Insurance & Pensions

Key dates

2026-11-03

DP26/2 opened and was first published by the FCA jointly with the DWP and TPR.

2026-12-22 Deadline

Deadline for responses to the Guided Retirement policy consultation.

Suggested considerations

• Firms should consider submitting responses to the DWP Guided Retirement Policy Team by 22 December 2026, including evidence on feasibility, consumer outcomes, product design, costs, data and operational dependencies.
• Contract-based providers should assess how potential Guided Retirement requirements could interact with their existing COBS 9B targeted-support processes, governance, suitability or appropriateness controls, customer communications and record keeping.
• Providers, trustees and administrators should map current retirement journeys and identify gaps in member data, administration systems, payment capabilities, transfer processes, decumulation products and management information.
• Scheme operators should consider which default retirement-income models could meet the emerging policy objectives, including approaches involving staged or flexible access and protection against longevity risk, while avoiding premature conclusions before the FCA rules and DWP regulations are consulted on.
• Governance teams should establish ownership for Guided Retirement readiness and monitor the FCA, DWP and TPR consultations expected to follow, including the FCA consultation on draft rules and guidance planned for the second half of 2027.
• Firms should assess interactions with other workplace-pension reforms, particularly value-for-money requirements, consumer-support arrangements, conflicts management and member communications, because independent commentary has identified a risk of overlapping or inconsistent standards.

What changed

The Discussion Paper sets out initial joint proposals for implementing Guided Retirement, under which workplace pension schemes would provide a clear, high-quality default route into retirement for eligible savers who do not make complex active choices. The framework is intended to apply across both FCA-regulated contract-based schemes and trust-based schemes, with the FCA required to introduce rules that achieve, so far as possible, the same outcomes as the duties imposed on trustees by the Pension Schemes Act 2026.

Key dates

2026-10-07

PRA published CP13/26 proposing automatic indexation of in-scope regulatory thresholds every five years, with a proposed first update on 1 July 2031.

2026-10-14

PRA published PS19/26 setting out the final policy on high loan-to-income lending.

2026-10-22

PRA published CP14/26 consultation on phase 2 of SM&CR reform.

2026-10-26

Bank of England and FCA published the 2026 survey results on artificial intelligence and machine learning in UK financial services.

2026-10-28

PRA rules and supervisory statement on high-LTI lending commenced; the firm-specific 15% cap was removed and the revised monitoring and governance framework became effective.

2027-01-22 Deadline

Consultation deadline reported for the PRA and FCA phase 2 SM&CR consultations.

2027-02-07 Deadline

Consultation deadline for CP13/26 and the associated discussion of additional thresholds potentially suitable for indexation.

2031-07-01

Proposed date for the first automatic update of in-scope regulatory thresholds under CP13/26, subject to final policy and implementation.

Suggested considerations

• Mortgage lenders should assess their high-LTI lending strategy against risk appetite, capital and credit-risk tolerances now that the firm-specific 15% cap has been removed.
• Mortgage lenders should establish or validate rolling four-quarter calculations for individual high-LTI flows and retain evidence supporting any adjustments, limits or risk appetite decisions.
• Relevant firms should review governance, underwriting, affordability, concentration and stress-testing controls to demonstrate prudent management of high-LTI lending under the new PRA expectations.
• Compliance and regulatory-reporting teams should monitor the PRA’s quarterly aggregate high-LTI publications and assess whether lending plans remain consistent with the FPC’s aggregate 15% limit.
• PRA-regulated firms should map current Rulebook and supervisory-statement thresholds against the 128 proposed in-scope thresholds and identify systems, permissions, reporting and policy documents that would require future updates.
• Affected firms should consider submitting responses to CP13/26 and its associated discussion questions by 7 February 2027, particularly where indexation could alter regulatory categorisation, reporting, capital, liquidity, governance or investment-flexibility requirements.
• SM&CR compliance teams should assess CP14/26 against current senior-manager responsibilities, certification processes, fitness and propriety controls, governance maps, handover arrangements and recordkeeping, while treating the proposals as non-final.
• Firms should monitor the related FCA SM&CR consultation and coordinate any response because implementation may require changes across PRA and FCA regimes.

What changed

PS19/26 removes the firm-specific 15% limit on high-LTI mortgage lending, while retaining the Financial Policy Committee’s aggregate 15% limit as the benchmark for overall market lending. Firms’ individual high-LTI flows and any required adjustments will be assessed on a rolling four-quarter basis, whereas aggregate high-LTI lending will continue to be monitored quarterly. The final rules and supervisory statement also introduce governance and risk-management expectations, and the PRA intends to publish aggregate high-LTI flow data quarterly.

Key dates

2026-11-02

MAS announced the grant scheme, commenced Consultation Paper P018-2026, and the Infrastructure Capability Development Grant took effect.

2026-12-18 Deadline

Deadline for comments on MAS Consultation Paper P018-2026 concerning capital treatment for securitisation and infrastructure investments under RBC 2.

2026-03-31

Earlier RBC 2 revisions concerning differentiated capital treatment for qualifying infrastructure investments took effect; this is relevant background to the current consultation.

Suggested considerations

• Compliance and regulatory affairs teams should review Consultation Paper P018-2026 and consider submitting comments to MAS by 18 December 2026.
• Insurers should distinguish the currently effective RBC 2 requirements from the proposed capital treatments and avoid applying the proposed lower charges before the relevant amendments take effect.
• Investment, risk and actuarial teams should inventory infrastructure debt, infrastructure equity and securitisation exposures and assess which assets could potentially satisfy the proposed credit-quality, contractual-revenue, demand-risk, counterparty, securitisation, diversification and liquidity criteria.
• Firms should review their investment due-diligence, valuation, credit-assessment and documentation processes so that qualifying characteristics can be evidenced and maintained throughout the investment lifecycle.
• Insurers considering the grant should contact MAS to obtain the Infrastructure Capability Development Grant terms, eligibility requirements, application process, eligible-cost rules and reporting conditions.
• Firms should monitor MAS updates on standardised disclosure templates, assessment guidance and fund-manager declarations and assess whether investment mandates and manager reporting can support those formats.
• Insurers should monitor MAS recognition of additional external credit assessment institutions and review whether expanded recognised-rating coverage could affect sourcing, eligibility or capital calculations.
• Governance committees should consider whether proposed infrastructure allocations remain consistent with policyholder protection, asset-liability management, concentration limits, liquidity needs and existing investment-risk policies.

What changed

The Infrastructure Capability Development Grant takes effect on 2 November 2026 and will be funded through the Financial Sector Development Fund. It may support dedicated investment teams, staff capability development, and professional services used to establish or expand infrastructure investment activities in Singapore; insurers must approach MAS for scheme details and eligibility conditions. MAS is consulting on further amendments to the insurance capital framework under RBC 2.

Key dates

2026-11-02

MAS published Circular ID 12/26 and opened consultation P018-2026 on capital treatment for securitisation and infrastructure investments under RBC 2.

2026-11-02

The S$30 million Infrastructure Capability Development Grant for Insurers took effect, subject to MAS grant arrangements.

2026-12-18 Deadline

Deadline for submitting comments on consultation P018-2026.

2026-03-31

Earlier finalised RBC 2 revisions to the capital treatment of securitisation and infrastructure investments took effect; the current consultation proposes further refinements to that framework.

Suggested considerations

• Compliance and capital teams should review the consultation paper and consider submitting comments to MAS by 18 December 2026, particularly on eligibility tests, evidence requirements, capital calibrations and implementation timing.
• Firms should map current and planned infrastructure debt, infrastructure equity, infrastructure-fund and securitisation exposures against the proposed qualifying criteria, distinguishing assets that could benefit from lower charges from assets that would remain subject to existing treatment.
• Investment, risk and finance functions should assess whether existing due diligence, valuation, credit assessment, look-through analysis and documentation can evidence contractual revenues, demand-risk limitations, counterparty strength, tranche seniority, investment grade status, diversification, liquidity and simplicity, transparency and comparability.
• Firms should monitor amendments to MAS Notice 133 and Notice FHC-N133 and avoid reflecting proposed capital relief in regulatory capital planning, pricing or investment limits until the proposals are finalised and effective.
• Insurers may wish to assess whether they qualify for or could benefit from the Infrastructure Capability Development Grant and identify capability gaps in origination, underwriting, infrastructure valuation, credit analysis and ongoing monitoring.
• Governance teams should establish a process for monitoring the additional external credit assessment institutions, standardised disclosure templates, fund-manager declarations and assessment guidance that MAS may introduce.
• Groups with infrastructure investments held through funds or structured products should confirm whether the final treatment will permit look-through and should not assume that infrastructure-backed structured products qualify for infrastructure treatment rather than structured-product treatment.

What changed

This is a consultation and does not itself amend Notice 133 or impose new binding capital requirements. MAS is proposing lower capital charges for rated infrastructure debt that satisfies specified credit-quality and other qualifying criteria; for qualifying infrastructure equity and debt investments with risk mitigants such as long-term contractual or regulated revenues, limited demand-risk exposure and strong counterparties; and for senior investment-grade securitisation tranches meeting relevant simplicity, transparency and comparability criteria or specified diversification and liquidity...

Key dates

2019-08-01

Start of the period in which ASIC alleges more than $600 million was invested in First Guardian and the alleged failures occurred.

2024-05-01

Falcon Capital froze or suspended redemptions from First Guardian, subject to limited exceptions.

2025-02-24

The Federal Court made interim orders freezing the assets of Falcon Capital, First Guardian and David Anderson.

2025-04-09

The Federal Court ordered Falcon Capital and First Guardian to be wound up and appointed liquidators and a receiver in related orders.

2026-10-30

ASIC announced commencement of civil penalty proceedings against David Anderson and Simon Selimaj and its application for leave to proceed against Falcon Capital in liquidation.

Suggested considerations

• Compliance teams may wish to inventory all related-party, connected-party and director-linked investments across managed investment schemes, including indirect exposures through controlled underlying funds.
• Firms should consider testing whether each private-credit, property and private-equity investment has current executed documentation, enforceable security, independent valuation support, documented approval, appropriate concentration analysis and evidence of ongoing monitoring.
• Responsible entities and trustees may wish to reassess whether investment committees exercise meaningful independent oversight, particularly where a chief executive, director or investment officer can originate, approve or vary investments without effective challenge.
• Firms should consider refreshing conflicts registers and reviewing whether conflicts were identified, disclosed, avoided or managed before investor funds were committed, including conflicts involving hospitality, alcohol-related businesses, technology ventures, property developments and payments to entities controlled by officers or associates.
• Product issuers may wish to review product disclosure statements and other investor communications for unsupported claims about robustness, diversification, security, liquidity, risk controls or investment processes, and assess whether any corrective disclosure or remediation is required.
• Platform operators, trustees and advice licensees may wish to review onboarding and due-diligence files for complex private-market products, including verification of valuations, underlying-fund registration status, custody arrangements, liquidity assumptions and the identity of related parties.
• Advice licensees may wish to test whether recommendations to transfer superannuation or establish an SMSF and invest in high-risk managed schemes were supported by documented best-interests analysis, appropriate disclosure and suitability assessments.
• Senior managers and boards may wish to preserve records demonstrating challenge, escalation, monitoring and follow-up of exceptions, red flags, valuation concerns, redemption restrictions and unusual related-party payments.

What changed

This is an enforcement action rather than a new rule or generally applicable legislative amendment. ASIC alleges that Falcon Capital, as responsible entity of the First Guardian Master Fund, failed to maintain effective investment governance, due diligence, documentation, security, conflict management and oversight; misled investors through product disclosure statements describing robust investment processes; and allowed at least $57 million to be paid to entities controlled by Anderson or Selimaj.

Key dates

2017-09-01

Start of the period identified by ASIC for the alleged directors’ and officers’ duty breaches concerning the Crown insurance arrangements; the date is approximate because ASIC states only September 2017.

2018-11-30

End of the period identified by ASIC for the alleged directors’ and officers’ duty breaches; ASIC states November 2018.

2022-03-01

ACBF entities entered liquidation; ASIC states March 2022, without specifying the exact day.

2026-02-01

The contested liability hearing concerning Jones took place in February 2026; ASIC has not specified the exact day.

2026-06-30 Deadline

Closing date for applications to the Government’s Youpla Support Program.

2026-10-30

ASIC announced the findings against Jones and Pattenden and the orders agreed with Pattenden.

2026-12-01

Payments under the Youpla Support Program are scheduled to continue being processed until this date.

Suggested considerations

• Firms should consider reviewing board and committee processes for identifying, disclosing and managing actual or potential conflicts involving directors, officers and related parties.
• Compliance teams may wish to test whether related-party insurance, reinsurance, outsourcing and service arrangements are demonstrably in the company’s interests, supported by independent analysis and properly documented board decisions.
• Boards may wish to review whether premium changes, counterparty concentration, offshore structures and insurer solvency risks are escalated promptly and communicated appropriately to affected customers.
• Insurers and other firms serving vulnerable or First Nations consumers should consider whether product governance, distribution controls and customer communications adequately address cultural, language, literacy and affordability risks.
• Companies should consider retaining evidence showing that directors challenged management assumptions, considered viable alternatives and monitored the ongoing financial and consumer consequences of material arrangements.
• Legal and compliance teams may wish to monitor the later penalty hearing for Jones and the reserved decisions concerning Jonathan Law, Michael Wilson and Geoffrey Clayton, as those outcomes may provide further indications of ASIC’s approach to individual accountability and director disqualification.
• Firms should distinguish this case from a new industry-wide rule: the immediate orders apply to Pattenden, while the broader compliance significance is the enforcement precedent and ASIC’s stated priority of protecting vulnerable consumers.

What changed

This is an enforcement outcome rather than a new rule or general compliance obligation. Pattenden is subject to a $250,000 civil penalty and a 15-year prohibition on managing corporations; Jones has been found liable, with penalties to be determined at a later hearing. ASIC’s case concerns alleged breaches of sections 180, 181 and 182 of the Corporations Act 2001 arising from insurance arrangements with Vanuatu-based Crown Insurance Services Limited, which ASIC alleged was beneficially owned and controlled by Pattenden and Jonathan Law and was not in the interests of the ACBF entities.

Key dates

2026-10-22

The FCA and PRA published parallel Phase 2 SM&CR consultations.

2027-01-22 Deadline

Deadline for responses to the FCA and PRA SM&CR Phase 2 consultations.

Suggested considerations

• Compliance teams may wish to review the FCA consultation CP26/37 and PRA consultation CP14/26 and consider submitting responses by 22 January 2027.
• Firms should continue operating existing SM&CR approval, certification, Directory, Conduct Rule and responsibility-mapping processes unless and until final rules and any required legislation take effect.
• Firms may wish to map current Senior Management Functions and identify Chief Actuary, Risk Committee Chair and Audit Committee Chair roles that could move from pre-approval to notification, while retaining evidence of fitness, propriety, competence and suitability assessments.
• Compliance teams should identify employees who could fall outside the proposed Certification Regime and assess how internal competence, performance, disciplinary and conduct controls would operate without annual regulatory certification.
• Firms may wish to model the effect of the proposed Enhanced-regime threshold increases on their classification, governance documentation, prescribed responsibilities and approval processes.
• Firms should review Conduct Rule breach-reporting workflows and training curricula, but should not apply a higher reporting threshold or reduced training scope until the relevant final rules are published and effective.
• Governance teams may wish to assess the proposed removal of ongoing Statements of Responsibilities and Management Responsibilities Map submissions and determine what internal records will still be needed to demonstrate clear accountability.
• Firms with cryptoasset activities or planned authorisation may wish to consider the interaction between these proposals, the FCA's modification-by-consent approach for cryptoasset firms and the wider cryptoasset perimeter work.

What changed

The regulators propose removing pre-approval for a range of functions, including Chief Actuaries and Chairs of Risk and Audit Committees, with firms instead notifying the regulators and retaining responsibility for fitness and propriety. Chief Executive, Chief Financial Officer and Chair roles would generally remain subject to regulatory pre-approval, while regulators could require pre-approval for otherwise notified roles in high-risk cases.

Key dates

2026-10-22

PRA CP14/26 was published and the Phase 2 consultation opened.

2027-01-22 Deadline

Deadline for responses to the PRA consultation.

Suggested considerations

• Compliance teams may wish to map current SMFs against the proposed pre-approved and notified categories, with particular attention to Chief Actuary, Risk Committee Chair, Audit Committee Chair and SMF7 roles.
• Firms should consider how they would evidence fitness, propriety, competence and conduct decisions if formal Certification Regime assessments, certificates and regulatory references are removed.
• Governance functions may wish to assess the proposed reduction in Prescribed Responsibilities and the future frequency of Statements of Responsibilities and Management Responsibilities Maps, while preserving clear accountability records.
• Firms may wish to review succession and contingency arrangements against the proposed 18-week temporary SMF cover period and assess whether internal approval workflows can support faster interim appointments.
• Dual-regulated firms should compare PRA CP14/26 with FCA CP26/37 and identify differences in scope, timing, forms, conduct-breach notifications and transitional arrangements.
• PRA-authorised firms may wish to prepare a consultation response addressing the proposed implementation period before the 2027 final policy.
• Firms should continue operating existing SM&CR approval, certification, fitness and propriety, regulatory-reference and notification obligations unless and until final rules and applicable legislative changes take effect.
• Compliance teams may wish to monitor the passage and commencement of the Financial Services and Markets Bill 2026 because the principal Phase 2 reforms depend on those legislative steps.

What changed

The PRA proposes to introduce a notification approach for almost half of current Senior Management Functions, including Chief Actuaries and Chairs of Risk and Audit Committees, while retaining an anticipated power to require pre-approval for an otherwise notified role in exceptional cases. Group Entity Senior Manager Function SMF7 would be divided between pre-approved and notified roles.

Key dates

2021-05-01

Shield Master Fund commenced operation; ASIC found that some SOAs nevertheless suggested Shield had generated returns or outperformed alternatives since 2016.

2023-09-18

Singh became authorised by MWL Financial Services.

2024-02-01

ASIC halted new offers of Shield investments through interim stop orders on four product disclosure statements.

2024-06-01

ASIC took action to secure assets held within Shield for the potential benefit of investors.

2024-12-23

Singh ceased being authorised by MWL.

2025-01-13

Singh became an authorised representative of Interprac Financial Planning.

2025-08-25

ASIC cancelled MWL’s Australian financial services licence and banned MWL director Nicholas Maikousis.

2025-11-21

Cor Cordis liquidators were appointed to MWL.

Suggested considerations

• Compliance teams may wish to review advice files involving rollovers or switches of superannuation into high-risk, illiquid or newly established products, including whether the advice demonstrated the client’s objectives, financial situation, needs, risk tolerance, diversification and capacity to bear loss.
• Firms should consider testing Statements of Advice for unsupported historical-performance claims, back-cast comparisons, projections, graphs and descriptions that could imply a product existed or achieved returns before its actual commencement date.
• Licensees may wish to reassess approved-product-list governance, including independent product due diligence, evidence of product track record, liquidity and valuation risk, investment-class risk ratings, concentration limits and escalation where a product is proposed for a substantial proportion of retirement savings.
• Compliance teams should consider targeted surveillance of advice involving large superannuation rollovers, replacement products, high-growth allocations and advisers or referral channels associated with MWL, Shield or similar schemes.
• Firms should review conflicts and remuneration controls, including referral arrangements, lead-generator relationships, bonuses, volume incentives and disclosures in Financial Services Guides and Statements of Advice.
• Licensees may wish to verify adviser status on ASIC’s Banned and Disqualified Register and ensure that a banned person cannot provide financial services, control a financial services business or perform functions involved in carrying on such a business during the prohibition period.
• Affected consumers and firms handling complaints should consider preserving advice records, product research, call recordings, referral documentation and transaction evidence, and directing eligible consumer complaints to AFCA while recognising that MWL remains an AFCA member.
• Superannuation trustees and product issuers may wish to assess whether comparable products, distribution models or adviser incentives create risks of misleading disclosure, unsuitable concentration or advice that is not in members’ best interests.

What changed

This is a final administrative banning decision against an individual rather than a new generally applicable rule. Singh is prohibited from providing financial services for four years and the banning order has been recorded on ASIC’s Banned and Disqualified Register. ASIC found conduct inconsistent with the best-interests duty, the appropriateness obligation and prohibitions on false or materially misleading representations: approximately 75% of certain clients’ rolled-over superannuation was recommended for investment in Shield’s Growth or High Growth Class despite the product being high...

Key dates

2026-06-10

The FSB published the consultation report proposing 12 sound practices for responsible AI adoption.

2026-07-22

The FSB consultation closed; approximately 160 responses were received.

2026-10-15

The FSB published the overview of consultation responses and the final report containing the 12 sound practices.

Suggested considerations

• Firms should consider mapping existing AI inventories, model-risk controls, operational-resilience arrangements, cyber controls, outsourcing registers, and board reporting against all 12 FSB practices.
• Compliance teams may wish to introduce or validate a documented, risk-based materiality assessment for each AI use case at inception and throughout its lifecycle, including uses embedded in products or obtained from vendors.
• Boards and senior management should consider whether AI adoption is aligned with business strategy, risk appetite, accountability structures, and existing risk-management frameworks.
• Firms using generative or agentic AI should consider defining permitted actions, autonomy limits, escalation paths, human-approval triggers, monitoring thresholds, and tested stop or safe-interruption procedures.
• Firms should consider retaining records sufficient to identify the AI system, data, model or vendor, intended purpose, materiality assessment, testing, approvals, monitoring results, changes, incidents, and reconstructed decisions or actions.
• Procurement and third-party-risk teams may wish to assess AI providers for performance, transparency, data quality, supply-chain exposure, concentration risk, exit options, resilience, and business-continuity arrangements.
• Technology and operational-resilience teams should consider adding AI-specific cyber and ICT scenarios to testing and exercises, including model manipulation, data poisoning, prompt or agent compromise, erroneous autonomous actions, provider outage, and loss of vendor access.
• Firms should consider reviewing the interaction between the FSB practices and binding local requirements, including the EU Digital Operational Resilience Act, EU AI Act, sectoral outsourcing rules, model-risk requirements, data-protection law, and senior-management accountability regimes.

What changed

The final framework retains 12 practices covering board and senior-management oversight, governance and accountability, AI risk integration and documentation, organisational adaptability, materiality assessment, model selection, data governance, explainability and transparency, performance management, human oversight, cyber and ICT risk, and third-party AI risk.

Key dates

2026-10-15

FSB published the final report on Sound Practices for Responsible Adoption of Artificial Intelligence.

Suggested considerations

• Firms should consider inventorying all material AI use cases, including internally developed tools, vendor-provided models, embedded productivity tools, generative AI and agentic or multi-agent systems, with ownership, purpose, data sources, model dependencies and deployment status recorded.
• Compliance teams may wish to map each use case to a documented materiality and risk classification performed at inception and refreshed after material model, data, vendor, scope or operating-environment changes.
• Boards and senior management should consider whether AI governance, risk appetite statements, delegated authorities and management information clearly cover autonomous actions, prohibited uses, escalation thresholds and accountability for AI-supported decisions.
• Firms should consider integrating AI-specific controls into existing model risk management, operational-risk, ICT-risk, cybersecurity, outsourcing and business-continuity frameworks rather than creating disconnected governance.
• Model and technology teams may wish to maintain evidence of data provenance, data quality, testing, validation, performance metrics, drift monitoring, incident handling, explainability assessments and compensating controls where explainability is limited.
• For higher-risk or autonomous use cases, firms should consider mandatory human approval triggers, bounded permissions, segregation of duties, real-time or near-real-time monitoring, complete audit trails, emergency stop or rollback capability and periodic reassessment of whether human oversight remains effective.
• Procurement and third-party-risk functions should consider enhancing due diligence and contracts for AI providers to address model performance, transparency, training and input data, subcontracting, security, audit access, incident notification, portability, exit planning, concentration risk and service continuity.
• Cybersecurity teams should consider adding AI-enabled attacks, prompt injection, data poisoning, model manipulation, deepfakes, automated exploitation and misuse of AI-assisted coding or defensive tools to threat assessments, testing and exercises.

What changed

The FSB replaced its June 2026 consultation with a final framework of 12 proportionate sound practices. The practices require firms to align AI adoption with business strategy and risk appetite; define accountability; incorporate AI risks into enterprise risk management; document AI use and materiality assessments; select models according to business, technical and risk requirements; govern data quality and security; address explainability and stakeholder transparency; test and monitor performance; apply human oversight proportionate to autonomy, complexity, risk and explainability; manage...

Key dates

2026-10-15

OSFI published its statement endorsing the FSB Sound Practices for Responsible Adoption of Artificial Intelligence; the FSB also published the final Sound Practices on this date.

Suggested considerations

• Compliance teams may wish to map the 12 FSB practices against existing controls under OSFI’s Corporate Governance Guideline, Integrity and Security Guideline, Guideline B-10, Guideline B-13, Guideline E-21 and Guideline E-23.
• Firms should consider maintaining an enterprise-wide inventory of AI use cases, including internally developed systems, embedded vendor functionality and generative or agentic AI, with documented owners, intended purposes, materiality assessments and lifecycle status.
• Boards and senior management may wish to review whether the institution’s business strategy, risk appetite and governance framework clearly address AI adoption, accountability, escalation and human oversight.
• Firms should consider assessing AI use cases for operational, technology, cyber, third-party, model, data, privacy, conduct and governance risks, with controls proportionate to the materiality and risk of each use case.
• Compliance and risk functions may wish to review AI development and deployment documentation, validation, monitoring, change management, testing, incident escalation, explainability and retirement processes, including for systems supplied by third parties.
• Institutions should consider evaluating whether existing B-10 outsourcing and third-party risk controls address vendor model changes, data access, subcontracting, concentration risk, resilience, audit rights and exit arrangements for AI-enabled services.
• Internal audit or an equivalent independent assurance function may wish to assess whether AI governance and lifecycle controls operate effectively and whether management reporting to the board is sufficiently complete.
• Firms may wish to monitor subsequent OSFI technology risk bulletins, supervisory communications and future revisions to the FSB practices, since OSFI stated that it will continue monitoring how AI changes the risk environment and institutional operations.

What changed

OSFI formally endorsed the FSB Sound Practices and identified them as complementary to existing OSFI expectations. The FSB practices cover organization-wide AI governance and management across the AI lifecycle, including strategic direction, accountability, risk management, human oversight, data governance, controls, adaptability and coordination. The publication is non-binding guidance rather than a new OSFI rule, capital requirement, reporting obligation or prescribed compliance deadline.

Key dates

2026-10-13

Instruction DOC-2026-05 was published; it applies to the specified OPCIs and evergreen FCPRs, and the two-year transition period begins for funds established before this date.

2028-10-13 Deadline

End of the two-year transition period for OPCIs and evergreen FCPRs established before 2026-10-13. Management companies should have notified the AMF of compliance through ROSA and filed the prospectus or rules and required stress tests by this date.

Suggested considerations

• Firms should identify every OPCI and evergreen FCPR in scope and map its redemption frequency, notice period, current liquid-asset holdings and applicable minimum cushion under Instruction DOC-2026-05.
• Management companies should calculate whether each fund satisfies the applicable permanent cushion and assess whether the potentially reduced regime for funds marketed exclusively through eligible insurance or savings products is available and properly evidenced.
• Compliance teams may wish to update prospectuses, evergreen FCPR rules and related investor disclosures to state the minimum liquid-asset cushion using the applicable Annex VII format.
• Firms should produce or refresh liquidity stress tests using all scenarios specified in DOC-2026-05, including evidence that redemption requests can be met, and establish governance for periodic review and escalation of shortfalls.
• Management companies should review whether any proposed change to redemption frequency or notice period would alter the required cushion and, if so, plan for prior AMF approval, specific investor notification and the applicable fee-free redemption right.
• For funds existing on 2026-10-13, firms should plan the ROSA filing of the amended prospectus or rules and compliant stress tests before the end of the two-year transition period.
• Product, distribution and insurance teams should verify that marketing materials and product documentation do not imply liquidity inconsistent with the fund’s redemption terms, liquid-asset cushion or stress-test assumptions.
• Firms should monitor the forthcoming French transposition of Directive (EU) 2024/927 and assess whether subsequent statutory liquidity-management-tool requirements impose additional controls beyond DOC-2026-05.

What changed

The former authorisation approach, under which management companies generally demonstrated liquid assets equal to 30% to 40% of net assets and submitted stress tests, is replaced or formalised through a permanent liquidity cushion calibrated to the fund’s redemption frequency or redemption notice period. The AMF gives a monthly-redemption fund as an example requiring at least 25% of net assets in liquid assets.

Key dates

2021-10-31

The insured family lodged the storm-related home insurance claim after roof damage in October 2021.

2022-08-01

A structural engineering assessment occurred approximately eight months after the need for one was identified; the source gives August 2022 but not an exact day.

2022-12-01

After the family complained to Hollard in late 2022, Hollard offered a $1,000 goodwill payment, which was rejected; the source gives only the month and year.

2023-04-01

Hollard made its final claim decision and rejected the claim approximately 15 months after initially accepting it; the source gives April 2023 but not an exact day.

2025-04-01

ASIC commenced Federal Court proceedings alleging breaches of section 13(2A) of the Insurance Contracts Act 1984 (Cth); the source gives April 2025 but not an exact day.

2026-10-09

The Federal Court ordered Hollard to pay a $2 million civil penalty for breach of the duty of utmost good faith.

Suggested considerations

• Compliance teams may wish to review open and recently closed home and property claims for extended periods of inactivity, delayed expert assessments, repeated reassignment, late temporary accommodation and decisions inconsistent with available expert evidence.
• Insurers should consider testing whether claims systems identify deterioration risks, vulnerable customers, habitability issues and requests for emergency accommodation, and whether those matters trigger timely management escalation.
• Firms should consider documenting clear ownership, next actions, decision dates and customer communications throughout the claim, including reasons for any investigation or decision delay.
• Insurers may wish to assess whether rejection decisions are supported by appropriate technical evidence and whether new evidence is properly reconciled with earlier inspections or admissions of cover.
• Claims governance functions should consider reviewing outsourced-provider service levels, escalation controls and management information for aging claims, complaint recurrence, temporary accommodation delays and claims exceeding internal handling targets.
• Legal and compliance teams may wish to map controls against Insurance Contracts Act 1984 (Cth), section 13(2A), and Corporations Act 2001 (Cth), section 912A(1)(a), while considering ASIC's 2024 claims-handling letter, 2025 review findings and 2026 enforcement priority.

What changed

The judgment establishes a binding enforcement precedent that an insurer may incur a civil penalty under section 13(2A) of the Insurance Contracts Act 1984 (Cth) where claims handling falls materially below the duty of utmost good faith. It does not introduce a new statutory claims-handling rule or compliance deadline, but confirms that insurers must handle claims fairly, communicate clearly, progress investigations and decisions without unnecessary delay, and respond appropriately when delay risks further insured loss.

Key dates

2024-02-28

Directive (EU) 2024/825 was adopted, amending the Unfair Commercial Practices Directive and the Consumer Rights Directive.

2026-03-27 Deadline

EU Member States were required to adopt and publish national transposition measures.

2026-06-24

The Dutch Implementatiewet richtlijn betere duurzaamheidsinformatie voor consumenten was published in the Staatsblad, according to the AFM publication.

2026-07-16

The Dutch implementation legislation entered into force, according to the AFM publication.

2026-09-27

The ECGT rules became applicable to consumer-facing commercial communications across the EU, including relevant financial-services marketing; the regime is applicable as at the publication date of 2026-10-09.

Suggested considerations

• Compliance teams may wish to inventory all consumer-facing sustainability claims, labels and environmental references used in websites, fund marketing, advertisements, product names, brochures, social media, sales scripts and corporate marketing.
• Firms should consider mapping each claim to the specific product, service, activity or business component to avoid implying whole-product or whole-enterprise sustainability where the evidence covers only part of the offering.
• Firms should consider maintaining an evidence file for every material claim, including the scope of the claim, methodology, data sources, verification, assumptions, limitations and approval owner.
• Marketing and product-governance reviews may wish to identify generic terms such as green, sustainable, environmentally friendly, climate positive and eco-friendly and confirm whether the required recognised excellent environmental performance can be demonstrated.
• Firms should consider removing or rewriting claims that describe products or services as climate neutral, carbon neutral or having reduced climate impact where the claim depends solely or materially on offsetting emissions, and should distinguish mitigation from compensation.
• Compliance teams may wish to review all sustainability labels, badges and proprietary ESG marks and confirm that each is supported by an eligible certification scheme or public scheme with appropriate independent verification.
• Firms communicating net-zero, climate-neutrality or other future environmental objectives should consider documenting a detailed and realistic implementation plan with measurable interim targets, deadlines, governance, monitoring and evidence of progress.
• Firms should consider testing claims against both the ECGT/BW 6 requirements and applicable Wft, SFDR, MiFID II, IDD and other sectoral disclosure and conduct standards, because satisfying a sectoral disclosure rule does not cure a claim prohibited under the consumer-law framework.

What changed

The Dutch Implementatiewet richtlijn betere duurzaamheidsinformatie voor consumenten amended Book 6 of the Dutch Civil Code, including the rules on unfair commercial practices in Articles 6:193a et seq., to implement Directive (EU) 2024/825, which amends Directive 2005/29/EC on unfair commercial practices and Directive 2011/83/EU on consumer rights. For consumer-facing commercial communications, sustainability claims should be specific, accurate, verifiable and supported by appropriate evidence.

Key dates

2026-10-08

FCA consultation CP26/35 opened and was first published.

2026-12-11 Deadline

Deadline for responses to the FCA consultation.

Suggested considerations

• AFMs may wish to identify NURS funds with at least 50% exposure to inherently illiquid assets and compare their current dealing frequency, redemption notice periods and liquidity profile with the proposed monthly and 90-day minimum terms.
• AFMs may wish to assess whether fund constitutional documents, prospectuses, application forms, investor communications and distribution agreements would need amendment if the proposals are adopted.
• AFMs may wish to review liquidity risk-management frameworks, asset-sale assumptions, valuation processes, cash-flow stress testing and governance arrangements for consistency between investment strategy, liquidity profile and redemption policy.
• Compliance teams may wish to assess the effect on the FIIA regime, suspension and deferred-redemption tools, depositary oversight and escalation procedures for liquidity mismatches.
• Distributors, platforms, advisers, SIPP operators and unit-linked product providers may wish to assess how longer notice periods and less frequent dealing would be displayed, explained and operationally administered for retail customers.
• Affected firms may wish to submit responses to the FCA by 11 December 2026, focusing on implementation feasibility, customer communications, operational dependencies and the treatment of indirect investors.
• Firms may wish to monitor the FCA's expected final rules in H1 2027 and avoid treating the consultation proposals as currently binding requirements.

What changed

This is a consultation rather than a binding rule change. For NURS funds with at least 50% of scheme property invested in inherently illiquid assets and offering regular liquidity, the FCA proposes minimum redemption terms aligned with LTAF requirements: redemption determinations no more frequently than once a month and a notice period of at least 90 days after acceptance of a redemption request. The FCA also proposes allowing other NURS fund managers to introduce comparable limited redemption arrangements voluntarily, subject to related rule and disclosure changes.

Key dates

2016-06-17

Saad became an authorised representative of Interprac Financial Planning, according to ASIC's background information.

2021-02-01

ASIC alleges the relevant advice period began, during which Saad advised retail clients to roll over superannuation into First Guardian.

2021-12-31

Saad's authorised-representative relationship with Interprac Financial Planning ended, according to ASIC's background information.

2026-10-07

ASIC commenced Federal Court civil penalty proceedings against Osama Saad.

Suggested considerations

• Compliance teams may wish to review adviser remuneration, referral, marketing and lead-generation arrangements for direct or indirect benefits linked to product recommendations, including payments made through related entities or third parties.
• Licensees should consider testing whether any benefit could reasonably influence the choice of financial product or advice strategy, and whether the arrangement falls within the conflicted-remuneration prohibitions in Part 7.7A Division 5 of the Corporations Act 2001.
• Advice businesses should consider targeted file reviews involving rollovers from superannuation into high-risk, illiquid or complex products, including assessment of best-interests compliance under section 961B, appropriateness under section 961G and the client-interest priority obligation under section 961J.
• Firms should consider tracing the full economic flow of adviser remuneration, referral fees, marketing funding and related-party payments rather than limiting testing to amounts shown on adviser or licensee invoices.
• Australian financial-services licensees may wish to reassess oversight of authorised representatives, referral partners and externally generated leads, including conflicts registers, product research, statements of advice and evidence supporting the client's circumstances and objectives.
• Relevant businesses should consider reviewing controls against ASIC Regulatory Guide 246, Conflicted and other banned remuneration, and preserving records that demonstrate why payment structures do not circumvent the statutory prohibitions.
• Product issuers and superannuation trustees may wish to review distribution and surveillance data for First Guardian, Shield and comparable products, and consider whether affected clients require remediation or referral to the appropriate complaints process.
• Compliance teams should monitor the Federal Court proceedings and ASIC's broader First Guardian and Shield enforcement program, noting that the allegations are unproven until determined by the Court.

What changed

This is an enforcement action rather than a new rule or amended requirement. ASIC alleges that Atlas Marketing and United Capital received benefits from entities connected with First Guardian and Shield, including payments allegedly used for personal benefit and to fund marketing and lead-generation businesses that referred prospective clients to advice firms.

Key dates

2025-10-22

The SFC published its consultation paper on proposed amendments to the UT Code.

2026-01-21

The consultation period closed.

2026-10-16

The revised UT Code and consequential revised PRF, MPF, ILAS and REIT codes are scheduled to be gazetted.

2026-11-01

The revised UT Code and consequential revised PRF, MPF, ILAS and REIT codes become effective.

2027-11-01 Deadline

The generally applicable 12-month transitional period for existing SFC-authorised funds is scheduled to end.

Suggested considerations

• Compliance teams may wish to map each SFC-authorised fund’s current derivative exposure methodology against the revised UT Code and assess whether adopting relative or absolute VaR would be operationally and commercially appropriate.
• Fund managers considering VaR may wish to validate reference-portfolio selection, VaR models, calibration, stress testing, back-testing, independent validation, governance approvals, limit monitoring and escalation procedures against the final revised UT Code and forthcoming SFC guidance.
• Managers may wish to review liquidity-risk frameworks, redemption terms, asset-liability liquidity matching, stress-testing scenarios, anti-dilution tools and disclosures, particularly for funds with exposure to less liquid assets.
• Money market fund managers may wish to test compliance with the 7.5% daily-liquid-assets and 15% weekly-liquid-assets thresholds and document monitoring of investor concentration, redemption behaviour, asset liquidity, days to trade, cost to trade and maturity profiles.
• Product, legal and disclosure teams may wish to update offering documents, constitutive documents, investment-management agreements, risk disclosures, derivatives policies and fund supplements where the revised requirements affect a fund’s strategy or operating model.
• Managers may wish to assess whether existing UCITS or other overseas risk-management documentation can be leveraged while confirming that Hong Kong-specific requirements and SFC-authorised-fund classifications are satisfied.
• Trustees, custodians and oversight committees may wish to confirm their revised oversight responsibilities, reporting arrangements and escalation processes before the transition period expires.
• Firms may wish to monitor the SFC’s forthcoming supplementary guidance, frequently asked questions and revised templates and incorporate them into implementation plans.

What changed

The revised UT Code will permit eligible retail funds to manage derivative exposure using either the existing net derivative exposure approach or a VaR approach. The proposed VaR framework uses a relative VaR limit of 200% of the VaR of a designated unleveraged reference portfolio or an absolute VaR limit of 20% of the fund’s NAV, together with associated governance, risk-management and monitoring requirements.

Key dates

2026-10-07

PRA consultation CP13/26 opens.

2027-02-07 Deadline

PRA consultation CP13/26 closes and responses are due.

2031-07-01

First proposed automatic threshold update would take effect, subject to the consultation outcome and final rules.

Suggested considerations

• Compliance teams may wish to review CP13/26 and identify which of the 128 proposed thresholds currently determine the firm's prudential categorisation, reporting obligations or application of specific rules.
• Firms should consider submitting consultation responses by 7 February 2027, particularly on the suitability of nominal UK GDP as the index, the five-year adjustment interval, the treatment of thresholds near business-planning boundaries and the thresholds excluded from the main proposal.
• Banks and building societies may wish to model how the proposed mechanism could affect future eligibility for the Small Domestic Deposit Takers regime and detailed capital-reporting requirements, while recognising that no 2031 value has been specified in the publication.
• Insurers may wish to assess potential future effects on Solvency UK scope and related governance, reporting and capital-planning assumptions.
• Credit unions may wish to inventory member-related monetary thresholds, including the £7,500 threshold, and assess whether systems and monitoring processes can accommodate future indexed values.
• Regulatory change teams should track the outcome of CP13/26 and the parallel Section 4 discussion on excluded and FCA-joint thresholds rather than treating the proposed increases as current law.
• Firms operating across UK and non-UK regimes may wish to consider potential divergence between UK automatic indexation and static or differently indexed thresholds in other jurisdictions.

What changed

CP13/26 proposes that 128 thresholds determining which PRA rules apply, how those rules apply and what firms must report should be indexed to nominal UK GDP published by the Office for National Statistics. The proposed indexation cycle is every five years, using nominal GDP because it captures both price changes and real economic growth.

Key dates

2027-02-07 Deadline

Deadline for responses to CP13/26 and the associated discussion-paper section.

2031-07-01

Proposed effective date for the first automatic update of in-scope thresholds, subject to finalisation of the framework.

Suggested considerations

• Consider submitting responses on the proposed framework, the proposed in-scope threshold list, the methodology and the separate discussion-paper thresholds by 2027-02-07.
• Map the firm's current and forecast assets, exposures, liabilities, lending and reporting metrics against relevant PRA thresholds, including proposed thresholds that may be revised before finalisation.
• Assess whether nominal GDP indexation could move the firm out of, or into, a threshold-defined prudential treatment from 2031 onwards, while recognising that firms growing faster than nominal GDP would still be expected to cross thresholds.
• Review regulatory reporting, capital, liquidity, governance, risk-management and policy systems that hard-code fixed threshold values or effective dates, and consider designing controlled update mechanisms for future indexed values.
• Assess the effect of the proposed five-year update cycle on business planning, acquisitions, balance-sheet growth, lending strategies and group-structure decisions.
• Consider providing quantitative evidence to the PRA on implementation costs, cliff-edge effects, reporting impacts and whether additional discussion-paper thresholds should be included.
• Monitor the final PRA policy statement, the final automatic-indexation statement of policy and the consolidated threshold list before treating any proposed uprating as a binding change.

What changed

The PRA proposes to replace the current predominantly ad hoc threshold-review process for eligible fixed nominal thresholds with a rules-based framework. In-scope thresholds would be indexed using UK nominal GDP, based on data produced by the Office for National Statistics, on a common five-year cycle; the first automatic update would take effect on 1 July 2031, subject to final policy.

Key dates

2026-10-07

MAS published its written parliamentary reply stating that LIA’s next review of severe-stage critical illness definitions will commence in 2027 and that updated definitions will apply to new products sold.

2027-01-01

The LIA review is expected to commence during 2027; the publication does not specify an exact commencement date or impose a firm for firms to act by this date.

2025-10-01

The LIA Critical Illness Framework 2024 was required to be adopted for new products no later than this date, according to independent industry and LIA-related materials; this is relevant background rather than a new deadline created by the MAS reply.

Suggested considerations

• Compliance teams may wish to monitor the LIA’s 2027 review, consultation materials, final framework amendments, implementation dates, and any MAS communications that follow.
• Insurers should consider mapping current severe-stage definitions to the procedures and clinical severity criteria that may be affected, including identifying products whose claims triggers are particularly dependent on a named surgical procedure.
• Product governance, actuarial, underwriting, claims, legal, and compliance functions may wish to assess how alternative disease- and severity-based triggers could affect coverage scope, expected claims frequency, reserves, reinsurance, and pricing.
• Firms should consider documenting whether existing policy wordings can continue to be administered consistently with their contractual terms and should avoid treating any future framework revision as automatically applicable to in-force policies.
• Insurers developing new products should consider preparing customer disclosures explaining the relevant disease, severity, diagnostic evidence, exclusions, waiting periods, and any procedure-independent claims criteria.
• Compliance teams may wish to review product approval and change-control processes so that future LIA definition changes are reflected consistently in policy documents, benefit illustrations, sales materials, claims manuals, staff training, and complaint-handling procedures.
• Actuarial and product teams should consider reassessing premiums and claims assumptions before launching products using revised definitions, since MAS expressly notes that premiums depend on the probability of claims materialising.

What changed

No immediate statutory requirement, product withdrawal, or mandatory amendment to existing policies was introduced. LIA’s 2027 review will consider procedure-neutral or less procedure-dependent definitions for certain medical conditions, while retaining the use of procedures where they provide objective evidence of severity, recovery duration, and financial impact. Any resulting changes will apply to new products sold; existing policies remain governed by their contractual definitions and terms.

Key dates

2026-10-07

MAS issued the Guidelines on Artificial Intelligence Risk Management following its November 2025 consultation.

2027-10-07 Deadline

The Guidelines take effect. FIs should meet the expectations in Sections 3 and 4 from this date.

2027-10-07

MAS intends to consult the financial sector during 2027 on what additional guidance on agentic AI would be useful.

2028-10-07 Deadline

FIs should meet the expectations in Sections 5 and 6 by this date under the phased implementation timetable.

Suggested considerations

• FIs should establish or update an enterprise inventory of AI systems, models, embedded AI functionality and third-party AI services, using a level of granularity appropriate to their risk profile.
• Compliance and risk teams may wish to classify individual AI use cases by materiality, including potential effects on customers, prudential soundness, operational resilience, other financial institutions and the wider financial system.
• Boards and senior management should consider documenting AI risk appetite, ownership, escalation routes and the allocation of responsibilities across business, risk, compliance, technology, cybersecurity, data and model-governance functions.
• FIs should map existing AI controls across the lifecycle, including data governance, development and validation, testing, human oversight, cybersecurity, monitoring, incident management and change management, and identify gaps against the Guidelines.
• Procurement, outsourcing and third-party-risk functions should consider adding AI-specific due diligence, assurance, contractual rights, performance monitoring, incident notification and exit or substitution arrangements for external AI providers.
• FIs should assess whether existing governance committees and risk frameworks provide sufficient cross-functional oversight, rather than assuming that a new dedicated AI committee is necessary.
• FIs may wish to define evidence that supports proportionality decisions, including why basic policies and procedures are adequate for lower-materiality AI use cases.
• Implementation planning should distinguish the expectations in Sections 3 and 4, which should be met from 7 October 2027, from Sections 5 and 6, which should be met by 7 October 2028.

What changed

The Guidelines introduce an enterprise- and use-case-level framework for managing AI risk. Boards and senior management are expected to oversee AI risk, define accountabilities, set risk appetite, and maintain suitable risk-management frameworks, policies and procedures; existing governance structures may be used and a dedicated AI committee is not required solely for compliance.

Key dates

2026-04-30

APRA issued its letter to banks, insurers and superannuation trustees calling for a step-change in governance, risk management, assurance and operational resilience for AI-related risks.

2026-05-08

ASIC issued its open letter to all licensees and market participants urging urgent strengthening of cyber resilience as frontier AI intensifies the global cyber-risk environment.

2026-06-01

ASIC and APRA began the June–July 2026 series of nine industry roundtables on frontier-AI preparedness and resilience; the source identifies June as the starting month but does not provide an exact day.

2026-07-31

ASIC and APRA completed the June–July 2026 roundtable period; the source does not provide an exact closing day.

2026-08-27

ASIC published the joint warning and related information paper and preparedness checklist, urging entities to move from awareness to action.

Suggested considerations

• Firms should consider presenting the ASIC and APRA roundtable themes, together with the available board and executive preparedness checklist, to the board and relevant risk or technology committees.
• Compliance teams may wish to map frontier-AI cyber and operational risks to existing obligations and controls under APRA CPS 230 Operational Risk Management, APRA CPS 234 Information Security, APRA CPS 220 Risk Management where applicable, and the entity's ASIC licence, governance and cyber-resilience arrangements.
• Firms should consider identifying critical assets, systems, data flows and material third-party dependencies, including common providers and concentration points that could create sector-wide disruption.
• Technology and security teams may wish to test patching, identity and privileged-access controls, attack-surface reduction, backup integrity, recovery-time priorities and incident-response playbooks against AI-accelerated attack scenarios.
• Boards and executives should consider documenting risk appetite, incident escalation authority, recovery priorities, internal and external communication strategies and decision rights before a frontier-AI-related crisis occurs.
• Firms should consider testing response and recovery arrangements under compressed timeframes and retaining evidence of exercise results, lessons learned, remediation owners and completion status.
• Entities using or procuring AI should consider applying existing model, data, supplier, change-management and assurance controls to internally developed models, vendor tools and embedded AI functionality, including defensive-AI tools used for threat intelligence, vulnerability detection, code review or incident response.
• Procurement and outsourcing functions may wish to strengthen supplier assurance, obtain relevant information on providers' AI and cyber controls, map material dependencies and assess substitutability and exit arrangements.

What changed

The regulators have consolidated a cross-sector expectation that entities address frontier-AI risk through cyber fundamentals, critical-asset identification, timely patching, strong identity and access controls, attack-surface reduction, reliable backups, tested response and recovery arrangements, and third-party risk management.

Key dates

2025-01-17

DORA began applying to in-scope financial entities supervised by the CSSF.

2025-12-17

The European Commission confirmed through DORA Q&A 102 that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF’s extended best-efforts deadline for the first register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2026-08-27

Circular CSSF 26/915 was published and took effect immediately; the listed CSSF circulars were amended to include or remove qualifying third-country branches as applicable.

2027-03-31 Deadline

Target date identified by CSSF for the required-quality register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2027-01-11

Relevant CRD VI third-country-branch provisions are scheduled to take effect, subject to national transposition and applicable transitional rules.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the counterfactual test in Circular 26/915: whether the head-office undertaking would qualify under Article 2(1)(a) to (t) of DORA if established in the relevant third country.
• Affected branches should update their regulatory-perimeter inventories, governance documents, ICT-risk policies, outsourcing inventories, incident-classification procedures and DORA control testing to reflect immediate inclusion in the DORA-specific CSSF circulars.
• Compliance teams may wish to separate non-ICT outsourcing, which remains subject to Part I of Circular CSSF 22/806, from ICT outsourcing, which is governed by DORA and Circular CSSF 25/882 rather than the legacy Part II framework.
• Affected entities should validate their register-of-information process under DORA and Circular CSSF 25/882, including branch-level data, ICT third-party contracts, intra-group arrangements and submission ownership. The 30 June 2026 best-efforts deadline for third-country branches of credit institutions has passed, and firms should prepare for the 31 March 2027 collection and any CSSF remediation requests.
• Incident-response teams should test access to the CSSF eDesk procedure and S3 API and document an escalation process for emailing [email protected] when technical impossibility prevents electronic submission.
• Firms should assess whether they qualify for the microenterprise exclusion in Circular CSSF 25/892; the exclusion applies to entities employing fewer than 10 persons with annual turnover and/or annual balance-sheet total not exceeding EUR 2 million, subject to the DORA definition and exclusions for specified market infrastructures.
• Third-country banking groups should coordinate DORA implementation with the CRD VI third-country-branch analysis, including the 11 January 2027 effective date for relevant CRD VI provisions, rather than assuming that the two regimes have identical scope or timing.

What changed

Qualifying third-country branches are added to the scope of Circulars CSSF 25/882, 25/892 and 25/893, covering DORA ICT third-party-service information and reporting, estimation of aggregated annual costs and losses from major ICT-related incidents under Article 11(11) of DORA and the Joint ESA Guidelines JC/GL/2024/34, and reporting of major ICT-related incidents and significant cyber threats.

Key dates

2025-12-30

MAS issued the revised Notices FAA-N27, 508 and SFA 04-N24 and published its response to feedback.

2026-08-24

MAS published the circular and FAQs explaining the revised misconduct-reporting requirements and the discontinuation of the existing system.

2027-01-01 Deadline

The revised Notices FAA-N27, 508 and SFA 04-N24 take effect; the existing Notices FAA-N14, 504 and SFA 04-N11 are cancelled; and the existing misconduct reporting system is discontinued.

2027-01-22 Deadline

Default deadline for reporting qualifying pre-2027 misconduct matters that were not reported under the cancelled Notice, calculated as 21 calendar days after 1 January 2027, unless MAS permits a longer period in writing.

Suggested considerations

• Compliance teams may wish to map existing misconduct, incident, whistleblowing, investigation, HR and police-referral processes to the revised definition and categories of reportable misconduct.
• Firms should consider establishing a documented escalation test for when reasonable grounds to believe misconduct occurred arise, rather than waiting for a final investigation finding, and configuring workflow controls around the 21-calendar-day initial-reporting deadline.
• Firms may wish to obtain and operationalise the prescribed misconduct-report, investigation-report and update-report formats before the existing system is discontinued.
• Internal investigation procedures should be reviewed to ensure that the prescribed investigation information, supporting evidence, investigator assessment, corrective action and appeal information can be produced concurrently with the initial MAS report where an investigation has commenced.
• Police-report handling should be updated so that available police reports and required accompanying details are captured and submitted with the misconduct report, with subsequent police or criminal-proceeding developments tracked for update reporting.
• Firms should consider controls for providing representatives with copies of initial misconduct reports and subsequent updates within the prescribed timelines, including appropriate treatment of former representatives and confidentiality or privilege issues.
• A transitional review of open matters may be appropriate to identify cases where reasonable grounds arose before 1 January 2027 but no report was filed under the cancelled Notice; those matters may need to be reported by 22 January 2027, subject to any written extension from MAS.
• Record-retention policies, case-management systems and management information should be tested against the minimum five-year retention requirement and the requirement that electronic records remain accessible, retrievable and readable.

What changed

From 1 January 2027, Notices FAA-N27, 508 and SFA 04-N24 replace and cancel the existing Notices FAA-N14, 504 and SFA 04-N11. The initial misconduct report must generally be submitted within 21 calendar days after the firm has reasonable grounds to believe that reportable misconduct was committed or is likely to have been committed; a conclusive investigation finding is not required before reporting.

Key dates

2021-03-01

First Guardian Diversified Class and Growth Class became available to adviser-led members through Netwealth Super Accelerator Plus; the publication gives March 2021 rather than a specific day.

2022-12-01

First Guardian classes were closed to new investments; the publication gives December 2022 rather than a specific day.

2024-05-01

Falcon Capital froze redemptions, leaving approximately 1,080 NSMF members invested with holdings totalling about $100.7 million; the publication gives May 2024 rather than a specific day.

2025-12-17

APRA accepted a court-enforceable undertaking from Netwealth Superannuation Services addressing material weaknesses in its investment governance framework and practices.

2025-12-18

ASIC commenced Federal Court proceedings against Netwealth and accepted a court-enforceable undertaking requiring compensation of affected members.

2026-01-28

Netwealth credited compensation payments to affected members' superannuation accounts; ASIC reported that more than $100 million had been paid to over 1,000 investors in January 2026.

2026-08-20

The Federal Court made declarations that Netwealth contravened the Corporations Act in relation to First Guardian.

Suggested considerations

• Firms should consider mapping their investment-option onboarding and review processes against sections 912A(1)(a) and 912A(5A) of the Corporations Act 2001, including documenting how the trustee independently validates issuer-provided information.
• Compliance teams may wish to require documented evidence of independent enquiries into strategy, underlying assets, valuation methodology, leverage, related-party exposure, custody, redemption terms, liquidity and operational risks before an option is approved.
• Trustees should consider implementing risk-based ongoing monitoring, watch-list and escalation criteria for complex or high-risk options, with clear triggers for suspension, closure, member notification and review of future investment directions.
• Firms should consider testing whether product disclosure documents, investment menus, member communications and online materials accurately explain potential illiquidity and any limits or conditions affecting withdrawals or redemptions.
• Trustees may wish to review historical investment options that were onboarded between March 2021 and December 2022, or during comparable periods, to identify gaps in due diligence, monitoring, risk disclosure and remediation records.
• Compliance teams should consider preserving approval papers, committee minutes, independent research, issuer correspondence, risk assessments, liquidity analyses and member communications sufficient to demonstrate the basis for each onboarding and monitoring decision.
• Where material weaknesses are identified, firms should consider a documented remediation assessment covering member impact, compensation, disclosure correction, governance uplift and potential notification to ASIC, APRA or AFCA as appropriate.
• Trustees should consider whether their governance framework can evidence alignment with the best financial interests duty and applicable APRA prudential expectations, particularly when adding high-risk investments to a platform.

What changed

The publication records binding Federal Court declarations against Netwealth; it does not introduce a new statutory rule or generally applicable deadline. The relevant conduct was found to breach the Australian financial services licensee obligation in section 912A(1)(a) to do all things necessary to ensure licensed financial services are provided efficiently, honestly and fairly, together with section 912A(5A), in the context of Netwealth's operation of the Netwealth Superannuation Master Fund.

Key dates

2018-05-01

Demetrios Hadjigeorgiou became CEO of SVS Securities Plc.

2019-08-02

The FCA required SVS to cease regulated activities, safeguard assets and notify affected third parties.

2019-08-05

SVS Securities Plc entered special administration.

2023-08-10

SVS Securities Plc was dissolved.

2024-04-25

The FCA issued its initial Decision Notice proposing an £84,600 penalty and prohibition order against Mr Hadjigeorgiou.

2026-08-19

The FCA published the settled enforcement outcome: a £56,400 fine and prohibition from senior management positions in financial services.

Suggested considerations

• Compliance teams may wish to review whether senior managers have documented challenge and escalation responsibilities for investments involving issuer payments, commissions, related parties or other conflicts of interest.
• Firms should consider testing whether investment due diligence appropriately assesses product risk, liquidity, valuation methodology, concentration and suitability for pension and retail customers.
• Firms should consider reconciling all fees, commissions, retained spreads and exit-value adjustments against customer disclosures, ensuring that any reduction in redemption or sale value is prominent, timely and understandable.
• Boards and senior managers may wish to evidence periodic review of model portfolios against customers’ stated objectives, risk appetite, liquidity needs and pension-transfer circumstances.
• Compliance teams may wish to assess whether management information would have identified customer detriment, unusually high issuer-related income or investment decisions that prioritised firm revenue over customer interests.
• Firms should consider retaining clear records showing how conflicts were identified, mitigated, disclosed and challenged, including the rationale for approving high-risk or illiquid products for retail and pension-related portfolios.
• Authorised firms may wish to review the FCA’s SVS enforcement materials alongside their own senior-manager accountability maps and Statements of Responsibilities, while recognising that this case does not itself create a new universal obligation.

What changed

This is a concluded enforcement action against an individual, not a new general rule or threshold applicable to firms. The FCA imposed a financial penalty under section 66 of the Financial Services and Markets Act 2000 and a prohibition order under section 56 of that Act, following settlement and withdrawal of the Upper Tribunal referral. The FCA found a breach of Statement of Principle 6, requiring an approved person to exercise due skill, care and diligence in managing the business of the firm.

Suggested considerations

• Compliance teams may wish to check whether any bundled, embedded, or referral-based cover could be characterised as insurance business requiring authorisation.
• Firms may wish to compare current products and distribution models against the licensing perimeter under the Short-term Insurance Act and Insurance Act.
• Compliance functions may wish to review complaint-handling controls to ensure perimeter issues are escalated promptly when customer complaints arise.
• Firms may wish to assess whether document-production and response procedures are adequate for FSCA investigations under the FSR Act.
• Senior management may wish to review governance over third-party arrangements and product approval processes where non-insurance businesses market insurance-like protection.

What changed

This is an enforcement outcome, not a new rule or consultation. The FSCA’s action confirms that operating an insurance-like business without the required short-term insurance authorisation can result in both a substantial monetary penalty and an individual debarment. The publication also indicates that obstruction or non-cooperation during an FSCA investigation can aggravate the matter and is treated as a breach of the Financial Sector Regulation Act framework.

Key dates

2026-03-03

FSCA confirmed it had completed its investigation into the South African Army Foundation and two senior officials and said enforcement action would follow.

2016-02-01

Start of the conduct period cited in reporting for the unlawful practices identified by the FSCA.

2022-03-31

End of the conduct period cited in reporting for the unlawful practices identified by the FSCA.

Suggested considerations

• Compliance teams may wish to review whether client-money segregation controls are strong enough to prevent commingling of funds where administration fees and member contributions pass through shared accounts.
• Firms may wish to test whether regulatory reporting processes include sufficient validation, approval, and escalation controls to reduce the risk of misleading submissions.
• Boards and senior management may wish to assess whether payment-authorization controls over senior personnel, related-party payments, and expense cards are independently reviewed and well documented.
• Risk and internal-audit teams may wish to examine whether bank-reconciliation and anomaly-detection procedures would identify unusual outflows to personal accounts or related entities quickly enough.
• Firms handling member deductions or insurance premiums may wish to confirm that end-to-end flow tracing exists for funds paid to insurers and third parties, with evidence that money is applied only for its intended purpose.
• Governance teams may wish to test whether fit-and-proper, debarment, and accountability frameworks are capable of detecting senior misconduct early and limiting harm.
• Businesses relying on legacy or outsourced administration structures may wish to confirm that interim management and contingency arrangements exist for rapid stabilisation if misconduct or licence risk emerges.

What changed

The FSCA confirmed that its investigation was complete and that enforcement action would follow, which is reflected in the later licence withdrawal, penalties, and debarment orders. The reported findings indicate unlawful practices between February 2016 and March 2022, including commingling client funds, submitting misleading regulatory reports, failing to exercise proper care over funds, and making unauthorised payments from the SANDF Group Life Insurance Scheme account.

Suggested considerations

• Compliance teams may wish to review whether client-money segregation and reconciliation controls are robust enough to prevent commingling or unauthorized use of funds.
• Firms may wish to reassess governance over senior executives, key individuals, related-party payments, and delegated authority limits.
• Institutions handling payroll deductions or benefit contributions may wish to test whether payment flows, beneficiary remittances, and audit trails are transparent and independently traceable.
• Compliance functions may wish to review statutory reporting sign-off, escalation, and challenge procedures for anomalies or inaccuracies.
• Boards and risk committees may wish to consider whether ongoing fit-and-proper monitoring of key individuals is sufficiently documented and frequent.
• Firms relying on affiliated or outsourced intermediaries may wish to confirm counterparties’ licence status and the scope of their authorisation before continuing service arrangements.

What changed

The Foundation’s authorisation to act as a financial services provider was withdrawn under the FAIS regulatory framework, ending its licence-based ability to render regulated financial services. Two senior individuals were also debarred from rendering financial services for 30 years, and the FSCA imposed administrative penalties of R24 million and R20.7 million, respectively, based on reported misconduct including commingling client funds, misleading regulatory reports, failure to exercise proper care over funds, and unauthorised payments to themselves.