The EU Anti-Money Laundering Authority (AMLA) published final draft regulatory technical standards (RTS) under Article 46(4) of the Sixth Anti-Money Laundering Directive (Directive (EU) 2024/1640) (AMLD 6). The draft RTS were previously consulted on in May and establish a simple, proportionate, and efficient framework for information exchange, cross-border inquiries, and coordinated supervision. In particular, they:

• give supervisors of cross-border groups—in both the financial and non-financial sectors—a shared baseline for working together across the EU
• set out practical arrangements for effective day-to-day cooperation, including a simplified disclosure framework allowing the onward sharing of information among EU supervisors without prior consent
• enable home and host supervisors to conduct cross-border inquiries and coordinate supervisory approaches
• favour a proportionate and risk-based approach to supervisory cooperation.

The final draft RTS will be submitted to the European Commission for adoption before being published in the Official Journal of the European Union (OJ). They are expected to come into force 20 days after being published in the OJ and will apply from 10 July 2027.

The Basel Committee on Banking Supervision (BCBS) has published the summary of its latest meeting which took place on 28-29 September, in which members discussed a range of analytical, supervisory and regulatory initiatives. In the press release, the BCBS sets out the outcomes of the meeting, including:

• Digitalisation: The BCBS noted that while AI may support greater efficiency and innovation in financial services, it could also increase operational, cyber and concentration risks. It agreed that AI's integration into critical financial functions will require careful governance, robust risk management and ongoing supervisory attention. The Committee also agreed to review the sufficiency and adequacy of existing "event type" loss categories set out in the operational risk framework, with a focus on cyber risk and AI developments. It will continue to monitor AI developments and discuss supervisory implications.
• Pillar 3 disclosures: Following its consultation on machine-readable Pillar 3 disclosures, the BCBS approved a final standard to provide for an innovative and efficient channel of bank disclosures. The final standard will be published around the end of the year.
• Cryptoassets: The Committee is reviewing targeted elements of its prudential standard for banks' exposures to cryptoassets, and expects to provide an update by the end of the year.
• Global systemically important banks (G-SIBs): The BCBS approved the results of the end-2025 assessment exercise under its G-SIBs framework. The results will be submitted to the Financial Stability Board before it publishes the 2026 list of G-SIBs. The BCBS also approved revisions to the G-SIB assessment framework to reduce "window-dressing" behaviour by banks following an earlier consultation. The revisions will be published later this month. In addition, it agreed to publish an update to its methodology for comment on whether to incorporate the treatment of cross-border exposures within the European banking union in the G-SIB framework. The consultation will also be published later this month.
• Interest rate risk in the banking book (IRRBB): The Committee agreed to consult on additional Pillar 2 guidance for banks and supervisors to strengthen implementation of the IRRBB framework. The consultation will be published next month.
• Liquidity: The BCBS is assessing targeted updates to its Principles for Sound Liquidity Risk Management and Supervision, which were published in September 2008. An update on this work will be provided later this year.

The UK Financial Conduct Authority (FCA) has published finalised non-Handbook guidance relating to the overall risk assessment requirements under the new prudential framework for regulated cryptoasset firms. This includes:

• Non-Handbook guidance on COREPRU 7: Overall risk assessment (FG26/9), which sets out the FCA's expectations for firms on completing the overall risk assessment required under the new Core Prudential sourcebook (COREPRU). The guidance explains how firms can link their business model, risk appetite, financial resource planning, and wind-down planning into one coherent process. It considers how firms should complete the overall risk assessment, the documentation, and how the risk assessment interacts with the FCA's Supervisory Review and Evaluation Process.
• Non-Handbook Guidance on CRYPTOPRU 7: Overall risk assessment for CRYPTOPRU firms (FG26/10), which sets out the FCA's expectations for firms on completing the overall risk assessment required under the new Prudential sourcebook for CRYPTOPRU firms (CRYPTOPRU). It is intended to help firms develop their own assessments, calculate financial resource requirements, and understand the implications of their wind-down plans.

Both sets of guidance will come into force on 25 October 2027, when the new UK crypto regime comes into force.

The European Securities and Markets Authority (ESMA) has responded to the European Commission's consultation on the review of the Markets in Crypto-Assets Regulation (MiCAR). The targeted consultation contained technical and legal questions on whether MiCAR remains fit for purpose in light of evolving market and international developments. ESMA's recommendations aim to simplify the framework while improving investor protection and addressing innovative business models, such as decentralised finance (DeFi), staking, lending, and borrowing. ESMA's proposals include:

• Enhancing investor protection: New safeguards in areas where investors face risks that are not fully covered under the current framework. This includes: (i) stricter rules for the marketing of cryptoassets; (ii) greater transparency in costs; and (iii) proportionate requirements for staking, lending, and borrowing, including through disclosure obligations.
• Reinforcing supervision: Strengthening supervisory powers and addressing the risks arising from unauthorised services, online fraud, and non-compliant stablecoins by: (i) enhancing the EU's capacity to detect, block and deactivate fraudulent websites and freeze cryptoassets in cases of suspicion of market abuse or terrorist financing; (ii) obtaining reinforced supervisory powers to deal with third-country firms which solicit EU investors without being authorised under MiCAR; and (iii) introducing explicit rules to prevent regulated crypto firms from offering services linked to stablecoins that do not comply with MiCAR requirements.
• Evolving towards DeFi and improving cryptoasset classification: Introducing clearer criteria for identifying which activities can be considered genuinely decentralised, as activity around DeFi and stablecoins evolves. It also proposes a new regulated cryptoasset service for firms that provide users with access to DeFi protocols, adopting rules on how cryptoassets should be classified (including hybrid tokens), and granting powers to ESMA to issue binding opinions on token classification to promote the consistent treatment of products across the EU.
• Simplification and burden reduction: Streamlining parts of the existing rules, including simplifying cryptoasset white-paper notification procedures, reducing duplicative authorisation requirements for some regulated firms, and improving the consistency of prudential requirements.

Beyond the immediate MiCAR review, ESMA also highlights the need for a framework for tokenised securities and on-chain settlement that can support the development of an integrated European tokenised capital market and facilitate cross-border activity in the future.

The UK Office of Financial Sanctions Implementation (OFSI) has published its annual frozen assets reporting notice alongside a reporting template, launching its 2026 review of frozen assets held under UK financial sanctions regimes. Persons holding or controlling funds or economic resources owned, held, or controlled by designated persons are required to submit a report to OFSI by 30 November, covering the value of relevant frozen assets as at the close of business on 30 September. The reporting obligation extends to assets held in the UK as well as those overseas where they are subject to UK financial sanctions legislation. The notice also reminds firms of their ongoing obligations to identify and freeze assets belonging to designated persons (and entities they own or control), report newly frozen assets to OFSI without delay, and provide information requested by OFSI.

The Annex to the notice provides a general description of the information to be reported. All returns must be submitted using the prescribed template. OFSI states that there is no requirement to submit a nil return where a person does not hold or control any funds or economic resources owned, held, or controlled by a designated person. However, if a person submitted a report last year (other than a nil return) and no longer holds those assets, they should submit a nil return.

The UK Financial Conduct Authority (FCA) has published Primary Market Bulletin 66 (PMB 66) covering developments relevant to primary market participants. The bulletin finalises technical note (TN) 619.3, which contains guidelines on disclosure requirements under the Prospectus Rules: Admission to Trading on a Regulated Market (PRM) and guidance on specialist issuers. It also makes consequential amendments to TN 321.5 on working capital statements and risk factors, following consultation in PMB 63. The updated guidelines aim to provide flexibility so that a clean working capital statement may be given where directors judge that certain uncommitted facilities can be considered available for the entirety of the working capital period, with appropriate disclosure alongside the working capital statement in the prospectus.

In PMB 66, the FCA also consults on a new proposed TN 803.1, which will set out the FCA's expectations for issuers under the new sustainability disclosure requirements and replace the existing UK Listing Rules guidance in TN 801.4. The rest of TN 801.4 will remain in force. TN 803.1 will also replace TN 802.3 in full. The deadline for responses is 28 October, and the FCA intends to finalise the guidance before the new rules take effect in January 2027. The FCA also sets out a list of its expectations to help listed companies prepare for the new requirements. Further details of the final sustainability disclosure rules are covered separately here.

PMB 66 also sets out the FCA's observations on disclosing inside information relating to cyber incidents. These were drawn from discussions the FCA held with issuers and their advisers. The FCA's observations also address disclosures relating to the discovery of historical systems compromise, delaying disclosure, making subsequent disclosures, and sharing inside information with authorities.

The UK Financial Conduct Authority (FCA) has published policy statement PS26/19, setting out its final rules to align listed issuers' sustainability and climate disclosures with UK Sustainability Reporting Standards (UK SRS), the UK-endorsed version of the International Sustainability Standards Board (ISSB) Standards. The final rules adopt a comply or explain approach across the UK SRS. The rules will replace the existing Task Force on Climate-related Financial Disclosures (TCFD)-aligned disclosures. Following feedback from the January consultation, the FCA has simplified the regime in two ways by requiring:

• a comply or explain approach across all categories of disclosures, bringing UK SRS S2 (climate disclosures) into line with the approach it consulted on for UK SRS S1 (non-climate disclosures) and Scope 3 (emissions data)
• international commercial companies with a secondary listing and depositary receipt issuers to also report against UK SRS on a comply or explain basis, in place of the consultation proposal to signpost any reporting requirements and disclosures under their home jurisdiction.

To support companies to apply the comply or explain rules, the FCA is also consulting on technical note (TN) 803.1 and related updates to existing technical guidance under TN 801.4, and the proposed deletion of TN 802.3. The proposals are outlined in the FCA's Primary Market Bulletin (PMB) 66. We cover PMB 66 separately in the Securities section above. The deadline for comments is 28 October and the FCA aims to finalise the guidance before the rules come into force.

The new rules will apply to accounting periods beginning on or after 1 January 2027, with first reporting due in 2028. Transitional reliefs will apply for one year for Scope 3 emissions disclosures and for two years for UK SRS S1 disclosures. The FCA also published some practical considerations in PMB 66 to support companies. The FCA also intends to organise a series of activities to help companies and investors understand the UK SRS and what is required under the rules.

The Bank of England (BoE) has published an insights article by Andrew Bailey, Governor of the BoE, on frontier AI and the question of governance. Mr Bailey argues that while the risks are real and increasingly significant, policymakers should not automatically turn to the questions of regulation. Instead, they should first ask what precisely the problem is that they are trying to solve. In his view, the challenge posed by frontier AI is that, in its most advanced forms, it threatens to operate outside society's framework of shared norms. A sufficiently powerful system functioning within a self-reinforcing loop risks reducing society's ability to exercise meaningful oversight and intervention. He is clear that this does not mean prohibiting frontier AI, whose potential benefits include driving scientific discovery, enhancing productivity and contributing to economic prosperity. However, society must retain the ability to intervene, to establish the boundaries within which these systems operate, and to revise those boundaries as the technology evolves.

Mr Bailey identifies rigorous model testing, conducted before and after deployment, as a sensible starting point. He notes that the UK's AI Security Institute is helping to develop the scientific and technical foundations of AI assurance, although the pace of progress must accelerate. In his view, testing should not be seen as an alternative to future regulation, nor as a complete solution. A more formal regulatory framework may well emerge over time, but understanding, testing, and establishing credible points of intervention must come first. Mr Bailey also links these issues to financial stability. He warns that frontier AI materially increases the scale and sophistication of cyber-threats facing the financial system, and that the resilience of payments networks, financial market infrastructures and banks can no longer be considered separately from AI advances. Rigorously testing the models that firms use will help to show how AI can be deployed safely. In time, that understanding could be codified into standards to ensure a consistent approach across the financial system.

The European Banking Authority (EBA) has published its work programme, setting out its key areas of focus and deliverables for 2027. The work programme is structured around three cost-cutting drivers: improving efficiency, fostering resilience and supporting transformation. Key areas of focus include:

• completing the implementation of the EU's 2024 banking package
• implementing the new payment services framework
• supporting crisis management and deposit insurance reforms
• contributing to the Savings and Investments Union (SIU) and the legislative proposals for the revised securitisation framework
• implementing a new supervisory convergence framework
• enhancing stress testing and simulation capacity
• advancing integrated reporting and data sharing
• strengthening internal governance and IT resilience
• continuing work under the Digital Operational Resilience Act (DORA), the Markets in Crypto-Assets Regulation (MiCAR) and the European Market Infrastructure Regulation (EMIR).

The EBA also highlights its commitment to regulatory simplification, proportionality, and reducing unnecessary reporting and compliance burdens, in support of the European Commission's banking competitiveness agenda. Chapter 2 of the work programme provides detailed descriptions of the specific activities that the EBA intends to undertake in 2027, including the timings of those activities.

The EU Anti-Money Laundering Authority (AMLA) has published three sets of final draft regulatory technical standards (RTS) defining key measures companies and professionals must apply to reduce anti-money laundering and countering terrorist financing (AML/CTF) under the EU AML Regulation ((EU) 2024/1624) (AMLR). For more background on the package, you may like to read our article "AML playbook: the new EU AML/CTF package". The three final draft RTS each cover a distinct area of AML/CTF requirements for the private sector:

• Draft RTS on group-wide minimum requirements and additional measures for subsidiaries and branches in third countries under Articles 16(4) and 17(3) of the AMLR. They are accompanied by two fact sheets covering group-wide requirements and legal impediments in third countries. The RTS set out minimum requirements for effective group-wide AML/CTF arrangements, including governance, risk management, internal controls, and secure information sharing. The RTS were previously consulted on in April.
• Draft RTS on customer due diligence (CDD) under Article 28(1) of the AMLR. They specify in detail how CDD requirements should be applied, including the information and documents to be collected. The RTS are accompanied by a fact sheet. They were previously consulted on in February.
• Draft RTS on criteria for identifying business relationships, occasional transactions and linked transactions as well as lower thresholds under Article 19(9) of the AMLR. They form the structural basis upon which CDD obligations apply. The RTS set out how companies and professionals should distinguish between the business relationships and occasional transactions, as well as how to identify linked transactions so that CDD thresholds are applied consistently. The RTS are accompanied by a fact sheet. They were previously consulted on in February and AMLA has made some revisions to improve clarity.

The final draft RTS will be submitted to the European Commission for adoption. Once adopted, they will be published in the Official Journal of the European Union and come into force 20 days later. They are expected to apply six months after they enter into force, except for specified provisions which will apply from 10 July 2029.

The UK Prudential Regulation Authority (PRA) has issued a Dear CFO Letter setting out thematic feedback from its annual review of written auditor reports of selected PRA-regulated deposit-takers, covering IFRS 9 expected credit loss (ECL) and accounting for climate risk. The PRA confirms that it has seen continuous improvements in firms' capabilities, controls, and governance in these areas.

The feedback covers:

• Data governance, where the PRA encourages continued enhancements in identifying material ECL data, and strengthening end-to-end accountability, data quality controls, and data lineage.
• Model risk, where the focus is on firms' responsiveness to emerging risks, the completeness of post- model adjustments, and ensuring model monitoring continues to support timely identification of model performance issues and mitigating actions.
• Climate risk, where the PRA encourages continued development of more granular risk assessments, stronger links between scenario analysis and ECL judgements, and the models and data to assess and reflect evolving climate-related credit risks.

Firms are encouraged to review the Annex to the letter, which sets out a range of practices observed by the PRA, together with its areas of focus. The PRA has requested auditors' views on firms' progress in these areas for the 2027 review. Auditors are also asked to report on firms' processes for identifying and monitoring credit risk in private market exposures and for reflecting changes in ECL in a timely manner.

The Bank of England (BoE) has published the record of the Financial Policy Committee's (FPC) meeting held on 25 September. The headline judgements and policy actions from the meeting include:

• The likelihood of interconnected vulnerabilities in the financial system crystallising has risen since the FPC's previous meeting. The re-escalation of the conflict in the Middle East has renewed uncertainty around growth and the path of interest rates in a number of advanced economies, re-intensifying the risk that vulnerabilities in sovereign debt markets, risky asset valuations, and risky credit markets crystallise at the same time.
• The rapid increase in AI-related debt issuance broadens the exposure of capital markets to developments in AI. In addition, recent frontier AI incidents have heightened concerns about the pace of AI development and related cyber and operational risks. The FPC stresses the importance of managing these increasingly interconnected risks in a timely and prudent manner.
• Risky credit markets, including parts of private credit, remain vulnerable to a tightening in financing conditions. It notes the importance of the private markets system-wide exploratory scenario in filling data gaps.
• Households and corporates remain resilient, and the UK banking system remains appropriately capitalised with high levels of liquidity.
• The FPC has decided to maintain the UK countercyclical capital buffer rate at its neutral setting of 2%.
• The Committee has agreed to proceed with the proposed leverage ratio reforms as set out in the July financial stability in focus report, which the BoE expects to consult on in early 2027. This increases the importance of continuing to develop and implement measures to improve the resilience of the gilt repo market. If, in future, the Committee were to judge that risks were heightened and that additional resilience was warranted, it would consider increasing the general leverage ratio buffer above 25 basis points.
• The most material climate-related channels to UK financial stability are the potential long-run impacts of climate change on sovereign debt pressures globally. The analysis behind this will be published in a forthcoming BoE Insights article.

Separately, the BoE published its systemic risk survey results for H2 2026 to quantify participants' views of risks to, and their confidence in, the stability of the UK financial system.

The European Securities and Markets Authority (ESMA) has published its 2027 work programme, setting out its priorities for strengthening, simplifying and integrating EU capital markets. It marks a decisive shift from analysis and groundwork to implementation and concrete delivery, building on the foundations laid in 2025 and 2026 and bringing key strategic cycles to completion. Key areas of work for 2027 include:

• Growing supervisory mandates: ESMA will advance its supervision of consolidated tape providers and external reviewers of European Green Bonds, and will process the applications and begin the supervision of environmental, social and governance (ESG) rating providers. ESMA will also adapt to its expanded responsibilities for benchmark administrators. It will carry out oversight of critical ICT third-party service providers and continue monitoring and promoting compliance with the Digital Operational Resilience Act (DORA) across all of its supervisory mandates. ESMA will also review the impact of EMIR 3 reforms and continue cooperation with national competent authorities, including on the supervision of cryptoasset service providers under the Markets in Crypto-Assets Regulation (MiCAR).
• Delivering more efficient financial markets: ESMA will prepare for changes to its mandates and responsibilities arising from the proposed Market Integration and Supervision Package (MISP), and support implementation of the European Single Access Point and the transition to T+1 settlement. It will also continue work on investor protection by supporting the implementation of the Retail Investment Strategy and promoting clear, accessible information for investors. ESMA has also stated that its simplification initiatives on transaction reporting, funds reporting, the retail investor journey and risk-based supervision will enter a new phase in 2027.
• Harnessing data and technological innovation: ESMA will further enhance its use of data and technology, including AI-based supervisory tools. It will also strengthen cybersecurity capabilities and continue its work on cryptoassets and the impact of AI on financial markets. Tokenisation will also remain a priority.

The Financial Markets Standards Board (FMSB) has published an updated version of its standard for sharing of standard settlement instructions (SSIs), together with updated SSI templates. The standard aims to increase the adoption of electronic solutions that allow for standardisation and pre-authentication of settlement instructions, and facilitate straight-through processing, to improve the efficiency of SSI management by recipient counterparties and reduce settlement fails through incorrect SSIs. It sets out nine core principles relevant to the sharing of SSIs, covering: use of industry platforms; off-platform; timing; data fields; data format; data validation; validity; governance and responsibility; and periodic review. Where such electronic solutions are not legally or operationally feasible, the standard provides templates for the manual sharing of SSIs.

Updated FAQs published alongside the updated standard and templates acknowledge that it may not always be possible to comply with the standard in all circumstances and at all times in core principle 9 (periodic review). There is an explicit carve-out for automation for sharing of SSIs where it is not "legally or operationally feasible", and for clarity purposes, the FMSB has now introduced a similar carve-out in core principle 2 (off-platform) for non-use of the template. The FAQs provide the following examples of situations under core principle 2 to which this carve-out may apply:

• Markets which require a local broker and/or custodian to access, where use of the template is not accepted by those actors.
• Markets in which regulations around data transmission and/or storage may prohibit the use of the template.
• Markets in which a regulator, market infrastructure, custodian or local agent mandates a specific form, format, or submission channel that is fundamentally incompatible with the FMSB template.

The FAQs also state that any exemption should be based on a genuine and documented legal or operational constraint, rather than local preference and should be reviewed at least annually as per core principle 9. Additionally, the FAQs confirm that the standard and templates have been recognised by both the EU Industry Committee for T+1 and the UK Accelerated Settlement Taskforce as supporting more efficient settlement processes, particularly in light of the planned move to T+1 settlement in the UK and EU in 2027.

The UK Financial Conduct Authority (FCA) has published Handbook Notice No. 144, outlining amendments to its Handbook made by various instruments including:

• Markets in Financial Instruments (Record Keeping, Transaction Reporting and Financial Instrument Reference Data) Instrument 2026, which comes into force on 3 April 2028. The instrument makes changes to the scope, content and operation of the transaction reporting regime. The changes aim to simplify firms' reporting obligations, reduce duplicative or low-value reporting and improve consistency in how key fields are populated.
• Changes to Information Flows for UK Equity IPOs Instrument 2026, which came into force on 5 August. This instrument updates the FCA's rules on information sharing during UK equity initial public offerings (IPOs) to reduce market risk and frictions in the UK IPO process for issuers and market participants.
• Collective Investment Schemes Sourcebook (Liquidity Management) Instrument 2026, which comes into force on 1 February 2027. Introduced following the consultation published in CP25/38, the instrument makes targeted improvements to the liquidity risk management framework for authorised fund managers (AFMs) of UK Undertakings for Collective Investment in Transferable Securities (UCITS) schemes and non-UCITS retail schemes. The changes promote the effective use of antidilution tools, clarify good practice for AFMs' assessment of the liquidity of securities held in funds, and introduce new guidance on stress testing.
• Perimeter Guidance (Regulated Cryptoasset Activities) Instrument 2026. Part 1 of Annex B of this instrument came into force on 16 September, with the remainder coming into force on 25 October 2027. It sets out perimeter guidance for the UK's future cryptoasset regime, helping firms understand when authorisations for cryptoasset activities will be required.
• Collective Investment Schemes Sourcebook (Cryptoasset Exchange Traded Note) Instrument 2026, which came into force on 28 September. Introduced following the consultation published in chapter 5 of CP26/17, the instrument allows certain authorised funds to hold cryptoasset exchange traded notes, subject to a limit of 10% of scheme property for retail funds.
• Cryptoasset Activities (Periodic and Application Fees) Instrument 2026, which came into force on 30 September, with Part 2 of the annex coming into force on 25 October 2027. This instrument sets out the application fees and periodic fees that firms with cryptoasset regulated activities permissions will pay to fund the FCA and the UK Financial Ombudsman Service.
• Disclosure of Climate-Related Financial Information (Asset Manager and Asset Owner) (Amendment) Instrument 2026, which came into force on 25 September. This instrument simplifies the FCA's Task Force on Climate-related Financial Disclosures product-level reporting requirements for asset managers, life insurers and FCA-regulated pension providers in the ESG sourcebook. It introduces more targeted climate disclosure rules that reduce complexity and burden for firms, while improving the clarity and usability of climate information for investors.
• Financial Promotion (Notification of Cryptoasset Approval) Instrument 2026, which came into force on 1 October. Introduced following the consultation published in chapter 6 of CP26/17, the instrument removes the requirement to submit notifications for most approvals of cryptoasset promotions, reducing the burden on both firms and the FCA.
• Decision Procedure and Penalties Manual (Cryptoassets) (Amendment) Instrument 2026. Part 1 of Annex B came into force on 30 September, with the remainder coming into force on 25 October 2027. Introduced following the consultation published in CP26/19, the instrument makes minor and consequential amendments to the Decision Procedure and Penalties Manual and the Glossary arising from the introduction of the market abuse regime for cryptoassets. The amendments apply the FCA's existing market abuse penalty framework to cryptoasset market abuse and identify the FCA decision-makers responsible for exercising powers under the transitional provisions of the Cryptoassets Regulations.
• Data Decommissioning (No 2) Instrument 2026, which came into force on 1 October. This instrument simplifies the scheduling rule for Section M of the Retail Mediation Activity Return and clarifies guidance notes for firms completing the FIN073 return.
• Pensions Projections Exemption Instrument 2026 and Conduct of Business (Interactive Pension Simulations) Instrument 2026, both of which came into force on 25 September.

Feedback for the various consultations behind the Handbook Notice is set out in chapter 3 of the notice.

The European Banking Authority (EBA) has launched a consultation on proposed revisions to its implementing technical standards (ITS) governing the joint decision process for institution-specific capital and liquidity requirements under Article 113 of the Capital Requirements Directive 2013/36/EU (CRD), as amended by Directive 2024/1619 (CRD VI). Article 113 of the CRD establishes the framework for joint decisions within supervisory colleges on institution specific prudential requirements for cross border banking groups. Since the ITS were first adopted in 2014, the prudential and supervisory framework has evolved significantly, including through changes introduced by CRD V (Directive (EU) 2019/878), which extended joint decisions to cover Pillar 2 guidance and leverage ratio-related elements. Changes were also introduced by the revised EBA Guidelines on the Supervisory Review and Evaluation Process (SREP). The EBA is proposing a comprehensive revision to streamline the joint decision process, simplify templates and better align the framework with current supervisory practice.

Key proposals include:

• supporting a more holistic and coordinated assessment of institutions' prudential requirements and guidance
• streamlining and simplifying templates, by introducing a single, reduced and integrated risk assessment report
• aligning the joint decision process with the revised SREP framework and current supervisory practices
• more clearly incorporating qualitative supervisory measures into the joint decision process
• updating the scope of joint decisions to include Pillar 2 guidance and leverage ratio-related Pillar 2 requirements and guidance.

The deadline for comments is 4 January 2027.

The European Commission (EC) has published a letter (dated 21 September) to the European Supervisory Authorities (ESAs), inviting them to deliver technical advice on private credit activities and exposures of EU banks and non-bank financial institutions (NBFIs). The letter enclosed a call for technical advice, which sets out the context for the invitation and notes the recent rapid growth of the private credit sector, the advantages offered by its customisability, the link between private equity and private credit activities, and the link between banks and NBFIs which needs to be better understood.

The EC have scoped the advice to cover the following four areas:

• Lending and investment exposure of EU banks and NBFIs to private credit activities.
• Gaps in the existing reporting framework.
• Retail investor participation.
• Mapping the interconnection between banks and NBFIs.

The advice should consider direct lending and investment in private credit funds or private credit instruments, and the EC has requested that the ESAs focus on unsecured direct lending to private companies and individuals in particular. EU banks and EU NBFIs are in scope, as well as non-EU subsidiaries. The data which should be used for producing this advice should be limited to data from regulatory reporting and/or commercial data sets.

The EC invites the ESAs to set up a task force to discuss and agree the technical specification in the call for advice which relates to common definitions, data management and processing (among other things) with the participation of the other European regulatory authorities. In terms of the expected timetable, the EC invites the report to be delivered within six months from the date of receipt of the call for advice, if possible.

The European Banking Authority (EBA) has published its response to the European Commission's targeted consultation on the review of the Regulation on Markets in Crypto-assets (Regulation (EU) 2023/1114) (MiCAR). The targeted consultation contained technical and legal questions on whether MiCAR remains fit for purpose in light of evolving market and international developments.

The response includes detailed answers and recommendations across the consultation's coverage of scope, asset-referenced tokens and e-money tokens, crypto-asset service providers, and areas beyond the current scope of MiCAR. Of particular interest are the following:

• Harmonisation definitions: the EBA recommends that further harmonisation on the definitions of financial instrument and tokenised deposits is needed to prevent divergent national approaches. In the EBA's view, tokenised financial instruments should remain out of scope of MiCAR.
• Classification: the EBA recommends that further analysis be carried out as to classification of commodities-linked tokens as there is still a lack of clarity on regulatory status of such tokens and notes the risk of arbitrage in the absence of regulatory clarity in edge cases such as hybrid tokens, synthetic exposure, and "wrapped" tokens.
• Prudential requirements: the EBA response requests clarification as to the application of requirements to entities which are both issuers and crypto-asset service providers and improvements to own funds requirements, among other recommendations in relation to alignment and calibration. The EBA also suggests reducing the deposit requirement for e-money token reserve assets.
• Crisis management: the EBA suggests extending the toolkit to non-bank issuers and further mechanisms to better coordinate recovery and redemption planning.
• Lending - the EBA recommends regulating crypto-asset lending, including activities linked to decentralised finance, in view of the risks posed to consumers.
• Third-country multi-issuer stablecoin schemes: the EBA recommends a dedicated regulatory and supervisory regime to mitigate the significant risks posed by these schemes.

The EBA also provides feedback in relation to group supervision, reporting, and the interplay between MiCAR and other payment services regulation.

The UK Financial Conduct Authority (FCA) has published findings from a multi-firm review on money mule activity (a form of money laundering in which a person transfers or receives criminal funds on behalf of others) and the cashing out of fraud proceeds. The review drew on a survey of 35 firms and analysis by an industry working group of 22 firms.

Key findings include:

• Retail banks accounted for most transactions passing through mule accounts, whereas other firms experienced lower volumes but higher-value transactions.
• Card payments were the most common cash-out method, as they can resemble legitimate consumer spending and are a versatile route for dispersing and monetising fraud proceeds.
• International and crypto cash-out methods were typically higher in value, showing that mule activity was not confined to UK payment flows.
• Repeat mule accounts suggest organised criminal infrastructure rather than an isolated or opportunistic misuse, as some accounts had been used multiple times for mule activity before firms shut them down, and there were accounts across multiple scam and fraud types.

The FCA expects firms to review their controls for detecting, preventing and disrupting money mule activity and to strengthen them where necessary. Firms should consider indicators beyond the initial receiving account, including linked accounts, payment characteristics and the broader transaction context. The FCA also highlights the importance of information-sharing, including through the provisions available under the Economic Crime and Corporate Transparency Act 2023, and is working with the National Economic Crime Centre to issue a further alert providing additional details of the working group's findings.

The Bank of England (BoE) has published a consultation paper on its proposed supervisory fees regime for recognised payment systems and specified service providers for the 2026/27 fee year. The BoE proposes increasing fees to reflect rising supervision costs, including greater focus on operational resilience and payments policy development. It is consulting on fee levels both under the current statutory fee cap (GBP760,000 per firm) and a proposed higher cap (GBP1.7 million) currently being consulted on by HM Treasury (HMT) earlier this year. The consultation also reflects the introduction of a new third impact category for less systemic payment systems, intended to support innovation through lower, proportionate fees.

Subject to the outcome of HMT's consultation and parliamentary approval of any proposed regulations, the revised fee regime would also apply to digital settlement asset service providers once they fall within scope of the BoE's supervisory remit. The deadline for responses to the BoE consultation is 22 October. The final fee will be confirmed in the fee policy statement issued once HMT has completed its process, including details of any transitional pro-rating if the fee cap is increased during the fee year. The proposals are currently expected to be implemented in Q4 of the 2026/27 fee year.

A Corrigendum to Directive (EU) 2023/2225 on credit agreements for consumers and repealing Directive 2008/48/EC (CCD2) has been published in the Official Journal of the European Union, correcting a number of drafting and cross-reference errors in the Directive.

The amendments include:

• a correction to the list of provisions referenced in Article 2(7), replacing a reference to Article 21(1), first subparagraph, point (r) (which refers to rights in relation to linked credit agreements) with point (s) (which refers to the early repayment provisions in Article 29)
• an amendment to Article 3(20)(a), which defines linked credit agreement, clarifying that the credit itself, rather than the credit or services, must exclusively finance the relevant supply agreement
• a correction to Article 10(5)(d) in relation to pre-contractual information for credit agreements providing different ways of drawdown with different charges or borrowing rates, that the relevant assumption is that set forth in Annex III, Part II, point (c) (not point (b))
• a clarification in Article 16(2)(a) in relation to consumer information around the provision of advisory services concerning recommendations made by the firm, and specifically whether they are based on a firm's own product range or a broader market assessment.

The Corrigendum makes technical corrections only and does not introduce substantive policy changes to the consumer credit framework.

The EU Platform on Sustainable Finance, an advisory body to the European Commission (EC), has published a brief setting out its views on the European Securities and Markets Authority's (ESMA) consultation on proposed reforms to certain key performance indicators (KPIs) and other provisions of the Disclosures Delegated Act under the Taxonomy Regulation (EU) 2020/852. The consultation forms part of the EC's broader Omnibus simplification agenda and follows its March call for technical advice from the European Supervisory Authorities (ESAs) on the review of the Taxonomy reporting framework.

ESMA's consultation covered potential simplifications relating to: (i) the operational expenditure (OpEx) KPI; (ii) voluntary use of the OpEx KPI by financial undertakings; (iii) group Taxonomy reporting; and (iv) additional possible simplifications.

The Platform makes four main recommendations:

• OpEx KPI: to adopt a two-tier approach consisting of: (i) a mandatory OpEx KPI limited to research and development (R&D) expenditure; and (ii) a voluntary opt in broader OpEx KPI based on the current denominator for companies wishing to disclose additional transition related operational expenditure.
• Group reporting: to remove the weighted average consolidated KPI. If a single KPI is required, the KPI arising from the group's main reporting regime should be used, with the regime to be determined based on the group's prevalent activity.
• Climate change adaptation: to incorporate certain clarifications directly into the Disclosures Delegated Act, as suggested by ESMA.
• Capital expenditure type C (CapEx C): to retain this as a mandatory metric. The Platform is working on a proposal to improve its definition by clarifying its scope and application.

The European Central Bank (ECB) has published an updated guide to licensing applications, replacing the previous 2019 version. The guide applies to authorisation applications under the Capital Requirements Regulation, including, but not limited to, initial authorisations for credit institutions, bridge bank applications and licence extensions. It aims to enhance transparency and consistency in the assessment of applications across participating member states and reflects developments in supervisory practice, EU legislation and European Banking Authority guidance. Among other things, it provides detailed guidance on the licensing process, including pre-application engagement, assessment criteria and timelines. The guide will be reviewed periodically to reflect further supervisory, European and international developments. The ECB emphasises that the guide is not legally binding and does not replace any requirements under EU or national law.

The European Commission (EC) has published a draft Delegated Regulation for a four-week feedback period, proposing amendments to the regulatory technical standards (RTS) laid down in Commission Delegated Regulation (EU) 2016/1052 regarding the conditions applicable to buy-back programmes and stabilisation measures. The amendments to the buy-back regime reflect changes introduced by the Listing Act (Regulation (EU) 2024/2809), which amended Article 5 of the Market Abuse Regulation (MAR) to simplify reporting and disclosure obligations for buy-back transactions. The amendments to the stabilisation regime were added in response to requests from certain national competent authorities.

The key changes are as follows:

• Issuers will be required to report buy-back transactions in respect of shares in aggregated form only, to the competent authority of the most relevant market in terms of liquidity, rather than to the competent authority of each trading venue on which the shares are admitted to trading or traded.
• Public disclosure of buy-back transactions in respect of shares will similarly be required in aggregated form, indicating the aggregated volume and the weighted average price per day and per trading venue, by no later than the end of the seventh daily market session following the date of execution.
• Separately, public disclosure and reporting of stabilisation transactions will also be required in aggregated form, indicating the aggregated volume and the weighted average price per day and per trading venue, replacing the current requirement to disclose the details of each stabilisation transaction. Public disclosure is required by the same deadline – the end of the seventh daily market session following the date of execution. Reporting will be required only to the competent authority of the most relevant market in terms of liquidity for each of the securities and instruments concerned, which must, upon request, forward the information to the competent authority of each trading venue on which the securities and associated instruments are admitted to trading and traded.

The deadline for feedback is 19 October. The amending Delegated Regulation will enter into force on the 20th day following its publication in the Official Journal of the European Union.

The House of Commons Treasury Committee has published a report containing the government's and the UK Financial Conduct Authority's (FCA's) responses to the Committee's inquiry report on HM Treasury's (HMT) financial inclusion strategy. In its response, the government agreed with the Committee on the importance of a robust evidence base for financial inclusion policy, including evidence that enables government to assess whether interventions are improving outcomes for people experiencing financial exclusion and are reaching those most in need. However, the government rejected calls to publish a separate quantitative analysis of financial exclusion specifically, stating that this would duplicate ongoing work already undertaken in developing the strategy and would largely reproduce publicly available evidence that has already been assembled and assessed. The response also noted that, as set out in the strategy, HM Treasury will conduct a review within two years to assess the impact of the strategy's interventions. In addition, both the government and the FCA confirmed their view that a broad firm-level financial inclusion metrics regime was not necessary, and the FCA response stated that such a regime would not be the most effective or proportionate means of improving financial inclusion outcomes.

The responses also highlighted a number of new data collection initiatives, including detailed Product Sales Data for consumer credit agreements, which it states will be used alongside advanced analytics to better understand barriers to access. The FCA in addition referred to its new annual Retail Banking Business Models Data return covering mortgages, personal banking, personal lending and small business banking which will help with providing both market-wide and firm-level information about the provision of banking services to consumers and small and medium-sized enterprises.

The European Banking Authority (EBA) has published its final guidelines on the sound management of third-party risk relating to non-ICT services (EBA/GL/2026/09), replacing the EBA's 2019 Guidelines on outsourcing arrangements. The guidelines establish a comprehensive framework for the governance, risk assessment, and oversight of third-party service providers (TPSPs) supplying non-ICT services to in-scope financial services entities, with a particular focus on services supporting "critical or important functions" (which are as defined in the EU Digital Operational Resilience Act (DORA)). The guidelines aim to harmonise the management of third-party risk and the use of TPSPs in relation to non-ICT services to a level more consistent with ICT services under DORA.

Read more.

The Single Resolution Board (SRB) has published its operational guidance for banks' communication in resolution scenarios, along with a communication testing supplement to its existing operational guidance on resolvability testing for banks. The guidance is aligned with the European Banking Authority resolvability framework and supports the implementation of the existing SRB's Expectations for Banks. The SRB states that it does not introduce new requirements but instead clarifies how banks should prepare and test their ability to communicate effectively with internal and external stakeholders during a resolution event or crisis.

Key areas covered include: (i) coordination between banks and the resolution authorities; (ii) consideration of moratorium tools under the Bank Recovery and Resolution Directive in communication planning; (iii) banks' communication plans for resolution; and (iv) governance arrangements for communication during resolution. The guidance was consulted on in October 2025. The SRB confirms that banks will have until April 2028 to consider and incorporate the operational guidance, where necessary, into their communication plans.

The UK Financial Conduct Authority (FCA) has published a feedback statement (FS26/2) from its review into whether regulation affects small and medium-sized enterprises' (SMEs) ability to access finance. The review found no evidence that FCA regulation is a major barrier to SME lending, but instead, found that many of the challenges relate to the wider market, information and capability. This is particularly the case for microbusinesses, who face issues such as limited awareness of finance options, complex application processes, duplicated customer checks and difficulties obtaining finance where businesses have limited collateral or predominantly intangible assets.

To reduce friction and support growth, the FCA has identified three priority areas for further work: (i) supporting a more proportionate regulatory framework through reform of the Consumer Credit Act; (ii) advancing open finance with SME lending as a priority use case; and (iii) monitoring industry work to explore whether digital verification could reduce duplication in customer checks, while maintaining effective financial crime controls.

The House of Lords Financial Services Regulation Committee has launched a call for evidence as part of its inquiry into regulatory sandboxes in UK financial services. The inquiry will examine the purpose, effectiveness and wider impact of regulatory sandboxes, including the UK Financial Conduct Authority (FCA)'s Regulatory Sandbox and Digital Sandboxes, as well as the Digital Securities Sandbox operated jointly with the Bank of England. The Committee is seeking views on whether sandboxes promote innovation, offer wider public benefits and value for money, shape markets through their selection of firms, and help to produce good regulatory policy, particularly for emerging technologies. The inquiry will also consider firms' experiences of participation, the use of sandboxes to test agentic AI, and how the UK's approach compares with those adopted in other jurisdictions and sectors. The deadline to submit evidence is 5pm on 23 October.

The European Commission has adopted a Delegated Regulation supplementing the Capital Requirements Directive 2013/36/EU, as amended by Directive 2024/1619 (CRD VI), with regard to regulatory technical standards (RTS) specifying the booking arrangements that third-country branches (TCBs) must apply for the purposes of Article 48h CRD. The RTS set out the methodology that TCBs must follow to track and maintain a precise and comprehensive record of all assets and liabilities booked or originated by the TCB, and off-balance sheet items, in each case that arise from transactions on the basis of their authorised activities, transactions that do not require authorisation, intragroup transactions, and transactions entered into on the basis of reverse solicitation of services.

The RTS also specify the minimum information that must be maintained in the registry book, together with information on their associated risks, taking into account the size and complexity of their operations. The Regulation is based on the European Banking Authority's final draft RTS published in January. It will enter into force on the 20th day following publication in the Official Journal of the European Union and will apply from 11 January 2027.

The UK Financial Conduct Authority (FCA) has published findings from its review of how payments and e-money firms are supporting consumers in vulnerable circumstances under the consumer duty. The review assessed firms' approaches to identifying vulnerability, providing tailored support and monitoring customer outcomes. The FCA found many examples of positive practice but also identified specific areas for improvement, including:

• Some firms identified very few or no customers in vulnerable circumstances, despite having customer bases where characteristics of vulnerability may reasonably be expected.
• There was limited testing or assurance to assess how effectively identification policies were being implemented in practice.
• Approaches on support arrangements were not always applied consistently across the customer journey, and some firms could not clearly evidence how vulnerability information translated into tailored support for customers.
• Communications relied primarily on standard formats, with limited tailoring for customers with different needs, and limited assessment on whether communications were understood and effective in practice.
• The frequency and quality of management information provided to senior management and boards could be improved. Boards at certain firms received limited insight beyond annual consumer duty reporting, and vulnerability data and outcomes information were not consistently recorded, reducing firms' ability to identify trends and take corrective action.
• Understanding the impact of distribution arrangements on consumer outcomes.

Firms are advised to consider these findings when assessing their own arrangements. The FCA will continue to engage with firms in this area and intervene where necessary.

The UK Financial Conduct Authority (FCA) has published policy statement PS26/18, setting out its final perimeter guidance on the new regulated cryptoasset activities introduced under the upcoming UK cryptoassets regime (PERG 18). The guidance seeks to clarify the scope of those activities, the regulatory perimeter, and when authorisation and permissions may be needed.

Following the April consultation, the FCA has proceeded largely as consulted on, with a number of targeted clarifications following feedback, including on the application of the "by way of business" test, the territorial scope of the regime, the distinction between qualifying cryptoassets and specified investment cryptoassets, the treatment of cryptoassets that are solely records of rights or value and of hybrid token structures, and the distinction between activities that do amount to arranging and activities that are unlikely to do so.

The government has also laid a further statutory instrument (SI) before Parliament amending the Cryptoasset Regulations 2026. The FCA states that the guidance in PS26/18 does not yet reflect the new SI. The FCA plans to consult in early Q4 on further PERG amendments addressing the new SI, with final amended guidance expected in early 2027.

The Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026 have been laid before Parliament, accompanied by a draft explanatory memorandum. The Regulations were previously consulted on in April and make targeted amendments to the UK cryptoassets regulatory framework established by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026.

Amongst other amendments and additions, the Regulations:

• Exclude activities involving UK qualifying stablecoins by an authorised person under FSMA for the activity of issuing such stablecoins from the regulated activities of dealing in qualifying cryptoassets as principal, dealing as agent, and arranging deals in qualifying cryptoassets.
• Exclude the temporary holding of UK qualifying stablecoins from the cryptoasset safeguarding activity, where they are being held in connection with a payment transaction.
• Clarify the regulatory perimeter for issuing UK qualifying stablecoins and exclude backing asset arrangements for those stablecoins from the relevant safeguarding regulated activities.
• Introduce targeted exemptions for certain cryptoasset proprietary trading, market making, technical services, and central securities depository activities.
• Make related changes to the financial promotion regime, including clarifying the regulatory perimeter for stablecoin issuance and backing asset arrangements and mirroring the exemptions in the FSMA (Regulated Activities) Order 2001 for certain proprietary trading, market making and central securities depository activities.
• Create a new controlled activity for the purposes of the financial promotion restriction (issuing qualifying stablecoin) and consequently a new controlled investment (qualifying stablecoin).
• Bring forward the commencement of provisions that provide that assets backing qualifying stablecoins are not treated as collective investment schemes, alternative investment funds or electronic money.

The changes are intended to remove overlapping or disproportionate regulatory requirements and unnecessary regulatory barriers, while maintaining high standards of regulation for activities that present material risks to consumers or market integrity. Firms excluded from regulation by this instrument continue to have obligations under other legislation, including anti-money laundering requirements.

The European Parliament's Economic and Monetary Affairs Committee (ECON) has published the text of the report it has adopted on the European Commission's proposal for a Regulation amending the Sustainable Finance Disclosure Regulation (SFDR), following the adoption of its negotiating mandate on 10 September. The report includes a draft European Parliament legislative resolution setting out the Parliament's proposed amendments to the Regulation (known as the SFDR 2.0 proposal). The Council of the EU previously adopted its negotiating position in June.

The Financial Services and Markets Bill has completed its third reading in the House of Lords and was subsequently introduced in the House of Commons for first reading. Parliament also published the Bill as brought from the Lords, reflecting amendments agreed during its passage through the House of Lords. A date for the second reading in the House of Commons has not yet been announced.

The UK government has published its anti-money laundering and asset recovery strategy 2026–2029, setting the direction for the UK's response to money laundering and criminal asset recovery over the next three years. Alongside the UK Anti-Corruption Strategy and UK Fraud Strategies, this strategy forms part of the Government's overall approach to economic crime as will be set out in the forthcoming Economic Crime Plan 2026-29.

Measures proposed include:

• Structural reform of the UK's anti-money laundering and counter-terrorist financing supervisory regime (AML/CFT), reducing the number of supervisors from 25 to three.
• Review of how the future of financial payments will impact threats and addressing risks and opportunities presented by the growing use of stablecoins.
• Developing a policy roadmap for addressing risks and opportunities of privacy enhancing technologies in relation to cryptoassets.
• Review of the suspicious activity reporting (SARs) regime for opportunities to reduce low-value activity, including whether to raise the suspicion threshold in POCA and finalising implementation of the SARs Digital Service with AI-enhanced analytics.
• Develop an agreed problem statement regarding law enforcement speed of access to basic bank account information and a review of options.
• Use of the UK's FATF Presidency (2026–28) and G20 Presidency (2027) to promote reform of international AML standards to support a more risk-based approach and reduce low-value compliance activity.

Annex A to the strategy sets out a delivery plan, detailing key actions and milestones across 2026–29.

The UK Financial Conduct Authority (FCA) and the Bank of England (BoE) have published a feedback statement on tokenisation in UK wholesale financial markets, summarising responses to their May joint call for input. Respondents were largely supportive of the authorities' vision and recognised that industry and regulators would need to work together to tokenise wholesale markets. The most frequently raised themes included:

• A desire for faster progress, with clear timelines and implementation milestones in the forthcoming tokenisation roadmap.
• A move beyond sandboxes and pilots towards full production, scale and permanence.
• Clarity on the prudential treatment of tokenised assets and the eligibility of tokenised assets as collateral (in both central bank operations and for central clearing at central counterparties), with tokenised Money Market Funds frequently mentioned by buy-side firms.
• Access to insolvency protections under the settlement finality regulations for blockchain-settled transactions, and the use of stablecoins as settlement assets.
• Prioritisation of regulatory work on interoperability, encompassing legal, regulatory and cross-jurisdictional dimensions.
• A preference for aligning custody rules for relevant specified investment cryptoassets (RSICs) broadly with CASS 6, with targeted overlays for blockchain-specific risks such as private key management.

The FCA and BoE have confirmed they will publish a tokenisation roadmap later in the year setting out detailed workstreams and target dates. Key commitments include progressing work on tokenised collateral, with a supervisory statement and discussion paper on central counterparties collateral due later this year, and consulting on rules for the safeguarding of RSICs in the first half of 2027.

Alongside the feedback statement, the FCA has issued a call for input on tokenised gold.

The UK Financial Conduct Authority (FCA) has published a call for input on whether tokenisation could improve the trading, transfer, mobilisation and use of gold as collateral while maintaining market integrity and consumer protection. The call follows feedback received in response to the FCA's and Bank of England's joint call for input on tokenisation, recognising gold as a significant potential use case given the international strength of the London spot gold market, and the increase in tokenised gold and other gold-related products in recent years.

In terms of scope, the FCA acknowledges a number of key questions around the regulatory perimeter and the status of gold as a commodity, and states that its objective is not to regulate segments of the gold trading market that fall outside the FCA's current remit. The call focuses on gold products that confer ownership rights in underlying physical gold which are clearly defined and have reliable redemption arrangements.

The call for input considers the legal, regulatory and operational conditions needed to support the safe and effective use of tokenised gold, including its incorporation in wholesale market use cases, and the development of industry-led market standards to improve interoperability. Like many recent initiatives from the UK government and regulators, it highlights the increasing momentum behind the development of tokenised asset markets and the importance that industry places on unlocking the use of tokenised securities and commodities in particular for collateral and settlement purposes. As tokenised gold may engage multiple regulatory regimes depending on the use case and participants involved, the FCA is seeking views on areas that may present challenges.

In addition to collateral and settlement, another specific area the FCA seeks feedback on is whether uncertainty around the collective investment scheme and alternative investment fund regimes regulatory perimeter may affect the development of certain use cases for tokenised gold, and whether regulatory clarification or alternative policy measures may be appropriate. The regulator raises two policy options that could be pursued: the first being clarification of the existing regulatory perimeter; and the second being a potential targeted exemption from those regimes for the benefit of gold market infrastructure.

The deadline for comments is 23 October. Alongside this call for input, the FCA, together with the Bank of England, has published a feedback statement setting out their joint ambition to support tokenisation in the UK's wholesale financial markets.

The European Parliament's Committee on Economic and Monetary Affairs (ECON) has published a draft report (dated 10 September) and motion for a resolution on the competitiveness of the banking sector in the EU. The report welcomes the European Commission's (EC) July communication on "Competitiveness of the Banking Sector and the Single Market in Banking" but calls for ambitious legislative action to complete the Banking Union, remove unjustified national barriers to the single market and facilitate market-led cross-border consolidation.

Key proposals include:

• Broadening the mandates of the European Supervisory Authorities (ESAs) to include competitiveness and innovation as a formal secondary objective, without prejudice to their primary objective of financial stability.
• Simplifying the capital stack by reducing overlapping buffers and supervisory add-ons, and exploring a significantly simpler regime for small, non-systemic banks.
• Enhancing the small and medium-sized enterprise supporting factor and raising the threshold for qualifying exposures.
• Launching an omnibus legislative initiative to eliminate obsolete, duplicative or excessively burdensome provisions, and empowering the ESAs to challenge disproportionate national gold-plating.
• Encouraging banks to deploy AI in areas such as creditworthiness assessments, fraud prevention and risk management.
• Clarifying the interaction between the AI Act and sectoral financial services legislation and shaping the regulatory framework for digital assets and tokenisation to preserve the EU's role in global finance.

The EC's detailed package of proposed legislative reform is expected in Q1 2027.

The Central Counterparties (Transitional Provision) (Extension and Amendment) Regulations 2026 have been laid before Parliament, accompanied by an explanatory memorandum. The Regulations extend the transitional provisions for overseas qualifying central counterparties (QCCPs) under Article 497 of the UK Capital Requirements Regulation by a further 12 months, to seven years after an application for recognition was made. This extension aims to ensure that UK firms with indirect exposures to these overseas CCPs do not face a sudden and disruptive increase in their capital requirements upon expiry of the QCCP transitional regime, which the explanatory memorandum notes for some CCPs within the regime could otherwise fall as early as 31 December.

As part of broader efforts to modernise the UK regulatory framework for UK and overseas CCPs, the government has already announced proposals for a new permanent framework for determining QCCP status. This would replace the current QCCP transitional regime. HM Treasury intends to legislate to implement these reforms later in the year.

The Regulations also make consequential amendments to the Financial Services and Markets Act 2023 (Commencement No. 15 and Saving and Transitional Provisions) Regulations 2026 to ensure that the saving and transitional provisions in that instrument in respect of QCCPs align with the extended expiry date.

Commission Delegated Regulation (EU) 2026/1221 has been published in the Official Journal of the European Union (OJ). The Regulation makes targeted amendments to the EU prudential framework for banks' market risk, specifically the Fundamental Review of the Trading Book (FRTB) under the Capital Requirements Regulation (CRR).

While most Basel III reforms have applied since 1 January 2025, the FRTB has been deferred on several occasions, most recently to 1 January 2027 in response to uncertainty around implementation timelines and potential deviations from the Basel standards in other major jurisdictions.

This Delegated Regulation sets out amendments intended to support a level playing field for EU banks competing internationally in trading activities by offsetting the negative capital impact of the FRTB for a period of three years – until 31 December 2029, in aspects of the framework where deviations in other jurisdictions have been identified or are likely, including:

• The profit and loss attribution test (PLAT): to allow banks to calculate the PLAT only for monitoring purposes during the three-year period, with no direct impact on the own funds requirements.
• The non-modellable risk factors (NMRFs) framework: to modify the conditions on the number of verifiable price observations needed for a risk factor to be considered modellable and hence be capitalised under the expected shortfall calculation.
• Internal default risk model requirements: applying a multiplier equal to 0 to the probability of default of issuers/obligors that attract a 0 % risk-weight under the alternative standardised approach (allowing banks under the internal model approach to treat exposures to those issuers identically to how those exposures would be treated under the alternative standardised approach).
• The expected shortfall risk measure and the stress scenario risk measure calculations: allowing banks under the alternative internal model approach to temporarily calculate and disclose the values of the regulatory expected shortfall risk measure and stress scenario risk measure on a weekly rather than daily basis.
• Exposures to Collective Investment Undertakings: allowing and specifying thresholds for a partial look-through, while requiring a more conservative treatment for the part that cannot be looked through.
• The residual risk add-on (RRAO): applying multipliers for instruments that have future realised volatility as an underlying, that are options that can be exercised on a finite number of dates, or that are options on the difference between two constant maturity swap rates denominated in the same currency, where those instruments attract an RRAO charge only for those reasons.
• Default risk under the alternative standardised approach: recognising economic hedges between an equity derivative and a cash position of the same underlying.
• The output floor: limiting the phase-in of the own funds requirements for market risk under the alternative standardised approach, and allowing banks that apply the simplified standardised approach to similarly benefit from the phase-in.
• Additional proportionality for banks with small trading book businesses: allowing use of the simplified standardised approach for their non-trading book positions subject to foreign exchange risk and commodity risk.
• Limiting capital impacts: allowing credit institutions adversely impacted by the implementation of the new market risk rules, even after applying the targeted amendments, to limit that capital impact for the three-year period.

The Regulation entered into force on 12 September, with the amendments applying from 1 January 2027.

The European Parliament's Economic and Monetary Affairs Committee (ECON) has announced it has adopted its negotiating mandate for proposed reforms to the Sustainable Finance Disclosure Regulation (SFDR). The proposals are intended to simplify the framework and make sustainable financial products more transparent, comparable and credible, while reducing administrative burden. The text has not yet been made available.

The mandate supports the European Commission's proposal, adopted in November 2025, to introduce three standard product categories (sustainable, transition and ESG basics), each of which would be required to disclose the main adverse impacts of its investments on sustainability. However, Members of the European Parliament insisted that transition products should exclude investments in companies earning revenue from fossil fuel exploration, extraction, mining or refining, subject to limited exceptions, while ESG basics products would be required to disclose their exposure to the fossil fuel sector. All three categories would also exclude investments in companies that violate human rights or humanitarian law. The reforms would further limit sustainability impact disclosure requirements to the largest financial market participants, exempt professional investors, and remove financial advice and portfolio management from the regulation's scope.

In addition, firms offering categorised products would be required to maintain due diligence and monitoring processes, review them at least annually, and report on matters including fossil fuel exposure, greenhouse gas emissions and activities affecting biodiversity-sensitive areas, disclosing any adverse impacts on a product's ESG objectives. The proposed negotiating mandate is expected to be announced at the October I plenary session before interinstitutional negotiations with the Council of the EU commence.

The House of Lords has published an updated webpage for the Financial Services and Markets Bill, confirming that the Bill is scheduled for third reading in the House of Lords on 15 September. Materials relating to the final report stage sitting on 9 September have also been published, providing details of the debates and proceedings during the Bill's consideration in the House of Lords, together with a current version of the Bill (as amended on report). After it concludes the third reading, the Bill will pass to the House of Commons for first reading.

The European Banking Authority has published a letter dated 8 September in response to the European Commission's (EC) decision not to endorse the EBA's final regulatory technical standards (RTS) amending Commission Delegated Regulation (EU) No 241/2014. The draft RTS would have shortened the timeframe for competent and resolution authorities to process an institution's application to reduce own funds and eligible liabilities instruments from four to three months. While acknowledging the reasoning behind the EC's decision, the EBA notes that the amendment was intended to address concerns from supervisors and institutions who considered the current timeframe too long. The EBA confirms that it will not resubmit revised draft RTS. Instead, in line with the EC's suggestion, it will pursue a broader review of Delegated Regulation 241/2014, with a view to delivering simplification and efficiency gains.

The Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) have published a cyber resilience toolkit for financial market infrastructures (FMIs) and a discussion paper on the challenges and risks of FMIs' reliance on third-party service providers. The toolkit provides a set of voluntary, non-binding practical tools intended to help FMIs strengthen their cyber resilience frameworks and implement operational resilience-related components of the CPMI-IOSCO Principles for Financial Market Infrastructures. The toolkit is intended to complement the 2016 guidance on cyber resilience for FMIs. In parallel, the discussion paper identifies and examines key challenges related to the provision of third-party services to FMIs, especially for the delivery of critical services. It sets out several questions for stakeholders on the identified risks and possible areas for further engagement. The deadline for comments on both the toolkit and the discussion paper is 1 December.

The European Commission (EC) has adopted a Delegated Regulation amending the regulatory technical standards (RTS) laid down in Commission Delegated Regulation (EU) 2018/1108 under the Fourth Anti-Money Laundering Directive (Directive (EU) 2015/849) (MLD4). The amending RTS set out the criteria for the appointment of central contact points for cryptoasset service providers (CASPs) and rules on their functions. The RTS amend Delegated Regulation (EU) 2018/1108 to extend its application to CASPs, reflecting amendments made to MLD4 by the Wire and Cryptoasset Transfer Regulation ((EU) 2023/1113), which extended the scope of MLD4 to cover CASPs. The RTS set out the criteria for determining the circumstances where CASPs should appoint a central contact point, a local representative in a host European Union country when operating across borders, and the functions that the central contact point should perform.

The amending Delegated Regulation is based on the European Banking Authority's (EBA) final draft RTS published in April 2025. The Council of the EU and the European Parliament will scrutinise the Delegated Regulation. If neither object, it will be published in the Official Journal of the European Union and will enter into force 20 days following its publication.

The Department for Business, Innovation, Science and Trade has published a consultation on modernising the UK corporate reporting framework system. It sets out wide-ranging proposals to simplify and modernise the framework, guided by five core principles including: clarity of purpose; flexibility and trust; simplicity and coherence; proportionality; and fitness for the future.

Key proposals include:

• Clarifying that annual reports and accounts are documents primarily intended for investors and creditors.
• Simplifying which companies are required to report different types of information. The government wishes to take a fresh look at the Companies Act 2006 to rationalise the scopes, thresholds and exemptions which determine what disclosures a company must make and is considering how thresholds and exemptions might be changed to take companies out of requirements.
• Creating a lighter regulatory load for small and medium-sized enterprises (SMEs), including allowing certain medium-sized companies to qualify for an audit exemption. The government is consulting on creating a reporting framework for SMEs which would allow certain medium-sized companies to claim a wider package of exemptions, including extending the small company audit exemption to certain medium-sized companies.
• Testing the merits of non-financial reporting requirements for private companies, including the possible creation of a new "very large" company threshold that could be applied to non-financial reporting requirements.
• Streamlining the UK's financial reporting framework by moving detailed requirements out of the Companies Act 2006 and into accounting standards, reducing available standards to four main standards, replacing the "true and fair presumption" for micro-entities with an obligation to prepare accounts that comply with the micro-entities standard, and creating a new accounting standard for not-for-profit entities.
• Replacing the complex rules on distributable profits and capital maintenance with a solvency-based regime for determining the legality of dividend payments.
• Simplifying and streamlining the strategic report requirements by removing prescriptive obligations and enabling companies to explain performance, strategy and governance in a way that reflects the size and nature of their business. The government is also considering which companies should be required to comply with future strategic reporting requirements.
• Simplifying remuneration and corporate governance reporting.
• Embracing digital communications, including making electronic communication with shareholders the default option.
• Introducing a central government "Reporting Gateway" function to examine the merits of future reporting proposals, ensuring they are coherent, proportionate and cost-effective.

The deadline for responses is 30 November. The government aims to publish its consultation response within six months of the consultation closing.

The UK Financial Conduct Authority (FCA) has published a new webpage setting out findings from its Defence, Security, and Resilience (DSR) Lab, a joint initiative with the Ministry of Defence, that brought together around 120 leaders from financial services, government and defence. Participants were taken through a deliberately challenging scenario involving regional Global Navigation Satellite System (GNSS) spoofing, multiple damaged subsea cables and a cyberattack on a cable landing station. The exercise explored how hostile activity, supply chain disruption and dual-use technologies (equipment that has both military and civilian use, like drones) could affect market integrity and the UK's wider security. Unlike traditional firm-level exercises, it focused on opportunities for investment to strengthen national resilience as well as systemic risks across the sector.

Key findings include:

• Although firms generally understand their own vulnerabilities, the exercise showed a gap in how they think about dependencies, and risks at a system level.
• Firms would like greater clarity on national threats and priorities before committing capital.
• International dependencies need to be considered when planning for resilience, given that the UK relies on global technology providers for parts of its financial services infrastructure.
• Firms often rely on the same communications networks, satellite systems, subsea cables and technology providers, but may not realise the extent of those shared dependencies.
• There is an appetite for stronger cross-industry collaboration to address shared risks that cannot be solved by firms acting alone.

The FCA notes the government's defence investment plan, which calls for a whole-of-society approach to preparedness and resilience, recognising that the UK cannot rely on any single sector to protect itself against modern, complex threats. The FCA intends to continue supporting the sector in understanding these risks and building resilience. It plans to investigate how it can support intelligence sharing with the financial sector, whether more focus is needed on back-up, "fail-safe" technologies that can be used when disruption hits, and access to banking and finance frictions. The webpage concludes with a series of questions to help firms consider their exposure to systemic risk and how they can support UK resilience.

Commission Delegated Regulation (EU) 2026/1092 was published in the Official Journal of the European Union (OJ). The Delegated Regulation sets out regulatory technical standards (RTS) on establishing an EU code of conduct for issuer-sponsored research under the Markets in Financial Instruments Directive (MiFID II). It is based on the European Securities and Markets Authority's final report containing draft RTS, which was submitted to the European Commission in October 2025. The resulting RTS were subsequently adopted in May and are discussed in more detail in our previous blog post here. The Delegated Regulation will enter into force on 7 September, three days following its publication in the OJ.

The UK Financial Conduct Authority (FCA) has published its quarterly consultation paper No. 53 inviting feedback on proposed amendments to its Handbook across financial promotion rules, banking conduct of business requirements, the new cryptoasset regime, complaints reporting, money market fund (MMF) reporting and the consumer composite investment (CCI) rules.

Key proposals include:

• Amending the financial promotion rules applicable to fractional shares, by amending the readily realisable security definition to include fractional shares that meet specified conditions.
• Removing an expired reference to the British Bankers' Association/Building Societies Association Code of Conduct for the Advertising of Interest Bearing Accounts in BCOBS 2.3.9G and replacing the reference in BCOBS 2 Annex 1, Note 1, to the latest Annual Equivalent Rate practice note published by UK Finance and the Building Societies Association.
• Making deferral arrangements for parts of the new cryptoasset regime (effective 25 October 2027), including relating to the admission process of qualifying cryptoassets on UK qualifying cryptoasset trading platforms, the execution venue requirements on UK-authorised dealers and arrangers, and the execution policy requirement for these firms.
• Correcting complaints data reporting rules by removing a duplicate data point on claims management fee cap redress in the Consumer Credit Return and clarifying the Handbook Glossary definition of "firm" for the purposes of DISP 1.10 and DISP 1.10A to ensure that payment services and e-money firms are within scope of these requirements.
• Removing the reference in DISP to the two-stage complaints process for the Society of Lloyd's.
• Updating MMF reporting requirements to ensure a proportionate approach that allows for effective monitoring of financial stability risks and is integrated into wider funds reporting requirements.
• Making minor amendments to the CCI rules in the DISC and COBS sourcebooks following feedback to PS25/20.

The deadline for comments is 12 October, and the proposed amendments are set out in draft instruments contained in the appendices to the consultation.