Operational Resilience / Outsourcing

Key dates

2026-11-05

CFTC Division of Clearing and Risk issued the no-action letter and accompanying public release addressing trust companies used for daily settlements.

Suggested considerations

• Compliance teams may wish to identify any existing or proposed trust-company settlement arrangements and determine whether each arrangement is being governed under the DCO’s settlement-bank policies and procedures.
• DCOs should consider documenting that each trust company satisfies the applicable 17 CFR 39.14 settlement-bank criteria, including capitalization, creditworthiness, liquidity access, operational reliability, and regulatory status.
• Firms should consider reviewing account structures, settlement agreements, payment workflows, and legal opinions to confirm that transfers are irrevocable and unconditional no later than the time the relevant DCO or clearing-member account is debited or credited.
• DCOs may wish to assess credit, liquidity, concentration, and intraday settlement exposures arising from the use of each trust company and confirm that monitoring, escalation, collateral, and contingency arrangements remain adequate.
• Operations and resilience teams may wish to test the trust company’s connectivity, payment-failure procedures, recovery arrangements, and coordination with the DCO’s business-continuity and disaster-recovery plans.
• Legal and compliance teams should consider recording the no-action letter’s conditions and limits in the DCO’s regulatory inventory, noting that the relief is staff relief rather than a binding amendment to Part 39 and may not extend to materially different structures or facts.
• Clearing members may wish to confirm that their agreements with the DCO and trust company allocate settlement, segregation, insolvency, operational, and account-control risks consistently with the DCO’s approved procedures.

What changed

The letter provides staff no-action relief for a DCO that uses a trust company to conduct daily settlement, notwithstanding the distinction between a trust company and a settlement bank under the CFTC framework. It does not create a generally applicable exemption or amend 17 CFR Part 39; instead, it allows the arrangement provided the trust company is managed and controlled as a settlement bank.

Key dates

2024-07-09

Directive (EU) 2024/1619 (CRD VI) entered into force, introducing or strengthening governance requirements including responsibility mapping and a dedicated framework for third-country branches.

2025-01-01

The CRD VI banking package began applying according to the EBA consultation materials, with the revised Guidelines intended to support implementation of the updated framework.

2026-11-05

The EBA published the final revised Guidelines and the final report on internal governance.

Suggested considerations

• Compliance teams may wish to identify the competent authority’s expected adoption or comply-or-explain treatment once the final Guidelines are translated and formally notified, because no application date is specified in the published final report.
• Firms should consider performing a gap assessment against the final provisions on management-body responsibilities, senior-management and key-function-holder role statements, responsibility mappings, reporting lines, organisational structures and internal-control arrangements.
• Institutions may wish to review board and committee terms of reference, chair and executive-role combinations, conflict-of-interest registers, recusal controls and escalation procedures against the clarified expectations.
• Third-country-branch operators should consider mapping the new branch-specific governance requirements to the local branch manager, head-office governance, risk management, internal control, oversight and reporting arrangements, using the proportionality available in the final text.
• Firms should consider checking consistency between internal-governance documentation and DORA-related ICT risk, operational resilience, business-continuity and third-party-risk arrangements.
• Groups may wish to determine which entities fall within the Guidelines and whether responsibility mappings should be maintained at entity, branch and group levels, documenting the rationale for the chosen scope.
• Compliance teams may wish to retain evidence of proportionality assessments based on size, nature, scale and complexity, rather than removing governance controls solely because the final Guidelines are less granular than the consultation draft.
• Firms should monitor publication of the final Guidelines in all EU official languages and subsequent national competent-authority communications before setting internal implementation deadlines.

What changed

The Guidelines clarify the responsibilities of the management body, senior management and key function holders, including documented statements of roles and duties and a mapping of responsibilities. They address organisational structures, management of conflicts of interest—including situations where the chair also has executive functions—and key elements of internal control frameworks. They introduce or clarify governance expectations for third-country branches under CRD VI, with greater proportionality than in the consultation draft.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the Supervisory Framework on Bank Use of Super Intelligence for examiner use.

Suggested considerations

• Compliance teams may wish to inventory current and planned SI and agentic-SI use cases, including embedded functionality supplied by vendors, and map each use case to its business owner, permitted actions, autonomy level, human oversight, data sources, and potential consequences of failure or misuse.
• Banks should consider documenting a risk-based classification methodology focused on potential consequences, transfer of agency, and degree of human oversight rather than technical sophistication alone.
• Risk and control owners may wish to assess whether existing model-risk, governance, data-governance, privacy, cybersecurity, compliance, operational-resilience, vendor-management, testing, monitoring, documentation, auditability, and independent-challenge controls adequately address SI-enabled activities.
• Higher-consequence or more autonomous use cases should be considered for stronger restrictions on permitted actions, more direct human oversight, independent validation or challenge, enhanced performance monitoring, audit trails, testing, fallback procedures, and resilience measures.
• Boards and senior management may wish to clarify accountability for SI deployments without creating a separate SI risk appetite unless the bank determines that one is useful internally; the OCC framework does not require one.
• Internal audit and compliance teams may wish to retain evidence showing how SI risks are identified, measured, monitored, controlled, and escalated within existing risk-management frameworks, particularly because examiners may use the framework during ordinary examinations despite its nonbinding status.
• Banks should consider reviewing contracts and oversight arrangements for SI vendors, including access to data, model changes, incident notification, testing rights, service continuity, explainability or transparency, subcontracting, and termination or fallback arrangements.
• Compliance teams may wish to monitor future OCC revisions and stakeholder feedback because the framework is expressly intended to be a living document.

What changed

The OCC provided examiners with a risk-based, proportionate framework covering SI used in activities including credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities. Examiners are instructed to consider the bank’s size, complexity, risk profile, and the nature, consequences, autonomy, and complexity of each SI use case; banks are not required to create a separate SI risk category or SI-specific risk appetite. The framework identifies 16 components across six pillars: purpose, risk, control, oversight, resilience, and assurance.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the accompanying supervisory framework for examiner use.

2026-10-02

Executive Order 14434 was published in the Federal Register and is cited by the OCC as the source for the “super intelligence” terminology and broader definition.

Suggested considerations

• Firms should consider maintaining an inventory of SI and agentic use cases, documenting each system’s purpose, permitted actions, accessible data and systems, prohibited uses, degree of autonomy, human-oversight model, and business owner.
• Compliance teams may wish to prioritize review of use cases according to potential consequences of failure or misuse, transfer of decision-making agency, reversibility, customer or market impact, data sensitivity, and the practical ability of personnel to intervene.
• Banks should consider testing whether human reviewers can meaningfully understand, reject, pause, or stop system outputs and actions, rather than relying solely on nominal approval checkpoints or high-volume bulk approvals.
• Risk functions may wish to map SI-enabled activities to existing model risk management, operational-risk, cybersecurity, privacy, consumer-protection, compliance, and business-continuity controls instead of creating a standalone SI risk category.
• Governance teams should consider assigning accountable owners across the system lifecycle, including approval, deployment, change management, incident response, suspension, retirement, and post-incident remediation.
• Banks should consider establishing monitoring capable of detecting model drift, erroneous or harmful actions, unauthorized activity, control exceptions, low-frequency high-impact events, and customer harm, with defined escalation and containment procedures.
• Third-party risk teams may wish to review contracts for vendor notification of model changes and new SI functionality, incident and notification timelines, audit and testing rights, data-use restrictions, responsibility for model errors, service suspension rights, and operational-resilience obligations.
• Internal audit and independent validation functions should consider whether they can reconstruct material outputs and actions, assess control effectiveness, and provide effective challenge to developers, business owners, and validation teams.

What changed

The OCC provided examiners with a framework that supplements existing model risk management, governance, technology, compliance, cybersecurity, and operational-risk practices. It covers 16 components organized around purpose, risk, control, oversight, resilience, and assurance, including permitted use and authority, criticality assessment, human-in-the-loop and human-on-the-loop controls, governance and accountability, performance monitoring, operational resilience, documentation and auditability, vendor risk, testing, and independent challenge.

Key dates

2026-11-04

The proposed rule was published in the Federal Register at 91 FR 69642.

2027-01-04 Deadline

Comments on RIN 3064-AG35 must be received by the FDIC.

2029-10-01

First proposed inflation-based adjustment to the section 360.9 covered-institution and larger-covered-institution thresholds.

Suggested considerations

• Affected banks should assess whether they meet the proposed covered-institution or larger-covered-institution thresholds using Call Report definitions and current deposit-account and asset data.
• Current part 370 institutions should map existing output files and deposit-account records against the 26 proposed mandatory fields in 12 CFR part 360 appendices C through G, identifying gaps in account title, ownership, relationship, beneficiary, domestic-versus-foreign, and other required data.
• Part 370 institutions should evaluate the effect of replacing their own deposit-insurance calculation systems with FDIC-calculation reliance, while preserving or redeveloping the provisional-hold capabilities required by proposed section 360.9.
• Larger covered institutions should inventory transactional accounts subject to the proposed account-holder contractual or disclosure requirement and determine which mortgage-servicer, fiduciary, real-estate, IOLTA, employee-benefit-plan, and trust-related accounts may be excluded.
• Compliance, operations, legal, and technology teams should review the proposed six-month implementation period for general requirements and 18-month period for provisional-hold requirements for institutions that are larger covered institutions on the final rule's effective date.
• Banks approaching the thresholds should establish monitoring for two consecutive quarters, the proposed 12-month implementation period after becoming a larger covered institution, and the proposed release mechanism after three consecutive quarters below the relevant threshold.
• Institutions should consider whether to submit comments by January 4, 2027, particularly on field-level data requirements, provisional-hold redevelopment, account-holder disclosures, transition timing, exemptions, and the CPI-W indexing methodology.
• Industry commentary indicates that the proposal is being read primarily as a burden-reduction measure for large banks, with estimated annual savings of approximately $33 million offset by approximately $14 million in transition costs; firms should nevertheless account for operational work associated with standardized data and provisional holds.

What changed

Proposed revised 12 CFR 360.9 would apply to insured depository institutions with at least $2 billion in deposits and either at least 250,000 deposit accounts or at least $20 billion in total assets, regardless of deposit-account count. A new category of larger covered institution would include institutions with at least $2 billion in deposits and two million or more deposit accounts. Part 370 institutions would generally become larger covered institutions under section 360.9, and would no longer need to operate systems capable of calculating deposit-insurance coverage themselves.

Key dates

2026-11-03

PRA and FCA publish the joint discussion paper and open the feedback period.

2027-03-05 Deadline

Deadline for responses to the discussion paper to be submitted to the PRA and FCA.

Suggested considerations

• Firms should assess the discussion paper against their size, growth trajectory, business model, lending mix, capital methodology, governance arrangements and operational-risk profile.
• Credit unions may wish to submit evidence to the PRA and FCA by 5 March 2027, including quantified costs and benefits of simplified requirements, risk-based capital treatment, revised reporting and any proposed thresholds.
• Compliance and risk teams should map current internal-audit, regulatory-documentation, capital, leverage-ratio, risk-weighted-asset, capital-add-on and stress-testing requirements so that the impact of possible future options can be assessed without assuming that any proposal is yet effective.
• Boards and senior management should consider whether planned growth, aggregator arrangements, mortgage or fixed-rate lending, outsourcing and technology investment are matched by appropriate governance, liquidity, credit-risk, operational-resilience and third-party oversight capabilities.
• Firms considering new products or services should identify statutory, prudential, conduct, systems and outsourcing barriers and document the safeguards that would be needed to support a credible response to the regulators.
• Credit unions should review current wind-down, transfer and restructuring plans and identify legislative or contractual barriers to sale of loan books, transfer of business or conversion to another mutual form.
• Industry bodies and service providers may wish to coordinate submissions on FCA fees, shared-service models, CUSO capability, third-party guidance and the practical consequences of applying Small Domestic Deposit Takers rules.

What changed

This is a discussion paper, not a consultation proposing or committing to specific policy changes, so existing PRA and FCA requirements continue to apply. The regulators are examining whether internal-audit and regulatory-document requirements could be reduced for smaller and simpler credit unions; whether larger or more complex credit unions should move to a risk-based framework with more flexible capital requirements; and whether relevant Small Domestic Deposit Takers rules, including the standardised approach for risk-weighted assets, could replace the current simple leverage-ratio...

Key dates

2026-11-03

PRA publication date for DP2/26 and FCA publication date for the parallel credit-union discussion paper DP26/1.

2027-03-05 Deadline

Deadline for responses to DP2/26, submitted to [email protected].

Suggested considerations

• Firms should consider whether to submit evidence or a response to DP2/26 by 2027-03-05, addressing the questions most relevant to their size, business model, activities and growth plans.
• Compliance teams may wish to map current prudential, reporting, governance and operational-resilience requirements against the proposed distinction between small and simple firms and larger or more complex credit unions.
• Credit unions considering growth should assess whether board expertise, senior-management capacity, capital and liquidity planning, credit-risk controls, member-servicing capability and operational resilience will scale with membership and lending volumes.
• Firms may wish to review governance and controls for aggregator-driven growth, mortgage lending, fixed-rate products, outsourced activities, third-party providers and CUSO relationships, because these are identified as areas where future safeguards or supervisory expectations may develop.
• Boards and senior managers should consider how existing responsibilities under Rule 11.5(3) of the Credit Unions Part of the PRA Rulebook are evidenced, including oversight of regulatory compliance, risk management and business growth.
• Credit unions may wish to evaluate their current solvent-exit and wind-down arrangements, including the feasibility of transferring business, selling a loan book, restructuring or maintaining continuity of member services.
• Trade associations and service organisations may wish to provide data on compliance costs, asset-based thresholds, barriers to permitted activities, common-bond expansion, CUSO use and the practical effects of different prudential models.
• Firms should monitor subsequent PRA and FCA consultations and any legislative proposals; no implementation plan or transition timetable has been established at this stage.

What changed

No rules, thresholds, permissions or supervisory requirements have been amended by DP2/26. The regulators are seeking evidence on six outcomes: proportionate regulation; consumer confidence and protection; competition and innovation; long-term sustainability; operational resilience and risk management; and orderly market exit.

Key dates

2026-09-30

The FCA’s application window for the new UK cryptoasset regime opened.

2026-10-01

The application window opened for the FCA Regulatory Sandbox themed cohort on climate scenario models.

2026-11-02

The FCA published Wholesale banks supervision - Insights 3 (Autumn 2026).

2026-11-30 Deadline

The application window closes for the FCA Regulatory Sandbox climate scenario models cohort.

2027-02-28 Deadline

FCA-encouraged deadline for wholesale banks to submit a variation-of-permission application for new regulated cryptoasset activities to obtain the stated pre-regime application treatment.

2027-10-25

The new UK cryptoasset regime comes into force.

Suggested considerations

• Firms should consider performing a control-by-control review of critical data ingestion, including completeness checks, reconciliation, coding-change testing, source-to-consumption lineage and evidence of design and operating effectiveness for financial-crime and surveillance controls.
• Compliance and technology teams may wish to test communications surveillance after system changes, including lexicon configuration, geographic and channel coverage, third-party-provider interfaces, ingestion completeness and retention or auditability of records for in-scope activities.
• Firms should consider reconciling the technology-asset inventory to procurement, disposal, redeployment, identity and endpoint-management records across all regions, assigning clear lifecycle accountability and confirming that assets cannot leave service without security and inventory updates, including encryption status.
• Algorithmic-trading firms should consider testing enhancements across the complete order lifecycle, including near-simultaneous and geographically distributed fills, order-management and fill-notification interactions, overfills, stop-loss scenarios, venue behaviour, pre-trade limits, kill or cancel mechanisms and post-implementation monitoring, with governance aligned to UK MiFID RTS 6.
• Firms should consider testing DLP controls against deliberate circumvention, including split messages, altered classifications, changed file formats, embedded images and misleading subjects, while reviewing staff training, monitoring, escalation and privacy safeguards.
• Operational-resilience owners may wish to refresh important-business-service impact tolerances using potential disruption to trading, settlement, clients, counterparties and time-critical market processes rather than relying solely on generic recovery-time or availability metrics.
• Firms should consider separating current resilience capability from planned remediation in self-assessments, linking incidents, near misses and test results to mapping and remediation decisions, and validating completed remediation through retesting.
• Settlement-related firms should consider the effect of T+1 on post-trade dependencies, reconciliation, funding, exception management, recovery capability, scenario testing and impact-tolerance calibration.

What changed

The FCA has not introduced new binding rules through this publication; it has consolidated supervisory findings and clarified areas against which wholesale banks may be assessed. Firms are expected to be able to evidence complete data lineage and ingestion controls, auditable recording and communications surveillance even where third parties are used, reliable asset inventories, end-to-end algorithmic-trading testing and controls consistent with UK MiFID RTS 6, and DLP controls capable of addressing adaptive evasion techniques.

Key dates

2026-10-30

FDIC Board unanimously approved the Notice of Proposed Rulemaking by notational vote.

Suggested considerations

• Compliance teams should obtain and review the complete NPRM, including proposed amendments, definitions, scope thresholds, transition provisions, and the Federal Register comment deadline, because the bulletin itself contains only a high-level announcement.
• Firms should map each insured depository institution against the current applicability criteria in 12 CFR part 370 and 12 CFR 360.9, documenting deposit-account counts, domestic deposits, total assets, existing exemptions, certifications, and any voluntary compliance elections.
• Affected institutions should inventory overlapping deposit-insurance determination, depositor-record, provisional-hold, data-format, and reporting capabilities to identify systems that could potentially be consolidated if the proposal is finalized.
• Technology, operations, deposit administration, legal, resolution-planning, and third-party-risk teams should assess whether current data lineage, account ownership and capacity coding, reconciliation, testing, and FDIC access processes would satisfy a revised standardized-record framework.
• Firms should consider submitting comments on the operational feasibility, treatment of affiliates and mergers, transition periods, testing expectations, treatment of custodial and pass-through accounts, and whether any proposed relief would create gaps in failure-day data availability.
• Institutions should continue complying with currently effective 12 CFR part 370 and 12 CFR 360.9 requirements until a final rule becomes effective and any applicable transition period expires.

What changed

The FDIC has proposed amendments concerning the framework used by large insured depository institutions to maintain depositor records and support rapid deposit-insurance determinations. Based on the FDIC’s accompanying policy direction and independent industry commentary, the proposal would likely preserve standardized depositor-record and data-access requirements while reducing or eliminating the need for institutions subject to 12 CFR part 370 to maintain separate, independent deposit-insurance determination systems.

Key dates

2026-12-04 Deadline

ASIC consultation on CS 69 and the proposed RG 172 update closes at 5pm AEDT.

Suggested considerations

• Market licensees should consider submitting responses to CS 69 by 5pm AEDT on 4 December 2026, addressing whether the proposed methodology is workable for their business model and venue type.
• Compliance teams may wish to map current financial-resources calculations against the proposed six-month minimum and identify whether all venue, group, outsourcing and related-party operating costs are included.
• Licensees should consider separating liquid resources supporting continuity and recovery from capital buffers supporting positive net assets and loss absorption, and documenting the legal availability of each resource.
• Market operators may wish to perform severe-but-plausible recovery and orderly-wind-down scenarios, including critical-service recovery, prolonged disruption, higher professional costs and support for affected users.
• Significant market venues should consider developing or enhancing scenario analysis, stress-testing governance, assumptions, frequency, management information and escalation thresholds.
• Finance and compliance functions may wish to prepare evidence linking financial-resources calculations to specific balance-sheet items and to the methodologies and assumptions reported under section 792F.
• Boards and senior management should consider reviewing dividend, distribution, intra-group funding and other capital-management controls to prevent actions that could cause or reasonably be expected to cause a financial-resources shortfall.
• Licensees should consider establishing documented monitoring, notification and remediation processes for actual or prospective shortfalls, including assessment of notification obligations under section 792B and restoration timeframes agreed with ASIC.

What changed

The consultation proposes revised RG 172 guidance supporting the existing obligation in section 792A(1)(d) of the Corporations Act 2001 to maintain sufficient resources to operate a market properly. A licensee would assess resources for all of its activities, not only a particular venue, and would generally need resources sufficient to cover at least six months of operating expenses; the assessment should include relevant service and outsourcing costs, including related-party arrangements.

Key dates

2026-10-29

FCA CP26/39 published and consultation opens.

2026-12-17 Deadline

Deadline for responses to CP26/39.

2027-03-18

PS26/2 final rules and guidance on operational incident and material third-party reporting come into force; the CTP-related enhanced reporting framework is expected to apply from this date.

2027-01-01

FCA plans to publish a Feedback Statement confirming the income-sharing metric and percentage for the equity CTP.

2027-04-01

FCA expects to publish its Policy Statement on how shared equity-CTP income is distributed among data contributors during spring 2027.

Suggested considerations

• Trading venues and other potential data contributors should consider modelling how alternative allocation metrics, including data contribution, trading activity, quote quality or coverage measures, could affect their expected income-sharing receipts.
• Prospective equity CTP bidders should consider the proposed distribution methodology, the five-year concession structure and the resulting revenue, accounting, data-governance and contractual controls in procurement and operating models.
• CTPs and firms providing critical technology or data services to CTPs should map operational incidents against the PS26/2 thresholds and assess whether current escalation, evidence retention and regulatory-notification procedures can support reporting as soon as practicable.
• CTPs should consider whether their incident-management playbooks distinguish standard and enhanced reporting, capture significant status changes and support submissions through the FCA’s prescribed reporting channel.
• Affected stakeholders should consider submitting responses to the FCA consultation by 17 December 2026, particularly on allocation fairness, data-contribution measurement, treatment of different contributor classes and the operational burden of enhanced incident reporting.
• Compliance teams may wish to track the early-2027 Feedback Statement on the income metric and percentage, the spring-2027 Policy Statement on distribution rules and the separate final rules on systematic-internaliser quotes.

What changed

The FCA proposes to add Handbook rules and guidance governing how the portion of equity CTP income specified in the five-year concession agreement is allocated among data contributors. The proposed allocation rules would apply regardless of the income metric or percentage ultimately specified in that agreement; the FCA plans to confirm the income-sharing percentage and metric in an early-2027 Feedback Statement and the distribution rules in a spring-2027 Policy Statement.

Key dates

2026-10-29

The Bank of England published the consultation and draft Supervisory Statement on CCP acceptance of tokenised collateral.

2027-02-12 Deadline

Consultation closes; responses on the draft supervisory expectations and wider tokenised-collateral policy are requested by this date.

2028-01-01

Target year for the Bank’s planned RT2 synchronisation capability supporting settlement between digital-asset ledgers and central bank money; this is a stated implementation target, not a compliance deadline.

Suggested considerations

• CCPs and prospective CCP applicants should consider whether tokenised versions of currently accepted or eligible collateral would constitute new collateral requiring notification to, or permission from, the Bank under the existing supervisory and margin-permission processes.
• Compliance, legal and risk teams should consider mapping each proposed tokenised collateral arrangement end to end, including issuance, representation of rights, custody, transfer, settlement finality, redemption, liquidation and default management.
• CCPs should consider preparing evidence on valuation methodology, price reliability, liquidity, conversion between tokenised and conventional forms, repo or outright-sale access, stress-market behaviour and concentration treatment across identical underlying assets.
• CCPs and their service providers should consider legal opinions addressing ownership, enforceability, insolvency treatment, settlement finality under the Settlement Finality Regulations, transfer restrictions and the relationship between ledger records, CSD records and underlying assets.
• Operational-resilience assessments should consider ledger, bridge, smart-contract, custodian, wallet, key-management and other third-party failure scenarios, including alternative access, transfer, liquidation and recovery arrangements.
• CCPs should consider whether proposed arrangements require changes to models, parameters, margining, collateral haircuts, default-management procedures, investment-policy controls, outsourcing oversight or governance approvals.
• Affected firms and infrastructure providers may wish to submit responses to the Bank’s consultation by 2027-02-12, particularly on practical barriers, wider tokenised-asset use cases and whether the proposed expectations remain suitable for future collateral types.
• Firms operating cross-border collateral arrangements should consider the interaction with parallel international developments, including ESMA’s October 2026 call for evidence on tokenised collateral in EU central clearing.

What changed

The Bank proposes to assess tokenised collateral through the existing supervisory process for new collateral, including where a tokenised version has risk characteristics that differ from the approved non-tokenised asset because of its delivery method, credit risk or liquidity profile. The draft Supervisory Statement adopts a technology-neutral, outcomes-focused and proportionate approach: CCPs would need to demonstrate that tokenised collateral can be valued, transferred, controlled and realised within required timeframes in normal and stressed conditions.

Key dates

2026-12-07 Deadline

First phased requirements under the amended RTS on settlement discipline and related ESMA guidelines apply to allocations and confirmations, including electronic, standardised and machine-readable communications, subject to the temporary technical disruption exception.

2027-07-01 Deadline

Additional phased requirements under the amended RTS on settlement discipline become applicable, as specified in the regulation’s transitional provisions.

2027-10-11 Deadline

Regulation (EU) 2025/2075 applies and the EU standard securities settlement cycle changes from T+2 to T+1; the final phase of related settlement-layer requirements also applies.

Suggested considerations

• Firms should map every affected transaction type, market, currency, venue, CSD, custodian, broker, client and outsourcing provider across the full trading and settlement ecosystem rather than assessing only internal readiness.
• Compliance and operations teams may wish to confirm whether allocations and confirmations can be completed on trade date and transmitted through electronic, standardised and machine-readable channels from 7 December 2026, including accurate place-of-settlement data where required.
• Firms should assess and test ISO or other applicable international messaging standards, matching platforms, standing settlement instruction governance, exception handling and the documented process for temporary technical disruptions.
• Firms should identify manual processing steps that cannot reliably operate within the shortened timetable and consider automation, straight-through processing, reconciliation, controls over data quality and resilient fallback arrangements.
• Firms should obtain implementation commitments and test plans from clients, brokers, custodians, CSD participants, CSDs, CCPs, vendors and outsourcing providers, with evidence of end-to-end testing and defect remediation.
• Firms should review liquidity, collateral, margin, FX funding, corporate-action, securities-lending, fund dealing and investment-operation processes for the reduced interval between trade and settlement.
• Firms should maintain a regulatory change plan covering the phased milestones on 7 December 2026, 1 July 2027 and 11 October 2027, with senior management oversight, documented risk acceptance and escalation of unresolved dependencies.

What changed

Regulation (EU) 2025/2075 amends Regulation (EU) No 909/2014 (CSDR) and provides for the EU settlement cycle to apply on a T+1 basis from 11 October 2027. Commission Delegated Regulation (EU) 2026/1536 amends the RTS on settlement discipline in Commission Delegated Regulation (EU) 2018/1229, with phased application beginning on 7 December 2026. From 7 December 2026, the allocation and confirmation process must use electronic, standardised communication channels and international messaging standards, with machine-readable communications required except during temporary technical disruptions.

Key dates

2012-12-31

MISMEL was licensed by the DFSA as a credit rating agency.

2023-12-01

Beginning of the period during which MISMEL reported seven inadvertent data-disclosure incidents to the DFSA; the source specifies December 2023 but not an exact day.

2026-05-31

End of the incident period described by the DFSA; the source specifies May 2026 but not an exact day.

2026-10-28

The DFSA announced the enforcement action and USD 585,825 penalty against MISMEL.

Suggested considerations

• Credit rating agencies should consider mapping confidential-information flows, permitted uses, recipients and disclosure exceptions against DFSA COB 8.9.1 and COB 8.9.2.
• Compliance and technology teams may wish to test email, endpoint, access-control, data-loss-prevention and external-recipient controls using realistic scenarios involving inadvertent disclosures.
• Firms should consider documenting compensating controls and an approved replacement before disabling or materially changing any security tool, with formal risk acceptance where continuity cannot be achieved.
• Control owners may wish to review incident detection, escalation, investigation and regulatory-notification processes, including whether repeated near misses are aggregated and reported to senior management and the DFSA where applicable.
• Senior management and compliance teams should consider reviewing employee training, attestations, supervision and disciplinary arrangements so that confidentiality obligations are demonstrably enforced and not merely documented.
• Credit rating agencies may wish to retain sufficient records and audit trails to evidence the operation and testing of confidentiality controls, noting the DFSA Rulebook requirement to maintain relevant records for at least six years.
• Firms outside the credit-rating sector should consider the enforcement action as an indicator of DFSA expectations for proportionate data-confidentiality governance, although the cited COB 8.9 requirements specifically apply to credit rating agencies.

What changed

This is an enforcement action rather than a new rule or prospective regulatory amendment. The DFSA found that MISMEL failed to implement and maintain adequate systems and controls to safeguard confidential information and failed to ensure that employees did not disclose it. The relevant DFSA framework requires a credit rating agency to maintain policies, procedures and controls preventing use of confidential information for unauthorised purposes and disclosure to other persons, subject to limited exceptions such as prior written consent or a legal obligation; COB 8.9.1 also addresses pending...

Key dates

2026-12-07 Deadline

First phased requirements apply to investment firms and their clients for allocations and confirmations, including electronic, standardised, international-standard and machine-readable communications except during temporary technical disruptions.

2027-07-01 Deadline

Second phased implementation deadline under the amended settlement-discipline framework.

2027-10-11 Deadline

EU securities markets move from the standard T+2 settlement cycle to T+1; the final phased settlement-discipline requirements apply.

Suggested considerations

• Firms should map every allocation, confirmation, matching and settlement-instruction process affected by the amended settlement-discipline RTS and identify manual, non-standardised or non-machine-readable steps.
• Compliance teams may wish to confirm that electronic, standardised communication channels and international messaging standards are available to the firm and its professional clients before 7 December 2026.
• Firms should consider implementing trade-date controls, internal cut-offs, automated alerts, escalation procedures and exception reporting to identify transactions at risk of missing the applicable allocation and confirmation deadline.
• Investment firms may wish to review client onboarding and contractual documentation to ensure that professional clients provide complete settlement details and use compatible communication channels and formats.
• Operations and technology teams should test end-to-end connectivity, message formats, reference data, settlement instructions, matching, foreign-exchange funding, securities lending, collateral and asset-servicing workflows across the entire trading and settlement ecosystem.
• Firms should assess readiness not only within their own organisation but also across brokers, custodians, clients, fund administrators, CSDs, settlement agents and other outsourced providers.
• Firms should establish a phased implementation plan covering the 7 December 2026, 1 July 2027 and 11 October 2027 milestones, with evidence of testing, issue remediation and management oversight.
• Compliance teams may wish to monitor further ESMA and CSSF supervisory communications because ESMA and national competent authorities have indicated that they will monitor compliance with the new obligations.

What changed

Amended settlement-discipline regulatory technical standards under Commission Delegated Regulation (EU) 2018/1229 introduce phased requirements supporting the EU T+1 transition. From 7 December 2026, investment firms and their clients must use electronic, standardised communication channels and international messaging standards for allocations and confirmations, with machine-readable communication required except during temporary technical disruptions.

Key dates

2026-10-23

FCA consultation CP26/38 opened and published.

2026-12-24 Deadline

Deadline for submitting responses to the FCA consultation.

2027-10-01

The FCA describes the new cryptoasset regime as applying from October 2027; the precise commencement date should be confirmed against the final legislation and FCA rules.

Suggested considerations

• Compliance teams may wish to review the proposed changes and submit consultation responses through the FCA online form by 24 December 2026, particularly where the proposals would create material implementation costs or operational challenges.
• Firms should consider mapping current fraud, AML/CTF, sanctions, proliferation-financing, data-security and financial-crime systems-and-controls frameworks against the consultation themes, while recognising that the proposals are not yet final guidance.
• Cryptoasset businesses and firms intending to provide regulated cryptoasset services may wish to assess readiness for the new regime expected in October 2027, including AML/KYC controls, blockchain analytics, Travel Rule processes, sanctions screening, transaction monitoring and governance.
• Firms using AI or external technology providers for transaction monitoring, customer screening or other financial-crime controls should consider documenting model governance, validation, parameter testing, explainability, human oversight, data security, third-party oversight and retention of decision records.
• Senior management and boards may wish to review whether financial-crime management information, risk assessments and escalation arrangements adequately cover proliferation financing, sanctions evasion, cryptoasset risks and reliance on outsourced or AI-enabled controls.
• Firms may wish to monitor the FCA's final Policy Statement and consolidated Financial Crime Guide, since the final text may differ from the consultation proposals and is likely to inform future supervisory assessments.

What changed

No new binding rules have been made by this consultation. The FCA proposes to revise non-Handbook guidance and practical examples in the Financial Crime Guide to reflect emerging risks and regulatory developments, including AI and third-party tools used in financial-crime controls, cryptoasset-specific risks, evolving financial and trade sanctions, proliferation financing, data security, fraud, and AML/CTF systems and controls.

Key dates

2020-11-01

Beginning of the period during which the Central Bank found Coinbase Ireland breached safeguarding and outsourcing obligations under the Electronic Money Regulations 2011.

2025-08-19

End of the enforcement period identified by the Central Bank.

2026-10-21

Central Bank of Ireland and Coinbase Ireland reached the settlement under the undisputed-facts settlement process.

2026-10-22

Central Bank published the enforcement outcome and announced the proposed reprimand and discounted monetary penalty.

Suggested considerations

• Firms should map all safeguarding responsibilities to the specific Irish or EU-authorised entity that holds the regulatory obligation and document how the entity retains effective control despite group or third-party outsourcing.
• Compliance teams may wish to assess whether the regulated entity has sufficient local expertise, decision-making authority and management information to oversee safeguarding and challenge outsourced providers on an ongoing basis.
• Firms should consider independently validating the design of safeguarding calculations, reconciliations, treasury-rebalancing processes and designated safeguarding-account funding, including testing for data, systems and mapping errors.
• Firms may wish to perform daily or otherwise risk-appropriate reconciliations between customer liabilities, safeguarding obligations and funds held in designated accounts, with documented investigation and remediation of exceptions.
• Boards and senior management should consider whether control testing covers the complete safeguarding process, including outsourced components, and whether testing is sufficiently independent and frequent to identify prolonged shortfalls.
• Firms should review escalation procedures for safeguarding incidents, control failures, underfunding and material changes to operating models, including criteria and ownership for notifying the Central Bank of Ireland.
• Authorised firms should compare their current operating model with representations, commitments and governance arrangements submitted during authorisation and assess whether any material changes were notified to the Central Bank.
• Outsourcing registers, contracts and service-level arrangements should be reviewed to confirm clear regulatory access, audit rights, information rights, incident reporting, business-continuity provisions and accountability for safeguarding outcomes.

What changed

The publication does not introduce a new statutory rule; it applies existing obligations under the Electronic Money Regulations 2011 and establishes a substantial enforcement precedent. Coinbase Ireland admitted that it lacked an adequate outsourcing-governance framework, relied excessively on a US Coinbase Group entity, lacked sufficient local skill and expertise to oversee safeguarding, used inadequately designed and tested systems that left its designated safeguarding account underfunded, and lacked adequate escalation and reporting arrangements for material safeguarding changes.

Key dates

2026-10-21

CSSF published the communiqué warning about CVE-2026-109618 and CVE-2026-109619; PHP also released security updates addressing the vulnerabilities on this date.

Suggested considerations

• Firms should consider urgently inventorying internet-facing and internally accessible services that run PHP, including PHP embedded in outsourced, cloud-hosted and vendor-managed applications.
• Technology and security teams may wish to determine the installed PHP branch and apply the relevant fixed release, including PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 where applicable, after validating compatibility and deployment integrity.
• Where immediate patching is not feasible, firms should consider isolating or taking affected internet-facing services offline, placing them behind network-layer authentication or equivalent compensating controls, and restricting PHP execution to required functions.
• Security teams may wish to review web-server, PHP, application, endpoint and identity logs for exploitation indicators, unusual child processes, unexpected outbound connections, persistence and activity associated with unauthenticated requests.
• Firms should consider assessing whether any unauthorised remote code execution, suspected compromise or material service disruption meets the applicable major ICT-related incident criteria and documenting the classification decision.
• DORA entities should consider preparing the notification required under Circular CSSF 25/893 and the applicable DORA implementing rules if the incident is classified as major; the initial notification is generally due within four hours of classification and no later than 24 hours after awareness, followed by an intermediate report within 72 hours and a final report within one month.
• Entities subject to CSSF Circular 24/847 should consider following that circular's notification process for a major ICT-related incident and confirming whether any parallel obligations arise under applicable NIS or sectoral requirements.
• Compliance teams may wish to retain evidence of the affected-asset inventory, patch or mitigation decisions, threat monitoring, incident assessment and communications with relevant ICT third-party providers.

What changed

The publication does not introduce a new standalone rule or compliance deadline; it provides an urgent supervisory warning and links the risk to existing ICT incident-reporting obligations. Until the affected versions were officially confirmed, the CSSF's stated position was that all PHP-powered services should be treated as potentially exposed. Independent security analysis reported that PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with both vulnerabilities rated CVSS 4.0 at 9.2 and capable of execution under the web-worker account.

Key dates

2026-10-21

FCA published GC26/7 and opened the guidance consultation.

2026-11-18 Deadline

Deadline for consultation responses to GC26/7.

2027-01-01

FCA plans to publish final DeFi guidance during January 2027; no specific publication day has been stated.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are due to bring new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Compliance teams may wish to map each DeFi use case, protocol, smart-contract dependency, service provider and customer-facing activity against the firm's existing SYSC 15A, SYSC 6 and Money Laundering Regulations obligations.
• Firms should consider documenting governance and accountability for DeFi arrangements, including who controls or can materially influence protocol changes, access permissions, treasury assets, upgrades, emergency controls and customer outcomes.
• Operational resilience teams may wish to assess important business services, impact tolerances, vulnerabilities, third-party and smart-contract dependencies, oracle and bridge risks, key-management arrangements, cyberattack scenarios and credible disruption testing.
• Financial-crime teams should consider whether existing customer due diligence, transaction monitoring, sanctions screening, blockchain analytics, wallet-risk assessment, suspicious activity escalation and record-keeping controls remain effective for pseudonymous, automated or cross-chain activity.
• Firms may wish to review outsourcing and third-party risk assessments for protocol developers, validators, custodians, wallet providers, analytics providers, cloud infrastructure and other critical DeFi dependencies.
• Legal and regulatory teams should assess whether current and planned activities fall within the existing perimeter or the new cryptoasset activities introduced by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, including whether there is an identifiable controlling entity.
• Affected stakeholders may wish to submit responses to the FCA by 18 November 2026 and identify any areas where the illustrative guidance is unclear, disproportionate or difficult to apply to genuinely decentralised arrangements.
• Firms may wish to track the FCA's planned final guidance in January 2027 and update risk assessments, policies, control testing and implementation plans before the new cryptoasset regime commences.

What changed

The FCA is proposing guidance describing the operational resilience and financial crime risks associated with DeFi and providing illustrative measures firms may consider. The guidance is relevant to firms within SYSC 15A, SYSC 6 and the Money Laundering Regulations, including firms using distributed-ledger technology, automated protocols, open and interoperable systems or arrangements with limited traditional intermediation. It is intended to clarify application of existing requirements rather than establish a separate DeFi regime or new Handbook obligations.

Key dates

2026-09-30

The application period opened for existing UK cryptoasset businesses seeking to conduct new regulated cryptoasset activities and benefit from the savings provision.

2026-10-21

FCA consultation CP26/36 opened and was published.

2026-11-18 Deadline

Deadline for responses to FCA consultation CP26/36.

2027-01-01

FCA aims to publish final perimeter guidance after considering consultation responses.

2027-02-28 Deadline

Application period closes for firms seeking to rely on the savings provision for newly regulated cryptoasset activities.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are scheduled to bring the new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Firms should map each proposed and existing cryptoasset activity against the statutory regulated activities in the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 and the proposed PERG guidance, documenting the factual basis for any exclusion relied upon.
• Technical-service providers should assess whether they merely provide access to a third-party service or decentralised protocol, or whether they also arrange, execute, safeguard, operate, control or otherwise provide a service to users; the use of automation or decentralised technology should not be treated as determinative.
• Stablecoin and payment businesses should identify the precise duration, purpose, parties and asset flows associated with temporary holding and backing-asset arrangements and test whether the relevant statutory conditions are met.
• Trading firms and market makers should distinguish genuine proprietary trading from activity performed as a service for another person and retain evidence supporting any reliance on the proprietary-trading or qualifying-cryptoasset-trading-platform market-maker exclusion.
• Firms should review safeguarding and settlement structures, including structures involving central securities depositaries and third-country central securities depositaries, for possible inclusion within the proposed exclusions or within regulated custody-related activities.
• Businesses that may need authorisation should consider submitting responses to CP26/36 by 18 November 2026 and should not defer application planning while the guidance remains in consultation.
• Existing UK cryptoasset businesses seeking to conduct newly regulated activities should consider submitting an otherwise complete application between 30 September 2026 and 28 February 2027 to preserve access to the applicable savings provision.
• Firms materially affected by uncertainty about the technical-services-provider exclusion should consider engaging the FCA through its pre-application support service and retaining evidence of how that uncertainty affected application preparation.

What changed

The FCA proposes guidance on exclusions from regulated cryptoasset activities introduced by the draft Cryptoassets (Miscellaneous Amendments) Regulations 2026. The examples include temporary settlement arrangements; temporary arrangements for holding UK qualifying stablecoins in connection with payment transactions; arrangements involving backing assets held in relation to a UK qualifying stablecoin; proprietary trading where the person is not providing a service to another person; proprietary trading by a market maker on a qualifying cryptoasset trading platform; and technical services that...

Key dates

2026-10-20

ESMA published its final report on the RTS specifying requirements for PTRR services using the EMIR 3 clearing-obligation exemption.

Suggested considerations

• PTRR providers should compare their existing compression, rebalancing and basis-risk-optimisation procedures with the final ESMA requirements, particularly participant disclosures, algorithm governance, execution controls, record retention and monitoring support.
• Firms should identify OTC derivative transactions processed through PTRR services that are currently expected to rely on the EMIR 3 conditional clearing exemption and document the legal and operational basis for that treatment.
• Compliance and legal teams may wish to review contracts, client disclosures and service descriptions to ensure that participants receive adequate information about the exercise, its methodology, expected outcomes and relevant risks.
• Providers should consider preserving evidence that each exercise meets the applicable risk-reduction and market-risk-neutrality conditions and does not function as a means of avoiding the clearing obligation.
• Firms should prepare for possible changes when the European Commission endorses the RTS, including tracking the endorsement, publication and application dates and updating policies, controls, reporting procedures and staff guidance accordingly.
• Operations and records-management teams should assess whether existing books and records can identify the participants, transactions, algorithms, controls, results and decisions associated with each PTRR exercise for the required supervisory period.
• Users of third-party PTRR services should consider obtaining contractual assurances and sufficient information from providers to demonstrate that transactions claimed as exempt satisfy the final RTS conditions.
• Industry participants may wish to monitor Commission endorsement and any transitional provisions rather than treating the 20 October 2026 publication date as the effective date of the RTS.

What changed

The final report specifies the conditions under which transactions resulting from PTRR services may qualify for the EMIR 3 clearing-obligation exemption, including requirements concerning participant information, the conduct and execution of PTRR exercises, provider controls, record-keeping and supervisory monitoring. The framework addresses the main service types identified in ESMA's consultation: portfolio compression, portfolio rebalancing and basis risk optimisation, with requirements intended to demonstrate risk reduction and prevent circumvention of the clearing obligation.

Key dates

2026-10-16

ESMA publishes the final revised Guidelines on standardised procedures and messaging protocols used between investment firms and their professional clients.

2026-12-07 Deadline

First regulatory milestone: the new allocation and confirmation requirements apply, including mandatory electronic, standardised and machine-readable communication methods, subject to temporary technical-disruption exceptions.

2027-10-11 Deadline

EU securities markets move from T+2 to T+1 settlement; the final phase of the amended settlement-discipline implementation is expected to apply, including settlement-layer process and CSD functionality changes.

Suggested considerations

• Map the firm's transactions, clients, counterparties and settlement venues against CSDR Article 5(2), including the scope for transferable securities traded on an EU trading venue and settling in an EU-registered CSD.
• Assess whether the firm is directly subject to the amended RTS on Settlement Discipline or must implement equivalent controls contractually or operationally for clients and counterparties.
• Complete a gap assessment of allocation and confirmation workflows against the 7 December 2026 requirements for electronic, standardised, international and machine-readable communications.
• Replace manual, oral, email-based or non-machine-readable processes where they are not justified by a temporary technical disruption, and document the disruption, compensating controls, duration and remediation.
• Configure systems to support continuous same-day processing and, taking account of the industry roadmap, completion of allocations and confirmations no later than 23:00 CET on trade date.
• Validate the capture and exchange of critical static data, including place of settlement, BIC, ISIN, MIC and standing settlement instruction data, and establish controls over data quality and versioning.
• Test end-to-end processing with investment firms, professional clients, custodians, brokers, clearing members, CSDs, settlement systems, FX providers and technology vendors rather than testing only internal systems.
• Review client and counterparty agreements, service descriptions, operating memoranda and escalation procedures for the compressed T+1 timetable and cross-border time-zone dependencies.

What changed

The revised ESMA Guidelines on standardised procedures and messaging protocols clarify how investment firms and their professional clients must meet the allocation and confirmation requirements in the amended RTS on Settlement Discipline. From 7 December 2026, firms must use electronic, standardised communication channels and international messaging standards, with machine-readable communication required except during temporary technical disruptions.

Key dates

2026-10-16

SFC welcomed HKEX’s consultation conclusions on the proposed transition from T+2 to T+1; HKEX published the consultation conclusions on the same date.

2028-09-01

September 2028 is identified as HKEX’s target month for implementation within the broader second-half-of-2028 timetable, subject to market readiness, regulatory approval and final rule and procedure amendments.

Suggested considerations

• Firms should map all Hong Kong cash-market products, trading venues, settlement locations and transaction types that may fall within the final T+1 scope, including stock-option physical settlement where relevant.
• Compliance and operations teams may wish to perform an end-to-end impact assessment covering trade capture, allocation, confirmation, affirmation, settlement-instruction creation and matching, funding, stock borrowing, corporate actions, reconciliations, fails management and client reporting.
• Firms should assess whether overseas time zones, foreign-exchange funding, cross-border custody arrangements and client approval processes will effectively create a T+0 operating deadline for US- and European-based investors.
• Broker-dealers, custodians and investment managers should review service-level agreements, settlement cut-offs, standing settlement instructions, client documentation, fail-allocation terms and contractual responsibility for late or failed settlement.
• Technology teams may wish to test automation, real-time or near-real-time status updates, API connectivity, matching, exception queues, reconciliation and management information against the compressed timetable.
• Firms should engage HKEX, HKSCC, executing brokers, custodians, prime brokers, fund administrators and other vendors on technical specifications, testing windows, training and readiness assessments as they become available.
• Risk and treasury functions may wish to reassess intraday liquidity, pre-funding, collateral, stock-borrow availability, overdraft capacity, settlement-fail exposure and related client-margin assumptions.
• Compliance teams should monitor the consequential amendments to HKEX and HKSCC rules and procedures, SFC communications, regulatory approvals and any final scope, cut-off, penalty or fail-management provisions before treating the September 2028 date as firm.

What changed

HKEX proposes to settle in-scope Hong Kong cash-market transactions one business day after trade date rather than two business days. The transition is subject to market readiness, regulatory approval and consequential amendments to applicable HKEX and settlement-system rules and procedures; the SFC says it will work with HKEX on those amendments and implementation arrangements.

Key dates

2026-06-10

The FSB published the consultation report proposing 12 sound practices for responsible AI adoption.

2026-07-22

The FSB consultation closed; approximately 160 responses were received.

2026-10-15

The FSB published the overview of consultation responses and the final report containing the 12 sound practices.

Suggested considerations

• Firms should consider mapping existing AI inventories, model-risk controls, operational-resilience arrangements, cyber controls, outsourcing registers, and board reporting against all 12 FSB practices.
• Compliance teams may wish to introduce or validate a documented, risk-based materiality assessment for each AI use case at inception and throughout its lifecycle, including uses embedded in products or obtained from vendors.
• Boards and senior management should consider whether AI adoption is aligned with business strategy, risk appetite, accountability structures, and existing risk-management frameworks.
• Firms using generative or agentic AI should consider defining permitted actions, autonomy limits, escalation paths, human-approval triggers, monitoring thresholds, and tested stop or safe-interruption procedures.
• Firms should consider retaining records sufficient to identify the AI system, data, model or vendor, intended purpose, materiality assessment, testing, approvals, monitoring results, changes, incidents, and reconstructed decisions or actions.
• Procurement and third-party-risk teams may wish to assess AI providers for performance, transparency, data quality, supply-chain exposure, concentration risk, exit options, resilience, and business-continuity arrangements.
• Technology and operational-resilience teams should consider adding AI-specific cyber and ICT scenarios to testing and exercises, including model manipulation, data poisoning, prompt or agent compromise, erroneous autonomous actions, provider outage, and loss of vendor access.
• Firms should consider reviewing the interaction between the FSB practices and binding local requirements, including the EU Digital Operational Resilience Act, EU AI Act, sectoral outsourcing rules, model-risk requirements, data-protection law, and senior-management accountability regimes.

What changed

The final framework retains 12 practices covering board and senior-management oversight, governance and accountability, AI risk integration and documentation, organisational adaptability, materiality assessment, model selection, data governance, explainability and transparency, performance management, human oversight, cyber and ICT risk, and third-party AI risk.

Key dates

2026-06-10

The FSB published its consultation report proposing 12 sound practices for responsible AI adoption by financial institutions.

2026-10-15

The FSB published the final report and consultation-response overview. The sound practices take effect as non-binding supervisory guidance with no stated implementation deadline.

Suggested considerations

• Firms should inventory AI use cases, including embedded or shadow AI and autonomous or agentic functionality, and assign accountable owners for each use case.
• Boards and senior management may wish to evidence how AI adoption aligns with the business model, strategy, risk appetite and existing governance framework.
• Compliance and risk teams should consider adding AI-specific materiality, risk and approval assessments at inception and at defined review points after deployment or material model changes.
• Firms should consider documenting model purpose, data sources, versions, limitations, testing, performance results, explainability assessments, human controls, incidents and changes sufficiently to reconstruct AI-supported decisions and actions.
• For higher-risk or autonomous use cases, firms should consider setting risk-based human-approval triggers, access and action limits, real-time or periodic monitoring, escalation paths and tested intervention or shutdown mechanisms.
• Existing cyber, ICT, operational resilience and third-party risk assessments may need to be extended to cover AI-specific threats, model manipulation, data leakage, outages, unsafe updates and concentration among common providers or models.
• Procurement and legal teams should consider whether third-party AI contracts provide adequate monitoring, transparency, data-quality information, audit and access rights, change notification, incident cooperation, business continuity and exit arrangements.
• Firms should map the FSB practices against applicable requirements under DORA, the EU AI Act, outsourcing rules, model-risk frameworks, conduct obligations and data-protection law, recording any gaps and the basis for proportionate controls.

What changed

The final report consolidates 12 proportionate practices into two areas: organisation-wide AI governance and risk management across the AI lifecycle. It strongly encourages boards and senior management to align AI adoption with business strategy and risk appetite, define responsibilities, incorporate AI risks into existing risk frameworks, document AI use cases, assess materiality at inception and thereafter, govern data, address explainability, evaluate performance, provide risk-based human oversight, manage AI-related cyber and ICT risks, and control third-party AI dependencies.

Key dates

2026-10-15

FSB published the final report on Sound Practices for Responsible Adoption of Artificial Intelligence.

Suggested considerations

• Firms should consider inventorying all material AI use cases, including internally developed tools, vendor-provided models, embedded productivity tools, generative AI and agentic or multi-agent systems, with ownership, purpose, data sources, model dependencies and deployment status recorded.
• Compliance teams may wish to map each use case to a documented materiality and risk classification performed at inception and refreshed after material model, data, vendor, scope or operating-environment changes.
• Boards and senior management should consider whether AI governance, risk appetite statements, delegated authorities and management information clearly cover autonomous actions, prohibited uses, escalation thresholds and accountability for AI-supported decisions.
• Firms should consider integrating AI-specific controls into existing model risk management, operational-risk, ICT-risk, cybersecurity, outsourcing and business-continuity frameworks rather than creating disconnected governance.
• Model and technology teams may wish to maintain evidence of data provenance, data quality, testing, validation, performance metrics, drift monitoring, incident handling, explainability assessments and compensating controls where explainability is limited.
• For higher-risk or autonomous use cases, firms should consider mandatory human approval triggers, bounded permissions, segregation of duties, real-time or near-real-time monitoring, complete audit trails, emergency stop or rollback capability and periodic reassessment of whether human oversight remains effective.
• Procurement and third-party-risk functions should consider enhancing due diligence and contracts for AI providers to address model performance, transparency, training and input data, subcontracting, security, audit access, incident notification, portability, exit planning, concentration risk and service continuity.
• Cybersecurity teams should consider adding AI-enabled attacks, prompt injection, data poisoning, model manipulation, deepfakes, automated exploitation and misuse of AI-assisted coding or defensive tools to threat assessments, testing and exercises.

What changed

The FSB replaced its June 2026 consultation with a final framework of 12 proportionate sound practices. The practices require firms to align AI adoption with business strategy and risk appetite; define accountability; incorporate AI risks into enterprise risk management; document AI use and materiality assessments; select models according to business, technical and risk requirements; govern data quality and security; address explainability and stakeholder transparency; test and monitor performance; apply human oversight proportionate to autonomy, complexity, risk and explainability; manage...

Key dates

2026-10-15

ADGM announced publication of Consultation Paper No. 7 of 2026 on the proposed regulatory framework for business centres.

2026-11-06 Deadline

Consultation period closes; stakeholders wishing to provide feedback should submit comments by this date.

Suggested considerations

• Business centre operators should consider reviewing the consultation paper and the proposed Controlled Activities Rules, Conditions of Licence and Branch Registration Rules, and Fees Rules to identify whether their current services would fall within the proposed controlled activity.
• Existing and prospective operators should consider assessing licensing eligibility, governance, premises, staffing, client-contract, registered-office and continuity arrangements against the proposed framework once the detailed amendments are reviewed.
• Company service providers and firms using business centres should consider assessing whether their current registered-office or premises arrangements depend on an operator that may require a new or amended ADGM licence.
• Affected stakeholders should consider submitting comments to the RA before 6 November 2026, including feedback on scope, transitional arrangements, fees, continuity protections and the treatment of existing tenants.
• Compliance teams may wish to monitor the RA’s final rules and any implementation or grandfathering provisions before treating the proposal as a binding obligation.

What changed

The RA proposes amendments to the Commercial Licensing Regulations (Controlled Activities) Rules, the Commercial Licensing Regulations (Conditions of Licence and Branch Registration) Rules, and the Commercial Licensing Regulations (Fees) Rules. The proposed framework would classify the provision of business centre services as a controlled activity, meaning that business centre operators would need the relevant ADGM commercial licence or applicable exemption.

Key dates

2026-10-15

OSFI published its statement endorsing the FSB Sound Practices for Responsible Adoption of Artificial Intelligence; the FSB also published the final Sound Practices on this date.

Suggested considerations

• Compliance teams may wish to map the 12 FSB practices against existing controls under OSFI’s Corporate Governance Guideline, Integrity and Security Guideline, Guideline B-10, Guideline B-13, Guideline E-21 and Guideline E-23.
• Firms should consider maintaining an enterprise-wide inventory of AI use cases, including internally developed systems, embedded vendor functionality and generative or agentic AI, with documented owners, intended purposes, materiality assessments and lifecycle status.
• Boards and senior management may wish to review whether the institution’s business strategy, risk appetite and governance framework clearly address AI adoption, accountability, escalation and human oversight.
• Firms should consider assessing AI use cases for operational, technology, cyber, third-party, model, data, privacy, conduct and governance risks, with controls proportionate to the materiality and risk of each use case.
• Compliance and risk functions may wish to review AI development and deployment documentation, validation, monitoring, change management, testing, incident escalation, explainability and retirement processes, including for systems supplied by third parties.
• Institutions should consider evaluating whether existing B-10 outsourcing and third-party risk controls address vendor model changes, data access, subcontracting, concentration risk, resilience, audit rights and exit arrangements for AI-enabled services.
• Internal audit or an equivalent independent assurance function may wish to assess whether AI governance and lifecycle controls operate effectively and whether management reporting to the board is sufficiently complete.
• Firms may wish to monitor subsequent OSFI technology risk bulletins, supervisory communications and future revisions to the FSB practices, since OSFI stated that it will continue monitoring how AI changes the risk environment and institutional operations.

What changed

OSFI formally endorsed the FSB Sound Practices and identified them as complementary to existing OSFI expectations. The FSB practices cover organization-wide AI governance and management across the AI lifecycle, including strategic direction, accountability, risk management, human oversight, data governance, controls, adaptability and coordination. The publication is non-binding guidance rather than a new OSFI rule, capital requirement, reporting obligation or prescribed compliance deadline.

Key dates

2026-10-15

The proposed rule is published in the Federal Register.

2026-12-14 Deadline

Public comments on the proposed amendments to 12 CFR parts 704 and 713 are due.

Suggested considerations

• Compliance teams may wish to review the proposal against existing policies and procedures under 12 CFR 704.18, 12 CFR 713, and 12 CFR 741.201, distinguishing provisions that would be removed from obligations that would remain.
• Credit unions should continue to maintain existing fidelity-bond coverage, deductibles, renewal processes, and NCUA-related approvals unless and until a final rule becomes effective.
• Boards and management may wish to assess whether current coverage remains adequate for fraud, dishonesty, theft, burglary, robbery, and other covered losses, and preserve documentation supporting the required board review.
• Credit unions and insurers may wish to evaluate whether the proposed flexibility in coverage amounts and deductibles affects policy terms, underwriting, renewal timing, or internal risk assessments.
• Interested parties may wish to submit comments by December 14, 2026, addressing the proposed treatment of coverage calculations, deductibles, bond forms, purchase and renewal procedures, and any transition or implementation concerns.

What changed

The proposal would amend 12 CFR part 713 and related corporate-credit-union requirements in 12 CFR 704.18 by eliminating or modifying prescriptive procedural requirements concerning fidelity-bond purchases and renewals, simplifying the rules governing coverage amounts and deductibles, and removing outdated requirements. The proposal would preserve the requirement that a federally insured credit union maintain adequate fidelity-bond coverage against losses involving fraud, dishonesty, theft, and other covered risks.

Key dates

2026-10-14

The EBA announced that USDC issued by Circle Internet Financial Europe SAS had been classified as a significant EMT under MiCA.

2026-11-12 Deadline

Dual supervision of USDC begins: the EBA assumes direct responsibility for own funds, reserve of assets, liquidity requirements, and recovery and redemption plans, while the ACPR retains specified governance and organisational responsibilities.

Suggested considerations

• Circle and its regulatory counsel should map existing own-funds, reserve-of-assets, liquidity, recovery, and redemption controls to the EBA’s supervisory expectations and establish clear evidence and reporting channels before 2026-11-12.
• Circle should confirm the allocation of responsibilities between the EBA and ACPR, including supervisory contacts, escalation procedures, information requests, and documentation ownership for prudential and organisational matters.
• Crypto-asset service providers should reassess their USDC due diligence, product governance, liquidity, redemption, custody, safeguarding, and operational-risk controls in light of the significant-EMT designation.
• Firms using USDC should identify exposures in client assets, settlement, treasury, collateral, and payment flows and assess whether updated counterparty, liquidity, concentration, and business-continuity assessments are appropriate.
• Compliance teams should monitor EBA and ACPR communications, supervisory-college activity, and any subsequent guidance or requests concerning significant EMT reporting and recovery or redemption planning.
• Firms operating across the EU and United States should review information-sharing, incident-notification, and cross-border supervisory arrangements, noting the EBA’s memorandum of understanding with the New York State Department of Financial Services.

What changed

USDC will be subject to the MiCA framework for significant EMTs from 2026-11-12. The EBA will assume direct supervisory responsibility for own-funds requirements, the reserve of assets, liquidity requirements, and recovery and redemption plans; the ACPR will continue supervising governance, qualifying holdings, fit and proper assessments, outsourcing, and conflicts of interest. Under MiCA Articles 56 and 43(1), an EMT is classified as significant where at least three significance criteria are met during the applicable reporting periods.

Key dates

2021-04-20

Start of the relevant period during which Fortnum admitted the cybersecurity governance failures occurred.

2022-01-01

Independent industry reporting identified a 2022 cyber incident at a Fortnum authorised representative involving data relating to up to 9,828 clients; the ASIC publication does not specify the incident date.

2023-05-11

End of the relevant period covered by Fortnum’s admissions.

2025-07-22

ASIC commenced Supreme Court of NSW proceedings against Fortnum concerning alleged failures to manage and mitigate cybersecurity risks.

2026-10-12

The Supreme Court of NSW approved the agreed $1.35 million pecuniary penalty and ordered Fortnum to pay $250,000 toward ASIC’s costs.

2026-10-14

ASIC published the enforcement outcome and stated that this was its third cyber-resilience enforcement action against an AFSL holder, following RI Advice and FIIG Securities.

Suggested considerations

• Compliance teams may wish to map cybersecurity governance to the licensee’s obligations under section 912A of the Corporations Act 2001 (Cth), including documented ownership, escalation and board or senior-management oversight.
• Firms should consider assessing whether their cybersecurity policy applies consistently to authorised representatives, outsourced providers and other connected practices, with minimum controls, implementation evidence and exception-management processes.
• Licensees may wish to establish a documented assurance programme covering representative due diligence, cyber training, control testing, incident reporting, vulnerability management and periodic reviews of representative cyber resilience.
• Firms should consider whether they have access to suitably qualified cybersecurity expertise, either internally or through appropriately scoped external specialists, and retain evidence that advice informs the risk-management framework.
• Compliance teams may wish to test whether their risk-management system identifies and evaluates cyber risks across the entire advice network and whether monitoring results are reported to accountable senior personnel.
• Following a cyber incident or material control deficiency, firms should consider prompt escalation, preservation of evidence, assessment of notification obligations and constructive engagement with ASIC; Fortnum’s self-reporting and cooperation were identified as relevant factors in the agreed penalty.
• Firms should consider validating that cyber controls protect highly sensitive personal information, including identity documents, tax file numbers and financial-account details, and that remediation is independently verified rather than limited to policy updates.

What changed

No new rule or prospective compliance deadline was introduced. The enforcement outcome establishes a further ASIC precedent that an AFSL holder’s obligation to provide financial services efficiently, honestly and fairly and to maintain adequate risk-management systems extends to cybersecurity controls, specialist expertise and oversight of authorised representatives.

Key dates

2026-10-13

Federal Register publication date for the ANPRM, published as 91 FR 64811 and document number 2026-20888.

2026-12-14 Deadline

Deadline for submitting comments to the CFTC on Regulation CTX, Regulation CAM, and the interpretation and implementation of CEA section 2(c)(2)(D).

Suggested considerations

• Compliance teams may wish to determine whether current or planned retail crypto products could constitute transactions covered by CEA section 2(c)(2)(D), including products described as spot, margin, leveraged, financed, perpetual, or otherwise structured to defer delivery.
• Firms should consider mapping current customer agreements, funding arrangements, custody models, delivery controls, and liquidation processes against the CFTC's preliminary positions on offers and actual delivery.
• Prospective venues may wish to assess the potential CAM operating model, including registration perimeter, governance, listing standards, market surveillance, position controls, execution, recordkeeping, cyber and system safeguards, proof-of-reserves, and customer-asset arrangements.
• FCMs, IBs, DCOs, custodians, and leverage providers should consider identifying the registrations, permissions, capital, segregation, margin, clearing, insolvency, and operational dependencies that a CAM structure could create.
• Crypto businesses may wish to prepare comments addressing the scope of section 2(c)(2)(D), the definition and practical test for actual delivery, treatment of fully paid open transactions, permissible crypto assets, and the allocation of responsibilities among CAMs, FCMs, DCOs, and leverage providers.
• Firms should monitor whether the CFTC follows the ANPRM with a formal proposed rule and should not treat the ANPRM as creating immediate registration, margin, reporting, or conduct obligations.
• Affected firms may wish to preserve evidence of product design, delivery capability, customer disclosures, surveillance controls, and legal analysis in anticipation of supervisory or enforcement scrutiny under the CFTC's stated interpretation of section 2(c)(2)(D).

What changed

The CFTC has published ANPRM RIN 3038-AF80, 91 FR 64811, concerning proposed Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets. Regulation CTX would seek to clarify when section 2(c)(2)(D) applies to crypto asset transactions, including the meaning of covered offers, actual delivery, and actual delivery of fully paid open transactions. Regulation CAM would create a crypto asset market subcategory of designated contract market registration under 17 CFR part 38, supported by related amendments or requirements under 17 CFR parts 1, 38, and 39.

Suggested considerations

• Firms should consider conducting a documented effectiveness review of governance arrangements, covering board composition and capability, challenge and decisions, delegation and escalation, management information, conflicts and assurance.
• Boards and management bodies may wish to map collective capability against the administrator's current and emerging risks, including technology, cyber resilience, data management, innovation, methodology, market structure and user needs.
• Compliance teams may wish to test whether board and committee records capture principal challenge, decision rationale, actions, ownership and follow-through, including significant decisions taken between scheduled meetings.
• Firms should consider documenting ownership of key risks, decision rights, escalation routes and the way UK-regulated entity obligations are represented in group governance arrangements.
• Administrators may wish to review whether group reporting and escalation channels remain effective if individuals with multiple roles are unavailable, conflicted or subject to competing priorities.
• Firms should consider whether conflicts frameworks address multiple roles, group relationships, commercial pressures, competing priorities and differing stakeholder interests, and whether identified conflicts, mitigations and decisions are recorded.
• Board reporting owners may wish to distinguish information provided for awareness from matters requiring discussion, decision or escalation, and highlight changes, exceptions, emerging trends, risk movements, mitigation effectiveness and overdue actions.
• Administrators should consider whether between-meeting escalation arrangements provide directors with timely information on significant developments without disconnecting those decisions from formal governance records.

What changed

The FCA has not amended rules, introduced new thresholds or imposed a compliance deadline. Instead, it has set out supervisory observations that benchmark administrators should assess against their own activities, risks, users and operating environments. The FCA will use these observations in supervisory engagement alongside developments in the benchmarks framework.

Key dates

2021-10-31

The insured family lodged the storm-related home insurance claim after roof damage in October 2021.

2022-08-01

A structural engineering assessment occurred approximately eight months after the need for one was identified; the source gives August 2022 but not an exact day.

2022-12-01

After the family complained to Hollard in late 2022, Hollard offered a $1,000 goodwill payment, which was rejected; the source gives only the month and year.

2023-04-01

Hollard made its final claim decision and rejected the claim approximately 15 months after initially accepting it; the source gives April 2023 but not an exact day.

2025-04-01

ASIC commenced Federal Court proceedings alleging breaches of section 13(2A) of the Insurance Contracts Act 1984 (Cth); the source gives April 2025 but not an exact day.

2026-10-09

The Federal Court ordered Hollard to pay a $2 million civil penalty for breach of the duty of utmost good faith.

Suggested considerations

• Compliance teams may wish to review open and recently closed home and property claims for extended periods of inactivity, delayed expert assessments, repeated reassignment, late temporary accommodation and decisions inconsistent with available expert evidence.
• Insurers should consider testing whether claims systems identify deterioration risks, vulnerable customers, habitability issues and requests for emergency accommodation, and whether those matters trigger timely management escalation.
• Firms should consider documenting clear ownership, next actions, decision dates and customer communications throughout the claim, including reasons for any investigation or decision delay.
• Insurers may wish to assess whether rejection decisions are supported by appropriate technical evidence and whether new evidence is properly reconciled with earlier inspections or admissions of cover.
• Claims governance functions should consider reviewing outsourced-provider service levels, escalation controls and management information for aging claims, complaint recurrence, temporary accommodation delays and claims exceeding internal handling targets.
• Legal and compliance teams may wish to map controls against Insurance Contracts Act 1984 (Cth), section 13(2A), and Corporations Act 2001 (Cth), section 912A(1)(a), while considering ASIC's 2024 claims-handling letter, 2025 review findings and 2026 enforcement priority.

What changed

The judgment establishes a binding enforcement precedent that an insurer may incur a civil penalty under section 13(2A) of the Insurance Contracts Act 1984 (Cth) where claims handling falls materially below the duty of utmost good faith. It does not introduce a new statutory claims-handling rule or compliance deadline, but confirms that insurers must handle claims fairly, communicate clearly, progress investigations and decisions without unnecessary delay, and respond appropriately when delay risks further insured loss.

Key dates

2026-10-09

ESMA launched the Call for Evidence on the use of tokenised collateral by EU CCPs.

2027-01-15 Deadline

Deadline for stakeholders to submit responses to ESMA's Call for Evidence.

2027-03-31

ESMA is expected to assess the feedback during the first quarter of 2027; the source does not specify an exact day.

Suggested considerations

• CCPs, clearing members and relevant infrastructure providers should consider whether to submit evidence through ESMA's consultation webpage by 15 January 2027, including practical data on existing pilots, live arrangements, legal structures and stress scenarios.
• Compliance and legal teams may wish to map each proposed tokenisation model against the collateral requirements in Article 46 of Regulation (EU) No 648/2012 and Commission Delegated Regulation (EU) No 153/2013, including quality, liquidity, credit and market-risk, custody and operational-availability criteria.
• Firms developing tokenised collateral arrangements should consider documenting whether the token gives the holder ownership of, a security interest in, or another enforceable right to the underlying asset, and how that right would operate across insolvency, default and cross-border situations.
• CCPs and clearing members may wish to test whether tokenised collateral can be accessed, transferred, valued, liquidated or converted into central-bank money or other liquidity within required default-management timelines, including during distributed-ledger outages, congestion, cyber incidents and loss of connectivity to traditional infrastructures.
• Firms should consider assessing client-asset segregation, title-transfer, custody, insolvency-remoteness and settlement-finality arrangements where distributed-ledger systems interact with traditional custodians, central securities depositories or payment systems.
• Risk and compliance functions may wish to reassess whether tokenisation changes the risk profile of otherwise eligible collateral, including redemption, transfer restrictions, oracle dependence, smart-contract risk, operational resilience, concentration risk and liquidity-discount assumptions.
• Industry respondents may wish to provide ESMA with evidence on interactions between tokenised collateral and tokenised cash, stablecoins, tokenised deposits and other settlement assets, rather than assuming that liquidity in the underlying asset automatically carries over to its tokenised form.
• Firms should monitor ESMA's first-quarter 2027 assessment and any subsequent amendments to EMIR technical standards, supervisory convergence measures or supervisory expectations; no immediate change to existing collateral controls should be inferred from the Call for Evidence.

What changed

ESMA has opened a consultation and requested stakeholder evidence by 15 January 2027. It is examining the full collateral lifecycle, including transfer, custody, protection, segregation, access, valuation, settlement and conversion into liquidity during market stress or following a clearing-member default. The Call for Evidence covers tokenised representations of assets held in traditional infrastructures, assets issued directly on distributed-ledger technology, hybrid models, and interactions with tokenised cash and other settlement assets.

Key dates

2027-01-17 Deadline

The current transitional regime for certain third-country CSD notary and central maintenance services is scheduled to expire; ESMA says access should nevertheless not be prevented after this date pending finalisation of the legislative extension.

Suggested considerations

• Firms should identify securities, issuer programmes, custody chains and settlement arrangements that depend directly or indirectly on a third-country CSD, including arrangements involving DTC or other non-EU infrastructure.
• Compliance and operations teams may wish to document reliance on the transitional regime and assess the consequences of a delayed or unsuccessful legislative extension, including possible suspension, removal of securities from a CSD system, settlement disruption and trading interruption.
• Issuers should consider confirming with their third-country CSD, depositary, registrar, paying agent, custodian and trading venues how access is expected to be maintained after 17 January 2027 and what contingency arrangements exist.
• Firms should distinguish ESMA's policy statement from a binding legislative amendment or formal recognition decision and avoid treating it as confirmation that every third-country CSD may provide services indefinitely without satisfying CSDR requirements.
• Legal and regulatory teams may wish to monitor the final text and commencement date of the Market Integration and Supervision Package, together with any European Commission equivalence decisions and ESMA recognition decisions relevant to the CSDs used by the firm.
• Firms should review contractual, disclosure and operational-resilience documentation so that any dependency on third-country CSD access, alternative settlement routes or potential service suspension is appropriately reflected.

What changed

ESMA has provided a supervisory and market-access clarification that EU market participants should not be prevented from accessing the relevant notary and central maintenance services of third-country CSDs solely because the current transitional regime reaches its scheduled end on 17 January 2027. The clarification is intended to apply during the period after that date and until the EU finalises the proposed legislative extension under the Market Integration and Supervision Package.

Key dates

2026-10-07

MAS issued the Guidelines on Artificial Intelligence Risk Management following its November 2025 consultation.

2027-10-07 Deadline

The Guidelines take effect. FIs should meet the expectations in Sections 3 and 4 from this date.

2027-10-07

MAS intends to consult the financial sector during 2027 on what additional guidance on agentic AI would be useful.

2028-10-07 Deadline

FIs should meet the expectations in Sections 5 and 6 by this date under the phased implementation timetable.

Suggested considerations

• FIs should establish or update an enterprise inventory of AI systems, models, embedded AI functionality and third-party AI services, using a level of granularity appropriate to their risk profile.
• Compliance and risk teams may wish to classify individual AI use cases by materiality, including potential effects on customers, prudential soundness, operational resilience, other financial institutions and the wider financial system.
• Boards and senior management should consider documenting AI risk appetite, ownership, escalation routes and the allocation of responsibilities across business, risk, compliance, technology, cybersecurity, data and model-governance functions.
• FIs should map existing AI controls across the lifecycle, including data governance, development and validation, testing, human oversight, cybersecurity, monitoring, incident management and change management, and identify gaps against the Guidelines.
• Procurement, outsourcing and third-party-risk functions should consider adding AI-specific due diligence, assurance, contractual rights, performance monitoring, incident notification and exit or substitution arrangements for external AI providers.
• FIs should assess whether existing governance committees and risk frameworks provide sufficient cross-functional oversight, rather than assuming that a new dedicated AI committee is necessary.
• FIs may wish to define evidence that supports proportionality decisions, including why basic policies and procedures are adequate for lower-materiality AI use cases.
• Implementation planning should distinguish the expectations in Sections 3 and 4, which should be met from 7 October 2027, from Sections 5 and 6, which should be met by 7 October 2028.

What changed

The Guidelines introduce an enterprise- and use-case-level framework for managing AI risk. Boards and senior management are expected to oversee AI risk, define accountabilities, set risk appetite, and maintain suitable risk-management frameworks, policies and procedures; existing governance structures may be used and a dedicated AI committee is not required solely for compliance.

Key dates

2026-10-06

The proposed rule was published in the Federal Register as 91 FR 63870, covering pages 63870-64103.

2026-12-07 Deadline

Public comments must be received by the SEC on or before this date.

Suggested considerations

• Compliance teams may wish to determine whether client or fund crypto assets are currently held through arrangements that would constitute adviser or regulated-fund self-custody under the proposal, including arrangements involving service providers, private keys, wallets, or decentralized finance protocols.
• Firms should consider mapping proposed requirements for key management, joint authorization, asset segregation, safeguarding expertise, cybersecurity, incident response, annual review, internal control reporting, and client or investor account statements against existing custody, information-security, and operational-resilience controls.
• Advisers and regulated funds may wish to assess whether existing custodians, including state trust companies, could satisfy the proposed authorization, policy, audit, internal-control, and segregation conditions.
• Compliance teams should consider preparing comments for File No. S7-2026-35 by December 7, 2026, particularly on the proposed scope of self-custody, the qualified-custodian determination, treatment of airdropped crypto assets, decentralized finance activity, and the interaction with existing custody arrangements.
• Firms should assess potential changes to Form ADV, Form ADV-E, Form N-CEN, custody records, crypto-network records, audited financial statements, and accountant reports if the proposal is adopted.
• Investment advisers and regulated funds may wish to inventory tokenized private funds and tokenized regulated-fund shares in anticipation of the proposed additional Form ADV and Form N-CEN questions.
• Firms should distinguish proposal-stage planning from current legal obligations because the publication does not itself impose the proposed requirements and does not establish a final compliance date.

What changed

The proposal would add an adviser self-custody framework under proposed Advisers Act rule 223-1(b)(7), allowing an adviser to self-custody client crypto assets only in specified circumstances and subject to conditions addressing safeguarding expertise, documented safeguarding systems, key management, joint authorization, segregation, cybersecurity risk assessment, threat and vulnerability management, incident response and recovery, annual review, an internal control report, and client account statements.

Key dates

2026-06-30

The FCA opened consultation on the proposed CRYPTOPRU 7 guidance.

2026-07-30

Consultation on the proposed guidance closed.

2026-09-30

The FCA finalised and published FG26/10.

2027-10-25 Deadline

FG26/10 comes into force alongside the FCA's new UK cryptoasset regime.

Suggested considerations

• Firms should map their current CRYPTOPRU 7 overall risk assessment against FG26/10, documenting any gaps in risk identification, stress testing, financial-resource calculations, recovery planning and wind-down analysis.
• Compliance and prudential teams may wish to confirm that the own-funds requirement is calculated as the highest of the permanent minimum requirement, fixed overheads requirement and K-factor requirement, and that the own-funds threshold requirement is not below that amount.
• Firms should consider developing severe-but-plausible scenarios that combine cryptoasset price declines, customer withdrawal surges, counterparty or exchange failure, cyber incidents, private-key compromise, reduced market liquidity, stablecoin de-pegging and infrastructure outages.
• Firms should assess whether collateral, committed facilities, group support, banking arrangements, custody structures and other mitigants are legally, operationally and practically available under stress, rather than relying solely on their accounting treatment.
• Firms should prepare or refresh a stressed 90-day cash-flow forecast covering peak and cumulative liquidity needs, including margin calls, settlement failures, client drawdowns, pre-funding requirements and delayed or unavailable funding.
• Firms should assess their funding profile over the following 12 months, including renewal and rollover risk, withdrawal of facilities, reduced group funding and increased funding costs.
• Firms should establish a contingency funding plan with quantitative internal triggers above regulatory thresholds, credible actions within management control, implementation timelines, impediments and communication arrangements.
• Firms should distinguish recovery actions that management can execute directly from actions dependent on shareholders, banks, counterparties, group entities or buyers, and should consider whether limited recovery capacity requires earlier wind-down triggers.

What changed

FG26/10 does not create a new standalone binding rule or prescribe a single methodology; it explains how firms should evidence compliance with the binding requirements in CRYPTOPRU 7 and should be applied proportionately to the firm's nature, scale and complexity. Firms should begin with their business model, strategy and risk appetite, identify market, leverage, credit, liquidity, operational and concentration risks, assess interactions between those risks, and evaluate whether mitigants remain effective under stress.