Payments & E-Money

Key dates

2026-11-02

WBF amended Annex 2 of the Ordinance of 25 May 2005 on Measures against Sudan (SR 946.231.18), modifying three individual entries.

2026-11-03 Deadline

The amended Sudan sanctions measures enter into force at 23:00 Swiss time; affected financial intermediaries must apply the relevant prohibitions, freeze assets and report affected relationships and blocked assets as required by the ordinance.

Suggested considerations

• Compliance teams should consider updating sanctions-screening data, including aliases and identifying information, from SESAM and the amended Annex 2 before the 23:00 effective time on 3 November 2026.
• Firms should consider screening customers, beneficial owners, counterparties, payment beneficiaries, securities positions and existing business relationships against all three modified entries, including historical and transliterated names where relevant.
• Where a potential match is identified, firms should consider applying the Article 2 financial-sanctions restrictions, preventing further availability of assets or economic resources, preserving relevant records and escalating the case for false-positive resolution and sanctions governance review.
• Firms should consider notifying SECO of affected business relationships and blocked assets in accordance with SR 946.231.18 and maintaining evidence of the decision, controls applied and notification submitted.
• Compliance teams may wish to assess whether a sanctions hit or related transaction creates additional money-laundering concerns requiring enhanced inquiries under Article 6 GwG and, if suspicions cannot be dispelled, an immediate Article 9 GwG report to the Money Laundering Reporting Office.
• Firms with cross-border operations should consider separately assessing whether the modified persons are also subject to EU, UK, US or other sanctions regimes, because the Swiss listing and any foreign restrictions may differ in scope and ownership or control consequences.
• Firms should consider validating batch-screening, real-time payment-screening, case-management and alert-escalation controls after the SESAM update, given the short notice between publication and effectiveness.

What changed

Three individual entries in Annex 2 were modified; the update is implemented through the Swiss SESAM sanctions database. The amended listings are subject to the financial sanctions in Article 2 paragraph 1 of SR 946.231.18, including the freezing of assets and economic resources and the prohibition on directly or indirectly making assets or economic resources available to listed persons. The relevant travel-ban provisions under Article 4 paragraph 1 also apply. Financial intermediaries must report affected business relationships and blocked assets to SECO.

Key dates

2018-08-03

iSignthis represented that less than 15% of quarterly revenue came from one-off or set-up fees; the Court found that the proportion exceeded 75% and that approximately AUD 3 million of one-off revenue and AUD 2.85 million of related one-off costs were not disclosed.

2020-05-12

iSignthis received Visa's letter communicating the finality of Visa's decision to terminate its relationship; the Court found that disclosure to the ASX was required on or shortly after this date.

2020-12-07

ASIC commenced civil penalty proceedings against iSignthis and Nickolas John Karantzis.

2022-05-11

iSignthis changed its name to Southern Cross Payments Ltd.

2022-11-04

Southern Cross Payments Ltd was delisted from the ASX.

2024-06-21

The Federal Court found that iSignthis had contravened disclosure laws and that Karantzis had breached relevant director duties.

2025-08-08

The Federal Court ordered iSignthis to pay a AUD 10 million penalty and ordered Karantzis to pay AUD 1 million and be disqualified from managing corporations for six years.

2025-09-05

iSignthis and Karantzis lodged appeals against the liability and penalty decisions.

Suggested considerations

• Firms should consider reviewing continuous-disclosure procedures against Corporations Act 2001 section 674 and ASX Listing Rule 3.1, including escalation criteria for operational, commercial and revenue information.
• Compliance teams may wish to test whether financial reporting distinguishes recurring revenue from one-off or set-up fees and discloses material associated costs consistently with market communications.
• Listed entities should consider documenting how they assess materiality, finality and reasonable grounds for delay when a major counterparty indicates that a contract or relationship may end.
• Boards and senior officers may wish to review controls ensuring that information provided to the ASX is accurate, complete and not misleading, including verification of statements made in analyst briefings and investor presentations.
• Firms should consider confirming that trading suspensions do not cause disclosure controls to stop operating and that market-sensitive developments continue to be assessed during a suspension.
• Companies may wish to retain contemporaneous records of disclosure decisions, legal advice, board or committee deliberations and communications with counterparties where disclosure timing is disputed.
• Compliance teams should consider whether director and officer accountability frameworks adequately address the risk of personal civil penalties and disqualification for failures to take reasonable steps to ensure ASX information is accurate.

What changed

The appeal did not introduce a new statutory obligation, but it confirms the substantial enforcement consequences of existing Australian continuous-disclosure and director-duty requirements. The Court upheld findings concerning iSignthis's failure to accurately disclose the extent of one-off revenue and related costs, and its failure from 12 May 2020 to disclose Visa's decision to terminate its relationship and the reasons communicated by Visa.

Key dates

2026-10-26

Current date and FCA publication context for the review; firms have been told to take prompt action, but this is not a statutory compliance deadline.

2028-12-01

The FCA says the point-in-time publication may be treated as retired by December 2028 if it has not been removed sooner; this is not stated as a mandatory implementation deadline.

Suggested considerations

• Compliance teams may wish to map how the firm identifies direct defence businesses, defence supply-chain participants, dual-use technology businesses and relevant customers that are not accurately captured by SIC codes.
• Firms should consider testing whether onboarding and enhanced due diligence requests are risk-based, non-duplicative and proportionate to the individual customer's activities, jurisdictions, products, end use and supply chain, rather than triggered solely by a broad defence-sector label.
• Firms should consider reviewing blanket exclusions, revenue thresholds, automatic escalation rules and approval stages affecting defence customers, documenting why any retained restrictions are justified by legal, financial-crime, reputational or commercial-risk considerations.
• Firms should consider defining and governing reputational, ESG and sustainability criteria used in account opening, servicing, product access, restriction or closure decisions, with evidence that the criteria are consistently applied and aligned with stated risk appetite.
• Firms should consider establishing or improving management information covering defence-sector identification, application volumes, approval and rejection rates, onboarding duration, repeated information requests, escalation frequency, restrictions, closures, complaints and outcomes by customer risk category.
• Senior management and relevant committees may wish to review whether the available information allows them to challenge inconsistent treatment, unexplained delays or outcomes that arise from internal processes rather than the customer's actual risk.
• Where legally permissible and appropriate, firms should consider keeping applicants informed about additional checks, progress and likely decision timescales, and explaining decisions sufficiently to reduce avoidable uncertainty.
• Firms should continue to apply customer due diligence, enhanced due diligence, sanctions and other financial-crime controls required by applicable law; the FCA's message is to make those controls targeted and proportionate, not to reduce them.

What changed

No binding regulatory obligations or new thresholds have been introduced. The FCA has nevertheless written to firms providing banking services to SMEs and expects prompt action under existing requirements. Firms should review whether onboarding, enhanced due diligence, escalation, servicing, restriction and closure processes distinguish among different defence activities and reflect the specific customer, geographic, product, supply-chain, end-use, financial-crime and reputational risks.

Key dates

2026-10-23

FCA consultation CP26/38 opened and published.

2026-12-24 Deadline

Deadline for submitting responses to the FCA consultation.

2027-10-01

The FCA describes the new cryptoasset regime as applying from October 2027; the precise commencement date should be confirmed against the final legislation and FCA rules.

Suggested considerations

• Compliance teams may wish to review the proposed changes and submit consultation responses through the FCA online form by 24 December 2026, particularly where the proposals would create material implementation costs or operational challenges.
• Firms should consider mapping current fraud, AML/CTF, sanctions, proliferation-financing, data-security and financial-crime systems-and-controls frameworks against the consultation themes, while recognising that the proposals are not yet final guidance.
• Cryptoasset businesses and firms intending to provide regulated cryptoasset services may wish to assess readiness for the new regime expected in October 2027, including AML/KYC controls, blockchain analytics, Travel Rule processes, sanctions screening, transaction monitoring and governance.
• Firms using AI or external technology providers for transaction monitoring, customer screening or other financial-crime controls should consider documenting model governance, validation, parameter testing, explainability, human oversight, data security, third-party oversight and retention of decision records.
• Senior management and boards may wish to review whether financial-crime management information, risk assessments and escalation arrangements adequately cover proliferation financing, sanctions evasion, cryptoasset risks and reliance on outsourced or AI-enabled controls.
• Firms may wish to monitor the FCA's final Policy Statement and consolidated Financial Crime Guide, since the final text may differ from the consultation proposals and is likely to inform future supervisory assessments.

What changed

No new binding rules have been made by this consultation. The FCA proposes to revise non-Handbook guidance and practical examples in the Financial Crime Guide to reflect emerging risks and regulatory developments, including AI and third-party tools used in financial-crime controls, cryptoasset-specific risks, evolving financial and trade sanctions, proliferation financing, data security, fraud, and AML/CTF systems and controls.

Key dates

2024-04-01

Bank of America self-identified the inaccurate wire-transmittor information issue, according to the OCC enforcement order; the date is included as an approximate month-level historical reference represented by the first day of the month.

2024-10-01

Bank of America stopped the inaccurate transmittor-information practice in 2024; the OCC order does not provide an exact day, so this is an approximate month-level historical reference represented by the first day of the month.

2026-10-08

The OCC announced the American Express National Bank cease-and-desist order and $350 million civil money penalty.

2026-10-13

The OCC announced the Bank of America $750 million civil money penalty, described as the largest penalty in OCC history, in coordination with Treasury and FinCEN actions.

2026-10-22

The OCC published the October 2026 consolidated enforcement-actions release.

Suggested considerations

• Firms should consider reassessing whether their BSA/AML risk assessments cover the risks of all material products and services, rather than concentrating on narrower deposit activity while underweighting credit-card, charge-card, correspondent, or payment activity.
• Compliance teams may wish to test end-to-end transaction-monitoring workflows for alert generation, escalation, investigation, disposition, and SAR filing, including backlog governance, aging thresholds, management information, and evidence that suspected trade-based money laundering is escalated promptly.
• Firms should consider validating that customer identification, customer due diligence, beneficial-ownership information, and ongoing-risk-rating processes are complete, accurate, risk-based, and aligned to the institution's actual customer and product populations.
• Banks may wish to perform a targeted review of outgoing wire data to confirm that originator or transmittor names and other required fields are accurate, consistently populated, retained, and not overwritten by deficient interfaces or manual processes.
• Boards and senior management should consider documenting sufficient staffing, subject-matter expertise, training, independent testing, audit coverage, and issue-remediation ownership for BSA/AML programs.
• Institutions operating under prior supervisory findings should consider independent validation that corrective actions are complete, effective, sustainable, and supported by evidence, rather than merely implemented procedurally.
• Compliance teams should consider reviewing whether third-party, correspondent, and payment-processing arrangements create data-quality or monitoring dependencies that could delay SAR filing or impair law-enforcement traceability.

What changed

This publication announces enforcement outcomes rather than a new rule or generally applicable deadline. American Express National Bank is subject to a cease-and-desist order and a $350 million penalty for an inadequately designed and monitored BSA/AML program, inadequate resources and expertise, internal-control weaknesses, weak independent testing and training, systemic failures involving approximately $13 billion of suspected trade-based money-laundering activity, and customer identification and customer due diligence deficiencies.

Key dates

2020-11-01

Beginning of the period during which the Central Bank found Coinbase Ireland breached safeguarding and outsourcing obligations under the Electronic Money Regulations 2011.

2025-08-19

End of the enforcement period identified by the Central Bank.

2026-10-21

Central Bank of Ireland and Coinbase Ireland reached the settlement under the undisputed-facts settlement process.

2026-10-22

Central Bank published the enforcement outcome and announced the proposed reprimand and discounted monetary penalty.

Suggested considerations

• Firms should map all safeguarding responsibilities to the specific Irish or EU-authorised entity that holds the regulatory obligation and document how the entity retains effective control despite group or third-party outsourcing.
• Compliance teams may wish to assess whether the regulated entity has sufficient local expertise, decision-making authority and management information to oversee safeguarding and challenge outsourced providers on an ongoing basis.
• Firms should consider independently validating the design of safeguarding calculations, reconciliations, treasury-rebalancing processes and designated safeguarding-account funding, including testing for data, systems and mapping errors.
• Firms may wish to perform daily or otherwise risk-appropriate reconciliations between customer liabilities, safeguarding obligations and funds held in designated accounts, with documented investigation and remediation of exceptions.
• Boards and senior management should consider whether control testing covers the complete safeguarding process, including outsourced components, and whether testing is sufficiently independent and frequent to identify prolonged shortfalls.
• Firms should review escalation procedures for safeguarding incidents, control failures, underfunding and material changes to operating models, including criteria and ownership for notifying the Central Bank of Ireland.
• Authorised firms should compare their current operating model with representations, commitments and governance arrangements submitted during authorisation and assess whether any material changes were notified to the Central Bank.
• Outsourcing registers, contracts and service-level arrangements should be reviewed to confirm clear regulatory access, audit rights, information rights, incident reporting, business-continuity provisions and accountability for safeguarding outcomes.

What changed

The publication does not introduce a new statutory rule; it applies existing obligations under the Electronic Money Regulations 2011 and establishes a substantial enforcement precedent. Coinbase Ireland admitted that it lacked an adequate outsourcing-governance framework, relied excessively on a US Coinbase Group entity, lacked sufficient local skill and expertise to oversee safeguarding, used inadequately designed and tested systems that left its designated safeguarding account underfunded, and lacked adequate escalation and reporting arrangements for material safeguarding changes.

Key dates

2026-10-21

CSSF published the communiqué warning about CVE-2026-109618 and CVE-2026-109619; PHP also released security updates addressing the vulnerabilities on this date.

Suggested considerations

• Firms should consider urgently inventorying internet-facing and internally accessible services that run PHP, including PHP embedded in outsourced, cloud-hosted and vendor-managed applications.
• Technology and security teams may wish to determine the installed PHP branch and apply the relevant fixed release, including PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 where applicable, after validating compatibility and deployment integrity.
• Where immediate patching is not feasible, firms should consider isolating or taking affected internet-facing services offline, placing them behind network-layer authentication or equivalent compensating controls, and restricting PHP execution to required functions.
• Security teams may wish to review web-server, PHP, application, endpoint and identity logs for exploitation indicators, unusual child processes, unexpected outbound connections, persistence and activity associated with unauthenticated requests.
• Firms should consider assessing whether any unauthorised remote code execution, suspected compromise or material service disruption meets the applicable major ICT-related incident criteria and documenting the classification decision.
• DORA entities should consider preparing the notification required under Circular CSSF 25/893 and the applicable DORA implementing rules if the incident is classified as major; the initial notification is generally due within four hours of classification and no later than 24 hours after awareness, followed by an intermediate report within 72 hours and a final report within one month.
• Entities subject to CSSF Circular 24/847 should consider following that circular's notification process for a major ICT-related incident and confirming whether any parallel obligations arise under applicable NIS or sectoral requirements.
• Compliance teams may wish to retain evidence of the affected-asset inventory, patch or mitigation decisions, threat monitoring, incident assessment and communications with relevant ICT third-party providers.

What changed

The publication does not introduce a new standalone rule or compliance deadline; it provides an urgent supervisory warning and links the risk to existing ICT incident-reporting obligations. Until the affected versions were officially confirmed, the CSSF's stated position was that all PHP-powered services should be treated as potentially exposed. Independent security analysis reported that PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with both vulnerabilities rated CVSS 4.0 at 9.2 and capable of execution under the web-worker account.

Key dates

2026-10-21

FCA published GC26/7 and opened the guidance consultation.

2026-11-18 Deadline

Deadline for consultation responses to GC26/7.

2027-01-01

FCA plans to publish final DeFi guidance during January 2027; no specific publication day has been stated.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are due to bring new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Compliance teams may wish to map each DeFi use case, protocol, smart-contract dependency, service provider and customer-facing activity against the firm's existing SYSC 15A, SYSC 6 and Money Laundering Regulations obligations.
• Firms should consider documenting governance and accountability for DeFi arrangements, including who controls or can materially influence protocol changes, access permissions, treasury assets, upgrades, emergency controls and customer outcomes.
• Operational resilience teams may wish to assess important business services, impact tolerances, vulnerabilities, third-party and smart-contract dependencies, oracle and bridge risks, key-management arrangements, cyberattack scenarios and credible disruption testing.
• Financial-crime teams should consider whether existing customer due diligence, transaction monitoring, sanctions screening, blockchain analytics, wallet-risk assessment, suspicious activity escalation and record-keeping controls remain effective for pseudonymous, automated or cross-chain activity.
• Firms may wish to review outsourcing and third-party risk assessments for protocol developers, validators, custodians, wallet providers, analytics providers, cloud infrastructure and other critical DeFi dependencies.
• Legal and regulatory teams should assess whether current and planned activities fall within the existing perimeter or the new cryptoasset activities introduced by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, including whether there is an identifiable controlling entity.
• Affected stakeholders may wish to submit responses to the FCA by 18 November 2026 and identify any areas where the illustrative guidance is unclear, disproportionate or difficult to apply to genuinely decentralised arrangements.
• Firms may wish to track the FCA's planned final guidance in January 2027 and update risk assessments, policies, control testing and implementation plans before the new cryptoasset regime commences.

What changed

The FCA is proposing guidance describing the operational resilience and financial crime risks associated with DeFi and providing illustrative measures firms may consider. The guidance is relevant to firms within SYSC 15A, SYSC 6 and the Money Laundering Regulations, including firms using distributed-ledger technology, automated protocols, open and interoperable systems or arrangements with limited traditional intermediation. It is intended to clarify application of existing requirements rather than establish a separate DeFi regime or new Handbook obligations.

Key dates

2026-09-30

The application period opened for existing UK cryptoasset businesses seeking to conduct new regulated cryptoasset activities and benefit from the savings provision.

2026-10-21

FCA consultation CP26/36 opened and was published.

2026-11-18 Deadline

Deadline for responses to FCA consultation CP26/36.

2027-01-01

FCA aims to publish final perimeter guidance after considering consultation responses.

2027-02-28 Deadline

Application period closes for firms seeking to rely on the savings provision for newly regulated cryptoasset activities.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are scheduled to bring the new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Firms should map each proposed and existing cryptoasset activity against the statutory regulated activities in the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 and the proposed PERG guidance, documenting the factual basis for any exclusion relied upon.
• Technical-service providers should assess whether they merely provide access to a third-party service or decentralised protocol, or whether they also arrange, execute, safeguard, operate, control or otherwise provide a service to users; the use of automation or decentralised technology should not be treated as determinative.
• Stablecoin and payment businesses should identify the precise duration, purpose, parties and asset flows associated with temporary holding and backing-asset arrangements and test whether the relevant statutory conditions are met.
• Trading firms and market makers should distinguish genuine proprietary trading from activity performed as a service for another person and retain evidence supporting any reliance on the proprietary-trading or qualifying-cryptoasset-trading-platform market-maker exclusion.
• Firms should review safeguarding and settlement structures, including structures involving central securities depositaries and third-country central securities depositaries, for possible inclusion within the proposed exclusions or within regulated custody-related activities.
• Businesses that may need authorisation should consider submitting responses to CP26/36 by 18 November 2026 and should not defer application planning while the guidance remains in consultation.
• Existing UK cryptoasset businesses seeking to conduct newly regulated activities should consider submitting an otherwise complete application between 30 September 2026 and 28 February 2027 to preserve access to the applicable savings provision.
• Firms materially affected by uncertainty about the technical-services-provider exclusion should consider engaging the FCA through its pre-application support service and retaining evidence of how that uncertainty affected application preparation.

What changed

The FCA proposes guidance on exclusions from regulated cryptoasset activities introduced by the draft Cryptoassets (Miscellaneous Amendments) Regulations 2026. The examples include temporary settlement arrangements; temporary arrangements for holding UK qualifying stablecoins in connection with payment transactions; arrangements involving backing assets held in relation to a UK qualifying stablecoin; proprietary trading where the person is not providing a service to another person; proprietary trading by a market maker on a qualifying cryptoasset trading platform; and technical services that...

Key dates

2026-10-21

OCC publishes Bulletin 2026-52, revised PS-01 and PS-02 forms for public comment, and issues its GENIUS Act implementing final rule.

2027-01-18

The OCC final rule implementing the GENIUS Act and the GENIUS Act take effect, according to the OCC’s related final-rule materials.

2027-01-25 Deadline

First weekly PS-01 report date, subject to OMB approval of the information collection.

2027-03-31 Deadline

First quarterly PS-02 report date, subject to OMB approval of the information collection.

Suggested considerations

• Compliance teams at affected issuers should review the revised PS-01 and PS-02 workbooks and instructions and identify every required data element, reporting frequency, aggregation rule, and responsible control owner.
• Firms should consider submitting comments within 30 days after publication of the information-collection notice in the Federal Register, with particular attention to data availability, calculation methodology, confidentiality, reporting burden, and transition timing.
• Issuers should map daily issuance, redemption, reserve, ownership-concentration, and trading data to PS-01 and test whether systems can produce a complete weekly submission for the January 25, 2027 report date, subject to OMB approval.
• Issuers should assess whether finance and regulatory-reporting systems can produce PS-02 information on income, assets, liabilities, off-balance-sheet activities, and capital for the March 31, 2027 report date.
• Firms should establish governance for data certification, reconciliation to general-ledger and reserve records, exception management, senior review, and retention of supporting documentation for OCC examination.
• Issuers should assess the interaction between the reporting forms and the final rule’s reserve, redemption, risk-management, audit, capital, custody, and supervisory requirements, rather than treating the forms as an isolated reporting exercise.
• Foreign issuers should confirm their OCC registration status, reporting perimeter, U.S. activities, and allocation of information-production responsibilities between U.S. operations, parent entities, and service providers.

What changed

The OCC is reopening public comment on revised weekly Form PS-01 and quarterly Form PS-02 and their instructions. PS-01 requires daily data compiled and submitted weekly for each payment stablecoin, covering issuance, reserves, ownership concentration, and trading activity. PS-02 requires quarterly reporting on the issuer’s condition and income, including balance-sheet assets and liabilities, off-balance-sheet activities, income, and capital.

Key dates

2026-10-21

The OCC issued Bulletin 2026-51 and stated that applications and waiver requests will be accepted only after OMB approves the related information collection.

2027-01-18 Deadline

The GENIUS Act and OCC final rule become effective; the Prior Approval Requirement generally applies, and unauthorized issuance of a payment stablecoin in the United States may carry criminal penalties.

2028-01-18 Deadline

The maximum statutory period for a waiver beginning on January 18, 2027 expires, subject to the terms and shorter duration of any individual waiver.

Suggested considerations

• Firms should determine whether they are currently issuing a payment stablecoin in the United States and whether they fall within the OCC application pathway or another primary federal payment stablecoin regulator's pathway.
• Existing issuers should consider preparing and submitting a substantially complete OCC application as soon as the agency announces that applications are accepted, rather than relying on the waiver as a substitute for authorization.
• Applicants should map their submission against every prescribed application question and documentation requirement, including the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML, OFAC, third-party risk, enterprise risk, compliance risk, and audit functions.
• Compliance teams may wish to prepare a separate written waiver request addressing the Prior Approval Requirement, identifying any additional GENIUS Act or final-rule requirements that cannot be met by January 18, 2027, and explaining the requested duration and operational rationale.
• Issuers should monitor the OCC's GENIUS Act landing page and press releases for OMB approval and the opening of the application and waiver process, because the bulletin does not provide a fixed application-opening date.
• Firms should maintain evidence supporting the completeness and accuracy of their applications and establish a process to respond promptly to OCC requests for missing information within the 30-day review cycles.
• Prospective issuers that are not already operating in the United States should consider planning for operations to begin only after OCC approval, consistent with the agency's stated position on waiver eligibility.
• Regulatory change teams should continue tracking separate FinCEN, OFAC, OCC, and other agency rulemakings concerning AML, CFT, sanctions, and customer-identification requirements rather than assuming that an OCC application or Prior Approval Requirement waiver resolves those obligations.

What changed

Beginning January 18, 2027, a person generally must be approved as a permitted payment stablecoin issuer before issuing a payment stablecoin in the United States; unauthorized issuance may carry criminal penalties. Under GENIUS Act section 5(f) and 12 CFR 15.30(g), an issuer with a substantially complete OCC application pending on January 18, 2027 may request a written waiver of the Prior Approval Requirement and other statutory or final-rule requirements that it cannot satisfy by the effective date.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule and related application, waiver and reporting materials.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment stablecoin issuance generally requires permitted payment stablecoin issuer status, and a substantially complete application must be pending by this date to support eligibility for an OCC waiver request.

2027-01-25

Proposed first weekly OCC reporting date, subject to OMB approval of the information collection.

2027-03-31

Proposed first quarterly OCC reporting date, subject to OMB approval of the information collection.

Suggested considerations

• Firms seeking permitted payment stablecoin status should consider mapping their licensing strategy, corporate structure and applicable OCC pathway under 12 CFR part 15 before 2027-01-18.
• Existing U.S. issuers that need transitional relief should consider submitting a substantially complete OCC application on or before 2027-01-18 and preparing a written waiver request promptly after the OCC begins accepting applications and waiver requests.
• Applicants should consider documenting business plans, management, reserve assets, issuance and redemption processes, capital and liquidity, risk management, third-party and shared-services arrangements, audit functions and compliance governance in the application package.
• Issuers should consider validating reserve composition, one-to-one backing, liquidity, concentration, counterparty exposure, stress-testing and redemption controls against the final rule rather than relying on the proposal's reserve assumptions.
• Issuers should consider testing operational capacity to process redemptions within two business days and to notify the OCC within 24 hours when the 10% redemption-demand trigger is reached.
• Issuers and distribution partners should consider reviewing stablecoin rewards, yield, rebate and promotional arrangements on a transaction-by-transaction basis because pre-existing programs are not automatically grandfathered and the final rule provides no general safe harbor.
• Covered firms should consider establishing governance for audits, reporting, examination responses, custody controls, foreign-issuer oversight and potential approval revocation or rescission.
• Compliance teams should track the separate Treasury-coordinated BSA, AML and OFAC rulemaking and avoid treating this final rule as the complete GENIUS Act compliance framework.

What changed

The final rule applies to national banks and their subsidiaries, federal savings associations and their subsidiaries, federal branches and their subsidiaries, federal qualified payment stablecoin issuers, foreign payment stablecoin issuers, and state qualified payment stablecoin issuers over which the OCC has regulatory or enforcement authority.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule, application and waiver guidance, and revised proposed reporting forms.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment-stablecoin issuance generally requires permitted payment stablecoin issuer approval, and existing issuers seeking a waiver generally must have a pending substantially complete OCC application by this date.

2027-01-25 Deadline

Proposed effective report date for the weekly reporting form, subject to Office of Management and Budget approval.

2027-03-31 Deadline

Proposed effective report date for the quarterly reporting form, subject to Office of Management and Budget approval.

Suggested considerations

• Firms considering U.S. payment-stablecoin issuance should assess whether they qualify as a permitted payment stablecoin issuer, a federal qualified issuer, a state-qualified issuer subject to OCC authority, or a foreign issuer within the rule's scope.
• Existing U.S. issuers should consider preparing a substantially complete OCC application and evaluating whether a waiver request is needed by January 18, 2027; the OCC may grant waivers for up to 12 months beginning on that date, generally where an eligible application is pending.
• Applicants should prepare documentation covering the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML/OFAC controls, third-party risk, enterprise risk, compliance risk, and audit functions.
• Issuers should map reserve assets to the final rule's 1:1 backing, daily-liquidity, diversification, and counterparty-concentration requirements and establish controls capable of supporting generally timely redemption within two business days.
• Compliance and product teams should inventory interest, yield, cashback, loyalty, referral, and exchange rewards arrangements involving payment stablecoins and document the business purpose and consideration supporting each payment, because the OCC has not provided a categorical safe harbor and will apply the statutory prohibition case by case.
• Issuers should design weekly reserve and payment-stablecoin activity reporting and quarterly reports of condition and income, subject to confirming the final OMB-approved forms and effective reporting dates.
• Banks and other OCC-supervised custodians should review custody arrangements, segregation and control frameworks, third-party dependencies, and contractual allocation of responsibility for stablecoin and reserve-asset custody.
• Firms should track the separate Treasury, FinCEN, OFAC, Federal Reserve, and FDIC implementation work because the OCC final rule does not complete BSA, AML, or sanctions requirements and is only one component of the GENIUS Act framework.

What changed

New 12 CFR part 15 establishes requirements for permitted payment stablecoin issuers, foreign payment stablecoin issuers subject to OCC authority, certain state-qualified issuers, and specified custody activities conducted by OCC-supervised entities. The framework covers issuer activities, reserve assets, redemption, risk management, audits, reports, examinations, supervision, custody, applications and registrations, state-to-federal transitions, foreign-issuer supervision, approval revocation or rescission, and capital and operational backstops.

Key dates

2026-10-21

The French Treasury, AMF, Banque de France and ACPR published their joint response to the European Commission consultation on the MiCA review.

2026-09-30 Deadline

The European Commission consultation deadline identified in independent legal commentary; this date had passed before publication of the French authorities' response.

Suggested considerations

• Compliance teams may wish to maintain the existing MiCA control framework because this publication does not create an immediate amendment, authorisation requirement or prohibition.
• Firms should consider mapping each token, service and distribution channel against the definitions and perimeter provisions of MiCA, MiFID II and payment-services legislation, with particular attention to products that could require more than one authorisation.
• EU-authorised crypto-asset service providers should consider reviewing onboarding, asset-admission, execution, custody, trading and distribution controls for exposure to asset-referenced tokens or e-money tokens that may not satisfy MiCA requirements.
• Stablecoin issuers and groups using the same fungible token across EU and third-country markets should consider documenting issuance structures, reserve segregation, redemption rights, equivalence assumptions and supervisory-cooperation dependencies in anticipation of possible multi-issuance rules.
• Significant crypto-asset service providers and crypto-conglomerates should consider assessing governance, prudential, group-risk and supervisory-reporting readiness for a possible future shift of direct or enhanced oversight toward ESMA.
• Banks, payment firms and investment firms should consider assessing strategic opportunities and regulatory dependencies arising from euro-denominated e-money tokens and tokenised bank deposits without treating the French position as approval of any specific product.
• DeFi, staking and crypto-lending businesses should consider identifying responsible intermediaries, documenting due-diligence controls and preserving evidence of protocol governance and risk assessments pending any future EU framework.
• Industry participants may wish to monitor the Commission's MiCA review, subsequent legislative proposals, ESMA and EBA opinions, and national implementation developments before changing operating models.

What changed

No legal requirements changed on 2026-10-21. The French authorities proposed streamlining MiCA and clarifying when an activity falls under MiCA, the legislation governing financial instruments, or payment-services legislation, including where one business model could require multiple authorisations. They stated that a financial instrument should remain fully subject to the financial-instruments regime irrespective of the technology used for issuance or trading, and that the same principle should apply to payment instruments.

Key dates

2026-10-16

ESMA published Q&As 2949, 2950, 2936, 2937 and 2938.

2025-06-25

The EMIR 3 active account regime began applying to counterparties already within scope after the six-month implementation period.

Suggested considerations

• CASPs should consider mapping each client-funds flow against MiCA Article 70(2) and (3), documenting the end-of-next-business-day transfer control and verifying that any intermediary-held credit-institution account is specifically held for the CASP and technically segregated.
• CASPs and their payment-service-provider partners may wish to review contractual terms, account mandates, insolvency protections, reconciliation processes and evidence demonstrating clients’ ownership rights and prohibition of proprietary use.
• Crowdfunding providers using registration, membership or access fees should consider documenting why their model does or does not constitute a crowdfunding service under Regulation (EU) 2020/1503 and reviewing website disclosures, fee descriptions, client communications and investor-protection controls.
• AAR counterparties should recalculate the 12-month aggregate month-end average gross notional position, including the applicable group perimeter and excluding client-clearing activity, against the EUR 6 billion and EUR 100 billion thresholds.
• AAR counterparties relying on the 85% exemption should consider testing the one-half rule across the relevant derivative classes, retaining the underlying EU-CCP clearing data and avoiding any assumption that the exemption removes the representativeness requirement.
• Affected counterparties should review trade-level residual-maturity data, bucket allocation, annual-average trade counts and reporting calendars so that representative clearing can be demonstrated at the applicable reporting date.
• Compliance teams may wish to update policies, procedures, management information and regulatory inventories to distinguish ESMA Q&A interpretive expectations from directly binding Level 1 and Level 2 requirements.

What changed

For CASPs, ESMA clarifies that client funds may be temporarily held in an account with a non-bank payment service provider, such as a payment institution or electronic money institution, provided the funds are transferred to an account with a credit institution or central bank no later than the end of the business day following receipt.

Key dates

2026-09-30

The extended sector-wide no-action position associated with INFO 225 ended.

2026-11-27 Deadline

Deadline for submissions on ASIC Consultation Paper 392, at 5pm AEDT.

2027-04-08

The DAF Act and the new DAP and TCP framework are scheduled to commence.

2027-10-07 Deadline

The proposed transition deadline by which platforms already operating as DAPs or TCPs should apply for an AFS licence or variation.

Suggested considerations

• Firms should assess whether their products, custody arrangements and platform activities fall within the DAP or TCP definitions under the DAF Act and the proposed ASIC guidance.
• Affected operators should consider whether they need a new Australian financial services licence or a variation to an existing licence, including whether any streamlined process may apply.
• Compliance teams may wish to map current custody, segregation, asset-control, reconciliation, trading, settlement and incident-management processes against the proposed standards.
• Firms should assess the likely impact of the proposed net tangible asset and other financial requirements on capital planning, liquidity and licence documentation.
• Operators should review proposed customer disclosure documents and platform rules, including how digital-asset risks, custody arrangements, execution and settlement are explained to clients.
• Businesses affected by the framework should consider submitting comments to ASIC by 2026-11-27 and engaging with ASIC's consultation events or targeted roundtables.
• Firms should maintain evidence of their licensing analysis and transition planning, particularly because the sector-wide INFO 225 no-action position ended on 2026-09-30 and independent commentary indicates that existing licensing obligations apply outside the relief period.

What changed

CP 392 proposes implementation guidance for digital asset platforms (DAPs), which hold digital tokens for clients and provide associated platform services, and tokenised custody platforms (TCPs), which record underlying client assets as digital tokens. ASIC is proposing standards covering asset holding, trading and settlement activities, and financial requirements including net tangible asset requirements where relevant.

Key dates

2026-10-14

The EBA announced that USDC issued by Circle Internet Financial Europe SAS had been classified as a significant EMT under MiCA.

2026-11-12 Deadline

Dual supervision of USDC begins: the EBA assumes direct responsibility for own funds, reserve of assets, liquidity requirements, and recovery and redemption plans, while the ACPR retains specified governance and organisational responsibilities.

Suggested considerations

• Circle and its regulatory counsel should map existing own-funds, reserve-of-assets, liquidity, recovery, and redemption controls to the EBA’s supervisory expectations and establish clear evidence and reporting channels before 2026-11-12.
• Circle should confirm the allocation of responsibilities between the EBA and ACPR, including supervisory contacts, escalation procedures, information requests, and documentation ownership for prudential and organisational matters.
• Crypto-asset service providers should reassess their USDC due diligence, product governance, liquidity, redemption, custody, safeguarding, and operational-risk controls in light of the significant-EMT designation.
• Firms using USDC should identify exposures in client assets, settlement, treasury, collateral, and payment flows and assess whether updated counterparty, liquidity, concentration, and business-continuity assessments are appropriate.
• Compliance teams should monitor EBA and ACPR communications, supervisory-college activity, and any subsequent guidance or requests concerning significant EMT reporting and recovery or redemption planning.
• Firms operating across the EU and United States should review information-sharing, incident-notification, and cross-border supervisory arrangements, noting the EBA’s memorandum of understanding with the New York State Department of Financial Services.

What changed

USDC will be subject to the MiCA framework for significant EMTs from 2026-11-12. The EBA will assume direct supervisory responsibility for own-funds requirements, the reserve of assets, liquidity requirements, and recovery and redemption plans; the ACPR will continue supervising governance, qualifying holdings, fit and proper assessments, outsourcing, and conflicts of interest. Under MiCA Articles 56 and 43(1), an EMT is classified as significant where at least three significance criteria are met during the applicable reporting periods.

Key dates

2026-10-14

The CFPB announced the debanking investigation and enforcement initiative; the OCC released its report on the nine largest national banks on the same date.

Suggested considerations

• Compliance teams may wish to inventory account closures, service restrictions, onboarding denials, credit denials, and material service-friction decisions since 2020, with particular attention to political or religious affiliations and lawful activities in firearms, oil and gas, coal, tobacco, digital assets, and other sectors identified by the OCC.
• Firms should consider testing whether customer-facing reasons for adverse decisions accurately and specifically reflect the documented internal rationale, including compliance with ECOA and Regulation B adverse-action notice requirements and applicable FCRA adverse-action notice requirements.
• Institutions may wish to review reputation-risk policies, sector restrictions, escalation criteria, committee materials, employee guidance, and risk taxonomies to confirm that decisions are based on objective, individualized, documented, and legally supportable risk considerations rather than generalized political, social, or reputational preferences.
• Compliance teams should consider preserving relevant complaints, account-review records, escalation communications, decision logs, adverse-action notices, and policy versions in anticipation of CFPB information requests or supervisory examination.
• Banks and covered nonbanks may wish to compare complaint-portal submissions and internal complaint data against account-closure and service-denial populations to identify unexplained patterns, inconsistent reasons, or failures to provide required notices.
• Firms should consider assessing whether deposit-account and payment-service decisions create potential UDAAP exposure even where ECOA or FCRA does not directly apply, while continuing to apply legitimate safety, soundness, sanctions, fraud, AML, credit, and operational-risk controls.
• Senior compliance and legal personnel may wish to establish governance for politically sensitive or sector-based account decisions so that risk-based controls are not removed indiscriminately and exceptions are documented, consistently applied, and subject to appropriate review.

What changed

The CFPB did not issue a new regulation or impose a new compliance deadline. It announced a supervisory and enforcement initiative implementing Executive Order 14331 and responding to the OCC's report covering conduct identified between 2020 and September 2025. The CFPB stated that it will investigate potential violations of the Equal Credit Opportunity Act, including Regulation B adverse-action requirements, the Fair Credit Reporting Act adverse-action requirements, and the prohibition on unfair, deceptive, or abusive acts or practices under the Consumer Financial Protection Act.

Key dates

2026-10-14

CPMI and IOSCO published the final report on FMIs' management of general business risks and general business losses.

2026-02-06

The consultation period for the predecessor November 2025 report closed.

Suggested considerations

• FMIs should consider mapping their existing general business risk frameworks, loss taxonomies and financial resources against the final guidance and PFMI Principles 1, 15, 16 and 17.
• FMIs should reassess whether LNAFE is sufficient not only to meet the six-month operating-expense floor but also to cover credible one-time and recurring loss scenarios and the period needed for recovery or orderly wind-down.
• FMIs should review business continuity, recovery and orderly wind-down plans for explicit treatment of general business losses, including escalation and options for raising additional equity.
• FMIs should consider documenting the assumptions, scenarios, methodologies and governance approvals used to size LNAFE and distinguish general business losses from participant-default losses and other PFMI resources.
• FMIs should consider enhancing public and authority-facing disclosures on general business risk exposures, LNAFE, risk-management assumptions, governance responsibilities and available recovery or wind-down resources.
• Authorities should consider incorporating the supplemental guidance into supervisory assessments and reviewing whether local FMI rules, recovery plans and disclosure expectations remain aligned with the final report.
• FMI operators and participants should monitor national implementation because CPMI-IOSCO guidance is not directly binding and practical obligations will depend on the relevant jurisdiction's legal and supervisory framework.

What changed

The final report elaborates the existing PFMI requirements, especially Principle 15, rather than creating a new standalone binding standard. It provides guidance on identifying, monitoring and managing general business risks; determining the minimum LNAFE required to cover potential general business losses and support continued operations, recovery or orderly wind-down; and strengthening governance and transparency.

Key dates

2025-12-03

The EBA launched its consultation on the draft amendments to the CSD prudential RTS.

2026-03-03 Deadline

The EBA consultation closed.

2026-10-12

The EBA published the Final Report and submitted draft amendments to the European Commission.

Suggested considerations

• Banking CSDs and designated credit institutions should map existing and planned cash, deposit, payment and foreign-exchange services against the CSDR Refit permissions and the draft RTS risk-management and notification framework.
• CSDs should assess whether providing or receiving these services creates additional intraday credit, liquidity, settlement, counterparty or concentration exposures, including exposures arising through foreign-currency settlement and increased inter-CSD interconnectedness.
• Compliance and regulatory-policy teams should compare current prudential policies, risk limits, management information, reporting and public-disclosure processes with the draft RTS once the EBA draft text has been reviewed in detail.
• Firms should monitor the European Commission's endorsement, any amendments made during adoption, publication in the Official Journal and the eventual application date before treating the draft requirements as binding.
• CSDs and designated credit institutions may wish to engage with their competent authorities early on the expected supervisory notifications, information flows and governance for arrangements involving participants of another CSD.
• Regulatory inventories and internal legal references should be updated for the amended CSDR terminology and relevant CRR changes after the final delegated act is adopted.

What changed

The draft RTS update the prudential framework under Article 59(5) of Regulation (EU) No 909/2014 (CSDR) for monitoring, measuring, managing, reporting and publicly disclosing credit and liquidity risks, including intraday risks. They address arrangements under which a banking CSD provides banking-type ancillary services to another, or designating, CSD, including cash accounts, deposits and payment services involving cash and foreign-exchange transactions, with particular attention to the effect on the banking CSD's risk profile and to notifications required by supervisors.

Key dates

2026-10-08

Federal Reserve and OCC announced coordinated enforcement actions; the OCC imposed a $350 million civil money penalty on American Express National Bank and issued a cease-and-desist order. The Federal Reserve action applied to American Express Company and American Express Travel Related Services Company, Inc.

2027-01-06 Deadline

Approximate deadline for American Express National Bank to submit the OCC-required written Action Plan within 90 days of the October 8, 2026 order, subject to the order's day-counting conventions.

Suggested considerations

• Compliance teams may wish to reassess whether the institution's BSA/AML risk assessment adequately covers its largest and most economically significant products, customer segments, transaction channels, and trade-related activity.
• Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and transaction-monitoring scenarios are appropriately calibrated to credit-card, charge-card, merchant, cross-border, and trade-based money-laundering risks.
• Management may wish to inventory staffing, subject-matter expertise, escalation capacity, data quality, model and rules governance, internal controls, independent testing, and BSA/AML training for employees and directors against the deficiencies identified in the coordinated orders.
• Compliance teams may wish to conduct a lookback of previously generated alerts and transactions to assess whether suspicious activity was timely investigated, escalated, documented, and reported through SARs, including whether systemic monitoring gaps affected historical activity.
• Boards and senior management should consider obtaining documented evidence that enterprise AML oversight is operating effectively at subsidiaries and that parent-level governance does not rely solely on narrow subsidiary or product risk assessments.
• Affected American Express entities should track the 90-day Action Plan submission requirement and prepare supporting remediation evidence, governance reporting, milestone tracking, and supervisory communications.
• Other regulated firms should consider treating the action as a supervisory signal that risk assessments, transaction monitoring, and SAR controls must be aligned to actual business volume and risk rather than to the products that are easiest to administer.

What changed

This is an enforcement action rather than a generally applicable new rule, but it establishes concrete remediation expectations for a large, complex card issuer. The coordinated OCC order requires American Express National Bank to submit, within 90 days of the October 8, 2026 order, an acceptable written Action Plan addressing all BSA/AML deficiencies and incorporating the order's substantive requirements; the OCC must provide prior written supervisory non-objection.

Key dates

2026-10-08

The OCC announced the cease-and-desist order and $350 million civil money penalty against American Express National Bank; the Federal Reserve announced a coordinated action against American Express Company and American Express Travel Related Services Company.

Suggested considerations

• Compliance teams may wish to reassess whether the BSA/AML risk assessment accurately reflects the institution's largest and most complex products, customer segments, payment flows, geographies, channels, and transaction types, rather than relying primarily on deposit-account risk.
• Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and account-risk-rating processes provide sufficiently complete and reliable data for transaction monitoring and suspicious-activity reporting.
• Banks may wish to conduct a targeted lookback for trade-based money-laundering indicators in card, merchant, payment, cross-border, and related repayment activity, including activity involving insiders or connected accounts, and document escalation and reporting decisions.
• Compliance teams should consider validating that monitoring scenarios, alert thresholds, investigative workflows, case-management controls, quality assurance, and SAR filing processes can identify and report suspicious activity within applicable regulatory timeframes.
• Boards and senior management may wish to review whether BSA/AML staffing levels, expertise, reporting lines, technology, data governance, and independent-testing coverage are proportionate to the institution's size, complexity, and risk profile.
• Firms should consider strengthening role-based BSA/AML training for employees, directors, and senior management, with evidence of completion, competency, and periodic refreshers.
• Internal audit or another suitably independent function may wish to perform end-to-end testing of risk assessment, customer due diligence, monitoring, investigation, SAR decisioning, and governance controls, with tracked remediation and board-level reporting.
• U.S. banking organizations may wish to compare their programs against the OCC's findings and the market commentary emphasizing that the principal lesson is product-risk misalignment and the need for enterprise-wide controls, not merely remediation of isolated monitoring alerts.

What changed

This is an enforcement action and supervisory precedent, not a new generally applicable rule. The OCC required American Express National Bank to remediate a BSA/AML program that was not reasonably designed to assure and monitor compliance with the BSA and its implementing regulations. The findings specifically reinforce expectations that risk assessments cover the institution's actual product mix, including credit and charge cards; customer identification and customer due-diligence procedures support effective monitoring; transaction-monitoring and suspicious-activity reporting processes...

Key dates

2026-10-08

ESMA published its opinion on the provision of crypto-asset services in relation to non-MiCA-compliant asset-referenced tokens and e-money tokens.

2027-01-08 Deadline

Latest date by which National Competent Authorities should require remediation of remaining pre-existing exposures, calculated as three months after publication; firms may be required to act earlier.

Suggested considerations

• Firms should inventory every ART and EMT made available to EU clients and classify whether each token satisfies the applicable MiCA requirements, including any relevant authorisation, notification, offer, and admission-to-trading conditions.
• Compliance teams may wish to map each affected token across trading, exchange, execution, placing, order-routing, advice, transfer, custody, and portfolio-management workflows, including bundled or indirect services.
• Firms should consider suspending onboarding, purchases, subscriptions, trading, swaps, staking-related access where relevant, and other activities that could allow EU clients to acquire or increase exposure to a non-MiCA-compliant token.
• Technology and operations teams should assess geolocation, account, wallet, order-management, token-listing, transfer, and API controls, with testing and monitoring designed to prevent EU-client access or increased exposure.
• Legal and product teams should review client terms, token-listing policies, disclosures, contractual restrictions, and arrangements with issuers, liquidity providers, exchanges, and other intermediaries.
• Firms should identify pre-existing client exposures and prepare a documented wind-down or remediation plan capable of completion by 2027-01-08, subject to any earlier NCA requirement.
• Firms may wish to define narrowly controlled exit-only services for liquidation, conversion, withdrawal, transfer, and safekeeping, with time limits, risk controls, client communications, records, and escalation to the relevant NCA.
• Governance functions should document the interpretation of the ESMA opinion, approvals for affected product changes, control ownership, exceptions, surveillance, management information, and evidence available for supervisory review.

What changed

The opinion covers the full range of MiCA crypto-asset services, including operating trading platforms, exchanging crypto-assets for funds or other crypto-assets, executing orders, placing crypto-assets, reception and transmission of orders, investment advice, transfers, custody and administration, and portfolio management. ESMA expects National Competent Authorities to supervise so that CASPs do not maintain, introduce, or facilitate EU-client access to non-MiCA-compliant ARTs or EMTs.

Key dates

2026-10-08

FINMA published the final partial revision of Circular 2016/7.

2026-11-01 Deadline

The revised Circular 2016/7 enters into force and the new supervisory expectations for digital onboarding apply.

2027-11-01 Deadline

Market commentary reports a transitional deadline for firms using qualified electronic signatures to add liveness detection and residence verification.

Suggested considerations

• Compliance teams should map each digital onboarding journey to the revised Circular 2016/7 method requirements, distinguishing video identification, online identification, Swiss e-ID and qualified electronic-signature workflows.
• Firms should assess whether their liveness-detection controls reliably establish that the applicant is a physically present living person and can resist photographs, replayed video, deepfakes and other AI-enabled manipulation.
• Firms should review identity-document validation rules and testing so that approved QR-code documents, including the Swiss driving licence, are handled on an equivalent basis to documents with an MRZ where the circular permits this.
• Firms should validate digital residence-verification processes, including whether the process reliably links the contracting party and the relevant device or infrastructure to the declared place of residence.
• Firms planning to use the Swiss e-ID should confirm technical readiness, evidence retention and treatment of the e-ID's non-copyable, non-archivable characteristics, while avoiding use of the e-ID for workflows limited to video identification.
• Firms should update AML, fraud-risk and onboarding policies, vendor requirements, testing scripts, staff procedures and customer disclosures before the effective date.
• Compliance teams may wish to reassess whether supplementary controls are warranted for higher-risk channels, such as device intelligence, fraud databases, transfer-account verification, duplicate-account detection or enhanced review, because FINMA's circular does not eliminate risk-based control expectations.
• Firms using qualified electronic signatures should confirm any transitional implementation requirements identified in the final circular and related commentary, including the reported 1 November 2027 date for adding liveness and residence verification to that route.

What changed

The Swiss e-ID may be used as an identification method when onboarding clients through digital channels under the Anti-Money Laundering Act, although market commentary indicates that it is available for online identification rather than video identification. Official identification documents bearing a QR code are treated as equivalent to documents containing a machine-readable zone, expanding the acceptable document formats for digital onboarding.

Key dates

2026-02-09

AMLA opened the public consultation on the draft RTS concerning business relationships, occasional and linked transactions, lower thresholds, and customer due diligence.

2026-04-16

AMLA opened the public consultation on the draft RTS concerning group-wide requirements and additional measures for subsidiaries and branches in third countries.

2026-05-08

Public consultation closed for the business-relationship, transaction and customer-due-diligence draft RTS.

2026-06-15

Public consultation closed for the group-wide arrangements and third-country legal-impediment draft RTS.

2026-10-01

AMLA announced that it had finalised the three draft RTS and submitted them to the European Commission for formal adoption.

2026-10-07

CSSF published its communiqué drawing Luxembourg professionals’ attention to the draft RTS and recommending preparatory gap analysis and control work.

Suggested considerations

• Compliance teams may wish to complete a gap analysis against the AMLA final reports, particularly for customer and beneficial-owner information, verification sources, electronic identification, non-face-to-face onboarding and PEP screening.
• Firms should consider mapping current customer journeys and transaction-monitoring logic to the proposed distinction between business relationships, occasional transactions and linked transactions.
• Firms may wish to identify products, sectors and transaction types that could be affected by lower CDD thresholds for higher-risk activities, while avoiding reliance on unfinalised monetary thresholds.
• Financial groups should consider reviewing group-wide AML/CFT governance, risk assessments, policies, internal controls, training and secure information-sharing arrangements, including structures involving common ownership, management, compliance control, networks or partnerships.
• Groups with branches or subsidiaries in third countries should consider inventorying legal impediments to applying EU AMLR and group policies and preparing escalation, risk-mitigation and supervisory-response procedures.
• IT and operations teams may wish to assess changes needed for customer-data fields, linked-transaction detection, identity-verification evidence, electronic identification and intra-group information exchange.
• Firms should monitor the European Commission’s adoption process and the Official Journal publication because the final text, effective date and any amendments remain unknown; preparatory work should be calibrated to the proposed six-month transition period rather than treated as a current binding deadline.

What changed

The draft RTS under Article 19(9) of Regulation (EU) 2024/1624 would establish criteria for distinguishing business relationships, occasional transactions and linked transactions, and would identify high-risk obliged entities, sectors or transactions for which lower CDD thresholds should apply. The draft RTS under Article 28(1) would specify information and verification requirements for standard, simplified and enhanced CDD, including reliable and independent verification sources, electronic identification means, qualified trust services, non-face-to-face verification, and relevant treatment...

Key dates

2020-12-23

FinCEN published the NPRM at 85 FR 83840 proposing additional reporting, recordkeeping, and identity-verification requirements for certain transactions involving unhosted or otherwise covered wallets.

2026-10-06

FinCEN withdrew the NPRM and stated that it would take no further action on that rulemaking.

Suggested considerations

• Compliance teams may wish to remove implementation workstreams, testing scenarios, and policy language that were created solely for the withdrawn NPRM's proposed $3,000 recordkeeping or $10,000 reporting thresholds.
• Firms should consider documenting that the NPRM was never effective and that its withdrawal does not eliminate existing obligations under the Bank Secrecy Act or applicable implementing regulations in 31 CFR parts 1010, 1020, and 1022.
• Banks and MSBs may wish to reassess whether current controls for transfers involving unhosted wallets remain risk-based and supported by documented AML risk assessments, rather than treating the withdrawn proposal's thresholds as mandatory rules.
• Crypto businesses should continue reviewing applicable customer-identification, customer-due-diligence, suspicious-activity-reporting, recordkeeping, transaction-monitoring, and OFAC sanctions requirements independently of this withdrawal.
• Regulatory-monitoring teams may wish to track whether FinCEN or Treasury develops a replacement digital-asset framework, particularly in light of the stated policy objective that digital-asset regulation be fit for purpose.

What changed

FinCEN withdrew the NPRM published at 85 FR 83840 and stated that it will take no further action on that rulemaking. The withdrawn proposal would have required banks and money services businesses to file reports when a transaction involving an unhosted or otherwise covered wallet exceeded $10,000, or multiple such transactions exceeded $10,000 in 24 hours. It also would have required records, counterparty information, and customer identity verification for covered transactions exceeding $3,000.

Key dates

2023-10-23

FinCEN published the proposed section 311 finding and special measure concerning international CVC mixing at 88 FR 72701.

2026-10-06

FinCEN's withdrawal of the finding and proposed rulemaking became effective upon Federal Register publication at 91 FR 63513.

Suggested considerations

• Compliance teams should discontinue implementation work that was undertaken solely for the withdrawn section 311 CVC-mixing proposal, including plans for the proposal-specific data fields, reporting workflows, and enhanced customer records.
• Firms should not interpret the withdrawal as authorization to process illicit mixer activity without controls; they should continue applying existing risk-based AML, sanctions, transaction-monitoring, escalation, and suspicious activity reporting procedures.
• Crypto exchanges and other covered institutions should review whether current transaction-monitoring scenarios appropriately identify mixer exposure and other indicators of money laundering or terrorist financing under existing requirements, without treating all privacy-preserving activity as inherently suspicious.
• Firms may wish to document the withdrawal in their regulatory inventory, rulemaking-impact assessments, and model or procedure change logs, while preserving controls that address independently applicable BSA or sanctions requirements.
• Compliance teams should monitor future FinCEN notices, section 311 actions, enforcement activity, and interpretive guidance because FinCEN expressly reserved the possibility of future measures concerning mixers.
• Legal and compliance functions should reassess any customer, product, or transaction restrictions adopted specifically in anticipation of the proposed rule and determine whether they remain justified by the firm's risk assessment, other legal requirements, or contractual obligations.

What changed

FinCEN withdrew the proposed rule published at 88 FR 72701 and the underlying section 311 finding concerning international CVC mixing. The proposed special measure one regime would have required covered financial institutions to report specified information for transactions they knew, suspected, or had reason to suspect involved international CVC mixing, including CVC type and amount, mixer and wallet information, transaction hashes, transaction dates, IP addresses, customer-identifying information, and a narrative description.

Key dates

2026-10-05

The CFTC Chairman announced the proposed Regulation CTX and Regulation CAM framework, and independent industry reporting identified the accompanying action as an advance notice of proposed rulemaking.

Suggested considerations

• Compliance teams may wish to monitor the Federal Register for publication of the CTX/CAM ANPRM and calculate the 60-day comment period from the actual publication date rather than from the Chairman’s October 5 statement.
• Affected exchanges should map each product and customer flow against margin, leverage, financing, custody, settlement, and internal-ledger features to determine whether the activity could fall within the proposed CTX concept.
• State-licensed platforms may wish to assess the strategic and operational consequences of pursuing a CFTC registration pathway instead of relying solely on state money-transmitter licenses.
• Firms may wish to review governance, conflicts-of-interest controls, market surveillance, anti-manipulation controls, customer-asset segregation, operational resilience, disclosure, and recordkeeping capabilities against existing CFTC designated contract market and customer-protection expectations.
• Exchanges and service providers may wish to prepare comments addressing the scope of Section 2(c)(2)(D), the treatment of fully paid transactions, the boundary between spot trading and financed transactions, and the interaction between CAM registration and state licensing.
• Legal and compliance functions may wish to inventory crypto assets and classify them consistently with the referenced joint CFTC-SEC interpretation, while preserving separate analysis for assets that may constitute securities or fall outside the proposed framework.
• U.S.-facing offshore platforms should reassess territorial exposure and customer-access controls because the proposal may create a clearer federal compliance pathway without eliminating potential CFTC jurisdiction over unregistered or fraudulent activity.

What changed

The CFTC is proposing to use its existing Commodity Exchange Act authority, including Section 2(c)(2)(D), to develop a purpose-built framework for crypto asset transactions and markets. Regulation CTX would address retail crypto transactions involving margin, leverage, or financing. Regulation CAM would establish a tailored category of CFTC-registered crypto asset market, apparently as a specialized form of designated contract market, for exchanges offering those transactions.

Key dates

2023-01-01

The Economic Crime and Corporate Transparency Act 2023 received Royal Assent during 2023; its voluntary information-sharing provisions are identified by the FCA as a potential mechanism for firms to share information concerning economic crime. The specific commencement date for any relevant provision should be verified against the applicable commencement instruments.

2025-01-01

Cifas introduced a dedicated funds received for money muling filing category and revised filing criteria and guidance, making 2025 filing data not directly comparable with 2023 and 2024. The date is stated as January 2025 rather than a specific day.

2026-09-23

The FCA published its multi-firm review on money-mule activity and cashing out findings.

Suggested considerations

• Firms should consider refreshing their business-wide and customer-risk assessments to reflect mule-chain activity, including the concentration of cashing out between the second and fifth accounts and the higher concentration at the second account.
• Compliance and fraud teams may wish to test whether transaction-monitoring scenarios identify linked accounts, repeated use of accounts across fraud types, rapid onward transfers, fragmented card spending, international destinations and higher-value crypto-related cash-outs.
• Firms should consider reviewing controls across the full payment chain rather than focusing only on the first account receiving suspected fraud proceeds, including internal account link analysis and escalation between fraud, AML and investigations teams.
• Banks, payment institutions and EMIs may wish to compare detection and response performance by account tenure, customer type and channel, noting that 74.1% of EMI closures and 56.9% of PI closures in the survey occurred within six months of account opening.
• Firms should consider assessing whether their use of the National Fraud Database is effective and whether suspected cases meet the applicable Cifas evidential and category criteria; the FCA data should not be interpreted as requiring Cifas filings to equal account closures.
• Firms should consider whether the Economic Crime and Corporate Transparency Act 2023 information-sharing provisions can lawfully support prevention, detection or investigation of linked mule activity, with appropriate governance, records and data-protection controls.
• MLROs and nominated officers may wish to prepare for the further FCA and National Economic Crime Centre alert and retain evidence showing how the review findings were considered and, where appropriate, incorporated into control enhancements.

What changed

The FCA has provided new supervisory findings on the scale, profile and mechanics of money-mule activity based on a survey of 35 firms and analysis by a 22-firm public-private cell covering 140 cases across seven fraud types. It expects firms to use the findings in their own money-mule risk assessments and to review and strengthen controls for detecting, preventing and disrupting mule activity.

Key dates

2026-09-17

The FCA published its findings on payments firms delivering good outcomes for consumers in vulnerable circumstances.

Suggested considerations

• Compliance teams may wish to map the four vulnerability drivers in FG21/1 against the firm’s customer base, products, channels and transaction journeys, including digital-only and automated interactions.
• Firms should consider testing whether vulnerability identification, recording, flagging and information-sharing operate consistently in practice through call listening, complaints analysis, quality assurance, customer research and sample-based file reviews.
• Firms may wish to document how identified needs translate into specific support, such as alternative channels, assisted onboarding, additional time, accessible communications, language support or human intervention, and how those interventions produce good outcomes.
• Management information may need to cover the prevalence and characteristics of vulnerability, support provided, customer outcomes, complaints, failed or delayed payments, access barriers, vulnerable-customer journey performance and trends over time; smaller firms may use proportionate qualitative evidence but should still demonstrate effective oversight.
• Boards and senior management may wish to receive sufficiently frequent reporting to challenge whether arrangements are working, investigate root causes and track whether remedial actions improve outcomes rather than relying solely on annual Consumer Duty reporting or isolated case studies.
• Firms using intermediaries should consider how they assess the intermediary’s identification, training, support, communications, recording and outcomes-monitoring arrangements, and how issues are escalated and remediated.
• When collecting or sharing vulnerability information, firms should consider compliance with UK GDPR, the Data Protection Act 2018 and applicable confidentiality and data-minimisation requirements.
• Smaller firms may wish to record why their systems, controls and management information are proportionate to their business model, customer base and potential harm, while retaining evidence that individual circumstances can be addressed flexibly.

What changed

No new binding requirements or prescribed operating model were introduced. The FCA has nevertheless clarified the evidence it expects firms to maintain under the existing Consumer Duty and its vulnerable-customer guidance, including an understanding of the four vulnerability drivers—health, life events, financial resilience and financial capability—identification and recording across customer journeys, appropriate support and communications, outcome-focused management information, senior-management or board oversight, testing and assurance, intermediary oversight, and continuous improvement.

Key dates

2026-09-16

The FCA published PS26/18 and its final cryptoasset perimeter guidance.

2026-09-30

The application window opened for firms seeking to use the transitional arrangements.

2027-02-28 Deadline

The application window closes for firms wishing to use the transitional arrangements.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 introduce the new regulated cryptoasset activities into the FCA perimeter.

Suggested considerations

• Firms should map each current and planned cryptoasset service against the PERG 18 regulated-activity analysis, including whether the activity is conducted in the UK and by way of business.
• Firms registered under the Money Laundering Regulations should assess separately whether FCA authorisation or a variation of permission is required, because existing registration does not convert automatically into authorisation.
• Existing FCA-authorised firms should review their permissions and consider whether a variation of permission will be needed for cryptoasset activities.
• Firms intending to rely on transitional or savings arrangements should assess eligibility and submit an application within the 30 September 2026 to 28 February 2027 application window.
• Compliance teams may wish to inventory custodial wallets, trading venues, brokerage and arranging models, staking services, stablecoin issuance, lending products, market-making and technology or infrastructure services.
• Firms should review UK territoriality, customer location, solicitation, marketing and operating-model assumptions, particularly for overseas businesses serving UK consumers.
• Firms should monitor the FCA's further consultation on amendments to the perimeter guidance and reassess their analysis when the underlying regulations and final amended guidance change.
• Applicants should prepare governance, business-model, financial, operational, safeguarding, systems and controls material expected for authorisation and may wish to obtain independent legal and compliance advice.

What changed

The FCA has finalised new PERG 18 guidance on determining whether a cryptoasset activity is regulated, whether it is carried on in the UK, whether it is carried on by way of business, and whether an exemption or transitional provision applies. The perimeter covers activities such as issuing qualifying stablecoins, operating cryptoasset trading platforms, dealing in or arranging deals in cryptoassets, safeguarding cryptoassets and arranging cryptoasset staking.