delegated Regulation (EU) 2021/2178, the related Omnibus simplification measures and any final ESA or Commission guidance before updating policies, public disclosures or regulatory reporting systems.
• Legal and regulatory-change teams may wish to engage with the Commission consultation or legislative process and preserve evidence supporting current reporting interpretations during the transition.

What changed

The EBA recommends removing the Fees and Commissions KPI and the Trading Book KPI from Taxonomy disclosure requirements. It proposes simplifying the investment firms’ other-services KPI, including capital-markets-related services, and aligning grandfathering provisions with Regulation (EU) 2023/2631 on European Green Bonds, but only for bonds issued under that Regulation. The EBA advises against introducing the operational expenditure KPI of non-financial undertakings into financial undertakings’ KPI calculations.

Key dates

2026-10-29

MAS published the policy statement announcing the extension of motor vehicle financing restrictions to individual-owned PHCs.

2026-10-30 Deadline

New restrictions take effect for individual-owned PHC purchases where the sales agreement is signed on or after this date; where there is no sales agreement, they apply if the COE is obtained on or after this date.

Suggested considerations

• Compliance teams at affected lenders should update eligibility, LTV and tenure controls so that individual-owned PHCs are treated as private cars for transactions falling within the effective-date tests.
• Firms should confirm that the LTV calculation uses the full purchase price, including relevant taxes and the COE price where applicable, and that the OMV threshold is applied at $20,000.
• Lenders and finance providers should review onboarding and documentation controls to distinguish individual or sole-proprietor ownership from business-owned PHC ownership and to evidence the sales-agreement or COE date.
• Providers should assess pending applications, approvals, hire-purchase agreements and conditional sales near the 30 October 2026 transition point, including whether any transaction was restructured to avoid the new restrictions.
• Car dealers and platform operators should consider updating customer disclosures, application workflows and referral arrangements so that individual buyers are not presented with financing terms inconsistent with the new limits.
• Firms should review dealer, leasing and in-house financing products for potential regulatory perimeter or circumvention risk, particularly because the Government has indicated that it may apply equivalent restrictions to additional arrangements.
• Compliance teams may wish to monitor MAS and Government follow-up, including implementation guidance and any measures affecting in-house loans or platform-operated financing channels.
• Firms should consider controls and customer communications addressing unregulated leasing, lease-to-own or other arrangements that may be marketed as alternatives to regulated motor vehicle financing.

What changed

For an individual-owned PHC with an OMV of $20,000 or below, the maximum LTV is 70% of the purchase price, including relevant taxes and the COE price where applicable. For an OMV above $20,000, the maximum LTV is 60%; financing tenure is capped at seven years in both cases. The restrictions apply to motor vehicle loans provided by financial institutions and licensed or exempt moneylenders, and to hire-purchase and conditional sale agreements.

Key dates

2026-10-28

FOMC statement released; target federal funds range maintained at 3.75% to 4.00% and ample-reserves policy continued.

Suggested considerations

• Compliance and risk teams may wish to record the October 28, 2026 target range of 3.75% to 4.00% and the 10-2 vote in regulatory change-management and market-risk records.
• Firms should consider reviewing interest-rate, basis, liquidity and funding-risk limits against scenarios involving a further 25-basis-point increase, including a possible December 2026 hike suggested by independent market commentary.
• Banks and other lenders may wish to assess the effect of persistently elevated rates on borrower affordability, refinancing risk, delinquency assumptions, fair-lending monitoring and customer communications.
• Treasury and finance teams should consider validating the treatment of the unchanged policy rate in transfer-pricing, liquidity-stress, valuation, hedge-accounting and capital-planning models.
• Broker-dealers, asset managers and leveraged funds may wish to reassess margin, collateral, redemption-liquidity and counterparty exposures under higher-for-longer rate scenarios.
• Compliance teams should consider monitoring the forthcoming FOMC implementation note and subsequent Federal Reserve communications for any operational details affecting reserve management or money-market conditions.
• Firms should consider documenting the distinction between this policy decision and a new regulatory rule: the statement contains no new prudential ratio, disclosure, reporting or customer-protection requirement.

What changed

The FOMC made no change to the federal funds target range, which remains 3.75% to 4.00%, and did not announce a change to its policy of maintaining ample reserves in the banking system. The statement upgraded its description of economic activity to expanding at a strong pace and characterized productivity growth and capital investment as strong or robust, while stating that inflation remains elevated. The Committee emphasized that it will assess additional information in determining the policy stance needed to return inflation to its 2% goal. Lisa D. Cook and Beth M.

Key dates

2026-12-07 Deadline

First phased requirements under the amended RTS on settlement discipline and related ESMA guidelines apply to allocations and confirmations, including electronic, standardised and machine-readable communications, subject to the temporary technical disruption exception.

2027-07-01 Deadline

Additional phased requirements under the amended RTS on settlement discipline become applicable, as specified in the regulation’s transitional provisions.

2027-10-11 Deadline

Regulation (EU) 2025/2075 applies and the EU standard securities settlement cycle changes from T+2 to T+1; the final phase of related settlement-layer requirements also applies.

Suggested considerations

• Firms should map every affected transaction type, market, currency, venue, CSD, custodian, broker, client and outsourcing provider across the full trading and settlement ecosystem rather than assessing only internal readiness.
• Compliance and operations teams may wish to confirm whether allocations and confirmations can be completed on trade date and transmitted through electronic, standardised and machine-readable channels from 7 December 2026, including accurate place-of-settlement data where required.
• Firms should assess and test ISO or other applicable international messaging standards, matching platforms, standing settlement instruction governance, exception handling and the documented process for temporary technical disruptions.
• Firms should identify manual processing steps that cannot reliably operate within the shortened timetable and consider automation, straight-through processing, reconciliation, controls over data quality and resilient fallback arrangements.
• Firms should obtain implementation commitments and test plans from clients, brokers, custodians, CSD participants, CSDs, CCPs, vendors and outsourcing providers, with evidence of end-to-end testing and defect remediation.
• Firms should review liquidity, collateral, margin, FX funding, corporate-action, securities-lending, fund dealing and investment-operation processes for the reduced interval between trade and settlement.
• Firms should maintain a regulatory change plan covering the phased milestones on 7 December 2026, 1 July 2027 and 11 October 2027, with senior management oversight, documented risk acceptance and escalation of unresolved dependencies.

What changed

Regulation (EU) 2025/2075 amends Regulation (EU) No 909/2014 (CSDR) and provides for the EU settlement cycle to apply on a T+1 basis from 11 October 2027. Commission Delegated Regulation (EU) 2026/1536 amends the RTS on settlement discipline in Commission Delegated Regulation (EU) 2018/1229, with phased application beginning on 7 December 2026. From 7 December 2026, the allocation and confirmation process must use electronic, standardised communication channels and international messaging standards, with machine-readable communications required except during temporary technical disruptions.

Key dates

2026-10-28

MAS published its statement reinforcing banks’ existing environmental-risk management expectations in the context of transboundary haze, pollution and deforestation.

Suggested considerations

• Banks should consider mapping customers, counterparties and financed activities that may be linked to open burning, deforestation, peatland development or other haze-related pollution, at both customer and portfolio level.
• Compliance and risk teams may wish to establish a process for capturing, validating and escalating relevant NEA information and notices issued under the Transboundary Haze Pollution Act.
• Banks should consider enhancing customer due diligence for potentially haze-linked customers, including obtaining evidence of land ownership or control, fire-prevention and response arrangements, concession and supply-chain information, environmental permits, incident history and remediation measures.
• Banks may wish to document customer engagement, responses, management decisions and escalation criteria so that the rationale for continuing, conditioning, reducing or terminating exposure is demonstrable.
• Credit committees and relationship teams should consider incorporating environmental-risk findings into new-financing approvals, renewals, covenant-setting, pricing, collateral assessments and ongoing monitoring.
• For higher-risk customers, banks may wish to consider enhanced measures such as site visits, independent environmental expertise, satellite or geospatial monitoring and contractual rights to obtain information or suspend further drawdowns.
• Banks should consider defining governance triggers for cases involving suspected or confirmed breaches, with senior-management or board escalation where exposure limits or relationship exit is contemplated.
• Banks may wish to review public environmental-risk disclosures and transition plans for consistency with the strengthened supervisory focus, while recognising that the statement itself does not create a new disclosure deadline.

What changed

MAS has expressly linked banks’ environmental-risk processes to haze-related pollution and deforestation risks. Banks should consider relevant information released by the National Environment Agency under the Transboundary Haze Pollution Act and engage customers potentially connected to haze-producing activities to obtain sufficient information about their role, including controls to prevent, detect and stop fires.

Key dates

2026-12-07 Deadline

First phased requirements apply to investment firms and their clients for allocations and confirmations, including electronic, standardised, international-standard and machine-readable communications except during temporary technical disruptions.

2027-07-01 Deadline

Second phased implementation deadline under the amended settlement-discipline framework.

2027-10-11 Deadline

EU securities markets move from the standard T+2 settlement cycle to T+1; the final phased settlement-discipline requirements apply.

Suggested considerations

• Firms should map every allocation, confirmation, matching and settlement-instruction process affected by the amended settlement-discipline RTS and identify manual, non-standardised or non-machine-readable steps.
• Compliance teams may wish to confirm that electronic, standardised communication channels and international messaging standards are available to the firm and its professional clients before 7 December 2026.
• Firms should consider implementing trade-date controls, internal cut-offs, automated alerts, escalation procedures and exception reporting to identify transactions at risk of missing the applicable allocation and confirmation deadline.
• Investment firms may wish to review client onboarding and contractual documentation to ensure that professional clients provide complete settlement details and use compatible communication channels and formats.
• Operations and technology teams should test end-to-end connectivity, message formats, reference data, settlement instructions, matching, foreign-exchange funding, securities lending, collateral and asset-servicing workflows across the entire trading and settlement ecosystem.
• Firms should assess readiness not only within their own organisation but also across brokers, custodians, clients, fund administrators, CSDs, settlement agents and other outsourced providers.
• Firms should establish a phased implementation plan covering the 7 December 2026, 1 July 2027 and 11 October 2027 milestones, with evidence of testing, issue remediation and management oversight.
• Compliance teams may wish to monitor further ESMA and CSSF supervisory communications because ESMA and national competent authorities have indicated that they will monitor compliance with the new obligations.

What changed

Amended settlement-discipline regulatory technical standards under Commission Delegated Regulation (EU) 2018/1229 introduce phased requirements supporting the EU T+1 transition. From 7 December 2026, investment firms and their clients must use electronic, standardised communication channels and international messaging standards for allocations and confirmations, with machine-readable communication required except during temporary technical disruptions.

Key dates

2026-10-26

Current date and FCA publication context for the review; firms have been told to take prompt action, but this is not a statutory compliance deadline.

2028-12-01

The FCA says the point-in-time publication may be treated as retired by December 2028 if it has not been removed sooner; this is not stated as a mandatory implementation deadline.

Suggested considerations

• Compliance teams may wish to map how the firm identifies direct defence businesses, defence supply-chain participants, dual-use technology businesses and relevant customers that are not accurately captured by SIC codes.
• Firms should consider testing whether onboarding and enhanced due diligence requests are risk-based, non-duplicative and proportionate to the individual customer's activities, jurisdictions, products, end use and supply chain, rather than triggered solely by a broad defence-sector label.
• Firms should consider reviewing blanket exclusions, revenue thresholds, automatic escalation rules and approval stages affecting defence customers, documenting why any retained restrictions are justified by legal, financial-crime, reputational or commercial-risk considerations.
• Firms should consider defining and governing reputational, ESG and sustainability criteria used in account opening, servicing, product access, restriction or closure decisions, with evidence that the criteria are consistently applied and aligned with stated risk appetite.
• Firms should consider establishing or improving management information covering defence-sector identification, application volumes, approval and rejection rates, onboarding duration, repeated information requests, escalation frequency, restrictions, closures, complaints and outcomes by customer risk category.
• Senior management and relevant committees may wish to review whether the available information allows them to challenge inconsistent treatment, unexplained delays or outcomes that arise from internal processes rather than the customer's actual risk.
• Where legally permissible and appropriate, firms should consider keeping applicants informed about additional checks, progress and likely decision timescales, and explaining decisions sufficiently to reduce avoidable uncertainty.
• Firms should continue to apply customer due diligence, enhanced due diligence, sanctions and other financial-crime controls required by applicable law; the FCA's message is to make those controls targeted and proportionate, not to reduce them.

What changed

No binding regulatory obligations or new thresholds have been introduced. The FCA has nevertheless written to firms providing banking services to SMEs and expects prompt action under existing requirements. Firms should review whether onboarding, enhanced due diligence, escalation, servicing, restriction and closure processes distinguish among different defence activities and reflect the specific customer, geographic, product, supply-chain, end-use, financial-crime and reputational risks.

Key dates

2026-10-22

FCA published CP26/37 and opened the consultation.

2027-01-22 Deadline

Deadline for consultation responses.

2027-06-30

End of the first half of 2027, during which the FCA expects to publish final regulatory requirements; the exact publication date is not specified.

Suggested considerations

• Firms should assess the consultation proposals against their current SMF population, including whether SMF18, SMF22 or the existing SMF7 definition is used and how responsibilities would be reallocated.
• Dual-regulated and Enhanced firms should review whether SMF5 and SMF10 to SMF15 appointments would move from prior approval to notification, while considering the continuing need for documented fitness and propriety assessments.
• Compliance teams may wish to model whether the proposed £200 million, £100 billion, £75 million and £750 million Enhanced thresholds would change the firm's classification, including group-level and three-year rolling-average calculations.
• Firms should plan to preserve accurate internal Statements of Responsibilities and Management Responsibilities Maps even if routine FCA submissions are removed.
• Firms should review Prescribed Responsibility allocations and identify the impact of removing nine responsibilities, including the proposed retention of A, D, Z and J-3.
• Certification-function inventories, annual certification processes, regulatory-reference procedures and Directory reporting should be mapped so that transition arrangements can be implemented if the proposals are finalised; firms should not discontinue current obligations before final rules and commencement.
• Conduct and HR teams should assess changes to training, staff notifications, disciplinary classifications, appeal processes and breach-reporting workflows, distinguishing staff subject only to Individual Conduct Rules from those also subject to Senior Manager Conduct Rules.
• Firms should retain processes for prompt notification of matters of regulatory significance under Principle 11, SUP 15 and SUP 10C, because the consultation does not remove those obligations.

What changed

The FCA proposes to make SMF5 (Head of Internal Audit) and SMF10 to SMF15 functions notified rather than subject to prior approval at specified dual-regulated and Enhanced firms. It proposes to remove SMF18 (Other Overall Responsibility) and SMF22 (Local Responsibility), narrow SMF7 (Group Entity Senior Manager), and retain SMF24 (Chief Operations Function) as a pre-approved function.

Key dates

2026-10-22

The FCA and PRA published parallel Phase 2 SM&CR consultations.

2027-01-22 Deadline

Deadline for responses to the FCA and PRA SM&CR Phase 2 consultations.

Suggested considerations

• Compliance teams may wish to review the FCA consultation CP26/37 and PRA consultation CP14/26 and consider submitting responses by 22 January 2027.
• Firms should continue operating existing SM&CR approval, certification, Directory, Conduct Rule and responsibility-mapping processes unless and until final rules and any required legislation take effect.
• Firms may wish to map current Senior Management Functions and identify Chief Actuary, Risk Committee Chair and Audit Committee Chair roles that could move from pre-approval to notification, while retaining evidence of fitness, propriety, competence and suitability assessments.
• Compliance teams should identify employees who could fall outside the proposed Certification Regime and assess how internal competence, performance, disciplinary and conduct controls would operate without annual regulatory certification.
• Firms may wish to model the effect of the proposed Enhanced-regime threshold increases on their classification, governance documentation, prescribed responsibilities and approval processes.
• Firms should review Conduct Rule breach-reporting workflows and training curricula, but should not apply a higher reporting threshold or reduced training scope until the relevant final rules are published and effective.
• Governance teams may wish to assess the proposed removal of ongoing Statements of Responsibilities and Management Responsibilities Map submissions and determine what internal records will still be needed to demonstrate clear accountability.
• Firms with cryptoasset activities or planned authorisation may wish to consider the interaction between these proposals, the FCA's modification-by-consent approach for cryptoasset firms and the wider cryptoasset perimeter work.

What changed

The regulators propose removing pre-approval for a range of functions, including Chief Actuaries and Chairs of Risk and Audit Committees, with firms instead notifying the regulators and retaining responsibility for fitness and propriety. Chief Executive, Chief Financial Officer and Chair roles would generally remain subject to regulatory pre-approval, while regulators could require pre-approval for otherwise notified roles in high-risk cases.

Key dates

2026-10-22

PRA CP14/26 was published and the Phase 2 consultation opened.

2027-01-22 Deadline

Deadline for responses to the PRA consultation.

Suggested considerations

• Compliance teams may wish to map current SMFs against the proposed pre-approved and notified categories, with particular attention to Chief Actuary, Risk Committee Chair, Audit Committee Chair and SMF7 roles.
• Firms should consider how they would evidence fitness, propriety, competence and conduct decisions if formal Certification Regime assessments, certificates and regulatory references are removed.
• Governance functions may wish to assess the proposed reduction in Prescribed Responsibilities and the future frequency of Statements of Responsibilities and Management Responsibilities Maps, while preserving clear accountability records.
• Firms may wish to review succession and contingency arrangements against the proposed 18-week temporary SMF cover period and assess whether internal approval workflows can support faster interim appointments.
• Dual-regulated firms should compare PRA CP14/26 with FCA CP26/37 and identify differences in scope, timing, forms, conduct-breach notifications and transitional arrangements.
• PRA-authorised firms may wish to prepare a consultation response addressing the proposed implementation period before the 2027 final policy.
• Firms should continue operating existing SM&CR approval, certification, fitness and propriety, regulatory-reference and notification obligations unless and until final rules and applicable legislative changes take effect.
• Compliance teams may wish to monitor the passage and commencement of the Financial Services and Markets Bill 2026 because the principal Phase 2 reforms depend on those legislative steps.

What changed

The PRA proposes to introduce a notification approach for almost half of current Senior Management Functions, including Chief Actuaries and Chairs of Risk and Audit Committees, while retaining an anticipated power to require pre-approval for an otherwise notified role in exceptional cases. Group Entity Senior Manager Function SMF7 would be divided between pre-approved and notified roles.

Key dates

2024-04-01

Bank of America self-identified the inaccurate wire-transmittor information issue, according to the OCC enforcement order; the date is included as an approximate month-level historical reference represented by the first day of the month.

2024-10-01

Bank of America stopped the inaccurate transmittor-information practice in 2024; the OCC order does not provide an exact day, so this is an approximate month-level historical reference represented by the first day of the month.

2026-10-08

The OCC announced the American Express National Bank cease-and-desist order and $350 million civil money penalty.

2026-10-13

The OCC announced the Bank of America $750 million civil money penalty, described as the largest penalty in OCC history, in coordination with Treasury and FinCEN actions.

2026-10-22

The OCC published the October 2026 consolidated enforcement-actions release.

Suggested considerations

• Firms should consider reassessing whether their BSA/AML risk assessments cover the risks of all material products and services, rather than concentrating on narrower deposit activity while underweighting credit-card, charge-card, correspondent, or payment activity.
• Compliance teams may wish to test end-to-end transaction-monitoring workflows for alert generation, escalation, investigation, disposition, and SAR filing, including backlog governance, aging thresholds, management information, and evidence that suspected trade-based money laundering is escalated promptly.
• Firms should consider validating that customer identification, customer due diligence, beneficial-ownership information, and ongoing-risk-rating processes are complete, accurate, risk-based, and aligned to the institution's actual customer and product populations.
• Banks may wish to perform a targeted review of outgoing wire data to confirm that originator or transmittor names and other required fields are accurate, consistently populated, retained, and not overwritten by deficient interfaces or manual processes.
• Boards and senior management should consider documenting sufficient staffing, subject-matter expertise, training, independent testing, audit coverage, and issue-remediation ownership for BSA/AML programs.
• Institutions operating under prior supervisory findings should consider independent validation that corrective actions are complete, effective, sustainable, and supported by evidence, rather than merely implemented procedurally.
• Compliance teams should consider reviewing whether third-party, correspondent, and payment-processing arrangements create data-quality or monitoring dependencies that could delay SAR filing or impair law-enforcement traceability.

What changed

This publication announces enforcement outcomes rather than a new rule or generally applicable deadline. American Express National Bank is subject to a cease-and-desist order and a $350 million penalty for an inadequately designed and monitored BSA/AML program, inadequate resources and expertise, internal-control weaknesses, weak independent testing and training, systemic failures involving approximately $13 billion of suspected trade-based money-laundering activity, and customer identification and customer due diligence deficiencies.

Key dates

2019-05-30

The Central Bank’s ASP investigation into PTSB concluded; PTSB had admitted 42 regulatory breaches and received a €21 million fine and reprimand.

2023-12-01

The Central Bank published ASP Guidelines providing further detail on its inquiry process; the exact publication day is not specified in the source, so this date denotes December 2023 only.

2025-04-23

The Central Bank Inquiry Decision concerning PTSB and David Guinane was issued.

2026-10-22

IFSAT published its decision, upheld Mr Guinane’s appeal and overturned the Inquiry Decision; the Central Bank stated that it does not propose to appeal.

Suggested considerations

• Compliance teams may wish to record the IFSAT outcome in enforcement-risk assessments and monitor the High Court confirmation process.
• Banks and mortgage lenders may wish to review open or potential individual-enforcement matters involving historic conduct to confirm that the alleged contraventions, issues for determination, evidential basis and proposed sanctions have been clearly particularised and communicated.
• Firms may wish to preserve governance records showing how customer-impact risks, escalation decisions, approvals and follow-up controls were assessed, particularly for tracker mortgage, conduct and legacy remediation matters.
• Legal and compliance teams may wish to assess whether the reasoning reported in the decision has implications for ongoing Central Bank inquiries, including fair-notice, statutory-authority, procedural-fairness and reasons requirements.
• Firms may wish to distinguish this case from the separate PTSB entity enforcement outcome: PTSB admitted 42 regulatory breaches and received a €21 million fine and reprimand in 2019, which this publication does not overturn.
• Firms may wish to track the Central Bank’s external review of wider enforcement activities and any revisions to inquiry procedures, ASP guidance or Individual Accountability Framework implementation.

What changed

No new regulatory obligation or rule has been introduced for firms. The specific inquiry decision against Mr Guinane has been overturned, and the Central Bank does not propose to appeal the IFSAT findings. Independent reporting indicates that IFSAT found the inquiry process and reasoning legally defective, including failures to give fair notice of certain issues and to provide adequate reasons. The Central Bank will apply to the High Court for confirmation of the IFSAT decision under the Central Bank Act 1942.

Key dates

2026-10-21

CSSF published the communiqué warning about CVE-2026-109618 and CVE-2026-109619; PHP also released security updates addressing the vulnerabilities on this date.

Suggested considerations

• Firms should consider urgently inventorying internet-facing and internally accessible services that run PHP, including PHP embedded in outsourced, cloud-hosted and vendor-managed applications.
• Technology and security teams may wish to determine the installed PHP branch and apply the relevant fixed release, including PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 where applicable, after validating compatibility and deployment integrity.
• Where immediate patching is not feasible, firms should consider isolating or taking affected internet-facing services offline, placing them behind network-layer authentication or equivalent compensating controls, and restricting PHP execution to required functions.
• Security teams may wish to review web-server, PHP, application, endpoint and identity logs for exploitation indicators, unusual child processes, unexpected outbound connections, persistence and activity associated with unauthenticated requests.
• Firms should consider assessing whether any unauthorised remote code execution, suspected compromise or material service disruption meets the applicable major ICT-related incident criteria and documenting the classification decision.
• DORA entities should consider preparing the notification required under Circular CSSF 25/893 and the applicable DORA implementing rules if the incident is classified as major; the initial notification is generally due within four hours of classification and no later than 24 hours after awareness, followed by an intermediate report within 72 hours and a final report within one month.
• Entities subject to CSSF Circular 24/847 should consider following that circular's notification process for a major ICT-related incident and confirming whether any parallel obligations arise under applicable NIS or sectoral requirements.
• Compliance teams may wish to retain evidence of the affected-asset inventory, patch or mitigation decisions, threat monitoring, incident assessment and communications with relevant ICT third-party providers.

What changed

The publication does not introduce a new standalone rule or compliance deadline; it provides an urgent supervisory warning and links the risk to existing ICT incident-reporting obligations. Until the affected versions were officially confirmed, the CSSF's stated position was that all PHP-powered services should be treated as potentially exposed. Independent security analysis reported that PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with both vulnerabilities rated CVSS 4.0 at 9.2 and capable of execution under the web-worker account.

Key dates

2026-10-21

OCC publishes Bulletin 2026-52, revised PS-01 and PS-02 forms for public comment, and issues its GENIUS Act implementing final rule.

2027-01-18

The OCC final rule implementing the GENIUS Act and the GENIUS Act take effect, according to the OCC’s related final-rule materials.

2027-01-25 Deadline

First weekly PS-01 report date, subject to OMB approval of the information collection.

2027-03-31 Deadline

First quarterly PS-02 report date, subject to OMB approval of the information collection.

Suggested considerations

• Compliance teams at affected issuers should review the revised PS-01 and PS-02 workbooks and instructions and identify every required data element, reporting frequency, aggregation rule, and responsible control owner.
• Firms should consider submitting comments within 30 days after publication of the information-collection notice in the Federal Register, with particular attention to data availability, calculation methodology, confidentiality, reporting burden, and transition timing.
• Issuers should map daily issuance, redemption, reserve, ownership-concentration, and trading data to PS-01 and test whether systems can produce a complete weekly submission for the January 25, 2027 report date, subject to OMB approval.
• Issuers should assess whether finance and regulatory-reporting systems can produce PS-02 information on income, assets, liabilities, off-balance-sheet activities, and capital for the March 31, 2027 report date.
• Firms should establish governance for data certification, reconciliation to general-ledger and reserve records, exception management, senior review, and retention of supporting documentation for OCC examination.
• Issuers should assess the interaction between the reporting forms and the final rule’s reserve, redemption, risk-management, audit, capital, custody, and supervisory requirements, rather than treating the forms as an isolated reporting exercise.
• Foreign issuers should confirm their OCC registration status, reporting perimeter, U.S. activities, and allocation of information-production responsibilities between U.S. operations, parent entities, and service providers.

What changed

The OCC is reopening public comment on revised weekly Form PS-01 and quarterly Form PS-02 and their instructions. PS-01 requires daily data compiled and submitted weekly for each payment stablecoin, covering issuance, reserves, ownership concentration, and trading activity. PS-02 requires quarterly reporting on the issuer’s condition and income, including balance-sheet assets and liabilities, off-balance-sheet activities, income, and capital.

Key dates

2026-10-21

The OCC issued Bulletin 2026-51 and stated that applications and waiver requests will be accepted only after OMB approves the related information collection.

2027-01-18 Deadline

The GENIUS Act and OCC final rule become effective; the Prior Approval Requirement generally applies, and unauthorized issuance of a payment stablecoin in the United States may carry criminal penalties.

2028-01-18 Deadline

The maximum statutory period for a waiver beginning on January 18, 2027 expires, subject to the terms and shorter duration of any individual waiver.

Suggested considerations

• Firms should determine whether they are currently issuing a payment stablecoin in the United States and whether they fall within the OCC application pathway or another primary federal payment stablecoin regulator's pathway.
• Existing issuers should consider preparing and submitting a substantially complete OCC application as soon as the agency announces that applications are accepted, rather than relying on the waiver as a substitute for authorization.
• Applicants should map their submission against every prescribed application question and documentation requirement, including the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML, OFAC, third-party risk, enterprise risk, compliance risk, and audit functions.
• Compliance teams may wish to prepare a separate written waiver request addressing the Prior Approval Requirement, identifying any additional GENIUS Act or final-rule requirements that cannot be met by January 18, 2027, and explaining the requested duration and operational rationale.
• Issuers should monitor the OCC's GENIUS Act landing page and press releases for OMB approval and the opening of the application and waiver process, because the bulletin does not provide a fixed application-opening date.
• Firms should maintain evidence supporting the completeness and accuracy of their applications and establish a process to respond promptly to OCC requests for missing information within the 30-day review cycles.
• Prospective issuers that are not already operating in the United States should consider planning for operations to begin only after OCC approval, consistent with the agency's stated position on waiver eligibility.
• Regulatory change teams should continue tracking separate FinCEN, OFAC, OCC, and other agency rulemakings concerning AML, CFT, sanctions, and customer-identification requirements rather than assuming that an OCC application or Prior Approval Requirement waiver resolves those obligations.

What changed

Beginning January 18, 2027, a person generally must be approved as a permitted payment stablecoin issuer before issuing a payment stablecoin in the United States; unauthorized issuance may carry criminal penalties. Under GENIUS Act section 5(f) and 12 CFR 15.30(g), an issuer with a substantially complete OCC application pending on January 18, 2027 may request a written waiver of the Prior Approval Requirement and other statutory or final-rule requirements that it cannot satisfy by the effective date.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule and related application, waiver and reporting materials.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment stablecoin issuance generally requires permitted payment stablecoin issuer status, and a substantially complete application must be pending by this date to support eligibility for an OCC waiver request.

2027-01-25

Proposed first weekly OCC reporting date, subject to OMB approval of the information collection.

2027-03-31

Proposed first quarterly OCC reporting date, subject to OMB approval of the information collection.

Suggested considerations

• Firms seeking permitted payment stablecoin status should consider mapping their licensing strategy, corporate structure and applicable OCC pathway under 12 CFR part 15 before 2027-01-18.
• Existing U.S. issuers that need transitional relief should consider submitting a substantially complete OCC application on or before 2027-01-18 and preparing a written waiver request promptly after the OCC begins accepting applications and waiver requests.
• Applicants should consider documenting business plans, management, reserve assets, issuance and redemption processes, capital and liquidity, risk management, third-party and shared-services arrangements, audit functions and compliance governance in the application package.
• Issuers should consider validating reserve composition, one-to-one backing, liquidity, concentration, counterparty exposure, stress-testing and redemption controls against the final rule rather than relying on the proposal's reserve assumptions.
• Issuers should consider testing operational capacity to process redemptions within two business days and to notify the OCC within 24 hours when the 10% redemption-demand trigger is reached.
• Issuers and distribution partners should consider reviewing stablecoin rewards, yield, rebate and promotional arrangements on a transaction-by-transaction basis because pre-existing programs are not automatically grandfathered and the final rule provides no general safe harbor.
• Covered firms should consider establishing governance for audits, reporting, examination responses, custody controls, foreign-issuer oversight and potential approval revocation or rescission.
• Compliance teams should track the separate Treasury-coordinated BSA, AML and OFAC rulemaking and avoid treating this final rule as the complete GENIUS Act compliance framework.

What changed

The final rule applies to national banks and their subsidiaries, federal savings associations and their subsidiaries, federal branches and their subsidiaries, federal qualified payment stablecoin issuers, foreign payment stablecoin issuers, and state qualified payment stablecoin issuers over which the OCC has regulatory or enforcement authority.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule, application and waiver guidance, and revised proposed reporting forms.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment-stablecoin issuance generally requires permitted payment stablecoin issuer approval, and existing issuers seeking a waiver generally must have a pending substantially complete OCC application by this date.

2027-01-25 Deadline

Proposed effective report date for the weekly reporting form, subject to Office of Management and Budget approval.

2027-03-31 Deadline

Proposed effective report date for the quarterly reporting form, subject to Office of Management and Budget approval.

Suggested considerations

• Firms considering U.S. payment-stablecoin issuance should assess whether they qualify as a permitted payment stablecoin issuer, a federal qualified issuer, a state-qualified issuer subject to OCC authority, or a foreign issuer within the rule's scope.
• Existing U.S. issuers should consider preparing a substantially complete OCC application and evaluating whether a waiver request is needed by January 18, 2027; the OCC may grant waivers for up to 12 months beginning on that date, generally where an eligible application is pending.
• Applicants should prepare documentation covering the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML/OFAC controls, third-party risk, enterprise risk, compliance risk, and audit functions.
• Issuers should map reserve assets to the final rule's 1:1 backing, daily-liquidity, diversification, and counterparty-concentration requirements and establish controls capable of supporting generally timely redemption within two business days.
• Compliance and product teams should inventory interest, yield, cashback, loyalty, referral, and exchange rewards arrangements involving payment stablecoins and document the business purpose and consideration supporting each payment, because the OCC has not provided a categorical safe harbor and will apply the statutory prohibition case by case.
• Issuers should design weekly reserve and payment-stablecoin activity reporting and quarterly reports of condition and income, subject to confirming the final OMB-approved forms and effective reporting dates.
• Banks and other OCC-supervised custodians should review custody arrangements, segregation and control frameworks, third-party dependencies, and contractual allocation of responsibility for stablecoin and reserve-asset custody.
• Firms should track the separate Treasury, FinCEN, OFAC, Federal Reserve, and FDIC implementation work because the OCC final rule does not complete BSA, AML, or sanctions requirements and is only one component of the GENIUS Act framework.

What changed

New 12 CFR part 15 establishes requirements for permitted payment stablecoin issuers, foreign payment stablecoin issuers subject to OCC authority, certain state-qualified issuers, and specified custody activities conducted by OCC-supervised entities. The framework covers issuer activities, reserve assets, redemption, risk management, audits, reports, examinations, supervision, custody, applications and registrations, state-to-federal transitions, foreign-issuer supervision, approval revocation or rescission, and capital and operational backstops.

Key dates

2026-10-20

ESMA published its final report on the RTS specifying requirements for PTRR services using the EMIR 3 clearing-obligation exemption.

Suggested considerations

• PTRR providers should compare their existing compression, rebalancing and basis-risk-optimisation procedures with the final ESMA requirements, particularly participant disclosures, algorithm governance, execution controls, record retention and monitoring support.
• Firms should identify OTC derivative transactions processed through PTRR services that are currently expected to rely on the EMIR 3 conditional clearing exemption and document the legal and operational basis for that treatment.
• Compliance and legal teams may wish to review contracts, client disclosures and service descriptions to ensure that participants receive adequate information about the exercise, its methodology, expected outcomes and relevant risks.
• Providers should consider preserving evidence that each exercise meets the applicable risk-reduction and market-risk-neutrality conditions and does not function as a means of avoiding the clearing obligation.
• Firms should prepare for possible changes when the European Commission endorses the RTS, including tracking the endorsement, publication and application dates and updating policies, controls, reporting procedures and staff guidance accordingly.
• Operations and records-management teams should assess whether existing books and records can identify the participants, transactions, algorithms, controls, results and decisions associated with each PTRR exercise for the required supervisory period.
• Users of third-party PTRR services should consider obtaining contractual assurances and sufficient information from providers to demonstrate that transactions claimed as exempt satisfy the final RTS conditions.
• Industry participants may wish to monitor Commission endorsement and any transitional provisions rather than treating the 20 October 2026 publication date as the effective date of the RTS.

What changed

The final report specifies the conditions under which transactions resulting from PTRR services may qualify for the EMIR 3 clearing-obligation exemption, including requirements concerning participant information, the conduct and execution of PTRR exercises, provider controls, record-keeping and supervisory monitoring. The framework addresses the main service types identified in ESMA's consultation: portfolio compression, portfolio rebalancing and basis risk optimisation, with requirements intended to demonstrate risk reduction and prevent circumvention of the clearing obligation.