Technology & Cyber

Key dates

2026-01-19

The PRM sourcebook and related POATR regime rules and amendments referred to in PMB 67 came into force.

2026-11-04

FCA published Primary Market Bulletin 67, launched the consultation on Knowledge Base amendments through GC26/8, and published the new PMB and ESS information.

2026-12-09 Deadline

Deadline for comments on GC26/8 consultation proposals concerning consequential Knowledge Base amendments.

Suggested considerations

• Sponsors should consider mapping every current and planned AI use case to the relevant sponsor workstream, identifying activities where AI assistance is unsuitable or requires enhanced review, including complex negotiations, board-level strategic advice and definitive ethical or legal accountability.
• Sponsors should consider documenting named human responsibility for validating AI outputs, correcting hallucinations and omissions, independently challenging analysis, and approving final sponsor work products.
• Compliance and risk teams may wish to review AI policies and controls for approved-tool restrictions, consumer-tool blocking or limitation, confidential-information handling, third-party adviser use, supplier confidentiality, model changes, and accountability for both information entered and output received.
• Sponsors should consider whether prompts, outputs, transcripts, drafts and related review evidence constitute records, and whether retained files demonstrate and permit verification of the basis for material judgements in accordance with applicable sponsor record-keeping arrangements.
• Primary-market legal and compliance teams should review employee and former-employee offering exemptions against PRM 1.4.12(2)(c), particularly where employee incentive or share schemes rely on the prospectus exemption.
• Interested firms should consider submitting comments on GC26/8 by 9 December 2026 and reviewing the final Knowledge Base amendments once published.
• ESS administrators should consider adopting the Update My Profile process, ensuring that profile changes are supported by a stated reason and that any impact on open cases is selected deliberately.
• Issuers and data users may wish to assess the new NSM interface and prepare for future FCA MIRA issuer profiles, API access and changes to the Official List, while continuing to maintain existing disclosure submission processes until further FCA instructions are issued.

What changed

The FCA has launched an enhanced NSM interface and intends to develop FCA MIRA, combining a modernised NSM, a modernised Official List, issuer profile pages, reference and short-position data, and an API for bulk access. The FCA has not introduced a new AI-specific rule in PMB 67, but its review provides clear supervisory expectations for sponsors: AI may support research, summarisation, drafting, due diligence, quality assurance and other work, but must not replace sponsor professional judgement, independent challenge, accountability or conclusions reached after due and careful enquiry.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the Supervisory Framework on Bank Use of Super Intelligence for examiner use.

Suggested considerations

• Compliance teams may wish to inventory current and planned SI and agentic-SI use cases, including embedded functionality supplied by vendors, and map each use case to its business owner, permitted actions, autonomy level, human oversight, data sources, and potential consequences of failure or misuse.
• Banks should consider documenting a risk-based classification methodology focused on potential consequences, transfer of agency, and degree of human oversight rather than technical sophistication alone.
• Risk and control owners may wish to assess whether existing model-risk, governance, data-governance, privacy, cybersecurity, compliance, operational-resilience, vendor-management, testing, monitoring, documentation, auditability, and independent-challenge controls adequately address SI-enabled activities.
• Higher-consequence or more autonomous use cases should be considered for stronger restrictions on permitted actions, more direct human oversight, independent validation or challenge, enhanced performance monitoring, audit trails, testing, fallback procedures, and resilience measures.
• Boards and senior management may wish to clarify accountability for SI deployments without creating a separate SI risk appetite unless the bank determines that one is useful internally; the OCC framework does not require one.
• Internal audit and compliance teams may wish to retain evidence showing how SI risks are identified, measured, monitored, controlled, and escalated within existing risk-management frameworks, particularly because examiners may use the framework during ordinary examinations despite its nonbinding status.
• Banks should consider reviewing contracts and oversight arrangements for SI vendors, including access to data, model changes, incident notification, testing rights, service continuity, explainability or transparency, subcontracting, and termination or fallback arrangements.
• Compliance teams may wish to monitor future OCC revisions and stakeholder feedback because the framework is expressly intended to be a living document.

What changed

The OCC provided examiners with a risk-based, proportionate framework covering SI used in activities including credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities. Examiners are instructed to consider the bank’s size, complexity, risk profile, and the nature, consequences, autonomy, and complexity of each SI use case; banks are not required to create a separate SI risk category or SI-specific risk appetite. The framework identifies 16 components across six pillars: purpose, risk, control, oversight, resilience, and assurance.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the accompanying supervisory framework for examiner use.

2026-10-02

Executive Order 14434 was published in the Federal Register and is cited by the OCC as the source for the “super intelligence” terminology and broader definition.

Suggested considerations

• Firms should consider maintaining an inventory of SI and agentic use cases, documenting each system’s purpose, permitted actions, accessible data and systems, prohibited uses, degree of autonomy, human-oversight model, and business owner.
• Compliance teams may wish to prioritize review of use cases according to potential consequences of failure or misuse, transfer of decision-making agency, reversibility, customer or market impact, data sensitivity, and the practical ability of personnel to intervene.
• Banks should consider testing whether human reviewers can meaningfully understand, reject, pause, or stop system outputs and actions, rather than relying solely on nominal approval checkpoints or high-volume bulk approvals.
• Risk functions may wish to map SI-enabled activities to existing model risk management, operational-risk, cybersecurity, privacy, consumer-protection, compliance, and business-continuity controls instead of creating a standalone SI risk category.
• Governance teams should consider assigning accountable owners across the system lifecycle, including approval, deployment, change management, incident response, suspension, retirement, and post-incident remediation.
• Banks should consider establishing monitoring capable of detecting model drift, erroneous or harmful actions, unauthorized activity, control exceptions, low-frequency high-impact events, and customer harm, with defined escalation and containment procedures.
• Third-party risk teams may wish to review contracts for vendor notification of model changes and new SI functionality, incident and notification timelines, audit and testing rights, data-use restrictions, responsibility for model errors, service suspension rights, and operational-resilience obligations.
• Internal audit and independent validation functions should consider whether they can reconstruct material outputs and actions, assess control effectiveness, and provide effective challenge to developers, business owners, and validation teams.

What changed

The OCC provided examiners with a framework that supplements existing model risk management, governance, technology, compliance, cybersecurity, and operational-risk practices. It covers 16 components organized around purpose, risk, control, oversight, resilience, and assurance, including permitted use and authority, criticality assessment, human-in-the-loop and human-on-the-loop controls, governance and accountability, performance monitoring, operational resilience, documentation and auditability, vendor risk, testing, and independent challenge.

Key dates

2026-11-04

The proposed rule was published in the Federal Register at 91 FR 69642.

2027-01-04 Deadline

Comments on RIN 3064-AG35 must be received by the FDIC.

2029-10-01

First proposed inflation-based adjustment to the section 360.9 covered-institution and larger-covered-institution thresholds.

Suggested considerations

• Affected banks should assess whether they meet the proposed covered-institution or larger-covered-institution thresholds using Call Report definitions and current deposit-account and asset data.
• Current part 370 institutions should map existing output files and deposit-account records against the 26 proposed mandatory fields in 12 CFR part 360 appendices C through G, identifying gaps in account title, ownership, relationship, beneficiary, domestic-versus-foreign, and other required data.
• Part 370 institutions should evaluate the effect of replacing their own deposit-insurance calculation systems with FDIC-calculation reliance, while preserving or redeveloping the provisional-hold capabilities required by proposed section 360.9.
• Larger covered institutions should inventory transactional accounts subject to the proposed account-holder contractual or disclosure requirement and determine which mortgage-servicer, fiduciary, real-estate, IOLTA, employee-benefit-plan, and trust-related accounts may be excluded.
• Compliance, operations, legal, and technology teams should review the proposed six-month implementation period for general requirements and 18-month period for provisional-hold requirements for institutions that are larger covered institutions on the final rule's effective date.
• Banks approaching the thresholds should establish monitoring for two consecutive quarters, the proposed 12-month implementation period after becoming a larger covered institution, and the proposed release mechanism after three consecutive quarters below the relevant threshold.
• Institutions should consider whether to submit comments by January 4, 2027, particularly on field-level data requirements, provisional-hold redevelopment, account-holder disclosures, transition timing, exemptions, and the CPI-W indexing methodology.
• Industry commentary indicates that the proposal is being read primarily as a burden-reduction measure for large banks, with estimated annual savings of approximately $33 million offset by approximately $14 million in transition costs; firms should nevertheless account for operational work associated with standardized data and provisional holds.

What changed

Proposed revised 12 CFR 360.9 would apply to insured depository institutions with at least $2 billion in deposits and either at least 250,000 deposit accounts or at least $20 billion in total assets, regardless of deposit-account count. A new category of larger covered institution would include institutions with at least $2 billion in deposits and two million or more deposit accounts. Part 370 institutions would generally become larger covered institutions under section 360.9, and would no longer need to operate systems capable of calculating deposit-insurance coverage themselves.

Key dates

2026-09-30

The FCA’s application window for the new UK cryptoasset regime opened.

2026-10-01

The application window opened for the FCA Regulatory Sandbox themed cohort on climate scenario models.

2026-11-02

The FCA published Wholesale banks supervision - Insights 3 (Autumn 2026).

2026-11-30 Deadline

The application window closes for the FCA Regulatory Sandbox climate scenario models cohort.

2027-02-28 Deadline

FCA-encouraged deadline for wholesale banks to submit a variation-of-permission application for new regulated cryptoasset activities to obtain the stated pre-regime application treatment.

2027-10-25

The new UK cryptoasset regime comes into force.

Suggested considerations

• Firms should consider performing a control-by-control review of critical data ingestion, including completeness checks, reconciliation, coding-change testing, source-to-consumption lineage and evidence of design and operating effectiveness for financial-crime and surveillance controls.
• Compliance and technology teams may wish to test communications surveillance after system changes, including lexicon configuration, geographic and channel coverage, third-party-provider interfaces, ingestion completeness and retention or auditability of records for in-scope activities.
• Firms should consider reconciling the technology-asset inventory to procurement, disposal, redeployment, identity and endpoint-management records across all regions, assigning clear lifecycle accountability and confirming that assets cannot leave service without security and inventory updates, including encryption status.
• Algorithmic-trading firms should consider testing enhancements across the complete order lifecycle, including near-simultaneous and geographically distributed fills, order-management and fill-notification interactions, overfills, stop-loss scenarios, venue behaviour, pre-trade limits, kill or cancel mechanisms and post-implementation monitoring, with governance aligned to UK MiFID RTS 6.
• Firms should consider testing DLP controls against deliberate circumvention, including split messages, altered classifications, changed file formats, embedded images and misleading subjects, while reviewing staff training, monitoring, escalation and privacy safeguards.
• Operational-resilience owners may wish to refresh important-business-service impact tolerances using potential disruption to trading, settlement, clients, counterparties and time-critical market processes rather than relying solely on generic recovery-time or availability metrics.
• Firms should consider separating current resilience capability from planned remediation in self-assessments, linking incidents, near misses and test results to mapping and remediation decisions, and validating completed remediation through retesting.
• Settlement-related firms should consider the effect of T+1 on post-trade dependencies, reconciliation, funding, exception management, recovery capability, scenario testing and impact-tolerance calibration.

What changed

The FCA has not introduced new binding rules through this publication; it has consolidated supervisory findings and clarified areas against which wholesale banks may be assessed. Firms are expected to be able to evidence complete data lineage and ingestion controls, auditable recording and communications surveillance even where third parties are used, reliable asset inventories, end-to-end algorithmic-trading testing and controls consistent with UK MiFID RTS 6, and DLP controls capable of addressing adaptive evasion techniques.

Key dates

2026-10-30

FDIC Board unanimously approved the Notice of Proposed Rulemaking by notational vote.

Suggested considerations

• Compliance teams should obtain and review the complete NPRM, including proposed amendments, definitions, scope thresholds, transition provisions, and the Federal Register comment deadline, because the bulletin itself contains only a high-level announcement.
• Firms should map each insured depository institution against the current applicability criteria in 12 CFR part 370 and 12 CFR 360.9, documenting deposit-account counts, domestic deposits, total assets, existing exemptions, certifications, and any voluntary compliance elections.
• Affected institutions should inventory overlapping deposit-insurance determination, depositor-record, provisional-hold, data-format, and reporting capabilities to identify systems that could potentially be consolidated if the proposal is finalized.
• Technology, operations, deposit administration, legal, resolution-planning, and third-party-risk teams should assess whether current data lineage, account ownership and capacity coding, reconciliation, testing, and FDIC access processes would satisfy a revised standardized-record framework.
• Firms should consider submitting comments on the operational feasibility, treatment of affiliates and mergers, transition periods, testing expectations, treatment of custodial and pass-through accounts, and whether any proposed relief would create gaps in failure-day data availability.
• Institutions should continue complying with currently effective 12 CFR part 370 and 12 CFR 360.9 requirements until a final rule becomes effective and any applicable transition period expires.

What changed

The FDIC has proposed amendments concerning the framework used by large insured depository institutions to maintain depositor records and support rapid deposit-insurance determinations. Based on the FDIC’s accompanying policy direction and independent industry commentary, the proposal would likely preserve standardized depositor-record and data-access requirements while reducing or eliminating the need for institutions subject to 12 CFR part 370 to maintain separate, independent deposit-insurance determination systems.

Key dates

2026-10-29

FCA CP26/39 published and consultation opens.

2026-12-17 Deadline

Deadline for responses to CP26/39.

2027-03-18

PS26/2 final rules and guidance on operational incident and material third-party reporting come into force; the CTP-related enhanced reporting framework is expected to apply from this date.

2027-01-01

FCA plans to publish a Feedback Statement confirming the income-sharing metric and percentage for the equity CTP.

2027-04-01

FCA expects to publish its Policy Statement on how shared equity-CTP income is distributed among data contributors during spring 2027.

Suggested considerations

• Trading venues and other potential data contributors should consider modelling how alternative allocation metrics, including data contribution, trading activity, quote quality or coverage measures, could affect their expected income-sharing receipts.
• Prospective equity CTP bidders should consider the proposed distribution methodology, the five-year concession structure and the resulting revenue, accounting, data-governance and contractual controls in procurement and operating models.
• CTPs and firms providing critical technology or data services to CTPs should map operational incidents against the PS26/2 thresholds and assess whether current escalation, evidence retention and regulatory-notification procedures can support reporting as soon as practicable.
• CTPs should consider whether their incident-management playbooks distinguish standard and enhanced reporting, capture significant status changes and support submissions through the FCA’s prescribed reporting channel.
• Affected stakeholders should consider submitting responses to the FCA consultation by 17 December 2026, particularly on allocation fairness, data-contribution measurement, treatment of different contributor classes and the operational burden of enhanced incident reporting.
• Compliance teams may wish to track the early-2027 Feedback Statement on the income metric and percentage, the spring-2027 Policy Statement on distribution rules and the separate final rules on systematic-internaliser quotes.

What changed

The FCA proposes to add Handbook rules and guidance governing how the portion of equity CTP income specified in the five-year concession agreement is allocated among data contributors. The proposed allocation rules would apply regardless of the income metric or percentage ultimately specified in that agreement; the FCA plans to confirm the income-sharing percentage and metric in an early-2027 Feedback Statement and the distribution rules in a spring-2027 Policy Statement.

Key dates

2026-10-29

The Bank of England published the consultation and draft Supervisory Statement on CCP acceptance of tokenised collateral.

2027-02-12 Deadline

Consultation closes; responses on the draft supervisory expectations and wider tokenised-collateral policy are requested by this date.

2028-01-01

Target year for the Bank’s planned RT2 synchronisation capability supporting settlement between digital-asset ledgers and central bank money; this is a stated implementation target, not a compliance deadline.

Suggested considerations

• CCPs and prospective CCP applicants should consider whether tokenised versions of currently accepted or eligible collateral would constitute new collateral requiring notification to, or permission from, the Bank under the existing supervisory and margin-permission processes.
• Compliance, legal and risk teams should consider mapping each proposed tokenised collateral arrangement end to end, including issuance, representation of rights, custody, transfer, settlement finality, redemption, liquidation and default management.
• CCPs should consider preparing evidence on valuation methodology, price reliability, liquidity, conversion between tokenised and conventional forms, repo or outright-sale access, stress-market behaviour and concentration treatment across identical underlying assets.
• CCPs and their service providers should consider legal opinions addressing ownership, enforceability, insolvency treatment, settlement finality under the Settlement Finality Regulations, transfer restrictions and the relationship between ledger records, CSD records and underlying assets.
• Operational-resilience assessments should consider ledger, bridge, smart-contract, custodian, wallet, key-management and other third-party failure scenarios, including alternative access, transfer, liquidation and recovery arrangements.
• CCPs should consider whether proposed arrangements require changes to models, parameters, margining, collateral haircuts, default-management procedures, investment-policy controls, outsourcing oversight or governance approvals.
• Affected firms and infrastructure providers may wish to submit responses to the Bank’s consultation by 2027-02-12, particularly on practical barriers, wider tokenised-asset use cases and whether the proposed expectations remain suitable for future collateral types.
• Firms operating cross-border collateral arrangements should consider the interaction with parallel international developments, including ESMA’s October 2026 call for evidence on tokenised collateral in EU central clearing.

What changed

The Bank proposes to assess tokenised collateral through the existing supervisory process for new collateral, including where a tokenised version has risk characteristics that differ from the approved non-tokenised asset because of its delivery method, credit risk or liquidity profile. The draft Supervisory Statement adopts a technology-neutral, outcomes-focused and proportionate approach: CCPs would need to demonstrate that tokenised collateral can be valued, transferred, controlled and realised within required timeframes in normal and stressed conditions.

Key dates

2026-12-07 Deadline

First phased requirements under the amended RTS on settlement discipline and related ESMA guidelines apply to allocations and confirmations, including electronic, standardised and machine-readable communications, subject to the temporary technical disruption exception.

2027-07-01 Deadline

Additional phased requirements under the amended RTS on settlement discipline become applicable, as specified in the regulation’s transitional provisions.

2027-10-11 Deadline

Regulation (EU) 2025/2075 applies and the EU standard securities settlement cycle changes from T+2 to T+1; the final phase of related settlement-layer requirements also applies.

Suggested considerations

• Firms should map every affected transaction type, market, currency, venue, CSD, custodian, broker, client and outsourcing provider across the full trading and settlement ecosystem rather than assessing only internal readiness.
• Compliance and operations teams may wish to confirm whether allocations and confirmations can be completed on trade date and transmitted through electronic, standardised and machine-readable channels from 7 December 2026, including accurate place-of-settlement data where required.
• Firms should assess and test ISO or other applicable international messaging standards, matching platforms, standing settlement instruction governance, exception handling and the documented process for temporary technical disruptions.
• Firms should identify manual processing steps that cannot reliably operate within the shortened timetable and consider automation, straight-through processing, reconciliation, controls over data quality and resilient fallback arrangements.
• Firms should obtain implementation commitments and test plans from clients, brokers, custodians, CSD participants, CSDs, CCPs, vendors and outsourcing providers, with evidence of end-to-end testing and defect remediation.
• Firms should review liquidity, collateral, margin, FX funding, corporate-action, securities-lending, fund dealing and investment-operation processes for the reduced interval between trade and settlement.
• Firms should maintain a regulatory change plan covering the phased milestones on 7 December 2026, 1 July 2027 and 11 October 2027, with senior management oversight, documented risk acceptance and escalation of unresolved dependencies.

What changed

Regulation (EU) 2025/2075 amends Regulation (EU) No 909/2014 (CSDR) and provides for the EU settlement cycle to apply on a T+1 basis from 11 October 2027. Commission Delegated Regulation (EU) 2026/1536 amends the RTS on settlement discipline in Commission Delegated Regulation (EU) 2018/1229, with phased application beginning on 7 December 2026. From 7 December 2026, the allocation and confirmation process must use electronic, standardised communication channels and international messaging standards, with machine-readable communications required except during temporary technical disruptions.

Key dates

2026-10-28

ADGM published the Guidance on Crypto Mining Activities in and from ADGM under section 23 of the Commercial Licensing Regulations 2025.

Suggested considerations

• Firms considering establishment or continued operation in ADGM should perform the RA pre-application self-assessment and document why their activities fall within commercial mining rather than an FSRA-regulated financial service.
• Operators should assess whether they require or should apply for the dedicated commercial licence associated with activity code 7230 and should avoid representing the licence as an authorisation to conduct regulated financial services.
• Compliance teams may wish to prepare an up-to-date corporate structure and ultimate-beneficial-owner information for RA review, together with governance documentation proportionate to the scale and risk of the operation.
• Operators should identify all blockchain addresses used to receive mining rewards and establish controlled procedures for making the required confidential on-chain address disclosures to the RA.
• ADGM-headquartered groups should map global mining activities, reporting lines, outsourced infrastructure, jurisdictional controls and board oversight so that the ADGM entity can demonstrate reasonable supervision of overseas operations.
• Firms should review whether staking, validator, custody, brokerage, token issuance, investment management or other associated activities separately require FSRA permission or create an additional regulatory perimeter.
• Operators may wish to monitor the RA’s forthcoming consultation on the second-phase regulatory framework and preserve records supporting their current perimeter analysis, licensing basis, governance and operational-risk controls.
• Firms should consider the practical implications identified in independent commentary, including operational resilience, cybersecurity, infrastructure security, energy management, transparent service terms and any applicable UAE federal tax, accounting and AML/CFT requirements, without treating those commentary points as additional requirements expressly created by this publication.

What changed

Commercial crypto mining conducted in or from ADGM is associated with dedicated RA commercial activity code 7230 and requires the applicable commercial licensing pathway. The Guidance is technology-neutral and covers Proof-of-Work, Proof-of-Stake and future consensus mechanisms. It establishes a pre-application self-assessment to help applicants distinguish mining from FSRA-regulated financial activities, and highlights expectations concerning corporate structure, ultimate beneficial ownership, and confidential disclosure of on-chain addresses used for reward flows.

Key dates

2012-12-31

MISMEL was licensed by the DFSA as a credit rating agency.

2023-12-01

Beginning of the period during which MISMEL reported seven inadvertent data-disclosure incidents to the DFSA; the source specifies December 2023 but not an exact day.

2026-05-31

End of the incident period described by the DFSA; the source specifies May 2026 but not an exact day.

2026-10-28

The DFSA announced the enforcement action and USD 585,825 penalty against MISMEL.

Suggested considerations

• Credit rating agencies should consider mapping confidential-information flows, permitted uses, recipients and disclosure exceptions against DFSA COB 8.9.1 and COB 8.9.2.
• Compliance and technology teams may wish to test email, endpoint, access-control, data-loss-prevention and external-recipient controls using realistic scenarios involving inadvertent disclosures.
• Firms should consider documenting compensating controls and an approved replacement before disabling or materially changing any security tool, with formal risk acceptance where continuity cannot be achieved.
• Control owners may wish to review incident detection, escalation, investigation and regulatory-notification processes, including whether repeated near misses are aggregated and reported to senior management and the DFSA where applicable.
• Senior management and compliance teams should consider reviewing employee training, attestations, supervision and disciplinary arrangements so that confidentiality obligations are demonstrably enforced and not merely documented.
• Credit rating agencies may wish to retain sufficient records and audit trails to evidence the operation and testing of confidentiality controls, noting the DFSA Rulebook requirement to maintain relevant records for at least six years.
• Firms outside the credit-rating sector should consider the enforcement action as an indicator of DFSA expectations for proportionate data-confidentiality governance, although the cited COB 8.9 requirements specifically apply to credit rating agencies.

What changed

This is an enforcement action rather than a new rule or prospective regulatory amendment. The DFSA found that MISMEL failed to implement and maintain adequate systems and controls to safeguard confidential information and failed to ensure that employees did not disclose it. The relevant DFSA framework requires a credit rating agency to maintain policies, procedures and controls preventing use of confidential information for unauthorised purposes and disclosure to other persons, subject to limited exceptions such as prior written consent or a legal obligation; COB 8.9.1 also addresses pending...

Key dates

2026-12-07 Deadline

First phased requirements apply to investment firms and their clients for allocations and confirmations, including electronic, standardised, international-standard and machine-readable communications except during temporary technical disruptions.

2027-07-01 Deadline

Second phased implementation deadline under the amended settlement-discipline framework.

2027-10-11 Deadline

EU securities markets move from the standard T+2 settlement cycle to T+1; the final phased settlement-discipline requirements apply.

Suggested considerations

• Firms should map every allocation, confirmation, matching and settlement-instruction process affected by the amended settlement-discipline RTS and identify manual, non-standardised or non-machine-readable steps.
• Compliance teams may wish to confirm that electronic, standardised communication channels and international messaging standards are available to the firm and its professional clients before 7 December 2026.
• Firms should consider implementing trade-date controls, internal cut-offs, automated alerts, escalation procedures and exception reporting to identify transactions at risk of missing the applicable allocation and confirmation deadline.
• Investment firms may wish to review client onboarding and contractual documentation to ensure that professional clients provide complete settlement details and use compatible communication channels and formats.
• Operations and technology teams should test end-to-end connectivity, message formats, reference data, settlement instructions, matching, foreign-exchange funding, securities lending, collateral and asset-servicing workflows across the entire trading and settlement ecosystem.
• Firms should assess readiness not only within their own organisation but also across brokers, custodians, clients, fund administrators, CSDs, settlement agents and other outsourced providers.
• Firms should establish a phased implementation plan covering the 7 December 2026, 1 July 2027 and 11 October 2027 milestones, with evidence of testing, issue remediation and management oversight.
• Compliance teams may wish to monitor further ESMA and CSSF supervisory communications because ESMA and national competent authorities have indicated that they will monitor compliance with the new obligations.

What changed

Amended settlement-discipline regulatory technical standards under Commission Delegated Regulation (EU) 2018/1229 introduce phased requirements supporting the EU T+1 transition. From 7 December 2026, investment firms and their clients must use electronic, standardised communication channels and international messaging standards for allocations and confirmations, with machine-readable communication required except during temporary technical disruptions.

Key dates

2026-10-23

FCA consultation CP26/38 opened and published.

2026-12-24 Deadline

Deadline for submitting responses to the FCA consultation.

2027-10-01

The FCA describes the new cryptoasset regime as applying from October 2027; the precise commencement date should be confirmed against the final legislation and FCA rules.

Suggested considerations

• Compliance teams may wish to review the proposed changes and submit consultation responses through the FCA online form by 24 December 2026, particularly where the proposals would create material implementation costs or operational challenges.
• Firms should consider mapping current fraud, AML/CTF, sanctions, proliferation-financing, data-security and financial-crime systems-and-controls frameworks against the consultation themes, while recognising that the proposals are not yet final guidance.
• Cryptoasset businesses and firms intending to provide regulated cryptoasset services may wish to assess readiness for the new regime expected in October 2027, including AML/KYC controls, blockchain analytics, Travel Rule processes, sanctions screening, transaction monitoring and governance.
• Firms using AI or external technology providers for transaction monitoring, customer screening or other financial-crime controls should consider documenting model governance, validation, parameter testing, explainability, human oversight, data security, third-party oversight and retention of decision records.
• Senior management and boards may wish to review whether financial-crime management information, risk assessments and escalation arrangements adequately cover proliferation financing, sanctions evasion, cryptoasset risks and reliance on outsourced or AI-enabled controls.
• Firms may wish to monitor the FCA's final Policy Statement and consolidated Financial Crime Guide, since the final text may differ from the consultation proposals and is likely to inform future supervisory assessments.

What changed

No new binding rules have been made by this consultation. The FCA proposes to revise non-Handbook guidance and practical examples in the Financial Crime Guide to reflect emerging risks and regulatory developments, including AI and third-party tools used in financial-crime controls, cryptoasset-specific risks, evolving financial and trade sanctions, proliferation financing, data security, fraud, and AML/CTF systems and controls.

Key dates

2026-10-21

CSSF published the communiqué warning about CVE-2026-109618 and CVE-2026-109619; PHP also released security updates addressing the vulnerabilities on this date.

Suggested considerations

• Firms should consider urgently inventorying internet-facing and internally accessible services that run PHP, including PHP embedded in outsourced, cloud-hosted and vendor-managed applications.
• Technology and security teams may wish to determine the installed PHP branch and apply the relevant fixed release, including PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 where applicable, after validating compatibility and deployment integrity.
• Where immediate patching is not feasible, firms should consider isolating or taking affected internet-facing services offline, placing them behind network-layer authentication or equivalent compensating controls, and restricting PHP execution to required functions.
• Security teams may wish to review web-server, PHP, application, endpoint and identity logs for exploitation indicators, unusual child processes, unexpected outbound connections, persistence and activity associated with unauthenticated requests.
• Firms should consider assessing whether any unauthorised remote code execution, suspected compromise or material service disruption meets the applicable major ICT-related incident criteria and documenting the classification decision.
• DORA entities should consider preparing the notification required under Circular CSSF 25/893 and the applicable DORA implementing rules if the incident is classified as major; the initial notification is generally due within four hours of classification and no later than 24 hours after awareness, followed by an intermediate report within 72 hours and a final report within one month.
• Entities subject to CSSF Circular 24/847 should consider following that circular's notification process for a major ICT-related incident and confirming whether any parallel obligations arise under applicable NIS or sectoral requirements.
• Compliance teams may wish to retain evidence of the affected-asset inventory, patch or mitigation decisions, threat monitoring, incident assessment and communications with relevant ICT third-party providers.

What changed

The publication does not introduce a new standalone rule or compliance deadline; it provides an urgent supervisory warning and links the risk to existing ICT incident-reporting obligations. Until the affected versions were officially confirmed, the CSSF's stated position was that all PHP-powered services should be treated as potentially exposed. Independent security analysis reported that PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with both vulnerabilities rated CVSS 4.0 at 9.2 and capable of execution under the web-worker account.

Key dates

2026-10-19

The FCA publication was issued as part of its wider AI supervisory and industry-engagement work.

Suggested considerations

• Firms should consider maintaining an inventory of AI use cases, including internally developed, embedded and outsourced tools, with a named accountable senior manager and documented risk classification for each use case.
• Compliance teams may wish to map each consumer-facing AI use case to Consumer Duty outcomes, the target market, foreseeable harms, vulnerable-customer considerations, fair value where relevant, complaints handling and available redress.
• Firms should consider documenting why AI is appropriate for the identified consumer need, which activities remain staff-led, where the system must abstain or escalate, and how those controls have been tested in practice.
• Model and risk functions may wish to test accuracy, bias, error rates, explainability, data quality, drift and robustness across relevant consumer characteristics, including vulnerability, accessibility, digital capability and financial capability.
• Firms should consider testing consumer understanding of AI disclosures and outputs with representative user groups, rather than relying solely on technical model explanations or generic disclaimers.
• Operations and technology teams may wish to implement proportionate live monitoring, clear escalation thresholds, sample-based human review, incident and near-miss processes, fallback arrangements and channel continuity where an AI system fails or produces harmful outputs.
• Firms should consider retaining auditable records of prompts, inputs, outputs, model and vendor versions, filters, approvals, overrides, escalations, complaints and remediation decisions for a period consistent with the applicable record-keeping requirements.
• Outsourcing and third-party risk assessments may wish to address concentration and dependency risks, access to testing and performance information, change control, data use, subcontracting, service continuity and the firm’s ability to challenge or replace an AI provider.

What changed

The publication consolidates the FCA’s expectations under the existing framework, including the Principles for Businesses, Threshold Conditions, SYSC, operational resilience, outsourcing and critical third-party requirements, Consumer Duty, vulnerable-customer guidance, SM&CR and DISP. It identifies good practice such as defining the consumer need and target market before deployment, testing outcomes across consumer characteristics and vulnerability scenarios, setting human escalation and abstention controls, maintaining auditable records of prompts, outputs, model versions and decisions, and...

Key dates

2026-10-16

ESMA publishes the final revised Guidelines on standardised procedures and messaging protocols used between investment firms and their professional clients.

2026-12-07 Deadline

First regulatory milestone: the new allocation and confirmation requirements apply, including mandatory electronic, standardised and machine-readable communication methods, subject to temporary technical-disruption exceptions.

2027-10-11 Deadline

EU securities markets move from T+2 to T+1 settlement; the final phase of the amended settlement-discipline implementation is expected to apply, including settlement-layer process and CSD functionality changes.

Suggested considerations

• Map the firm's transactions, clients, counterparties and settlement venues against CSDR Article 5(2), including the scope for transferable securities traded on an EU trading venue and settling in an EU-registered CSD.
• Assess whether the firm is directly subject to the amended RTS on Settlement Discipline or must implement equivalent controls contractually or operationally for clients and counterparties.
• Complete a gap assessment of allocation and confirmation workflows against the 7 December 2026 requirements for electronic, standardised, international and machine-readable communications.
• Replace manual, oral, email-based or non-machine-readable processes where they are not justified by a temporary technical disruption, and document the disruption, compensating controls, duration and remediation.
• Configure systems to support continuous same-day processing and, taking account of the industry roadmap, completion of allocations and confirmations no later than 23:00 CET on trade date.
• Validate the capture and exchange of critical static data, including place of settlement, BIC, ISIN, MIC and standing settlement instruction data, and establish controls over data quality and versioning.
• Test end-to-end processing with investment firms, professional clients, custodians, brokers, clearing members, CSDs, settlement systems, FX providers and technology vendors rather than testing only internal systems.
• Review client and counterparty agreements, service descriptions, operating memoranda and escalation procedures for the compressed T+1 timetable and cross-border time-zone dependencies.

What changed

The revised ESMA Guidelines on standardised procedures and messaging protocols clarify how investment firms and their professional clients must meet the allocation and confirmation requirements in the amended RTS on Settlement Discipline. From 7 December 2026, firms must use electronic, standardised communication channels and international messaging standards, with machine-readable communication required except during temporary technical disruptions.

Key dates

2026-10-16

SFC welcomed HKEX’s consultation conclusions on the proposed transition from T+2 to T+1; HKEX published the consultation conclusions on the same date.

2028-09-01

September 2028 is identified as HKEX’s target month for implementation within the broader second-half-of-2028 timetable, subject to market readiness, regulatory approval and final rule and procedure amendments.

Suggested considerations

• Firms should map all Hong Kong cash-market products, trading venues, settlement locations and transaction types that may fall within the final T+1 scope, including stock-option physical settlement where relevant.
• Compliance and operations teams may wish to perform an end-to-end impact assessment covering trade capture, allocation, confirmation, affirmation, settlement-instruction creation and matching, funding, stock borrowing, corporate actions, reconciliations, fails management and client reporting.
• Firms should assess whether overseas time zones, foreign-exchange funding, cross-border custody arrangements and client approval processes will effectively create a T+0 operating deadline for US- and European-based investors.
• Broker-dealers, custodians and investment managers should review service-level agreements, settlement cut-offs, standing settlement instructions, client documentation, fail-allocation terms and contractual responsibility for late or failed settlement.
• Technology teams may wish to test automation, real-time or near-real-time status updates, API connectivity, matching, exception queues, reconciliation and management information against the compressed timetable.
• Firms should engage HKEX, HKSCC, executing brokers, custodians, prime brokers, fund administrators and other vendors on technical specifications, testing windows, training and readiness assessments as they become available.
• Risk and treasury functions may wish to reassess intraday liquidity, pre-funding, collateral, stock-borrow availability, overdraft capacity, settlement-fail exposure and related client-margin assumptions.
• Compliance teams should monitor the consequential amendments to HKEX and HKSCC rules and procedures, SFC communications, regulatory approvals and any final scope, cut-off, penalty or fail-management provisions before treating the September 2028 date as firm.

What changed

HKEX proposes to settle in-scope Hong Kong cash-market transactions one business day after trade date rather than two business days. The transition is subject to market readiness, regulatory approval and consequential amendments to applicable HKEX and settlement-system rules and procedures; the SFC says it will work with HKEX on those amendments and implementation arrangements.

Key dates

2026-06-10

The FSB published the consultation report proposing 12 sound practices for responsible AI adoption.

2026-07-22

The FSB consultation closed; approximately 160 responses were received.

2026-10-15

The FSB published the overview of consultation responses and the final report containing the 12 sound practices.

Suggested considerations

• Firms should consider mapping existing AI inventories, model-risk controls, operational-resilience arrangements, cyber controls, outsourcing registers, and board reporting against all 12 FSB practices.
• Compliance teams may wish to introduce or validate a documented, risk-based materiality assessment for each AI use case at inception and throughout its lifecycle, including uses embedded in products or obtained from vendors.
• Boards and senior management should consider whether AI adoption is aligned with business strategy, risk appetite, accountability structures, and existing risk-management frameworks.
• Firms using generative or agentic AI should consider defining permitted actions, autonomy limits, escalation paths, human-approval triggers, monitoring thresholds, and tested stop or safe-interruption procedures.
• Firms should consider retaining records sufficient to identify the AI system, data, model or vendor, intended purpose, materiality assessment, testing, approvals, monitoring results, changes, incidents, and reconstructed decisions or actions.
• Procurement and third-party-risk teams may wish to assess AI providers for performance, transparency, data quality, supply-chain exposure, concentration risk, exit options, resilience, and business-continuity arrangements.
• Technology and operational-resilience teams should consider adding AI-specific cyber and ICT scenarios to testing and exercises, including model manipulation, data poisoning, prompt or agent compromise, erroneous autonomous actions, provider outage, and loss of vendor access.
• Firms should consider reviewing the interaction between the FSB practices and binding local requirements, including the EU Digital Operational Resilience Act, EU AI Act, sectoral outsourcing rules, model-risk requirements, data-protection law, and senior-management accountability regimes.

What changed

The final framework retains 12 practices covering board and senior-management oversight, governance and accountability, AI risk integration and documentation, organisational adaptability, materiality assessment, model selection, data governance, explainability and transparency, performance management, human oversight, cyber and ICT risk, and third-party AI risk.

Key dates

2026-06-10

The FSB published its consultation report proposing 12 sound practices for responsible AI adoption by financial institutions.

2026-10-15

The FSB published the final report and consultation-response overview. The sound practices take effect as non-binding supervisory guidance with no stated implementation deadline.

Suggested considerations

• Firms should inventory AI use cases, including embedded or shadow AI and autonomous or agentic functionality, and assign accountable owners for each use case.
• Boards and senior management may wish to evidence how AI adoption aligns with the business model, strategy, risk appetite and existing governance framework.
• Compliance and risk teams should consider adding AI-specific materiality, risk and approval assessments at inception and at defined review points after deployment or material model changes.
• Firms should consider documenting model purpose, data sources, versions, limitations, testing, performance results, explainability assessments, human controls, incidents and changes sufficiently to reconstruct AI-supported decisions and actions.
• For higher-risk or autonomous use cases, firms should consider setting risk-based human-approval triggers, access and action limits, real-time or periodic monitoring, escalation paths and tested intervention or shutdown mechanisms.
• Existing cyber, ICT, operational resilience and third-party risk assessments may need to be extended to cover AI-specific threats, model manipulation, data leakage, outages, unsafe updates and concentration among common providers or models.
• Procurement and legal teams should consider whether third-party AI contracts provide adequate monitoring, transparency, data-quality information, audit and access rights, change notification, incident cooperation, business continuity and exit arrangements.
• Firms should map the FSB practices against applicable requirements under DORA, the EU AI Act, outsourcing rules, model-risk frameworks, conduct obligations and data-protection law, recording any gaps and the basis for proportionate controls.

What changed

The final report consolidates 12 proportionate practices into two areas: organisation-wide AI governance and risk management across the AI lifecycle. It strongly encourages boards and senior management to align AI adoption with business strategy and risk appetite, define responsibilities, incorporate AI risks into existing risk frameworks, document AI use cases, assess materiality at inception and thereafter, govern data, address explainability, evaluate performance, provide risk-based human oversight, manage AI-related cyber and ICT risks, and control third-party AI dependencies.

Key dates

2026-10-15

FSB published the final report on Sound Practices for Responsible Adoption of Artificial Intelligence.

Suggested considerations

• Firms should consider inventorying all material AI use cases, including internally developed tools, vendor-provided models, embedded productivity tools, generative AI and agentic or multi-agent systems, with ownership, purpose, data sources, model dependencies and deployment status recorded.
• Compliance teams may wish to map each use case to a documented materiality and risk classification performed at inception and refreshed after material model, data, vendor, scope or operating-environment changes.
• Boards and senior management should consider whether AI governance, risk appetite statements, delegated authorities and management information clearly cover autonomous actions, prohibited uses, escalation thresholds and accountability for AI-supported decisions.
• Firms should consider integrating AI-specific controls into existing model risk management, operational-risk, ICT-risk, cybersecurity, outsourcing and business-continuity frameworks rather than creating disconnected governance.
• Model and technology teams may wish to maintain evidence of data provenance, data quality, testing, validation, performance metrics, drift monitoring, incident handling, explainability assessments and compensating controls where explainability is limited.
• For higher-risk or autonomous use cases, firms should consider mandatory human approval triggers, bounded permissions, segregation of duties, real-time or near-real-time monitoring, complete audit trails, emergency stop or rollback capability and periodic reassessment of whether human oversight remains effective.
• Procurement and third-party-risk functions should consider enhancing due diligence and contracts for AI providers to address model performance, transparency, training and input data, subcontracting, security, audit access, incident notification, portability, exit planning, concentration risk and service continuity.
• Cybersecurity teams should consider adding AI-enabled attacks, prompt injection, data poisoning, model manipulation, deepfakes, automated exploitation and misuse of AI-assisted coding or defensive tools to threat assessments, testing and exercises.

What changed

The FSB replaced its June 2026 consultation with a final framework of 12 proportionate sound practices. The practices require firms to align AI adoption with business strategy and risk appetite; define accountability; incorporate AI risks into enterprise risk management; document AI use and materiality assessments; select models according to business, technical and risk requirements; govern data quality and security; address explainability and stakeholder transparency; test and monitor performance; apply human oversight proportionate to autonomy, complexity, risk and explainability; manage...

Key dates

2026-10-15

OSFI published its statement endorsing the FSB Sound Practices for Responsible Adoption of Artificial Intelligence; the FSB also published the final Sound Practices on this date.

Suggested considerations

• Compliance teams may wish to map the 12 FSB practices against existing controls under OSFI’s Corporate Governance Guideline, Integrity and Security Guideline, Guideline B-10, Guideline B-13, Guideline E-21 and Guideline E-23.
• Firms should consider maintaining an enterprise-wide inventory of AI use cases, including internally developed systems, embedded vendor functionality and generative or agentic AI, with documented owners, intended purposes, materiality assessments and lifecycle status.
• Boards and senior management may wish to review whether the institution’s business strategy, risk appetite and governance framework clearly address AI adoption, accountability, escalation and human oversight.
• Firms should consider assessing AI use cases for operational, technology, cyber, third-party, model, data, privacy, conduct and governance risks, with controls proportionate to the materiality and risk of each use case.
• Compliance and risk functions may wish to review AI development and deployment documentation, validation, monitoring, change management, testing, incident escalation, explainability and retirement processes, including for systems supplied by third parties.
• Institutions should consider evaluating whether existing B-10 outsourcing and third-party risk controls address vendor model changes, data access, subcontracting, concentration risk, resilience, audit rights and exit arrangements for AI-enabled services.
• Internal audit or an equivalent independent assurance function may wish to assess whether AI governance and lifecycle controls operate effectively and whether management reporting to the board is sufficiently complete.
• Firms may wish to monitor subsequent OSFI technology risk bulletins, supervisory communications and future revisions to the FSB practices, since OSFI stated that it will continue monitoring how AI changes the risk environment and institutional operations.

What changed

OSFI formally endorsed the FSB Sound Practices and identified them as complementary to existing OSFI expectations. The FSB practices cover organization-wide AI governance and management across the AI lifecycle, including strategic direction, accountability, risk management, human oversight, data governance, controls, adaptability and coordination. The publication is non-binding guidance rather than a new OSFI rule, capital requirement, reporting obligation or prescribed compliance deadline.

Key dates

2021-04-20

Start of the relevant period during which Fortnum admitted the cybersecurity governance failures occurred.

2022-01-01

Independent industry reporting identified a 2022 cyber incident at a Fortnum authorised representative involving data relating to up to 9,828 clients; the ASIC publication does not specify the incident date.

2023-05-11

End of the relevant period covered by Fortnum’s admissions.

2025-07-22

ASIC commenced Supreme Court of NSW proceedings against Fortnum concerning alleged failures to manage and mitigate cybersecurity risks.

2026-10-12

The Supreme Court of NSW approved the agreed $1.35 million pecuniary penalty and ordered Fortnum to pay $250,000 toward ASIC’s costs.

2026-10-14

ASIC published the enforcement outcome and stated that this was its third cyber-resilience enforcement action against an AFSL holder, following RI Advice and FIIG Securities.

Suggested considerations

• Compliance teams may wish to map cybersecurity governance to the licensee’s obligations under section 912A of the Corporations Act 2001 (Cth), including documented ownership, escalation and board or senior-management oversight.
• Firms should consider assessing whether their cybersecurity policy applies consistently to authorised representatives, outsourced providers and other connected practices, with minimum controls, implementation evidence and exception-management processes.
• Licensees may wish to establish a documented assurance programme covering representative due diligence, cyber training, control testing, incident reporting, vulnerability management and periodic reviews of representative cyber resilience.
• Firms should consider whether they have access to suitably qualified cybersecurity expertise, either internally or through appropriately scoped external specialists, and retain evidence that advice informs the risk-management framework.
• Compliance teams may wish to test whether their risk-management system identifies and evaluates cyber risks across the entire advice network and whether monitoring results are reported to accountable senior personnel.
• Following a cyber incident or material control deficiency, firms should consider prompt escalation, preservation of evidence, assessment of notification obligations and constructive engagement with ASIC; Fortnum’s self-reporting and cooperation were identified as relevant factors in the agreed penalty.
• Firms should consider validating that cyber controls protect highly sensitive personal information, including identity documents, tax file numbers and financial-account details, and that remediation is independently verified rather than limited to policy updates.

What changed

No new rule or prospective compliance deadline was introduced. The enforcement outcome establishes a further ASIC precedent that an AFSL holder’s obligation to provide financial services efficiently, honestly and fairly and to maintain adequate risk-management systems extends to cybersecurity controls, specialist expertise and oversight of authorised representatives.

Key dates

2026-10-14

FSB published the consultation report on Regulatory and Supervisory Modernisation Principles and the 2026 G20 Implementation Monitoring Review.

2027-01-08 Deadline

Deadline for submitting comments on the consultation report and its questions through the FSB secure online form.

Suggested considerations

• Compliance teams may wish to determine whether their firm, trade association or parent group intends to submit feedback through the FSB's secure online form by 8 January 2027.
• Firms should consider reviewing the consultation questions against their existing regulatory-change, horizon-scanning and risk-assessment processes, particularly for emerging technology, new financial offerings and changing market vulnerabilities.
• Groups operating across jurisdictions may wish to map where differing legal frameworks, market structures or supervisory expectations could produce uneven implementation of future FSB-aligned measures.
• Regulatory-policy teams should consider monitoring the final FSB report, expected in the first half of 2027, together with consultations and rulemaking by relevant national and regional authorities.
• Firms may wish to retain evidence of material operational, prudential, technology and business-model risks that could inform proportionate, risk-based future regulation, without treating the consultation as a current change to applicable obligations.

What changed

The FSB proposed eight high-level principles for financial authorities in FSB member jurisdictions to apply when reviewing or modernising regulatory and supervisory frameworks. The principles are intended to improve effectiveness, efficiency, risk focus, coherence and responsiveness to new vulnerabilities, technologies, financial offerings and economic conditions.

Suggested considerations

• Firms should consider conducting a documented effectiveness review of governance arrangements, covering board composition and capability, challenge and decisions, delegation and escalation, management information, conflicts and assurance.
• Boards and management bodies may wish to map collective capability against the administrator's current and emerging risks, including technology, cyber resilience, data management, innovation, methodology, market structure and user needs.
• Compliance teams may wish to test whether board and committee records capture principal challenge, decision rationale, actions, ownership and follow-through, including significant decisions taken between scheduled meetings.
• Firms should consider documenting ownership of key risks, decision rights, escalation routes and the way UK-regulated entity obligations are represented in group governance arrangements.
• Administrators may wish to review whether group reporting and escalation channels remain effective if individuals with multiple roles are unavailable, conflicted or subject to competing priorities.
• Firms should consider whether conflicts frameworks address multiple roles, group relationships, commercial pressures, competing priorities and differing stakeholder interests, and whether identified conflicts, mitigations and decisions are recorded.
• Board reporting owners may wish to distinguish information provided for awareness from matters requiring discussion, decision or escalation, and highlight changes, exceptions, emerging trends, risk movements, mitigation effectiveness and overdue actions.
• Administrators should consider whether between-meeting escalation arrangements provide directors with timely information on significant developments without disconnecting those decisions from formal governance records.

What changed

The FCA has not amended rules, introduced new thresholds or imposed a compliance deadline. Instead, it has set out supervisory observations that benchmark administrators should assess against their own activities, risks, users and operating environments. The FCA will use these observations in supervisory engagement alongside developments in the benchmarks framework.

Key dates

2026-10-09

ESMA launched the Call for Evidence on the use of tokenised collateral by EU CCPs.

2027-01-15 Deadline

Deadline for stakeholders to submit responses to ESMA's Call for Evidence.

2027-03-31

ESMA is expected to assess the feedback during the first quarter of 2027; the source does not specify an exact day.

Suggested considerations

• CCPs, clearing members and relevant infrastructure providers should consider whether to submit evidence through ESMA's consultation webpage by 15 January 2027, including practical data on existing pilots, live arrangements, legal structures and stress scenarios.
• Compliance and legal teams may wish to map each proposed tokenisation model against the collateral requirements in Article 46 of Regulation (EU) No 648/2012 and Commission Delegated Regulation (EU) No 153/2013, including quality, liquidity, credit and market-risk, custody and operational-availability criteria.
• Firms developing tokenised collateral arrangements should consider documenting whether the token gives the holder ownership of, a security interest in, or another enforceable right to the underlying asset, and how that right would operate across insolvency, default and cross-border situations.
• CCPs and clearing members may wish to test whether tokenised collateral can be accessed, transferred, valued, liquidated or converted into central-bank money or other liquidity within required default-management timelines, including during distributed-ledger outages, congestion, cyber incidents and loss of connectivity to traditional infrastructures.
• Firms should consider assessing client-asset segregation, title-transfer, custody, insolvency-remoteness and settlement-finality arrangements where distributed-ledger systems interact with traditional custodians, central securities depositories or payment systems.
• Risk and compliance functions may wish to reassess whether tokenisation changes the risk profile of otherwise eligible collateral, including redemption, transfer restrictions, oracle dependence, smart-contract risk, operational resilience, concentration risk and liquidity-discount assumptions.
• Industry respondents may wish to provide ESMA with evidence on interactions between tokenised collateral and tokenised cash, stablecoins, tokenised deposits and other settlement assets, rather than assuming that liquidity in the underlying asset automatically carries over to its tokenised form.
• Firms should monitor ESMA's first-quarter 2027 assessment and any subsequent amendments to EMIR technical standards, supervisory convergence measures or supervisory expectations; no immediate change to existing collateral controls should be inferred from the Call for Evidence.

What changed

ESMA has opened a consultation and requested stakeholder evidence by 15 January 2027. It is examining the full collateral lifecycle, including transfer, custody, protection, segregation, access, valuation, settlement and conversion into liquidity during market stress or following a clearing-member default. The Call for Evidence covers tokenised representations of assets held in traditional infrastructures, assets issued directly on distributed-ledger technology, hybrid models, and interactions with tokenised cash and other settlement assets.

Key dates

2021-04-01

BaFin issued an earlier order requiring Deutsche Bank AG to remedy shortcomings in transaction monitoring; the publication gives April 2021 but not an exact day.

2023-11-01

BaFin issued a further order requiring Deutsche Bank AG to remedy transaction-monitoring shortcomings; the publication gives November 2023 but not an exact day.

2026-09-15

BaFin issued the order setting revised deadlines for Deutsche Bank AG’s remediation of transaction-monitoring data-processing deficiencies.

2026-10-06

The BaFin order became final and binding.

2026-10-09

BaFin published the enforcement update.

Suggested considerations

• Deutsche Bank compliance and programme-governance teams should obtain the operative BaFin order and map each revised deadline to the affected transaction-monitoring component, remediation milestone, accountable owner, testing evidence, and supervisory reporting obligation.
• The bank should consider validating that the system reorganisation has not reduced coverage of payment flows, customer and relationship risk indicators, alert generation, case-management records, or escalation and reporting processes during migration.
• Compliance teams should consider documenting how changed technical requirements were translated into revised data models, monitoring scenarios, thresholds, tuning decisions, controls, and model or rule validation outcomes.
• German credit institutions should consider benchmarking their transaction-monitoring governance, data lineage, system change controls, periodic effectiveness testing, and continuous-update processes against the requirements described in sections 25h KWG and 6(2) and 10(1) GwG.
• Firms should consider retaining evidence that suspicious-activity alerts are investigated promptly and that relevant transactions are reported to the FIU where required, including evidence of controls operating during system upgrades or parallel-running arrangements.
• Boards, supervisory boards, and senior managers responsible for AML oversight should consider reviewing whether remediation reporting clearly distinguishes completed corrective actions, residual deficiencies, dependencies, deadline changes, and risks requiring escalation.

What changed

The 2026-09-15 order revises deadlines contained in BaFin’s earlier 2021 and 2023 orders because Deutsche Bank is reorganising its transaction-monitoring system in response to changed technical requirements. The publication does not disclose the revised individual deadlines, identify each remaining deficiency, or impose a new obligation applicable to all institutions.

Key dates

2026-10-08

ESMA published its opinion on the provision of crypto-asset services in relation to non-MiCA-compliant asset-referenced tokens and e-money tokens.

2027-01-08 Deadline

Latest date by which National Competent Authorities should require remediation of remaining pre-existing exposures, calculated as three months after publication; firms may be required to act earlier.

Suggested considerations

• Firms should inventory every ART and EMT made available to EU clients and classify whether each token satisfies the applicable MiCA requirements, including any relevant authorisation, notification, offer, and admission-to-trading conditions.
• Compliance teams may wish to map each affected token across trading, exchange, execution, placing, order-routing, advice, transfer, custody, and portfolio-management workflows, including bundled or indirect services.
• Firms should consider suspending onboarding, purchases, subscriptions, trading, swaps, staking-related access where relevant, and other activities that could allow EU clients to acquire or increase exposure to a non-MiCA-compliant token.
• Technology and operations teams should assess geolocation, account, wallet, order-management, token-listing, transfer, and API controls, with testing and monitoring designed to prevent EU-client access or increased exposure.
• Legal and product teams should review client terms, token-listing policies, disclosures, contractual restrictions, and arrangements with issuers, liquidity providers, exchanges, and other intermediaries.
• Firms should identify pre-existing client exposures and prepare a documented wind-down or remediation plan capable of completion by 2027-01-08, subject to any earlier NCA requirement.
• Firms may wish to define narrowly controlled exit-only services for liquidation, conversion, withdrawal, transfer, and safekeeping, with time limits, risk controls, client communications, records, and escalation to the relevant NCA.
• Governance functions should document the interpretation of the ESMA opinion, approvals for affected product changes, control ownership, exceptions, surveillance, management information, and evidence available for supervisory review.

What changed

The opinion covers the full range of MiCA crypto-asset services, including operating trading platforms, exchanging crypto-assets for funds or other crypto-assets, executing orders, placing crypto-assets, reception and transmission of orders, investment advice, transfers, custody and administration, and portfolio management. ESMA expects National Competent Authorities to supervise so that CASPs do not maintain, introduce, or facilitate EU-client access to non-MiCA-compliant ARTs or EMTs.

Key dates

2026-10-08

FINMA published the final partial revision of Circular 2016/7.

2026-11-01 Deadline

The revised Circular 2016/7 enters into force and the new supervisory expectations for digital onboarding apply.

2027-11-01 Deadline

Market commentary reports a transitional deadline for firms using qualified electronic signatures to add liveness detection and residence verification.

Suggested considerations

• Compliance teams should map each digital onboarding journey to the revised Circular 2016/7 method requirements, distinguishing video identification, online identification, Swiss e-ID and qualified electronic-signature workflows.
• Firms should assess whether their liveness-detection controls reliably establish that the applicant is a physically present living person and can resist photographs, replayed video, deepfakes and other AI-enabled manipulation.
• Firms should review identity-document validation rules and testing so that approved QR-code documents, including the Swiss driving licence, are handled on an equivalent basis to documents with an MRZ where the circular permits this.
• Firms should validate digital residence-verification processes, including whether the process reliably links the contracting party and the relevant device or infrastructure to the declared place of residence.
• Firms planning to use the Swiss e-ID should confirm technical readiness, evidence retention and treatment of the e-ID's non-copyable, non-archivable characteristics, while avoiding use of the e-ID for workflows limited to video identification.
• Firms should update AML, fraud-risk and onboarding policies, vendor requirements, testing scripts, staff procedures and customer disclosures before the effective date.
• Compliance teams may wish to reassess whether supplementary controls are warranted for higher-risk channels, such as device intelligence, fraud databases, transfer-account verification, duplicate-account detection or enhanced review, because FINMA's circular does not eliminate risk-based control expectations.
• Firms using qualified electronic signatures should confirm any transitional implementation requirements identified in the final circular and related commentary, including the reported 1 November 2027 date for adding liveness and residence verification to that route.

What changed

The Swiss e-ID may be used as an identification method when onboarding clients through digital channels under the Anti-Money Laundering Act, although market commentary indicates that it is available for online identification rather than video identification. Official identification documents bearing a QR code are treated as equivalent to documents containing a machine-readable zone, expanding the acceptable document formats for digital onboarding.

Key dates

2026-11-30 Deadline

Consultation period for ADGM FSRA Consultation Paper No. 5 of 2026 closes; comments may be submitted to [email protected].

Suggested considerations

• Compliance teams may wish to review the proposed Guidance and submit written comments to [email protected] by 2026-11-30, particularly on operational feasibility, proportionality and the treatment of permissionless protocols.
• Firms should consider inventorying current and planned DeFi activity, including protocol use, liquidity provision, staking, lending, borrowing, decentralised exchange activity, smart-contract interaction and client-facing exposure.
• Firms should consider mapping each DeFi activity to existing ADGM permissions and identifying activities that may require a variation of permission, additional controls or discontinuation.
• Risk and compliance functions may wish to assess whether existing governance arrangements clearly assign senior accountability for DeFi, approve protocols and counterparties, set exposure limits and address conflicts of interest.
• Firms should consider enhancing due diligence for protocol code, governance structures, upgrade and administrative privileges, oracle dependencies, bridge and composability risks, concentration, liquidity, sanctions exposure and the availability of legal recourse.
• AML and financial-crime teams may wish to assess transaction-monitoring, wallet-screening, sanctions-screening, blockchain analytics, travel-rule and suspicious-activity escalation controls for DeFi-related activity, taking account of limited visibility into beneficial ownership and counterparties.
• Operations and technology teams should consider whether incident-management procedures cover smart-contract exploits, oracle failures, governance attacks, de-pegging, bridge compromise, protocol insolvency, loss of access and material service disruption.
• Client-asset teams should review segregation, custody, ownership, valuation, reconciliation and disclosure arrangements where client assets interact with DeFi protocols or are exposed to protocol failure.

What changed

The proposed Guidance sets supervisory expectations for identifying, assessing, monitoring and managing risks arising from engagement with DeFi protocols and venues. It covers governance and accountability, risk assessments, due diligence, exposure and control measures, ongoing monitoring, financial-crime controls, incident escalation, recordkeeping, auditability, competence and client-asset safeguards. The proposal is guidance under consultation and does not itself introduce binding new rules at this stage.

Key dates

2026-02-09

AMLA opened the public consultation on the draft RTS concerning business relationships, occasional and linked transactions, lower thresholds, and customer due diligence.

2026-04-16

AMLA opened the public consultation on the draft RTS concerning group-wide requirements and additional measures for subsidiaries and branches in third countries.

2026-05-08

Public consultation closed for the business-relationship, transaction and customer-due-diligence draft RTS.

2026-06-15

Public consultation closed for the group-wide arrangements and third-country legal-impediment draft RTS.

2026-10-01

AMLA announced that it had finalised the three draft RTS and submitted them to the European Commission for formal adoption.

2026-10-07

CSSF published its communiqué drawing Luxembourg professionals’ attention to the draft RTS and recommending preparatory gap analysis and control work.

Suggested considerations

• Compliance teams may wish to complete a gap analysis against the AMLA final reports, particularly for customer and beneficial-owner information, verification sources, electronic identification, non-face-to-face onboarding and PEP screening.
• Firms should consider mapping current customer journeys and transaction-monitoring logic to the proposed distinction between business relationships, occasional transactions and linked transactions.
• Firms may wish to identify products, sectors and transaction types that could be affected by lower CDD thresholds for higher-risk activities, while avoiding reliance on unfinalised monetary thresholds.
• Financial groups should consider reviewing group-wide AML/CFT governance, risk assessments, policies, internal controls, training and secure information-sharing arrangements, including structures involving common ownership, management, compliance control, networks or partnerships.
• Groups with branches or subsidiaries in third countries should consider inventorying legal impediments to applying EU AMLR and group policies and preparing escalation, risk-mitigation and supervisory-response procedures.
• IT and operations teams may wish to assess changes needed for customer-data fields, linked-transaction detection, identity-verification evidence, electronic identification and intra-group information exchange.
• Firms should monitor the European Commission’s adoption process and the Official Journal publication because the final text, effective date and any amendments remain unknown; preparatory work should be calibrated to the proposed six-month transition period rather than treated as a current binding deadline.

What changed

The draft RTS under Article 19(9) of Regulation (EU) 2024/1624 would establish criteria for distinguishing business relationships, occasional transactions and linked transactions, and would identify high-risk obliged entities, sectors or transactions for which lower CDD thresholds should apply. The draft RTS under Article 28(1) would specify information and verification requirements for standard, simplified and enhanced CDD, including reliable and independent verification sources, electronic identification means, qualified trust services, non-face-to-face verification, and relevant treatment...

Key dates

2026-10-07

AFM and DNB published their joint policy statement and exploration on tokenisation of securities in the Netherlands.

2023-03-23

Applications became available under the EU DLT Pilot Regime as implemented and supervised in the Netherlands; this is relevant background for firms assessing DLT market-infrastructure models, not a new deadline arising from the AFM and DNB publication.

Suggested considerations

• Firms should classify each proposed tokenised instrument by its legal and regulatory characteristics, distinguishing securities or other MiFID II financial instruments from crypto-assets covered by MiCA and from non-financial crypto-assets.
• Compliance and legal teams may wish to document whether the proposed arrangement is native tokenisation or a hybrid model, identify which record constitutes the legally authoritative record, and assess the resulting title, transfer, custody, settlement and insolvency risks under Dutch law.
• Market infrastructures and investment firms considering a DLT model should assess whether Regulation (EU) 2022/858 and the Dutch DLT Pilot Regime are available, including the need for specific permission and the eligibility limits applicable to DLT financial instruments and operators.
• Firms should continue applying existing requirements, including MiFID II conduct and organisational rules, the Prospectus Regulation where applicable, Regulation (EU) No 596/2014 on market abuse, Regulation (EU) No 909/2014 on central securities depositories where applicable, and relevant custody, client-asset and investor-protection controls; the AFM and DNB statement does not disapply them.
• Issuers, custodians, trading venues and service providers may wish to participate in or monitor the proposed government-supervisor-market follow-up and prepare concrete use cases that identify where statutory clarification, contractual documentation or a Dutch legislative amendment would be needed.
• Firms operating cross-border should compare the Dutch position with jurisdictions that have introduced specific legal recognition for electronic or DLT-based securities, while avoiding reliance on another jurisdiction's legal treatment without confirming Dutch offering, custody, settlement and investor-protection implications.
• Governance functions may wish to update technology, legal, operational-resilience and outsourcing risk assessments to account for the possibility that infrastructure and issuance activity migrate to jurisdictions offering greater legal certainty.

What changed

No legislation, regulatory technical standard, authorisation requirement or immediate compliance deadline was introduced. AFM and DNB jointly identified a legal gap: although EU and Dutch law do not generally prohibit DLT, market participants are commonly forced to maintain both a DLT-based record and a traditional legal administration, creating uncertainty about the legal significance of the token and limiting efficiency gains.

Key dates

2026-10-07

MAS issued the Guidelines on Artificial Intelligence Risk Management following its November 2025 consultation.

2027-10-07 Deadline

The Guidelines take effect. FIs should meet the expectations in Sections 3 and 4 from this date.

2027-10-07

MAS intends to consult the financial sector during 2027 on what additional guidance on agentic AI would be useful.

2028-10-07 Deadline

FIs should meet the expectations in Sections 5 and 6 by this date under the phased implementation timetable.

Suggested considerations

• FIs should establish or update an enterprise inventory of AI systems, models, embedded AI functionality and third-party AI services, using a level of granularity appropriate to their risk profile.
• Compliance and risk teams may wish to classify individual AI use cases by materiality, including potential effects on customers, prudential soundness, operational resilience, other financial institutions and the wider financial system.
• Boards and senior management should consider documenting AI risk appetite, ownership, escalation routes and the allocation of responsibilities across business, risk, compliance, technology, cybersecurity, data and model-governance functions.
• FIs should map existing AI controls across the lifecycle, including data governance, development and validation, testing, human oversight, cybersecurity, monitoring, incident management and change management, and identify gaps against the Guidelines.
• Procurement, outsourcing and third-party-risk functions should consider adding AI-specific due diligence, assurance, contractual rights, performance monitoring, incident notification and exit or substitution arrangements for external AI providers.
• FIs should assess whether existing governance committees and risk frameworks provide sufficient cross-functional oversight, rather than assuming that a new dedicated AI committee is necessary.
• FIs may wish to define evidence that supports proportionality decisions, including why basic policies and procedures are adequate for lower-materiality AI use cases.
• Implementation planning should distinguish the expectations in Sections 3 and 4, which should be met from 7 October 2027, from Sections 5 and 6, which should be met by 7 October 2028.

What changed

The Guidelines introduce an enterprise- and use-case-level framework for managing AI risk. Boards and senior management are expected to oversee AI risk, define accountabilities, set risk appetite, and maintain suitable risk-management frameworks, policies and procedures; existing governance structures may be used and a dedicated AI committee is not required solely for compliance.

Key dates

2026-10-06

The proposed rule was published in the Federal Register as 91 FR 63870, covering pages 63870-64103.

2026-12-07 Deadline

Public comments must be received by the SEC on or before this date.

Suggested considerations

• Compliance teams may wish to determine whether client or fund crypto assets are currently held through arrangements that would constitute adviser or regulated-fund self-custody under the proposal, including arrangements involving service providers, private keys, wallets, or decentralized finance protocols.
• Firms should consider mapping proposed requirements for key management, joint authorization, asset segregation, safeguarding expertise, cybersecurity, incident response, annual review, internal control reporting, and client or investor account statements against existing custody, information-security, and operational-resilience controls.
• Advisers and regulated funds may wish to assess whether existing custodians, including state trust companies, could satisfy the proposed authorization, policy, audit, internal-control, and segregation conditions.
• Compliance teams should consider preparing comments for File No. S7-2026-35 by December 7, 2026, particularly on the proposed scope of self-custody, the qualified-custodian determination, treatment of airdropped crypto assets, decentralized finance activity, and the interaction with existing custody arrangements.
• Firms should assess potential changes to Form ADV, Form ADV-E, Form N-CEN, custody records, crypto-network records, audited financial statements, and accountant reports if the proposal is adopted.
• Investment advisers and regulated funds may wish to inventory tokenized private funds and tokenized regulated-fund shares in anticipation of the proposed additional Form ADV and Form N-CEN questions.
• Firms should distinguish proposal-stage planning from current legal obligations because the publication does not itself impose the proposed requirements and does not establish a final compliance date.

What changed

The proposal would add an adviser self-custody framework under proposed Advisers Act rule 223-1(b)(7), allowing an adviser to self-custody client crypto assets only in specified circumstances and subject to conditions addressing safeguarding expertise, documented safeguarding systems, key management, joint authorization, segregation, cybersecurity risk assessment, threat and vulnerability management, incident response and recovery, annual review, an internal control report, and client account statements.

Key dates

2026-09-14

EDGAR Release 26.3 was deployed. LIVE and TEST submissions became available for ANE Exception Notices, withdrawals, Form 1, and specified Form 1 variants; the revised EDGAR functionality and interfaces became operational.

2026-10-06

The final rule became effective, and incorporation by reference of the revised EDGAR Filer Manual Volume II, Version 78, into the Code of Federal Regulations was approved.

2026-12-31 Deadline

Last day on which ANE Exception Notices and withdrawals may be submitted by email.

2027-01-01 Deadline

ANE Exception Notices and withdrawals must be submitted electronically through the EDGAR online interface or by filer-constructed EDGAR submission; email submissions will no longer be accepted.

2027-03-01 Deadline

Last day on which Form 1 and specified Form 1 variants may be filed in paper.

2027-03-02 Deadline

Form 1 and specified variants must be submitted electronically through the EDGAR online interface or by filer-constructed EDGAR submission; paper filings will no longer be accepted.

Suggested considerations

• Compliance teams may wish to identify all ANE Exception Notices and withdrawals that could be submitted between January 1, 2027 and December 31, 2026, and establish procedures using the EDGAR online interface or filer-constructed submissions before the mandatory transition.
• Affected Form 1 filers may wish to obtain or validate EDGAR access, submit Form ID where required, and migrate filing procedures from paper to the EDGAR interface or filer-constructed submissions before March 2, 2027.
• Firms may wish to use the EDGAR test environment and, where applicable, the EDGAR Beta environment to test user access, filer-constructed submissions, validation, acknowledgments, and correction workflows.
• Filing teams may wish to update internal checklists and software templates for the corrected Forms 13F and 13F-CTR reference to Special Instruction 4.
• XBRL filers and filing agents may wish to replace references to the former Volume II XBRL instructions with the EDGAR XBRL Guide and confirm that current taxonomies and technical specifications are being used.
• Firms may wish to retain evidence of successful testing, accepted submissions, filing acknowledgments, and fallback procedures during the transition periods.
• Compliance teams may wish to review EDGAR access credentials, CIK status, delegated filing permissions, and responsible-person coverage for any filer converting from paper to electronic filing.

What changed

EDGAR Release 26.3 was deployed on September 14, 2026, and the SEC adopted the corresponding Filer Manual amendments as Version 78. Technical instructions for submitting XBRL documents were removed from Filer Manual Volume II and relocated to the EDGAR XBRL Guide. EDGAR submission templates for Forms 13F and 13F-CTR were corrected so that the cover-page reference points to Special Instruction 4 rather than Special Instruction 5.

Key dates

2026-10-02

CP26/34 consultation opened and the FCA published the consultation paper and draft implementation materials.

2026-11-06 Deadline

Deadline for responses to CP26/34.

2027-04-03

FCA target date for publication of the final Transaction Reporting User Pack.

2028-04-03 Deadline

New UK transaction reporting rules in MAR 13, MAR 14 and MAR 15 come into force; FCA systems switch to the new schema and validation rules and UK MiFIR reporting formats cease to be accepted.

Suggested considerations

• Firms should consider submitting responses to CP26/34 by 6 November 2026, particularly on whether the proposed guidance and transitional provisions resolve practical implementation uncertainties.
• Compliance and regulatory reporting teams may wish to map current UK MiFIR reporting processes, fields, instrument populations, back-reporting logic and delegation arrangements against MAR 13, MAR 14 and MAR 15.
• Firms should assess the impact of reducing the reporting-field population from 65 to 52, removing EU-only instruments and excluding qualifying FX derivatives, while separately validating that CFDs, spread bets and other retained instruments remain correctly captured.
• Technology and operations teams should review the FCA draft schema and validation rules, identify data-source and transformation changes, and begin controlled testing before the 3 April 2028 cutover.
• Firms should plan for parallel controls over transaction reports, instrument reference data and order book data during migration, including reconciliation, exception management, resubmission and audit-trail requirements.
• Firms considering conditional single-sided reporting should assess counterparty eligibility, reliance controls, data-quality monitoring, contractual arrangements and fallback procedures before changing reporting responsibilities.
• Compliance teams may wish to distinguish the three-year default back-reporting period from applicable record-retention obligations and maintain evidence supporting any decision to use the reduced lookback.
• Firms should monitor the FCA's planned Q1 2027 consultation and subsequent final Transaction Reporting User Pack, and align implementation governance, vendor deliverables and staff training to the final materials.

What changed

CP26/34 does not propose a new substantive reporting perimeter; it provides implementation detail for the rules introduced in PS26/15. The FCA is consulting on guidance explaining the new rules, transitional arrangements, amendments referring to MAR 13, MAR 14 and MAR 15, and the migration of relevant existing Level 3 Materials into a new Transaction Reporting User Pack.